Cyber Essentials: A guide to the Cyber Essentials and Cyber Essentials Plus certifications

By Alan Calder

Cyber Essentials – A guide to Cyber Essentials and Cyber Essentials Plus certifications

Cyber attacks are a fact of life in the information age. For any organisation that connects to the Internet, the issue is not if an attack will come, but when. Most cyber attacks are performed by relatively unskilled criminals using tools available online. These attacks are often opportunistic: looking for easy targets rather than rich pickings.

The Cyber Essentials scheme is a UK government-backed effort to encourage UK-based organisations to improve their cyber security by adopting measures (called controls) that defend against common, less-sophisticated cyber attacks. The scheme recommends practical defences that should be within the capability of any organisation.

The Cyber Essentials scheme has two levels:

1. The basic Cyber Essentials; and
2. Cyber Essentials Plus.

This first part of this book will examine the various threats that are most significant in the modern digital environment, their targets and their impacts. It will help you to understand whether your organisation is ready for Cyber Essentials or Cyber Essentials Plus certification.

The second part of the book presents a selection of additional resources that are available to help you implement the controls or become certified.

• Language: English
• Publisher: itgovernance
• Release date: Jul 11, 2023
• ISBN: 9781787784369

Alan Calder

Alan Calder is a leading author on IT governance and information security issues. He is the CEO of GRC International Group plc, the AIM-listed company that owns IT Governance Ltd. Alan is an acknowledged international cyber security guru. He has been involved in the development of a wide range of information security management training courses that have been accredited by the International Board for IT Governance Qualifications (IBITGQ). He is a frequent media commentator on information security and IT governance issues, and has contributed articles and expert comment to a wide range of trade, national and online news outlets.

Book preview

Cyber Essentials

A guide to the Cyber Essentials and Cyber Essentials Plus certifications

Every possible effort has been made to ensure that the information contained in this book is accurate at the time of going to press, and the publisher and the author cannot accept responsibility for any errors or omissions, however caused. Any opinions expressed in this book are those of the author, not the publisher. Websites identified are for reference only, not endorsement, and any website visits are at the reader’s own risk. No responsibility for loss or damage occasioned to any person acting, or refraining from action, as a result of the material in this publication can be accepted by the publisher or the author.

Apart from any fair dealing for the purposes of research or private study, or criticism or review, as permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored or transmitted, in any form, or by any means, with the prior permission in writing of the publisher or, in the case of reprographic reproduction, in accordance with the terms of licences issued by the Copyright Licensing Agency. Enquiries concerning reproduction outside those terms should be sent to the publisher at the following address:

IT Governance Publishing Ltd

Unit 3, Clive Court

Bartholomew’s Walk

Cambridgeshire Business Park

Ely, Cambridgeshire

CB7 4EA

United Kingdom

www.itgovernancepublishing.co.uk

© Alan Calder, 2023.

The author has asserted the rights of the author under the Copyright, Designs and Patents Act, 1988, to be identified as the author of this work.

First edition published in the United Kingdom in 2023 by IT Governance Publishing.

ISBN 978-1-78778-436-9

Cover image originally sourced from Shutterstock®.

ABOUT THE AUTHOR

Alan Calder is a leading author on IT governance and information security issues. He is the CEO of GRC International Group plc, the AIM-listed company that owns IT Governance Ltd.

Alan is an acknowledged international cyber security guru. He has been involved in the development of a wide range of information security management training courses that have been accredited by the International Board for IT Governance Qualifications (IBITGQ).

He is a frequent media commentator on information security and IT governance issues, and has contributed articles and expert comment to a wide range of trade, national and online news outlets.

ACKNOWLEDGEMENTS

I would like to thank Nigel Evans, Technical Writer at GRC International Group Plc, for his help developing the material in this book.

CONTENTS

Chapter 1: The Cyber Essentials scheme

Why get certified?

Which contracts require Cyber Essentials?

What am I protecting?

Beyond and outside Cyber Essentials

Structure of this book

Part 1: Requirements for basic technical protection from cyber attacks

Chapter 2: Types of attack

Social engineering

Denial of service (DoS)

Password attacks

Threats outside the perimeter

Misconfiguration and unpatched vulnerabilities

Ransomware

Scoping

Implementation and documentation

Chapter 3: Technical control themes

Technical control theme 1: Firewalls

Technical control theme 2: Secure configuration

Technical control theme 3: User access control

Technical control theme 4: Malware protection

Technical control theme 5: Security update management

Further guidance from Cyber Essentials

Part 2: Gaining cyber essentials certification

Chapter 4: Certification

Externally managed services and scope

Cyber Essentials checklist

Cyber Essentials certification process

Getting certified – Cyber Essentials Plus

Appendix 1: Further assistance

Practical help and consultancy

Useful documents and further information

The next step – cyber security standards

Staff training

Cyber resilience

Appendix 2: IT Governance resources

Certification only

Get A Little Help

Get A Lot Of Help

Cyber Essentials Plus Health Check

Penetration testing

Gap analysis

GRC eLearning courses

Further reading

CHAPTER 1: THE CYBER ESSENTIALS SCHEME

Cyber attacks are a fact of life in the information age. For any organisation that connects to the Internet, the issue is not if an attack will come, but when. Most cyber attacks are performed by relatively unskilled criminals using tools available online. These attacks are often opportunistic: looking for easy targets rather than rich pickings.

The Cyber Essentials scheme is a UK government-backed effort to encourage UK-based organisations to improve their cyber security by adopting measures (called controls) that defend against common, less-sophisticated cyber attacks. The scheme recommends practical defences that should be within the capability of any organisation. Cyber Essentials is the digital equivalent of a locked front door and closed windows, rather than barbed wire, guard patrols and watchtowers.

The Cyber Essentials scheme was created in 2014 by the National Cyber Security Centre (NCSC), which is a part of the UK government. There was a major update to the scheme in 2022, which changed some of the requirements, and a smaller update in January 2023. These changes were largely prompted by developments in