An organization is implementing a control for the Limitation and Control of Network Ports, Protocols, and Services CIS Control. Which action should they take when they discover that an application running on a web server is no longer needed?

The principle of least functionality, which is central to CIS Control 9 (Limitation and Control of Network Ports, Protocols, and Services), dictates that systems should be configured to provide only essential capabilities. When an application is no longer needed, the most secure and definitive action is to uninstall it completely. This removes the application's code, its associated services, and any potential vulnerabilities from the host system. Disabling the service or blocking network access are less secure alternatives, as the unused software remains on the system and could be inadvertently or maliciously re-activated.

B. Turning the service off leaves the application installed, creating a risk that it could be re-enabled accidentally or maliciously.
C. Blocking the protocol at the firewall is a network-level control that does not remove the underlying software or vulnerability from the host.
D. Creating a router access list is a network filtering action that, like a firewall rule, fails to address the unnecessary software on the server itself.

1. Center for Internet Security (CIS). (2021). CIS Critical Security Controls v8. Control 04: Secure Configuration of Enterprise Assets and Software. Safeguard 4.1 states, "Establish and Maintain a Secure Configuration Process," which includes processes for "uninstalling or disabling any unnecessary software." Removing the software is the most complete implementation of this safeguard.

2. National Institute of Standards and Technology (NIST). (2008). NIST Special Publication 800-123: Guide to General Server Security. In Section 3.3.1, "Operating System," the guide explicitly states, "Unnecessary services, applications, and network protocols should be disabled or removed... Removing the software is preferred over disabling it because it eliminates the possibility of the software being re-enabled, either accidentally or maliciously."

3. National Institute of Standards and Technology (NIST). (2020). NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control CM-7, "Least Functionality," requires organizations to configure systems to "provide only essential capabilities." The discussion section clarifies that this includes the removal of non-essential software programs and components.