Blog Layout
The 5 Controls of Cyber Essentials – Access Control
Leo Daniels • December 1, 2020
This is a subtitle for your new post
Access control should be at the forefront of your business concerns. Without appropriately limiting access you could leave your staff or company open to a lot of problems. It should always be a concern no matter the circumstances but, with the world functioning the way it is now and the majority of businesses having at least a partially remote workforce, its importance has never been more apparent to ensure system security.
Cyber essentials – The Aim
The objective of Cyber Essentials is to ensure user accounts provide access to only those applications, networks and computers required for the user to perform their role. They ensure user accounts are assigned to authorised individuals only.
Why do you want the Cyber essential accreditation?
The certification is widely recognised as a reputable way to measure a business’s ability to provide a secure environment against cyber-attacks. Customers are much more likely to use a business that has proof from an outside source that they are doing everything within their power to ensure that their information is safe.
If you are planning to go for specific government contracts this can be mandatory – unless your business achieves it, you will not even be able to bid for certain contracts.
The Cyber Essential requirements to achieve adequate access control.
To achieve the Cyber Essentials accreditation, you will need to ensure you only give administrative privileges to those that need them and that there is control over what that administrator can do with those accounts.
You will reduce the risk of information being stolen or damaged by ensuring that only authorised employees have user accounts; and that they are given access only to the point at which they need it to complete their job role.
When applying you must have a user account creation and approval process as well as the ability to authenticate users before granting access to application devices. The applicant must use administrative accounts to perform administrative activities only. remove or disable user accounts when no longer required, implement two-factor authentication, and remove or disable special access privileges when no longer required.
Accounts with special access privileges being accessed by unauthorised personnel could potentially be very hazardous – with access to devices’ applications and potentially sensitive information they could start a larger corruption of the systems, in turn disrupting business processes and potentially having a detrimental effect on the reputation of the business.
Administration – “the process or activity of running a business, organisation, etc”.
Administrator – “a person responsible for carrying out the administration of a business or organisation”.
With the job role of an administrator being of such importance, understandably, they are usually the people in charge of privileged accounts. If a user opens a phishing email containing a virus it usually operates on and below the level of privilege it was opened on; meaning it can do irreparable damage to the business infrastructure.
For example:
James logged into an administrative account – he had no reason to as his job role does not require access to any of the files on that particular user. He notices an email that is unread and opens it, then discovers it contains a virus.
The virus reaps havoc – encrypting all the data on the network. It then demands a ransom to remedy the encryption.
We’re 1-fix, we can help you secure your business
At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.
If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take. If you have any questions, concerns or would like to discuss how we might help you with your regulatory challenges, we’d love to chat. Please click the banner below to book a call, or contact us straight away on 0118 926 0084 or by email to info@1-fix.com.
Thank you for reading.
Join Our Mailing List
All sign-ups are handled inline with our privacy policy and can unsubscribe at any time.
Recent Blogs
Data loss can occur due to various reasons, including hardware failures, cyberattacks, natural disasters, and human error. To protect your business from these risks, it's crucial to implement a strong data backup and security strategy.
While technology is essential for a successful business, it can also be a significant expense. Fortunately, there are several strategies you can implement to reduce IT costs without compromising on quality or performance.
Businesses are constantly faced with decisions about how to best manage their IT infrastructure. One of the most significant choices is whether to adopt cloud services or stick with on-premises solutions. Both options have their advantages and drawbacks, and the right choice depends on your business's specific needs and goals. Let's explore the key differences between cloud services and on-premises solutions to help you make an informed decision.
Nowadays, businesses rely heavily on technology to operate efficiently and stay competitive. However, with the increasing dependence on IT systems, businesses also face a myriad of IT issues that can disrupt operations and impact productivity.
One of the most effective tools to protect your business against cyber attacks is a password manager. But what exactly is a password manager, how does it work, and why is it essential for your business?
One of the most effective ways to protect your organisation from cyber threats is through Security Awareness Training. But what exactly is Security Awareness Training, how does it work, and why is it essential for your business? Let's explore these questions with a focus on KnowBe4, a leading platform in this field.
Get in Touch
Fill in this form to contact us and we'll get back to you ASAP (same working day where possible):
Contact Us
1-Fix Limited
Company Registration Number: 06543233
Registered address:
1-Fix Limited
1F02 Arena Business Centre, 100 Berkshire Place, Winnersh Triangle, Wokingham, Berkshire RG41 5RD
