Cyber Essentials and Cyber Essentials Plus Explained
Cyber Essentials is the UK Government backed scheme that shows your business has the basic security controls in place. Here is how it works, what it costs and how to prepare.
Why layered security works
No single product will keep a business safe. Antivirus does not stop someone logging in with a stolen password. Multi factor authentication does not stop a member of staff paying a fake invoice. A backup does not stop data being stolen. Each measure covers a different gap, and attackers only need one gap to get in.
That is why we take a layered approach. We put several sensible protections in place so that if one is bypassed, another is there to catch the problem. None of the layers on their own are complicated, but together they make your business a much harder target than the average.
The layers we put in place
Protecting your devices
Every laptop, desktop and server needs business grade protection. We use VIPRE endpoint security, which combines traditional malware protection with endpoint detection and response (EDR). EDR watches for suspicious behaviour, such as a program suddenly encrypting lots of files, and can stop it in its tracks. For businesses that want round the clock cover, managed detection and response adds a team of security analysts watching for threats. Read more on our endpoint protection page.
Securing email
Email is still the most common way attacks start. Good filtering removes most phishing and malware before it reaches anyone, link protection checks web addresses when they are clicked, and correctly configured SPF, DKIM and DMARC records make it harder for criminals to send email pretending to be you. See our email security page for the detail.
Protecting accounts and sign ins
Stolen passwords are behind a large share of business account compromises. Multi factor authentication (MFA) adds a second check, usually an app on your phone, so a password on its own is not enough. In Microsoft 365 we also review admin accounts, switch off old sign in methods that bypass MFA and, where your licences include it, set up conditional access rules that control where and how people can sign in.
Keeping software up to date
Many successful attacks use security holes that were fixed months earlier but never installed. We manage updates for Windows and common applications on a schedule that suits you, check that they have been applied and deal with any that fail. We also help you replace software and devices that no longer receive security updates.
Backups you can rely on
If ransomware or a mistake does get through, backups are what let you recover. We set up encrypted backups for servers, devices and Microsoft 365, keep copies away from your main systems and test restores regularly. Our backup and recovery page explains how.
Your team
Technology catches most threats, but people are the final layer. Short, regular security awareness training and simulated phishing tests help staff spot the scams that slip through and, just as importantly, feel comfortable reporting a mistake straight away.
Cyber Essentials
Cyber Essentials is the UK Government backed scheme that sets out basic technical controls every organisation should have. It is a useful benchmark and is required for some government contracts. We help businesses prepare by finding and fixing the gaps before their assessment. See our Cyber Essentials page for how the scheme works.
Firewalls and your network
A properly configured business firewall controls what can reach your network from the internet and is one of the five controls in Cyber Essentials. We make sure default passwords are changed, admin access is protected, unnecessary rules are removed and firmware is kept up to date. Guest WiFi is kept separate from your business systems. See our networks and WiFi page for more.
If something goes wrong
If you think you have clicked a bad link, entered your password somewhere you should not have, or notice something odd on a computer, call us straight away on 0191 543 3432. Acting quickly makes a real difference. For clients we can reset passwords, check sign in logs, isolate affected devices and help you work out what has happened and what needs to happen next, including whether you need to report it.
Security for North East businesses, explained plainly
We are a family run business based in Sunderland, working with organisations of around 5 to 100 staff across the North East. We do not use scare tactics or sell products you do not need. We will tell you honestly where your risks are, what we recommend and what it costs, and then look after it for you. Get in touch to talk it through.