Over the last ten to fifteen years, we have seen a significant shift in the way companies of all sizes operate. Long gone are the old lever-arch files, floppy storage disks and endless piles of notepads. Instead, we now live in a newer, cleaner and faster electronic world, where the majority of our sensitive information is stored in the cloud and can be accessed at the touch of a button.
The increase in cyber security incidents alongside the implementation of stricter data privacy and data protection legislation has meant that organisations are taking information security a lot more seriously than they may have done in the past.
A company may voluntarily choose to improve its security posture to follow best practices, or they may be forced to; not only for compliance purposes, but to also meet the requirements of their clients. Either way, the terms “risk assessment”, “threat intelligence” and “data protection policy” are now holding a lot more weight in the IT world.
So, what does a company need to do to improve its security posture? This is a question that every IT Director will be asking daily and, quite often, the response would be “where do you start?”
Luckily, groups of clever people have been working together to improve the way that organisations across the world operate, by producing defined sets of criteria that can be referenced and followed.
Frameworks such as ISO 27001, Centre for Internet Security (CIS) Controls, NIST Cyber Security Framework and Cyber Essentials are internationally recognised, and are periodically updated to take into account the ever-changing cyber landscape. Not only can they be used as benchmarks and guidelines, an organisation can also choose to be audited and certified to some of these standards. This will enable an organisation to showcase its compliance and gain a competitive advantage in their market.
If you have not used an information security framework before, the prospect of beginning that process can be daunting- especially as there are several to choose from. However, despite their, they also share a lot of similarities.
To guide you, we have outlined some common principles and criteria shared across the most notable security frameworks:
Access Control
Access Control is a critical part of any information security system and is featured heavily in a lot of the frameworks you may come across. Criteria may include: user account configuration, privileged access management, password policies, multi-factor authentication and network access control.
IT administrators are encouraged to adopt RBAC (Role-Based Access Control) and the principle of least privilege to ensure that users, systems and devices only have access to the resources strictly needed. If access rights need to be removed or amended, the process of doing so should be controlled, timely, traceable, and regularly reviewed.
Training and Awareness
It is often remarked that users are the weakest link in a security system. An indestructible gated structure limiting access to a data centre will be effective at preventing intruder access; however, it becomes useless if an engineer forgets to complete the necessary visitor due diligence checks.
This is why training and awareness is so important. We can all make mistakes and forget some of the basic information security principles. Refresher training should be used to remind us of what we should be doing, and to inform us of any new developments that we need to consider.
A lot of information security frameworks will recommend a regular training program that is tailored to your organisation’s needs.
Asset Management
You can’t protect what you don’t know. The NIST Cybersecurity Framework in particular spells out the need to identify your information security assets and ensure that they are protected. An asset inventory is a straightforward way to record and view an organisation’s assets. Although a manual register is compliant, an automated product such as a Mobile Device Management (MDM) system reduces the likelihood of human error.
Assets are not just limited to company devices; they should also include personally owned devices that have access to company resources. This is especially important for companies that use SaaS products, such as Microsoft 365. Restrictions should be in place to ensure that all devices accessing the network meet a minimum level of security criteria.
Furthermore, asset management includes the return of assets when no longer in use, as well as their secure disposal. An organisation should have robust processes in place to manage these scenarios and meet any legislative obligations.
Secure Configuration
Adding protection measures to a network is usually the first thing organisations think to do. Solutions such as firewalls and endpoint protection products should be in place and, as such, there is plentiful criteria to be found on this across available frameworks.
On the other hand, secure configuration practices can often be a second thought- though they are crucial to the improvement of an organisation’s security posture. Technical frameworks such as Cyber Essentials and the CIS Controls place great emphasis on this subject area.
The use of insecure protocols, default administrator passwords, generic user accounts, and unnecessary ports and software are some of the things that could increase the likelihood of system compromise. An IT administrator can mitigate these risks by performing regular reviews of the estate and by keeping up to date with current and emerging threats. This information should be used to ensure that the organisation is not left vulnerable.
Caladium Cyber have experts who are here to guide you through an information security assessment, such as CIS, ISO 27001 and the NIST Cyber Security Framework. We are here to help you find any gaps in your security posture and provide recommendations on how your organisation can improve.
For more information about how we can help you send an enquiry to consultancy@caladiumcyber.com.