10 Steps to Cyber Security
Cyber-attacks continue on a daily basis, and the scale and rate of these attacks shows little sign of abating as born out in the latest Cyber Security survey see Cyber Security – How Business are Faring This guidance is for businesses looking to protect themselves in cyberspace.
The Information Risk Management Regime, is central organisations’ overall strategy to manage and control the threat of Cyber-attacks. Surrounding and supporting this regime are 9 additional steps that, collectively, provide the basis for a more secure cyber environment.
Through following the 10 steps to cyber security below, your business will be ready to gain accreditation through the Cyber Essentials scheme and remember that your IT or Managed Service Provider has the knowledge and expertise to guide you on how best to address each of the steps.
10 Steps to Cyber Security
Information Risk Management Regime
Assess the risks to your organisation’s information assets with the same vigour as you would for legal, regulatory, financial and operational risks. To achieve this, embed an Information Risk Management Regime across your organisation, supported by the Board, senior managers and an empowered Information Assurance (IA) structure. Communicate your Risk Management Policy across your organisation to ensure that employees, contractors and suppliers are aware of your organisation’s risk management boundaries.
Introduce corporate policies and processes to develop secure baseline builds. Manage the configuration and use of your ICT systems. Remove or disable unnecessary functionality from ICT systems, Keeping them patched against known vulnerabilities. Failing to do this will expose your business to threats and vulnerabilities, and increase risk to the confidentiality, integrity and availability of systems and information.
Connecting to untrusted networks (such as the Internet) can expose your organisation to cyber-attacks. Follow recognised network design principles when configuring perimeter and internal network segments. Configure all network devices to the same secure baseline build. Filter all traffic at the network perimeter ensuring traffic to support your business is allowed. Monitor traffic for unusual or malicious incoming and outgoing activity.
Managing User privileges
All Users of your ICT systems should only be provided with the user privileges that they need to do their job. Control the number of privileged accounts for roles such as system or database administrators, and ensure this type of account is not used for high risk or day-to-day user activities. Monitor user activity, particularly all access to sensitive information and privileged account actions (such as creating new user accounts, changes to user passwords and deletion of accounts and audit logs).
User education and awareness
Produce user security policies that describe acceptable and secure use of your organisation’s ICT systems. All Users should receive regular training on the cyber risks they face as employees and individuals. Security related roles (such as system administrators, incident management team members and forensic investigators) will require specialist training.
Establish an incident response and disaster recovery capability that addresses the full range of incidents that can occur. Incident management plans must be regularly tested, including disaster recovery and business continuity. Your incident response team may need specialist training across a range of technical and non-technical areas. Report online crimes to the relevant law enforcement agency to help the UK build a clear view of the national threat and deliver an appropriate response.
Produce policies that directly address the business processes (such as email, web browsing, removable media and personally owned devices) that are vulnerable to malware. Scan for malware across your organisation and protect all host and client machines with antivirus solutions that will actively scan for malware. Scan information supplied to or from your organisation for malicious content.
Establish a monitoring strategy and develop supporting policies. Take into account previous security incidents and attacks, and your organisation’s incident management policies. Continuously monitor inbound and outbound network traffic to identify unusual activity or trends that could indicate attacks and the compromise of data. Monitor all ICT systems using Network and Host Intrusion Detection Systems (NIDS/HIDS) and Prevention Systems (NIPS/HIDS).
Removable media controls
Produce removable media policies that control the use of removable media for the import and export of information. If the use of removable media is unavoidable, limit the types of media that can be used together with the users, systems, and types of information that can be transferred. Scan all media for malware using a standalone media scanner before any data is imported into your organisation’s system.
Home and mobile working
Assess the risks to all types of mobile working. Include remote working where the device connects to the corporate network infrastructure. Develop appropriate security policies. Train mobile Users on the secure use of their mobile devices for locations they will be working from. Apply the secure baseline build to all types of mobile device used. Protect data-at-rest using encryption (if the device supports it) and protect data-in-transit using an appropriately configured Virtual Private Network (VPN).
Unsure if your systems and processes are secure? Contact us for a free consultation.