Start with the controls that stop most attacks
A small set of well-implemented controls prevents the majority of common cyber attacks. Recognised baselines such as Cyber Essentials and the CIS Controls agree on the same foundations. Implement them consistently across every system before investing in more advanced capabilities.
The five foundations
Secure configuration. Remove or change default accounts and passwords, disable unused services and features, and apply hardened settings to servers, workstations and network devices.
Access control. Give each person only the access they need, use unique accounts, and protect every account, especially administrators, with multi-factor authentication.
Patch management. Keep operating systems, applications and firmware supported and updated; prioritise internet-facing systems and act quickly on critical fixes.
Malware protection. Run reputable, updated endpoint protection and control which applications may run.
Firewalls and boundaries. Control traffic in and out of your networks and place public services behind appropriate protection.
Know what you are protecting
You cannot secure what you have not listed. Maintain an inventory of hardware, software, domains and data, and review it regularly to find forgotten systems, expired certificates and services exposed to the internet by mistake. Decommission what you no longer use.
Prove the controls work
Document a minimum standard, apply it to every new and existing system, and check compliance through regular reviews and vulnerability scanning. A control that is assumed but never verified is not a control. Record exceptions, with an owner and a date to resolve them.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.