Why Cyber Essentials?
Businesses are experiencing an increase in both the volume and sophistication of cyberattacks. With rapid technology adoption and increased hybrid work, the risk is greater for small and medium-sized customers contending with budget constraints and gaps in specialised security skills. Find out what steps you can make to address this evolving threat landscape
300% Increase in ransomware attacks
Ransomware is a common threat for small businesses, which make up one-half to three-quarters of the victims. Overall ransomware attacks are up almost 300% in the past year.
60% Affected small businesses taken offlineOver 60% of small businesses experiencing a cyberattack were left unable to operate. Stay online by adopting comprehensive security with automation to rapidly detect and respond to threats
What is Cyber Essentials?
It is a UK Government-backed scheme aimed at increasing the cyber security level of UK businesses. It was launched in 2014 and is operated by the National Cyber Security Centre (NCSC) in combination with its Cyber Essentials partner IASME. Cyber Essentials is important as the NCSC sees it as representing a minimum baseline for cyber security in the UK, so a good start for protecting organisations.
Cyber Essentials aims to support all companies against a wide range of commonly experienced cyber-attacks. Achieving Cyber Essentials accreditation will provide you with automatic cyber security insurance (terms and conditions apply).
The basis of Cyber Essentials certification is a self-assessment questionnaire which is reviewed by trained assessors and covers 5 technical business infrastructure areas:
Firewalls – required for Cyber Essentials
A firewall protects the boundary of a network or a computer system. Connections to a device are checked and are either blocked or permitted according to the firewall rules defined.
What is a Firewall?
Firewalls can be a physical device connected to a network, part of an existing hardware device e.g., a router provided by your internet service provider, or software based on the computer system itself either as part of the operating system or a standalone application.
External services which are required by a business to operate may need to allow connections through a firewall, such as a virtual private network (VPN). Cyber Essentials wants to make sure the applicant considers which services are required and to make sure any which are no longer needed are disabled.
Secure Settings and setting up a new device for Cyber Essentials
Accepting the default settings of any new device in a business network may leave your network open to increased risk. By default, devices tend to arrive with the end user in mind: multifunctional and with open use.
Password configurations should be considered and this article suggests an approach to achieve strong passwords. Multi factor authentication is a crucial element in building device security, ensuring that multiple identity verifications are required prior to accessing a device.
Secure Access and Cyber Essentials
Firstly, administration accounts which are rarely if ever required for day-to-day processing, should be accessed only by those that need them as part of their job role. Administration account access needs to be monitored and tracked by a nominated senior manager or business owner.
Simplify the audit trail on data access
Access rights for each user should be set up with the users’ job role in mind. As an example: a salesperson will rarely if ever also perform the HR function for a business. Set up your salesperson with access to the areas needed to fulfil that specific function. The less random access to data that is permitted, the less chance of human error or malevolent activity by an unauthorised user.
Anti-malware and Cyber Essentials
What is Anti-malware?
Anti-malware identifies and prevents malicious software (known as malware) from infecting computer systems or electronic devices. Anti-Malware tools once installed need should be reviewed and updated regularly. With the appropriate definitions and updates in place, anti-malware should scan files at the point of download, when external storage is inserted and check web pages to ensure they are not actually viruses.
Patching & Security Updates for Cyber Essentials
Patching is a process by which to repair a vulnerability or a flaw that is identified after the release of an application or software. Operating systems and applications regularly have updates with new features and vulnerability fixes present. These should be installed in a timely manner, which is determined in Cyber Essentials to be no more than 14 days to prevent attackers from being able to exploit these vulnerabilities to gain access to system or data.
Where possible software should be set to update automatically and out of business hours to prevent inconvenience and down time.
Once security patches are no longer available, the device should no longer be connected to the network and should be replaced. See this Windows 7 article as a prime example.
5 Cyber Essentials tips to keep your network protected
- Use longer less easily ‘guessable’ passwords, implementing guidance such as NCSC’s three random word guidance.
- Enable multi-factor authentication on all user and administration accounts
- Make sure administration accounts are not used for day-to-day activities (such as email and web browsing)
- Keep operating systems, applications and firmware patched and up to date
- Stop using devices and software out of manufacturer support.
Thought for the Day
Qi will work with you to make the required changes to your infrastructure to ensure you meet the Cyber Essentials baseline and also take you through the full accreditation procedure. Call Qi to book your initial 30 minute consultation, free of charge.