Multi-State Information Sharing and Analysis Center (MS-ISAC)

The Multi-State Information Sharing and Analysis Center (MS-ISAC) is a "round-the-clock cyber threat monitoring and mitigation center for state and local governments" operated by CIS under a cooperative agreement with the U.S. Department of Homeland Security^[7] (DHS), Cybersecurity and Infrastructure Security Agency^[8] (CISA).^[9] The MS-ISAC was established in late 2002, and officially launched in January 2003, by William F. Pelgrin, then Chief Security Officer of the state of New York.^[10] Beginning from a small group of participating states in the Northeast, MS-ISAC came to include all 50 U.S. States and the District of Columbia, as well as U.S. State, Local, Tribal, and Territorial (SLTT) governments. In order to facilitate its expanding scope, in late 2010, MS-ISAC "transitioned into a not-for-profit status under the auspices of the Center for Internet Security." The transition was facilitated by CIS having "an established reputation for providing cybersecurity resources to the public and private sectors".^[10][11]

MS-ISAC "helps government agencies combat cyberthreats and works closely with federal law enforcement",^[12][13] and is designated by DHS as a key cyber security resource for the nation's SLTT governments.

The main objectives of MS-ISAC are described as follows:^[14]

• provide two-way sharing of information and early warnings on cyber security threats
• provide a process for gathering and disseminating information on cyber security incidents
• promote awareness of the interdependencies between cyber and physical critical infrastructure as well as between and among the different sectors
• coordinate training and awareness
• ensure that all necessary parties are vested partners in this effort

The MS-ISAC offers a variety of federally funded, no-cost, cybersecurity products and services to its members through the DHS CISA cooperative agreement. It also offers fee-based products and services for SLTT members who want additional protection in addition to what is offered under the cooperative agreement. In 2021, the MS-ISAC announced^[15] it was undergoing a digital transformation, making major infrastructure upgrades including the implementation of a new cloud-based threat intelligence platform, security information and event management (SIEM) capability, security orchestration, automation, and response (SOAR) tool, and data lake capabilities for threat hunting.

Some of the offerings for SLTTs include:

• A Domain Name Service (DNS) security capability is provided to all SLTTs at no cost known as Malicious Domain Blocking and Reporting^[16] (MDBR). The MS-ISAC partnered with Akamai to protect organizations against a variety of cyberattacks such as phishing and ransomware
• Albert^[17] - the MS-ISAC custom-built Intrusion Detection System (IDS)
• Cyber Threat Intelligence^[18] (CTI), including bi-direction indicator feeds via STIX/TAXII. The MS-ISAC has feeds from over 200 sources, including real-time attacks against SLTTs.^[19]
• A 24x7x365 Security Operations Center (SOC) that performs network and endpoint monitoring
• Vulnerability management and scanning
• Incident response and digital forensics

Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)

The Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), as established by the Election Infrastructure Subsector Government Coordinating Council (GCC), is a critical resource for cyber threat prevention, protection, response and recovery for the nation's state, local, territorial, and tribal (SLTT) election offices. The EI-ISAC is operated by the Center for Internet Security, Inc. under the same cooperative agreement with DHS CISA as the MS-ISAC. By nature of election offices being SLTT organizations, each EI-ISAC member is automatically an MS-ISAC member and can take full advantage of the products and services provided to both ISACs.

The mission of the EI-ISAC is to improve the overall cybersecurity posture of SLTT election offices, through collaboration and information sharing among members, the U.S. Department of Homeland Security (DHS) and other federal partners, and private sector partners are the keys to success. The EI-ISAC provides a central resource for gathering information on cyber threats to election infrastructure and two-way sharing of information between and among public and private sectors in order to identify, protect, detect, respond and recover from attacks on public and private election infrastructure. And the EI-ISAC comprises representatives from SLTT election offices and contractors supporting SLTT election infrastructure.^[20]

CIS Controls and CIS Benchmarks

Formerly known as the SANS Critical Security Controls (SANS Top 20) and the CIS Critical Security Controls, the CIS Controls as they are called today is a set of 18 prioritized safeguards to mitigate the most prevalent cyber-attacks against today's modern systems and networks. The CIS Controls are grouped into Implementation Groups^[21] (IGs), which allow organizations to use a risk assessment in order to determine the appropriate level of IG (one through three) that should be implemented for their organization. The CIS Controls can be downloaded from CIS, as can various mappings to other frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework^[22] (CSF), NIST Special Publication (SP) 800-53,^[23] and many others. CIS also offers a free hosted software product called the CIS Controls Assessment Tool^[24] (CIS-CAT) that allows organizations to track and prioritize the implementation of the CIS Controls.

