CIS Controls CIS-18.3

This relationship applies when penetration testing identifies the described software configuration weakness and the remediation configures applications and browsers to reduce persistent sessions, shorten cookie validity, require reauthentication, and invalidate session material more aggressively.

This relationship applies when penetration testing identifies the described software configuration weakness and the remediation restricts insecure service/process behavior.

Application and browser configuration can reduce persistent or weakly protected web credential artifacts such as cookies that were found/forged during penetration testing.

This relationship applies when penetration testing identifies the described software configuration weakness and the remediation is related to configuring container services to run rootless or otherwise reduce unnecessary service privileges, directly constraining persistence or privilege abuse through the container service. The mapping does not apply when the finding requires patching or architectural changes rather than configuration correction.

This relationship applies when penetration testing identifies the described software configuration weakness and the remediation deals with enforcing password-manager locking, timeout, vault-access, and related security settings that reduce exposure of stored or decrypted credentials.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation relates to hardening security, logging, and monitoring tools so they are harder to disable or reconfigure, including by enforcing permissions, persistence settings, and service configuration.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthens mail service configuration, sender authentication policy, filtering, throttling, and related controls that reduce abusive high-volume email delivery.

This relationship applies when penetration testing identifies the described software-configuration weakness and remediation of the finding removes unnecessary PowerShell profiles, restrict profile modification, or configure PowerShell execution so untrusted profile content is not loaded.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes the applications and browsers to minimize persistent cookies, shorten cookie lifetime, and apply secure cookie settings that reduce reusable credential material.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes the DNS zone transfers to explicitly authorized servers and correct other DNS service settings that expose internal naming information.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding restricts the unnecessary DDE and embedded-content functionality in affected applications, directly reducing an execution path that relies on permissive application configuration.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthen mail system sender-authentication, attachment-handling, and filtering policies that reduce delivery of malicious attachments.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthens mail authentication, URL-handling, and browser or mail-client policy to reduce delivery or successful use of malicious links.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthens sender-authentication and attachment-filtering configuration to reduce spoofed or malicious messages used to solicit sensitive information.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding hardens CI/CD pipeline settings by restricting unreviewed code execution, isolating runners, reducing secrets exposure, constraining triggers, and preventing user-controlled input from being implicitly trusted.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding configure system settings so defensive services remain active or recover correctly when Windows is booted into Safe Mode.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes and enforces SPF, DKIM, DMARC, and related mail-domain protections to reduce successful sender impersonation.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes by configuring secure cookie attributes, shorter lifetimes, session invalidation, and reduced persistence in affected applications or browsers.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes the cloud applications and services to restrict external sharing, cross account transfers, and unapproved destinations, directly constraining data movement to adversary controlled cloud accounts.

This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes disables or restricts unused cloud regions and services so adversaries cannot create or operate resources in locations outside the organization's intended monitoring and governance scope.