Free advice from the experts
A small firm has no security team and no money for one. Where does it start?
The UK government's cyber experts publish a free checklist. A global group of volunteers publishes free guides on safe software.
Neither is law. Both are what good firms follow.
Key words
| Word | What it means |
|---|---|
| Network | Computers and devices linked so they can share data. |
| Malware | Software made to harm a computer or steal data. |
| Vulnerability | A weak point that an attacker could use. |
| Best practice | Advice from experts on the way that works best. |
| NCSC | National Cyber Security Centre: the UK government body that gives cyber security advice. |
| 10 Steps | The NCSC list of ten areas an organisation should work on. |
| OWASP | Open Web Application Security Project: a non-profit group that shares free help on safe software. |
| Web application | A program you use in a browser, such as an online shop. |
| Removable media | Memory sticks and other storage you can plug in and take away. |
| Privilege | The power a user has, such as the right to install software. |
| Incident | A security event that harms or could harm the organisation. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name the ten areas of the NCSC 10 Steps, say what OWASP is for, and match a problem to the step that helps.
Starter: standards
Have a go
Starter: standards
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: the NCSC 10 Steps
The NCSC is part of the UK government. Its 10 Steps guide tells organisations the key areas to focus on. The purpose is to inform. It is advice, not law.
The spec lists ten areas. You will learn one line for each.
The ten areas
| Area | In one line |
|---|---|
| User education and awareness | Train staff to spot scams and follow the rules |
| Home and mobile working | Protect devices and data away from the office |
| Secure configuration | Set up systems safely and remove what is not needed |
| Removable media controls | Limit and scan memory sticks and other plug-in storage |
| Managing user privileges | Give each person only the access they need |
| Incident management | Plan how to spot, handle and learn from an incident |
| Monitoring | Watch logs and traffic for odd events |
| Malware protection | Block, detect and remove harmful software |
| Network security | Protect the network edge and inside it |
| Risk management regime | A regular way to find and rank risks, owned by leaders |
The cells students fill in are left blank in this preview.
Check: which area?
Have a go
Check: which area?
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.