The CIS Controls advocate "a defense-in-depth model to help prevent and detect malware".^[25] A May 2017 study showed that "on average, organizations fail 55% of compliance checks established by the Center for Internet Security", with more than half of these violations being high severity issues.^[26] In March 2015, CIS launched CIS Hardened Images for Amazon Web Services, in response to "a growing concern surrounding the data safety of information housed on virtual servers in the cloud".^[27] The resources were made available as Amazon Machine Images, for six "CIS benchmarks-hardened systems", including Microsoft Windows, Linux and Ubuntu, with additional images and cloud providers added later.^[27] CIS released Companion Guides to CIS Controls, recommendations for actions to counter cybersecurity attacks, with new guides having been released in October and December 2015.^[28] In April 2018, CIS launched an information security risk assessment method to implement CIS Controls, called CIS RAM which is based upon the risk assessment standard by the DoCRA (Duty of Care Risk Analysis) Council.^[29] The latest version of CIS RAM v2.0^[30] was released October 2021^[31]

CIS Benchmarks are a collaboration of the Consensus Community and CIS SecureSuite members (a class of CIS members with access to additional sets of tools and resources).^[32] The Consensus Community is made up of experts in the field of IT security who use their knowledge and experience to help the global Internet community. CIS SecureSuite members are made up of several different types of companies ranging in size, including government agencies, colleges and universities, nonprofits, IT auditors and consultants, security software vendors and other organizations. CIS Benchmarks and other tools that CIS provides at no cost allow IT workers to create reports that compare their system security to universal consensus standard. This fosters a new structure for internet security that everyone is accountable for and that is shared by top executives, technology professionals and other internet users throughout the globe. Further, CIS provides internet security tools with a scoring feature that rates the configuration security of the system at hand. For example, CIS provides SecureSuite members with access to CIS-CAT Pro, a "cross-platform Java app" which scans target systems and "produces a report comparing your settings to the published benchmarks".^[5] This is intended to encourage and motivate users to improve the scores given by the software, which bolsters the security of their internet and systems. The universal consensus standard that CIS employs draws upon and uses the accumulated knowledge of skillful technology professionals. Since internet security professionals volunteer in contributing to this consensus, this reduces costs for CIS and makes it cost effective.^[33]

CIS CyberMarket

CIS CyberMarket is a "collaborative purchasing program that serves U.S. State, Local, Tribal, and Territorial (SLTT) government organizations, nonprofit entities, and public health and education institutions to improve cybersecurity through cost-effective group procurement".^[34] The intent of the CIS CyberMarket is to combine the purchasing power of governmental and nonprofit sectors to help participants improve their cybersecurity condition at a lower cost than they would have been able to attain on their own. The program assists with the "time intensive, costly, complex, and daunting" task of maintaining cybersecurity by working with the public and private sectors to bring their partners cost-effective tools and services. The combined purchasing opportunities are reviewed by domain experts.^[14]

There are three main objectives of the CIS CyberMarket:

• to contribute a trusted environment to improve the condition of the cybersecurity of the previously mentioned entities
• to lower the cost of cybersecurity needs
• to work with companies to bring services and security products to their partners^[14]

CIS CyberMarket, like the MS-ISAC, serves government entities and non-profits in achieving greater cyber security. On its "resources" page, multiple newsletters and documents are available free of charge, including the "Cybersecurity Handbook for Cities and Counties".^[35]

CIS Communities

CIS Communities are "a volunteer, global community of IT professionals" who "continuously refine and verify" CIS best practices and cybersecurity tools.^[36] To develop and structure its benchmarks, CIS uses a strategy in which members of the organization first form into teams. These teams then each collect suggestions, advice, official work and recommendations from a few participating organizations. Then, the teams analyze their data and information to determine what the most vital configuration settings are that would improve internet system security the most in as many work settings as possible. Each member of a team constantly works with their teammates and critically analyzes and critiques a rough draft until a consensus forms among the team. Before the benchmark is released to the general public, they are available for download and testing among the community. After reviewing all of the feedback from testing and making any necessary adjustments or changes, the final benchmark and other relevant security tools are made available to the public for download through the CIS website. This process is so extensive and so carefully executed that thousands of security professionals across the globe participate in it. According to ISACA, "during the development of the CIS Benchmark for Sun Microsystems Solaris, more than 2,500 users downloaded the benchmark and monitoring tools."^[37]