Understanding & implementing the 5 security controls

In this third instalment of our Cyber Essentials series we'll look at how Cyber Security has become paramount for organisations of all sizes as threats become ever more frequent and sophisticated. Protecting sensitive data and systems is crucial to maintaining business continuity and safeguarding customer trust. To address these challenges, organisations can utilise the five Cyber Essentials security controls which help establish stringent defence against cyber threats.

In this Cyber Essentials Guide, we will delve into the five fundamental security controls outlined by Cyber Essentials and explore strategies for implementing them effectively. Additionally, we will discuss the importance of employee training and secure remote work practices to fortify your organisation's cybersecurity posture.

If you've not yet read our previous two posts on What Cyber Essentials is and How To Get Started, I'd recommend you visit them first if your new to the topic.

Understanding the Five Security Controls

Boundary Firewalls and Internet Gateways:

Boundary firewalls and internet gateways serve as the first line of defence against external threats. These security controls are designed to monitor and filter incoming and outgoing network traffic, acting as a barrier between your organisation's internal network and the internet.

Implementing an effective boundary firewall and internet gateway strategy involves setting up robust access controls, such as whitelisting and blacklisting, to permit or deny traffic based on predefined rules. You will need to regularly review and update these rules to adapt with the ever-changing threat landscape.

Secure Configuration:

Secure configuration is the process of establishing and maintaining a secure baseline for your organisation's devices and systems. This control aims to reduce vulnerabilities by ensuring that all devices are configured according to security best practices and hardened against potential threats. For example, changing the standard publicly known password that comes with your device is one aspect of secure configuration.

To implement secure configuration effectively, organisations should develop a standard configuration baseline for their devices. This includes defining security settings, disabling unnecessary services, and applying stringent authentication methods. Regular audits and automated tools can help maintain compliance with these configurations over time.

Access Control:

Access control is a critical security control that restricts a user’s permissions to only those that are necessary for them to perform their role. This is known as the principle of least privilege and it is the underlying fundamental of access control, ensuring that users only have access to the resources and data essential to their role.

Implementing access control involves a meticulous review of user permissions, defining roles and responsibilities, and regularly auditing and updating access rights. This control mitigates the risk of insider threats and unauthorized access, making it a cornerstone of cybersecurity.

Malware Protection:

Malware, such as viruses, Trojans, and ransomware, pose a significant threat to organisations by exploiting vulnerabilities in systems and networks. Malware protection is designed to detect, prevent, and mitigate the impact of malware infections.

Effective malware protection involves installing and configuring antivirus software and malware protection tools on all endpoints. Regularly updating and patching these tools ensures they remain effective against the latest threats. Additionally, user education is essential to recognize and avoid malicious content, such as phishing, that may deliver malware.

Patch Management:

Software vulnerabilities are a common target for cyber criminals. Patch management is the process of identifying, testing, and applying security patches and updates to software and systems promptly – patches and updates that are defined as ‘high’ or ‘critical’ by the vendor must be updated within 14 days of release. This control helps organisations close security gaps and reduce exposure to known vulnerabilities.

Implementing patch management effectively requires establishing a process for identifying and prioritizing critical patches, testing them in a controlled environment, and deploying them promptly across the organisation. Automated patch management tools can streamline this process and ensure timely updates.

Implementing Security Controls Effectively

Now that we have a clear understanding of the five security controls, let's explore strategies for implementing them effectively:

Developing a Secure Baseline Configuration for Devices:

Start by defining a standard configuration baseline for all devices in your organisation. This baseline should include security settings, access controls, and authentication requirements. Regularly update and enforce these configurations to maintain a strong security posture.

Configuring Firewalls and Gateways to Filter Traffic:

Boundary firewalls and internet gateways should be configured to filter incoming and outgoing traffic based on established rules. These rules must be kept up to date to adapt to emerging threats and ensure that only legitimate traffic is allowed through.

Applying Access Controls Based on the Principle of Least Privilege:

User permissions should be reviewed and audited regularly to ensure that employees have access only to the resources necessary for their roles – it is beneficial to have an established process in place to follow whenever a staff member changes their role which includes reviewing their access permissions. Strong authentication methods, such as multi-factor authentication (MFA), should be implemented to enhance access security.

Installing and Configuring Antivirus Software and Malware Protection Tools:

Antivirus software and malware protection tools should be deployed on all endpoints and servers, and they should be configured to update and perform regular scans automatically. Educating employees on how to recognise and report potential malware threats is key to avoiding some of the most prominent cyberattacks.

Establishing a Process for Timely Software Updates and Patches:

Having a robust automated patch management process that identifies critical patches, tests them in a controlled environment, and deploys them promptly enables you to streamline the process and reduce the risk of unpatched vulnerabilities.

Employee Training and Awareness

Employee training and awareness is one of the most valuable components of a comprehensive cybersecurity strategy. Here's how to foster a cyber aware culture within your organisation:

Educating Employees about Cybersecurity Best Practices:

Your organisation should provide regular training on cybersecurity best practices, including strong password management, secure data handling, and safe browsing habits. Employees should be encouraged to report any security incidents or suspicious activities promptly.

Raising Awareness about Phishing and Social Engineering:

Phishing attacks and social engineering tactics are common entry points for cyber criminals. Awareness campaigns and simulated phishing exercises are essential for educating employees about these threats and how they can recognize and report them.

Conducting Regular Training Sessions:

Studies show that keeping cybersecurity at the forefront of employees' minds by conducting regular training sessions and workshops has proven to be an essential aspect of reducing the risk of experiencing a cyberattack NCSC Staff awareness and training. Emerging threats, new security policies, and cyber security best practices should be covered to ensure that your workforce stays informed and vigilant. If you are unsure of where to start with Security Awareness Training, at Secarma, our expert training team regularly run hands-on security awareness courses across the UK and remotely.

Secure Remote Work Practices

As remote work has become more prevalent since the COVID-19 pandemic, organisations must adapt to secure remote access solutions. Here are some practices to enhance remote work security:

Implementing Secure Remote Access Solutions:

Choose secure remote access solutions that employ strong encryption and authentication methods. Ensure that remote access tools are regularly updated and patched to address any vulnerabilities.

Encouraging the Use of Virtual Private Networks (VPNs):

Employees should be required to use VPNs when connecting remotely to your organisation's network because they encrypt traffic, making it more challenging for cyber criminals to intercept sensitive data.

Setting Up Multi-Factor Authentication (MFA) for Remote Access:

MFA adds an extra layer of security by requiring users to provide multiple forms of authentication before gaining access. Microsoft, later supported by Google, claim that the implementation MFA is one of the most effective ways that you can secure your accounts.

By embracing the Cyber Essentials tips and strategies within this guide, alongside fostering a cyber aware culture, your organisation can mitigate 80% of cyberthreats and maintain resilience in the face of the continually evolving threat landscape.