Five locks that stop most attacks
Most attacks on small firms are not clever. They use an old update, a weak login or a program nobody needed.
The UK government backs a set of five basic controls that stop most of them. They are called Cyber Essentials.
By the end of this lesson
Note
I can name the five Cyber Essentials controls and say what each one does.
Key words
| Word | What it means |
|---|---|
| Technical control | a setting or tool that lowers risk, as opposed to a rule or a lock on a door |
| Boundary firewall | a filter between your computers and the internet that blocks traffic you do not want |
| Secure configuration | setting devices up so users have only what they need |
| Malware protection | software that finds and stops harmful software, kept up to date |
| Patch management | keeping software and systems updated to the newest fixes |
| Access control | giving each person only the access their job needs |
| Least privilege | the rule of giving the smallest access that still lets the job be done |
| Malware | harmful software |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
What technical controls are for
Technical controls improve security for users and for systems. They are settings and tools, such as filters, updates and logins.
The scheme is run with the National Cyber Security Centre. A firm that follows all five controls can be certified.
The five controls, one line each
| Control | What it does | Example |
|---|---|---|
| Boundary firewalls and internet gateways | Restricts the flow of traffic in and out | Block all outside traffic to the file server |
| Secure configuration | Users have only the tools they need | Remove unneeded software, limit web access |
| Malware protection | Keeps anti-malware up to date and scans often | A scan of every laptop each night |
| Patch management | Keeps software and systems up to date | Install the monthly updates |
| Access control | Gives the minimum access, by user | Least privilege, and good username and password rules |
The cells students fill in are left blank in this preview.
A closer look at access control
Access control uses the user's own details to decide what they may reach. The key idea is least privilege: give the smallest access that still lets the job be done.
It also covers username and password rules. Each person has their own account, and strong passwords are kept private.