📗 Cringe, Corrected: Hot Takes Fixed by the CIS Controls ⚖️
summary
Session mines real social posts and maps bad advice to concrete CIS actions: identifies CentOS 6 is EOL and explains why unpatched OSes defeat FIDO2/SSH keys and fail2ban; flags internet-exposed ESXi and recommends access controls, asset inventory and training; shows EMR breakage tied to CORS and urges scoped exemptions and vendor SDLC controls. Explains 18 controls, IG1–IG3 risk sizing and the claim that IG1 blocks 74% of commodity TTPs, plus a white paper link for playbooks.
AI-written summary · about
chapters (12)
- 0:00Introduction of speakers
- 1:07What are CIS controls
- 3:54CIS controls structure
- 4:57Offense informs defense
- 6:43Implementation groups
- 8:48Social media hot takes
- 10:33Passwordless authentication myth
- 14:04VMware security claims
- 16:36Chrome update medical system issue
- 19:05CIS controls recap
- 20:49Why frameworks beat improvisation
- 21:55Q&A on CIS controls implementation
related talks
28mSecurity Basics: Burn It All and Start Over
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
58mWhy Control System Cyber-Security Sucks…
22mSecuring Kubernetes
32mThe One About Controls
32mIs the Internet on Fire? Strategies for Mitigating Open Source...
45mOpening Remarks, Rumblings, Ruminations, and Rants
28mImplementing Critical Cybersecurity Controls in a DevOps Environment