Blog Layout
The 5 Controls of Cyber Essentials – Access Control
Leo Daniels • Dec 01, 2020
This is a subtitle for your new post
Access control should be at the forefront of your business concerns. Without appropriately limiting access you could leave your staff or company open to a lot of problems. It should always be a concern no matter the circumstances but, with the world functioning the way it is now and the majority of businesses having at least a partially remote workforce, its importance has never been more apparent to ensure system security.
Cyber essentials – The Aim
The objective of Cyber Essentials is to ensure user accounts provide access to only those applications, networks and computers required for the user to perform their role. They ensure user accounts are assigned to authorised individuals only.
Why do you want the Cyber essential accreditation?
The certification is widely recognised as a reputable way to measure a business’s ability to provide a secure environment against cyber-attacks. Customers are much more likely to use a business that has proof from an outside source that they are doing everything within their power to ensure that their information is safe.
If you are planning to go for specific government contracts this can be mandatory – unless your business achieves it, you will not even be able to bid for certain contracts.
The Cyber Essential requirements to achieve adequate access control.
To achieve the Cyber Essentials accreditation, you will need to ensure you only give administrative privileges to those that need them and that there is control over what that administrator can do with those accounts.
You will reduce the risk of information being stolen or damaged by ensuring that only authorised employees have user accounts; and that they are given access only to the point at which they need it to complete their job role.
When applying you must have a user account creation and approval process as well as the ability to authenticate users before granting access to application devices. The applicant must use administrative accounts to perform administrative activities only. remove or disable user accounts when no longer required, implement two-factor authentication, and remove or disable special access privileges when no longer required.
Accounts with special access privileges being accessed by unauthorised personnel could potentially be very hazardous – with access to devices’ applications and potentially sensitive information they could start a larger corruption of the systems, in turn disrupting business processes and potentially having a detrimental effect on the reputation of the business.
Administration – “the process or activity of running a business, organisation, etc”.
Administrator – “a person responsible for carrying out the administration of a business or organisation”.
With the job role of an administrator being of such importance, understandably, they are usually the people in charge of privileged accounts. If a user opens a phishing email containing a virus it usually operates on and below the level of privilege it was opened on; meaning it can do irreparable damage to the business infrastructure.
For example:
James logged into an administrative account – he had no reason to as his job role does not require access to any of the files on that particular user. He notices an email that is unread and opens it, then discovers it contains a virus.
The virus reaps havoc – encrypting all the data on the network. It then demands a ransom to remedy the encryption.
We’re 1-fix, we can help you secure your business
At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.
If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take. If you have any questions, concerns or would like to discuss how we might help you with your regulatory challenges, we’d love to chat. Please click the banner below to book a call, or contact us straight away on 0118 926 0084 or by email to info@1-fix.com.
Thank you for reading.
Join Our Mailing List
All sign-ups are handled inline with our privacy policy and can unsubscribe at any time.
Recent Blogs
We won MSP of the Year 2024 (sub 1500 endpoints)!
Are you tired of juggling IT issues while trying to focus on growing your business? It may be time to consider outsourcing your IT support. We've put together 5 reasons why outsourcing your IT can be beneficial for you...
In today’s fast-paced digital landscape, having an intelligent assistant by your side can make all the difference. Enter Microsoft Copilot, a powerful AI companion designed to boost productivity, spark creativity, and simplify complex tasks. Let’s dive into what makes Copilot a game-changer for individuals and businesses alike.
We've finalists for not one, but two Network Group Awards 2024!
World Backup Day is just around the corner so we thought we'd share a few reasons why backing up your computers regularly is so important.
John Clark, from Solutions Shared joined us on a webinar to discuss what Microsoft Power Apps are and how they can be used in your business.
Get in Touch
Fill in this form to contact us and we'll get back to you ASAP (same working day where possible):
Contact Us
1-Fix Limited
Company Registration Number: 06543233
Registered address:
1-Fix Limited
1F02 Arena Business Centre, 100 Berkshire Place, Winnersh Triangle, Wokingham, Berkshire RG41 5RD
