CIS 6.3: Ensure functionality of Endpoint Detection and Response (EDR) (Manual)
Profile Applicability
Description
Establish and maintain an effective Endpoint Detection and Response (EDR) system to proactively monitor, detect, and respond to security threats on endpoints such as computers, mobile devices, and servers. This involves deploying EDR software that continuously collects data from endpoints, analyzes this data for signs of malicious activity, and provides real-time alerts and detailed incident reports. Regularly test and update the EDR system to ensure it can accurately identify and mitigate advanced threats, including zero-day exploits and sophisticated malware, ensuring comprehensive protection and swift response to potential security incidents.
Rationale
Ensuring the functionality of Endpoint Detection and Response (EDR) systems is essential for early detection and swift response to security threats on endpoints. These systems continuously monitor and analyze endpoint data, providing real-time alerts and detailed incident reports to identify and mitigate potential threats. Regular testing and updates of the EDR system ensure it remains effective against advanced threats, maintaining comprehensive protection for the organization's assets.
Impact
Implementing and maintaining EDR requires:
- Deployment of EDR software on all endpoints
- Continuous monitoring and analysis infrastructure
- Regular testing and updates
- Trained security personnel to respond to alerts
- Integration with incident response procedures
Audit Procedure
Via AWS Console
Preparing the Environment for EDR:
- Before getting started with EDR, you must prepare the environment that you want to back up.
Preparing the Source Server:
- Allow direct access to Elastic Disaster Recovery and Amazon S3 AWS service API endpoints through HTTPS protocol (TCP port 443).
- Direct outbound TCP port 1500 from the source server to the staging area subnet, which contains the replication servers.
Preparing the Staging Area Subnet:
- Allow Direct access to EDR, S3, and EC2 through HTTPS protocol (TCP port 443)
- Direct inbound TCP port 1500 for replication traffic
Accessing the AWS Elastic Disaster Recovery Console:
- Search for "AWS Elastic Disaster Recovery" in the AWS Console.
- Select "Elastic Disaster Recovery"
Configuring the Replication Settings Template:
- Select
Configure and Initializein in the AWS Elastic Disaster Recovery screen.
- You will be navigated to setup your replication settings template. This will create a staging area in a subnet of your choice and a replication server instance types.
- The default replication server instance type will be a t3 micro EC2 instance. This is good for normal workloads with small I/O operations.
Configure EBS encryption and volume types:
- This will depend on your workload requirements.
Configure EBS volumes:
- To encrypt EBS volumes, leave the setting as "default." If you wish to make a custom encryption setting, you will need to create an AWS KMS key.
Configure the security group:
- Remember what ports need to be opened on inbound / outbound traffic that was specified in previous steps.
- You can choose how you want your data routed and if you want to throttle network traffic to reserve bandwidth.
- To keep your data as secure as possible, it's recommended to get set up with a VPN or AWS direct connect, so your backups are not traveling over the public internet.
- Point in time policy defines the snapshot retention time. Because Elastic Disaster Recovery service uses incremental backups, it's not necessary to keep old copies of backups.
Launch the template:
- Now, you're ready to launch this template.
Expected Result
- EDR environment properly prepared and configured
- Source servers have network access to EDR and S3 endpoints (TCP 443)
- Outbound TCP port 1500 configured from source to staging area
- Staging area subnet allows EDR, S3, EC2 access (TCP 443)
- Staging area allows inbound TCP 1500 for replication
- Replication settings template configured
- EBS encryption enabled
- Security groups properly configured
- Network routing configured (preferably VPN or Direct Connect)
- Point-in-time policy configured for snapshot retention
Remediation
Via AWS Console
Follow the audit procedure steps to configure EDR functionality:
- Prepare the environment for EDR deployment
- Configure source server network access
- Configure staging area subnet
- Access AWS Elastic Disaster Recovery Console
- Configure replication settings template
- Enable EBS encryption
- Configure security groups with required ports
- Set up secure network routing (VPN/Direct Connect recommended)
- Configure point-in-time policy
- Launch and test the configuration
Default Value
By default, EDR is not configured. Organizations must manually set up all components including network access, security groups, replication settings, and encryption.
