The 5 Controls of Cyber Essentials – Access Control
Leo Daniels • December 1, 2020
This is a subtitle for your new post
Access control should be at the forefront of your business concerns. Without appropriately limiting access you could leave your staff or company open to a lot of problems. It should always be a concern no matter the circumstances but, with the world functioning the way it is now and the majority of businesses having at least a partially remote workforce, its importance has never been more apparent to ensure system security.
Cyber essentials – The Aim
The objective of Cyber Essentials is to ensure user accounts provide access to only those applications, networks and computers required for the user to perform their role. They ensure user accounts are assigned to authorised individuals only.
Why do you want the Cyber essential accreditation?
The certification is widely recognised as a reputable way to measure a business’s ability to provide a secure environment against cyber-attacks. Customers are much more likely to use a business that has proof from an outside source that they are doing everything within their power to ensure that their information is safe.
If you are planning to go for specific government contracts this can be mandatory – unless your business achieves it, you will not even be able to bid for certain contracts.
The Cyber Essential requirements to achieve adequate access control.
To achieve the Cyber Essentials accreditation, you will need to ensure you only give administrative privileges to those that need them and that there is control over what that administrator can do with those accounts.
You will reduce the risk of information being stolen or damaged by ensuring that only authorised employees have user accounts; and that they are given access only to the point at which they need it to complete their job role.
When applying you must have a user account creation and approval process as well as the ability to authenticate users before granting access to application devices. The applicant must use administrative accounts to perform administrative activities only. remove or disable user accounts when no longer required, implement two-factor authentication, and remove or disable special access privileges when no longer required.
Accounts with special access privileges being accessed by unauthorised personnel could potentially be very hazardous – with access to devices’ applications and potentially sensitive information they could start a larger corruption of the systems, in turn disrupting business processes and potentially having a detrimental effect on the reputation of the business.
Administration – “the process or activity of running a business, organisation, etc”.
Administrator – “a person responsible for carrying out the administration of a business or organisation”.
With the job role of an administrator being of such importance, understandably, they are usually the people in charge of privileged accounts. If a user opens a phishing email containing a virus it usually operates on and below the level of privilege it was opened on; meaning it can do irreparable damage to the business infrastructure.
For example:
James logged into an administrative account – he had no reason to as his job role does not require access to any of the files on that particular user. He notices an email that is unread and opens it, then discovers it contains a virus.
The virus reaps havoc – encrypting all the data on the network. It then demands a ransom to remedy the encryption.
We’re 1-fix, we can help you secure your business
At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.
If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take. If you have any questions, concerns or would like to discuss how we might help you with your regulatory challenges, we’d love to chat. Please click the banner below to book a call, or contact us straight away on 0118 926 0084 or by email to info@1-fix.com.
Thank you for reading.
Join Our Mailing List
All sign-ups are handled inline with our privacy policy and can unsubscribe at any time.
Recent Blogs
Avoid the risks of using Office 365 Home at work. Learn why Office 365 for business is the right choice for security, scalability, and compliance.
Discover the key benefits of outsourced IT support, from enhanced cybersecurity and 24/7 monitoring to cost savings and regulatory compliance.
Stay cyber secure while travelling with 10 expert tips. Use VPNs, avoid public Wi-Fi, and protect your data on the go.
In a world where AI is changing how we work and compete, security is more important than ever. We are gathering industry leaders and AI experts for a special roundtable event. This event will focus on a key topic: AI security.
Microsoft 365 Business Basic offers a range of cloud-based services designed to empower businesses to work smarter and more efficiently. Let's delve into what this package includes and how it can benefit your organisation.
We’re excited to announce an informative webinar featuring Elliot Wilkie from Brigantia and Craig Atkins from 1-Fix, diving deep into the world of DMARC on 8th July at 2 PM . This is an essential session for anyone looking to secure their email communications, understand DMARC compliance, and enhance their email deliverability.
