# CIS 14.8 — Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_cis_148_cb4962e23b-cis-148-train-workforce-on-the-dangers-of-connecting-to-and-transmitting-enterprise-data-o
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [Protect](https://support.icompaas.com/support/solutions/folders/f_gen_62000112673_protect)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

CIS · Control 14.8 · Priority: critical · Component: Protect

### What this control covers

Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users securely configure their home network infrastructure.

### Why it matters

A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.

### How to implement

#### AWS

Segment workloads into separate **VPCs/accounts per environment**. Use **security groups** as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and **VPC Flow Logs** to CloudWatch/S3. Front public services with **AWS WAF + Shield Advanced** and use **PrivateLink/VPC Endpoints** to keep service traffic off the internet.

#### Azure

Use **Network Security Groups** and **Application Security Groups** for east-west, and an **Azure Firewall** or NVA in a hub VNet for north-south. Enforce **Private Endpoints** for PaaS and turn on **Defender for Cloud — Network** for adaptive hardening recommendations.

#### GCP

Use **VPC Service Controls** to draw a perimeter around sensitive APIs and a hierarchical **Firewall policy** at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global **Cloud Load Balancer + Cloud Armor**.

#### On-premises

Roll out role-based security awareness annually + phishing simulations quarterly. Track completion in your LMS and tie to performance review for repeat-fails.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks.

### Quick checklist

-   Ensure — Network / Data
-   Configure — Network / Data
-   Securely — Network / Data
-   Protect — Network / Data
-   Train — Network / Data

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected](https://support.icompaas.com/support/solutions/articles/62000219760-2-10-ensure-that-microsoft-cloud-app-security-mcas-integration-with-security-center-is-selected)
-   [Ensure that Activity Log Alert exists for Create or Update Network Security Group](https://support.icompaas.com/support/solutions/articles/62000219859-ensure-that-activity-log-alert-exists-for-create-or-update-network-security-group)
-   [5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group](https://support.icompaas.com/support/solutions/articles/62000219861-5-2-4-ensure-that-activity-log-alert-exists-for-delete-network-security-group)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.