The 5 Controls of Cyber Essentials – Access Control

Leo Daniels • December 1, 2020

This is a subtitle for your new post

Access control should be at the forefront of your business concerns. Without appropriately limiting access you could leave your staff or company open to a lot of problems. It should always be a concern no matter the circumstances but, with the world functioning the way it is now and the majority of businesses having at least a partially remote workforce, its importance has never been more apparent to ensure system security.

Cyber essentials – The Aim

The objective of Cyber Essentials is to ensure user accounts provide access to only those applications, networks and computers required for the user to perform their role. They ensure user accounts are assigned to authorised individuals only.

Why do you want the Cyber essential accreditation?

The certification is widely recognised as a reputable way to measure a business’s ability to provide a secure environment against cyber-attacks. Customers are much more likely to use a business that has proof from an outside source that they are doing everything within their power to ensure that their information is safe.

If you are planning to go for specific government contracts this can be mandatory – unless your business achieves it, you will not even be able to bid for certain contracts.

The Cyber Essential requirements to achieve adequate access control.

To achieve the Cyber Essentials accreditation, you will need to ensure you only give administrative privileges to those that need them and that there is control over what that administrator can do with those accounts.

You will reduce the risk of information being stolen or damaged by ensuring that only authorised employees have user accounts; and that they are given access only to the point at which they need it to complete their job role.

When applying you must have a user account creation and approval process as well as the ability to authenticate users before granting access to application devices. The applicant must use administrative accounts to perform administrative activities only. remove or disable user accounts when no longer required, implement two-factor authentication, and remove or disable special access privileges when no longer required.

Accounts with special access privileges being accessed by unauthorised personnel could potentially be very hazardous – with access to devices’ applications and potentially sensitive information they could start a larger corruption of the systems, in turn disrupting business processes and potentially having a detrimental effect on the reputation of the business.

Administration – “the process or activity of running a business, organisation, etc”.

Administrator – “a person responsible for carrying out the administration of a business or organisation”.

With the job role of an administrator being of such importance, understandably, they are usually the people in charge of privileged accounts. If a user opens a phishing email containing a virus it usually operates on and below the level of privilege it was opened on; meaning it can do irreparable damage to the business infrastructure.

For example:

James logged into an administrative account – he had no reason to as his job role does not require access to any of the files on that particular user. He notices an email that is unread and opens it, then discovers it contains a virus.

The virus reaps havoc – encrypting all the data on the network. It then demands a ransom to remedy the encryption.

We’re 1-fix, we can help you secure your business

At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.

If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take. If you have any questions, concerns or would like to discuss how we might help you with your regulatory challenges, we’d love to chat. Please click the banner below to book a call, or contact us straight away on 0118 926 0084 or by email to info@1-fix.com.

Thank you for reading.

< Older Post

Newer Post >