References
CIS Controls
| Controls Version |
Control |
IG 1 |
IG 2 |
IG 3 |
| v8 |
13.2 Deploy a Host-Based Intrusion Detection SolutionDeploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported. |
|
● |
● |
| v8 |
13.3 Deploy a Network Intrusion Detection SolutionDeploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service. |
|
● |
● |
| v7 |
8.6 Centralize Anti-malware LoggingSend all malware detection events to enterprise anti-malware administration tools and event log servers for analysis and alerting. |
|
● |
● |
| v7 |
12.6 Deploy Network-based IDS SensorDeploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries. |
|
● |
● |
Profile
1---2name: cis-aws-storage-6-33description: Ensure functionality of Endpoint Detection and Response (EDR)4---56# CIS 6.3: Ensure functionality of Endpoint Detection and Response (EDR) (Manual)78## Profile Applicability910- **Level:** 21112## Description1314Establish and maintain an effective Endpoint Detection and Response (EDR) system to proactively monitor, detect, and respond to security threats on endpoints such as computers, mobile devices, and servers. This involves deploying EDR software that continuously collects data from endpoints, analyzes this data for signs of malicious activity, and provides real-time alerts and detailed incident reports. Regularly test and update the EDR system to ensure it can accurately identify and mitigate advanced threats, including zero-day exploits and sophisticated malware, ensuring comprehensive protection and swift response to potential security incidents.1516## Rationale1718Ensuring the functionality of Endpoint Detection and Response (EDR) systems is essential for early detection and swift response to security threats on endpoints. These systems continuously monitor and analyze endpoint data, providing real-time alerts and detailed incident reports to identify and mitigate potential threats. Regular testing and updates of the EDR system ensure it remains effective against advanced threats, maintaining comprehensive protection for the organization's assets.1920## Impact2122Implementing and maintaining EDR requires:2324- Deployment of EDR software on all endpoints25- Continuous monitoring and analysis infrastructure26- Regular testing and updates27- Trained security personnel to respond to alerts28- Integration with incident response procedures2930## Audit Procedure3132### Via AWS Console33341. **Preparing the Environment for EDR:**35 - Before getting started with EDR, you must prepare the environment that you want to back up.36372. **Preparing the Source Server:**38 - Allow direct access to Elastic Disaster Recovery and Amazon S3 AWS service API endpoints through HTTPS protocol (TCP port 443).39 - Direct outbound TCP port 1500 from the source server to the staging area subnet, which contains the replication servers.40413. **Preparing the Staging Area Subnet:**42 - Allow Direct access to EDR, S3, and EC2 through HTTPS protocol (TCP port 443)43 - Direct inbound TCP port 1500 for replication traffic44454. **Accessing the AWS Elastic Disaster Recovery Console:**46 - Search for "AWS Elastic Disaster Recovery" in the AWS Console.47 - Select "Elastic Disaster Recovery"48495. **Configuring the Replication Settings Template:**50 - Select `Configure and Initializein` in the AWS Elastic Disaster Recovery screen.51 - You will be navigated to setup your replication settings template. This will create a staging area in a subnet of your choice and a replication server instance types.52 - The default replication server instance type will be a t3 micro EC2 instance. This is good for normal workloads with small I/O operations.53546. **Configure EBS encryption and volume types:**55 - This will depend on your workload requirements.56577. **Configure EBS volumes:**58 - To encrypt EBS volumes, leave the setting as "default." If you wish to make a custom encryption setting, you will need to create an AWS KMS key.59608. **Configure the security group:**61 - Remember what ports need to be opened on inbound / outbound traffic that was specified in previous steps.62 - You can choose how you want your data routed and if you want to throttle network traffic to reserve bandwidth.63 - To keep your data as secure as possible, it's recommended to get set up with a VPN or AWS direct connect, so your backups are not traveling over the public internet.64 - Point in time policy defines the snapshot retention time. Because Elastic Disaster Recovery service uses incremental backups, it's not necessary to keep old copies of backups.65669. **Launch the template:**67 - Now, you're ready to launch this template.6869## Expected Result7071- EDR environment properly prepared and configured72- Source servers have network access to EDR and S3 endpoints (TCP 443)73- Outbound TCP port 1500 configured from source to staging area74- Staging area subnet allows EDR, S3, EC2 access (TCP 443)75- Staging area allows inbound TCP 1500 for replication76- Replication settings template configured77- EBS encryption enabled78- Security groups properly configured79- Network routing configured (preferably VPN or Direct Connect)80- Point-in-time policy configured for snapshot retention8182## Remediation8384### Via AWS Console8586Follow the audit procedure steps to configure EDR functionality:87881. Prepare the environment for EDR deployment892. Configure source server network access903. Configure staging area subnet914. Access AWS Elastic Disaster Recovery Console925. Configure replication settings template936. Enable EBS encryption947. Configure security groups with required ports958. Set up secure network routing (VPN/Direct Connect recommended)969. Configure point-in-time policy9710. Launch and test the configuration9899## Default Value100101By default, EDR is not configured. Organizations must manually set up all components including network access, security groups, replication settings, and encryption.102103## References104105- [AWS Elastic Disaster Recovery User Guide](https://docs.aws.amazon.com/drs/latest/userguide/)106- [AWS EDR Installation Requirements](https://docs.aws.amazon.com/mgn/latest/ug/installation-requirements.html)107108## CIS Controls109110| Controls Version | Control | IG 1 | IG 2 | IG 3 |111| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |112| v8 | 13.2 Deploy a Host-Based Intrusion Detection Solution<br/>Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported. | | ● | ● |113| v8 | 13.3 Deploy a Network Intrusion Detection Solution<br/>Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service. | | ● | ● |114| v7 | 8.6 Centralize Anti-malware Logging<br/>Send all malware detection events to enterprise anti-malware administration tools and event log servers for analysis and alerting. | | ● | ● |115| v7 | 12.6 Deploy Network-based IDS Sensor<br/>Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries. | | ● | ● |116117## Profile118119- Level 2
cyberstrikeus