Although cybersecurity sales engineers are largely considered non-technical, you will require technical-know how of cybersecurity controls to be able to sell effectively. Thankfully, there’s a blueprint to help you easily navigate these controls.

The Centre for Internet Security (CIS) has established a set of twenty (20) controls that are considered the industry standard for securing information systems and networks. Implementing CIS Controls can help organizations improve their overall security posture and reduce the risk of cyberattacks and data breaches. These controls cover a wide range of areas including Access control, Incident response, Network security, and more.

By understanding the different controls and how they apply to a specific customer’s environment be it Banking, Fintech, Telehealth, Manufacturing etc., the sales engineer can effectively communicate the value proposition to potential customers. In most cases, the key decision maker responsible for approving the procurement of security controls is a technical professional such as an IT manager or Chief Information Security Officer (CISO). These individuals are familiar with CIS controls and understand the importance of complying with them. By demonstrating an understanding of these controls, a security sales engineer can speak the same language as the technical decision-maker and establish credibility.

CIS controls are divided into three categories: Basic, Foundational, and Organizational. Below is a comprehensive breakdown:

BASIC CONTROLS

1. Inventory and Control of Hardware Assets
   Organizations are mandated to maintain an up-to-date inventory of all hardware devices that connect to the network, including servers, workstations, laptops, and mobile devices.
2. Inventory and Control of Software Assets
   This refers to any tool that provides an up-to-date inventory of all software installed on the network.
3. Continuous Vulnerability Management
   A system for identifying, prioritizing, and addressing vulnerabilities in software, hardware, and network configurations.
4. Controlled Use of Administrative Privileges
   This helps to limit the number of users who have administrative access to systems and applications.
5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
   Enables IT to configure systems and software to be secure by default thus mitigating misconfigurations.
6. Maintenance, Monitoring, and Analysis of Audit Logs
   These controls monitor and analyze system logs to detect and respond to security events.
7. Email and Web Browser Protection
   This refers to controls that enable IT to implement policies to protect against users visiting malicious emails and websites.
8. Malware Defenses
   Antimalware tools to detect and remove malicious software on endpoints.
9. Limitation and Control of Network Ports, Protocols, and Services
   Limits the number of open ports, protocols, and services on the network to reduce the attack surface.
10. Data Recovery Capabilities
    This enables businesses to develop and test a plan for backing up and restoring data and systems in case of a data breach or disaster.
    
    FOUNDATIONAL CONTROLS
    
11. Secure Configuration for Network Devices
    These tools enable IT to configure network devices such as Firewalls, Routers, and Switches to be secure by default.
12. Boundary Defense
    Implement controls to detect and prevent unauthorized access to the network.
13. Data Protection
    Protect sensitive data with encryption, access controls, and other security measures.
14. Controlled Access Based on Need to Know
    Limit access to data and systems based on job responsibilities and business needs.
15. Wireless Access Control
    Implement secure wireless network access controls.
16. Account Monitoring and Control
    Using this, organizations can monitor user accounts and limit access to systems and data based on user roles.
17. Security Awareness and Training Program
    Here the focus is to educate users about security best practices and how to recognize and report security threats.
    
    ORGANIZATIONAL CONTROLS
    
18. Application Software Security
    Ensures that application software is developed and maintained securely.
19. Incident Response and Management
    This enables the organization to develop and test a plan for responding to security incidents.
20. Penetration Testing and Red Team Exercises
    Conduct regular penetration testing and red team exercises to identify and address security weaknesses.

Without a doubt, knowledge of these twenty (20) controls is essential for a successful security sales career. By investing time in learning about these controls, you can stand out from the crowd and establish yourself as a trusted advisor to your potential customers.

If you applied for the cybersecurity sales internship, you will hear from us regarding the status of your application on or before Friday 10^th March, 2023.