CYBER ESSENTIALS

Certification Guide>

<Cyber Essentials

START >

>

>

Intro

Managment

00

01

Firewalls

03

04

05

Control

02

Protection

Configuration

What are the requirments?

<00>Introduction

start >

>

>

Below are the cyber essentials needed for a secure IT structure:

1. Firewalls
2. Secure Configuration
3. Security update management
4. User access control
5. Malware protection

// Five Technical controls

<01>Firewalls

start >

>

>

The majority of organisations are constantly running a form of communication between devices. These devices run network services, which allows this. Network services can be tapped into effortlessly, a way to combat this is a firewall. FFirewalls prevent unauthorised users access to services. This greatly benefits your organisation because cybercriminals would be deterred due to the levels of security.

// Firewalls - protect (a network or system) from unauthorized access with a firewall.

Requirements: Safeguarding all devices within an organisation should be the first priority. The following are the required standards that should be met:

1. Change default passwords into strong passwords
2. Monitor individuals who are accessing administrative interface
3. Automatically block foreign inbound connections
4. Tailor firewall rules to what your organisation finds essential & unessential

START >

<02>SECure configur-ation

>

>

Every single electronic device within an organisation ought to configured. This reduces the chance of the device having any weaknesses that could be exploited. Also, it only allows the device to carry out the specific requirements set by the administrator.

// Secure Configuration - security measures that are implemented to reduce unnecessary cyber vulnerabilities

Requirements:The problem with just relying on deafault configuration is that unless checked there are backdoors for example, default passwords (which are the same for everyone). The following requirements should prevent this:

1. Remove unnecessary accounts
2. Change default passwords
3. Uninstall any useless software
4. Halt any actions which don't need permission
5. Authenticate users before giving access
6. Device unlocking is in place (limited password guess attempts)

START >

<03>SECurity update managment

>

>

There is always a way to exploit an electronic device. Malicious individuals are on the constant lookout to find these weaknesses. One way to make sure there are no vulnerabilities is to update the system as soon as possible.

// Security Update Managment

Requirements:The follwoing requiremnts must be followed to eradicate any major or minor security issue.

1. Device licensed supported
2. Remove licesnse from devices when necessary
3. Apply automatic updates (if applicable)
4. Be up to date with all updates

START >

<04>User Accesscontrol

>

>

The role of controling who has access to certain services must be taken seriously. Access is a huge responsibility, the users you grant access to must be authorised. Users should only be able to interact with what their specific needs are.

// User access control - dictates who's allowed to access and use company information and resources.

Requirements:These are the requirements for how to handle access controls:

1. Authenticate users with username and passwords
2. Disable inactive/old accounts
3. Use multi factor authentification
4. Make a seperate account for administrative access
5. Give out the neccessary privileges and turn off ones which are not needed.

<05>Malware protection

start >

>

>

Malware can inflict an incredible amount of damage on your devices if you have no protection against it. Having protection, can stop malware from causing damage and from gaining any unauthorised access. In an organisation malicious emails with attachments are common.

// malware protection - cyber security solution that adds an extra layer of security to your computer to protect against cyberattacks.

Requirements:You must protect yourself against malware by following these measures:

1. Have malware protection mechanism

which could be: Antimalware software - prevent malware, maicius code or websites or Application allow listing - manually approve applications, not granting users the ability to install and uninstall.

/

Guide completed