What is Cyber Essentials?
Cyber Essentials is a UK developed but globally recognised IT security standard, used to give comfort to wider industry that basic levels of IT related security are being met. It covers five key control areas which can protect organisations from possible data breaches and leaks. These are; boundary firewall and internet gateways, secure configuration, access control, malware protection and patch management and software updates.
Benefits of Cyber Essentials:
The benefits of implementing Cyber Essentials are:
• Improve your organisation’s information security at a time where data protection has never been more important. Since May 25th 2018 GDPR ( General Data Protection Regulation) is now in force across Europe.
• Avoid the hefty fines as of yet, there is no guaranteed certification of GDPR compliance. However, Cyber Essentials is a great first step towards better information security management in your company.
• Ideal for small to medium-sized companies, Cyber Essentials is hassle-free, quick and cost-effective.
• Demonstrates a level of commitment towards protecting the data you process
• Increase your reputability and trust among your clients, customers and employees.
• Originating in the UK, a Cyber Essentials certification is mandatory for any company wishing to work on UK Government contracts which involve handling personal information and providing IT products and services. Therefore, holding a Cyber Essentials badge is a huge advantage for companies wishing to do business in the UK as it enables you to bid for these contracts.
Boundary Firewalls and Internet Gateways
Your first line of defense against an intrusion from the internet will be boundary firewalls and internet gateways. A well-configured firewall can prevent breaches before they penetrate deep into your network, while an internet gateway can deny access to users within your organisation to websites or other online services that present a threat.
To ensure your hardware and software are providing the most effective protection, some level of set-up and configuration will be required. Removing unused software and services from your devices will reduce the number of potential vulnerabilities as older versions of some widespread software have well-documented security vulnerabilities. It is also to ensure that you remove any default passwords used by software and hardware as these are well-known by hackers.
Access to your system should be restricted to trusted users so it is imperative that each of these users must have and use their own username and password, which is appropriate to the job they are undertaking at the time. Administrator accounts should only be used when strictly necessary – for example, when installing known and trusted software. A brute force password attack is a common method of attack, perhaps even by casual users trying to access your Wi-Fi. Therefore, you need to enforce strong passwords and frequent password changes and limit the number of failed login attempts. Passwords or other access should be cancelled immediately should a staff member leave the company or is absent for long periods.
Malware is a malicious software, specifically designed to disrupt or damage a computer system. You should have anti-virus or anti-malware products regularly scanning your network to prevent or detect threats. You will also need to make sure they are kept up-to-date and that it is switched on and monitoring the files that it should be. You should also make sure you receive and act upon any alerts issued by the malware protection.
Patch Management and Software Updates
Computer equipment and software need to be maintained regularly to fix any security vulnerabilities and keep it running smoothly. Security software such as anti-virus and anti-malware needs regular updates so that it can continue to provide adequate protection. Checking regularly for updates and subsequently applying them will keep your software up-to-date, and most software can also be set to update automatically. If your system is a few years old, you should review the protection you have in place to make sure that it is still adequate. In between updates, you should use patches to maintain your computer system. A patch is a piece of software designed to update a computer program or its supporting data, to fix or improve it. This includes fixing security vulnerabilities and other bugs, with such patches usually called bugfixes or bug fixes, and improving the usability or performance.