An overview of Cyber Essentials and why it's important. Presentation by Sam Eaton-Rosen and David Batho.

1. Introduction to Cyber Essentials
Sam Eaton-Rosen
Senior Penetration Tester, Team Lead
Cyber Essentials Assessor & CE+
Lead Auditor
David Batho
Senior Security Specialist
Cyber Essentials Assessor

2. Background to Cyber Essentials
• UK Government – many breaches due to lack of simple
controls implemented
• Review of these breaches over 4 years resulted in
identification of 5 key technical controls (Office Firewalls and
Internet Gateways, Secure Configuration, Security Update
Management, Access Control, Malware Protection)
• Backed by the NCSC – National Cyber Security Centre – and
run by IASME
• UK Government is mandating CE in many contracts

3. What is Cyber Essentials?
Cyber Essentials is a government-backed scheme focusing
on the five important technical security controls.

4. Benefits of Cyber Essentials
• Improve the security posture of your institution (internal and
external).
• Align your institution with a government-backed UK Standard.
• Demonstrate security within your supply chain.
• Ability to work with UK government contracts, partnerships
and third parties.

5. Scoping Cyber Essentials
• Whole organisation
• All devices that access organisational data
• No exclusions
• https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-IT-
infrastructure-2-2.pdf
• Strongest security implications
• Limited scope
• Focused areas of the network
• Can cover areas needed for funding but not others
• Defined by network boundaries

6. Scoping continued
• Education – Admin network only if there’s a network separation
• Home Workers (contracted or legally required to work from home for any amount of
time)
• Use a VPN, software firewall, or apply controls to their home network – good practice
• Cloud Services
• SAAS – Out of scope (you don’t have control over the service)
• PAAS – Out of Scope (unless you can apply any controls)
• IAAS – In scope (AWS and Azure) – you can apply controls
• Mobile Devices – Access business data and are in scope
• Should have MDM or anti-virus installed, or otherwise meet requirements
• Voice and 2FA only – not in scope
• BYOD (If they access business data) – they are in scope

7. Protection against internet threats
Social Engineering
(Phishing)
Vulnerabilities
(Hacking)
Password
Guessing

8. Where does CE sit?
Cyber
Security
Investment
CE focuses on prevention!

9. Office Firewalls and Internet Gateways
Firewall rules, default password, length of password and review process.
Secure Configuration
Formal process for admin accounts, segregation of duties, tracking privileged accounts, reviewing of
accounts, MFA for admins, gold image and default passwords
Security Update Management
OS and firmware within support, vendor recommendations, 14 days security patch cycle, end of life
support, open source supported (if they have an active community) phones and servers
Access Control
Software management, user accounts, local accounts passwords, admin account use, length of
password, lock outs, password policy and least privilege
Malware Protection
Malware protection on all devices, updates/scans, restricted access to unsigned software (approved) and
sandboxing
FAIL – If there is no sign off by Executive management, and also if you are running out of support operating systems
5 key security controls

10. CES Stages

11. What next?
• Download the questions and review prior to booking the assessment
• https://iasme.co.uk/cyber-essentials/free-download-of-cyber-essentials-self-
assessment-questions/
• Come to the Jisc Cyber Essentials drop-in clinics for support and advice
• Focused on education and research, for CE and CE+ questions
• https://www.jisc.ac.uk/training/cyber-essentials-drop-in-clinic
• Book assessment with Jisc
• Discuss scope with us, then complete the self-assessment in the online portal
• Answer questions – 5 controls plus some organisational info, signed off at an
executive level, adding additional justification for answers
• Re-assess - any remediations must be completed within 2 working days
• Certification!

12. Security is not just for Christmas?
• Need to do the assessment on a yearly basis
• Ensure you have budget and time to do the preparation work,
and any remediation for the re-assessment
• Ensure you have Executive management buy-in and support
for this process
• Can lead into Cyber Essentials Plus

13. PROFESSIONAL.CYBERSERVICES@JISC.AC.UK