Framework: The Center for Internet Security (CIS) Top 18 Controls

The remaining safeguards under Control 12 reinforce disciplined management of network infrastructure by combining secure management, centralized authentication, and dedicated administrative environments. They require enforcing secure network protocols such as SSH and HTTPS, centralizing authentication through AAA (Authentication, Authorization, and Accounting) services, and establishing separate systems for administrative work. These practices ensure that network devices are managed securely and consistently, reducing the risk of compromise through weak or outdated management channels. Secure management protocols prevent plaintext transmission of credentials, while centralized authentication provides uniform access control and auditing across all devices. Segregating administrative functions from everyday operations further isolates privileged activity, protecting both users and the network from lateral movement.

Implementing these safeguards demands a mix of policy enforcement and technical automation. Configuration templates should mandate encrypted management sessions, and network access controls must restrict administrative interfaces to trusted IP ranges or jump servers. Centralized AAA systems like RADIUS or TACACS+ should integrate with enterprise identity directories, applying multi-factor authentication for administrative logins. Administrative workstations must be hardened, isolated from the internet, and used exclusively for configuration and maintenance tasks. Continuous monitoring ensures that any deviation from approved management channels triggers alerts. Periodic reviews of administrative access logs provide visibility into configuration changes and detect suspicious patterns. Collectively, these safeguards align operational reliability with security governance, ensuring that network infrastructure remains resilient, auditable, and protected against insider error or external compromise. Control 12 thus closes the loop between network design and ongoing defense, creating a foundation for secure connectivity and scalable management.
 Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.