Security and good IT management go hand-in-hand: a well-managed network is more difficult to attack than a poorly managed one.

CIS Controls Implementation Guide for SMEs

This guide seeks to empower the owners of small and medium-sized enterprises (SMEs) to help them protect their businesses with a small number of high priority actions based on the CIS Controls - a comprehensive set of cybersecurity best practices developed by IT experts that address the most common threats and vulnerabilities.1

Phase 1: Know your environment

Here are a few key questions that are important to think about:2

  • Do you know what’s connected to your network?
  • Do you know what software is installed?
  • Do you know if your administrators and users are using strong passwords?
  • Do you know which online platforms are being used by your employees (i.e., work productivity or chat tools)?
  • Do you know where your most important data is stored on your network?

CIS Controls - 1 Inventory and Control of Hardware Assets

Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized devices are given access, and unauthorized and unmanaged devices are found and prevented from gaining access.3

CIS Controls - 1.1 Utilize an active discovery tool to identify devices connected to the organization’s network and update the hardware asset inventory.

Linux Ping Sweep - Red Team Field Manual
for x in {1..254..1}; 
     do ping -c 1 192.168.1.$x | grep "64 b" | cut -d " " -f4 >> ips.txt; 
Windows PowerShell Ping Sweep - https://www.ryanic.com/2016/12/living-off-land-powershell-ping-sweep.html
$results = ""; 
for ($d = 0; $d -le 255; $d++) { 
    "pinging 192.168.1.$d"; 
    $test = ping -n 1 -w 5 192.168.1.$d; 
    if ($test[2] -match "TTL") { 
        $results += $test[2].split(": ")[2] + "`n"
$results | Out-file "ips.txt"

CIS Controls - 2 Inventory and Control of Software Assets

Actively manage (inventory, track, and correct) all software on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.4

Phase 2: Protect your assets

Phase 3: Prepare your organization





Last edited by MichaelAlber .
Page last modified on Monday October 22, 2018 00:24:47 UTC.