CIS Controls CIS-13.10

Application-layer filtering can block uncommon, unauthorized, or malicious content and transferred file types at web proxies, application gateways, or similar inspection points before the content reaches protected systems.

Web filtering and application-layer gateways can block malicious web content and destinations used to deliver browser-based credential theft or session-stealing content.

Web proxies and application-layer gateways can prevent access to known malicious or unnecessary websites and block malicious web content used to compromise users through drive-by activity.

DNS filtering and sinkholing can prevent systems from resolving domains associated with dynamically changing adversary command-and-control infrastructure.

DNS filtering and sinkholing can block domains generated by known domain-generation algorithms when those domains or generation patterns can be identified.

Web proxies and application-layer gateways can restrict which external web services are permitted, reducing unauthorized use of web services for data exfiltration.

Application-layer filtering can block or restrict access to unauthorized external code repositories, limiting their use as destinations for data exfiltration.

Application-layer filtering can block or restrict access to unauthorized cloud-storage services, limiting their use as destinations for data exfiltration.

Application-layer filtering can block or restrict access to unauthorized text-storage and paste services, limiting their use as destinations for data exfiltration.

Application-layer firewalls and proxies can restrict access to unauthorized remote-access services, anonymization services, and other external services used to access enterprise resources.

Application-layer filtering can block malicious websites, links, attachments, and other web or email content used in phishing activity before that content reaches users.

Mail and application-layer gateways can inspect and block dangerous attachment types, malicious archives, and other suspicious content delivered through spearphishing attachments.

Web proxies and application-layer gateways can block access to malicious or unnecessary websites reached through spearphishing links.

Application-layer filtering can restrict access to personal webmail, social media, and other external services that may be abused to deliver spearphishing messages.

Web filtering and application-layer gateways can block malicious content or destinations used to deliver browser-based session-cookie theft activity.

Application-layer filtering can restrict malicious sites, downloads, attachments, and scripts that may deliver payloads later executed through trusted system binaries.

Application-layer filtering can block CHM and other uncommon or risky file types in transit, reducing delivery of content that may be executed through Compiled HTML Help.

Application-layer filtering can prevent malicious web or email content from reaching users, reducing opportunities for users to execute or interact with adversary-delivered content.

Web proxies and application-layer gateways can block requests to malicious links and prevent associated content from being downloaded.

Application-layer filtering can block malicious web content or destinations used to provide commands, scripts, or other content that users are instructed to copy and execute.

Web proxies and application-layer gateways can restrict access to unauthorized external web services, limiting their use for adversary command and control.

Application-layer filtering can block access to unauthorized web services used as dead-drop resolvers for adversary command-and-control infrastructure.

Application-layer filtering can block unauthorized web services used for bidirectional command-and-control communications.

Application-layer filtering can block unauthorized web services used for one-way command-and-control communications.

Application-aware gateways can inspect and restrict unauthorized application-layer protocols, services, and destinations used for adversary command and control.

Web proxies and application-layer firewalls can inspect and restrict HTTP and HTTPS traffic to unauthorized or malicious destinations.

Application-layer filtering can restrict FTP, SFTP, and related file-transfer protocol traffic to approved services and destinations.

Application-layer filtering can restrict SMTP, IMAP, POP3, and related mail-protocol traffic to approved infrastructure and expected communication paths.

DNS proxies and filtering services can block malicious domains and restrict systems to approved name-resolution services.

Application-aware filtering can restrict publish/subscribe protocols to approved brokers, destinations, and expected service ports.

Application proxies and gateways can require use of approved protocol services and restrict unauthorized application-layer protocols or destinations used for data exfiltration.

Application-layer gateways can restrict symmetrically encrypted non-command-and-control protocol traffic to approved services and destinations where the traffic remains identifiable to the control.

Application-layer gateways can restrict asymmetrically encrypted non-command-and-control protocol traffic to approved services and destinations where the traffic remains identifiable to the control.

Application-layer filtering can directly restrict unencrypted non-command-and-control protocols to approved services and destinations.

Web application firewalls and application-layer gateways can inspect inbound application requests and block known malicious request patterns or exploit payloads targeting public-facing applications.

Application and protocol filtering can block outbound WebDAV and related requests that may be abused to force systems to authenticate to attacker-controlled resources.

Web proxies and application-layer gateways can block unauthorized downloads, file-transfer services, and malicious content used to transfer adversary tools into the environment.

Application-aware filtering can identify and restrict unauthorized tunneling through otherwise permitted application protocols and services.

Application-layer gateways can block known anonymization services, unauthorized proxy services, and other proxy destinations used to conceal adversary communications.

Application-layer gateways can restrict known anonymization and proxy services that may be chained together to form multi-hop proxy infrastructure.

Application firewalls and proxies can restrict access to websites, services, and destinations associated with unauthorized remote-access tools.

Application-layer firewalls and proxies can restrict access to unauthorized remote-desktop services and destinations.

Web application firewalls and application-layer controls can block server-side request forgery paths that would otherwise expose credential-bearing cloud metadata services.

A properly configured web application firewall can block external server-side request forgery attempts that target the cloud instance metadata API and expose temporary credentials.

Application-layer firewalls and web application firewalls can inspect, rate-limit, or block abusive application requests that attempt to exhaust application resources.

Application-layer firewalls and web application firewalls can inspect and block known malicious request patterns or exploit payloads intended to cause application or system resource exhaustion.