Do Software Packages Install Services Without You Knowing?

CIS Control 9 is up next! CIS Control 9 is titled as the Limitation and Control of Network Ports, Protocols and Services.

Center for Internet Security defines this fundamental control as “manage (track/control/correct) the ongoing operational use of ports, protocols and services on networked devices in order to minimize windows of vulnerability available to attackers.”

In simpler terms, CIS Control 9 is put into place in order to monitor that every network port, protocol, and service actively running on any system that has valid business needs and usage. The control does so by implementing an automated port scan on the device. This automation performs a scan on all systems regularly to ensure that there are constant reports coming in, to best protect you! At any point, if an unauthorized port of any type is detected on the system, it sends an immediate alert.

Why is CIS Control 9 important to your security? As always, The IT Company wants to protect you to our fullest capacity. Not only do we highly encourage the implementation of CIS Control 9, but it is deemed highly critical in the eyes of the Center for Internet Security.

IT companies are aware that one of the entry points attackers look for is remotely accessible network services that are vulnerable to exploitation. Because of this recognition that IT companies have of this methodology- the implementation of CIS Control 9 is more and more critical. There are many different examples of what is considered to be a network service that is vulnerable to exploitation. Some of those vulnerabilities include poorly configured web servers, mail servers, file and print services, Domain Name System servers installed by default and more.

For instance, often times software packages install services and enable them without ever asking permission from the user. When the user is unaware of what the software is running, it makes them vulnerable. When attackers are searching for vulnerabilities, they often search for these specific services that are installed without the users knowledge. Once they have found an entry point, they often attempt to exploit the user ID’s and passwords or widely available exploitation codes.

By implementing CIS Control 9, you put up an armed defense in your security. If you are not sure if your business is currently implementing CIS Control 9, ask your IT provider. Reach out to us at The IT Company if we can help!