[sacm] CIS Control References for ECP

[Adam Montville <[e-mail]>]

Danny,

I previously indicated that I would provide some reference information in the ECP Security Considerations. Rather than call out each specific control, I thought I'd try this approach first. The following is modified text intended to replace section 13.2.1. Let me know what you think.

[START]
The EPCP profile is in and of itself a countermeasure for a compromised endpoint.  A primary defense for an endpoint is to run up to date software configured to be run as safely as possible. Ensuring that anti-virus signatures are up to date and that a firewall is configured are also protections for an endpoints that are supported by the current NEA specifications. Additionally, endpoints that have hardware cryptographic modules provisioned by the enterprise, in accordance with [IEEE-802-1ar], can protect the private keys used for authentication and help prevent adversaries from stealing credentials that can be used for impersonation.  Future versions of the EPCP may want to discuss in greater detail how to use a hardware cryptographic module, in accordance with [IEEE-802-1ar], to protect credentials and to protect the integrity of the code that executes during the bootstrap process.

In general, it is recommended that endpoint protections, including those endpoints running EPCP components, be part of an enterprise-wide security program, as informed by a reputable framwork, such as the [CIS Controls]. Such frameworks generally require hardware and software inventory management (CIS Controls 1 and 2 repsectively), vulnerability management (CIS Control 3),  privilege/credential management (CIS Control 4), configuraiton management (CIS Controls 5 and 11), and logging/monitoring (CIS Control 6) as the foundation for any reasonable security program. Thus, EPCP not only supports such security programs, but is best applied as a covered entity under such programs, as this security considerations section details.
[END]

Kind regards,

Adam