CIS Controls v8 Gap Analysis — Luigi's Case Study

How the Luigi's attack unfolded

The first task was to turn the case narrative into an ordered attack chain, so that every later recommendation could point at a specific failure. The reconstruction produced 12 steps:

1. An employee connected a personally owned, unmanaged laptop to the corporate wireless network. The device was not in the approved asset inventory.
2. Wireless and DHCP services issued it an internal IP address without checking that it was authorized, configured, patched, or protected.
3. The laptop was already infected with PSL malware and had no standard endpoint protection, so it opened a command-and-control connection as soon as it joined.
4. It scanned the internal network freely, which showed the user wireless segment was not isolated from sensitive systems.
5. An internal FTP service allowed anonymous access, so the attacker needed no valid account.
6. High-value data sat behind that service: proprietary drawings, parts lists, price quotes, patents, purchasing information, and legal documents.
7. The attacker compressed the data and removed it through an encrypted outbound VPN connection that outbound controls did not restrict or question.
8. The malicious-site reputation list was four months out of date, so the command-and-control destination was not flagged.
9. The Network Operations Center saw the large encrypted transfer and identified source and destination, but handled it as a routine help desk ticket.
10. The employee noticed the laptop running slowly on Friday and left it powered on through the three-day weekend without reporting it.
11. The gap between the first warning signs and containment gave the attacker extended time to scan, access, and exfiltrate.
12. Asset management, endpoint security, monitoring, threat intelligence, awareness, and incident response were not coordinated well enough to stop the attack at any earlier stage.

Why CIS Controls v8 and Implementation Groups 1 and 2

CIS Controls v8 organizes safeguards into Implementation Groups by organizational maturity and resources. Luigi's was assessed as falling between IG1 and IG2, so the analysis used IG1 safeguards plus the selected IG2 safeguards that directly address the facts of the case. The safeguard list is limited to those two groups for that reason. The CIS Critical Security Controls Navigator for v8 is the reference for safeguard names and group assignments.

The 10 CIS Controls that would have interrupted the attack

Of the 27 safeguards, 11 are IG1 and 16 are IG2. Each one in the full report carries its own rationale tied to a fact in the case, so the recommendation reads as a consequence of the evidence.

Prevention, detection, and response together

The safeguards fall into three layers, and the case shows why all three are needed.

• Prevention: an accurate asset inventory (1.1), a process to deny or quarantine unauthorized assets (1.2), and network access control through 802.1X and WPA2 Enterprise or stronger (12.6) would have kept the laptop off the internal network. Data access control lists (3.3) and disabling unnecessary services (4.8) would have removed the anonymous FTP path to the files.
• Detection: current DNS filtering (9.2) and maintained URL filters (9.3) could have blocked the command-and-control connection. Centralized security event alerting (13.1) would have correlated a new device, internal scanning, unusual FTP activity, and a large encrypted transfer into one high-severity event.
• Response: the NOC did detect the transfer. What was missing was a designated incident handler (17.1), a reporting process (17.3), and assigned roles (17.5) with authority to isolate a device on a weekend. Role-specific training (14.9) addresses why suspicious traffic was handled as routine troubleshooting.