Five habits that stop most attacks
The UK government set up a scheme called Cyber Essentials. It asks a business to do five simple things well.
Most attacks on small companies are not clever. They use an open door, a weak password or old software. These five controls close those doors.
Key words
| Word | What it means | Example |
|---|---|---|
| Cyber Essentials | A UK government-backed scheme with five basic security controls. | |
| NCSC | The National Cyber Security Centre. It gives UK security advice. | |
| Network | Computers and devices joined together so they can share data. | |
| Firewall | A filter that allows or blocks network traffic by rules. | |
| Secure configuration | Setting up a device so it has only what the user needs. | |
| Multi-factor authentication | Signing in with two or more proofs, such as a password and a phone code. | MFA |
| Malware | Software made to cause harm. | |
| Operating system | The main program that runs a computer. | Windows or Linux |
| Patch | A small update that fixes a security fault in software. | |
| Least privilege | Giving a user the minimum access they need. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name the five Cyber Essentials controls and say what each one does for a business.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: the five controls
1. Boundary firewalls and internet gateways. A firewall sits at the edge of the network. It restricts the flow of traffic in and out.
2. Secure configuration. Remove unneeded software. Limit what the web can reach. Change default passwords.
3. Access control. Give users the minimum access, which is least privilege. Manage usernames and passwords well, and use MFA wherever it is offered.
The last two controls
4. Malware protection. Keep anti-malware software up to date. Scan regularly.
5. Patch management. Keep operating systems and software updated. Cyber Essentials asks for critical and high-risk fixes to be installed within 14 days of release.
Together the five are easy to remember as: filter, set up, limit, scan, update.
The five controls in a help desk day
| Control | What it does | A help desk example |
|---|---|---|
| Boundary firewall | Restricts traffic at the edge | Block a port nobody uses |
| Secure configuration | Only what the user needs | Remove a game from a work laptop |
| Access control | Least privilege, managed passwords | A new starter gets standard rights, not admin |
| Malware protection | Up-to-date anti-malware, regular scans | Check the scan ran last night |
| Patch management | Software kept up to date | Roll out this month's updates |
The cells students fill in are left blank in this preview.
Check: which control?
Have a go
Check: which control?
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.