10 Checklist to Cyber Security according to NCSS

TL;DR

• Cyber security is the practice of protecting digital systems, networks, and data from unauthorized access, theft, and damage.
• 10 checklist to cyber security according to National Cyber Security Centre (NCSC)
• The 10 checklist is Risk Management, Engagement and Training, Asset Management, Architecture and Configuration, Vulnerability Management, Identity and Access Management, Data Security, Logging Monitoring, Incident Management and Supply Chain Security

---

In today’s digital age, cyber security is a critical concern for any organization that deals with sensitive data or relies on technology for its operations. While there is no foolproof way to prevent cyber attacks, following best practices and industry standards can greatly reduce the risk of a security breach. 

That’s why the National Cyber Security Centre (NCSC) has developed a checklist of ten essential areas for cyber security in medium to large organizations. This collection is aimed at cybersecurity professionals and technical staff, and provides a summary of NCSC’s advice for protecting your organization’s technology, systems, and information from cyber threats. 

In this post, we’ll introduce the ten areas of focus and explain why they are important for maintaining a secure environment. Whether you’re an IT manager or a business owner, this advice can help you build a more resilient and secure organization. So let’s get started!

Risk Management

Taking a risk-based approach to cyber security is an essential first step in securing your organization’s systems and data. This means identifying and assessing the potential risks to your technology and information, and developing a strategy to mitigate those risks based on their likelihood and impact. 

Here are some key elements of a risk management approach to cyber security: 

1. Identify assets and threats: The first step in risk management is to identify the assets that you need to protect, such as data, systems, and networks, and the potential threats that could harm those assets. This could include malware, phishing attacks, insider threats, and more. 
2. Assess risk: Once you have identified the assets and threats, you need to assess the likelihood and potential impact of each risk. This can help you prioritize which risks to address first and which ones are less critical. 
3. Develop a risk management plan: Based on your risk assessment, you should develop a plan to mitigate each risk. This could involve implementing security controls, such as firewalls, antivirus software, and access controls, and defining policies and procedures to ensure that your organization’s technology and information are protected. 
4. Monitor and review: Risk management is an ongoing process, and it’s important to regularly monitor and review your risk management plan to ensure that it’s still effective and up-to-date. This could include regular vulnerability assessments, penetration testing, and security audits.

Engagement and Training

Engagement and Training refers to the importance of fostering a culture of security within your organization, where everyone understands their role in protecting the organization’s systems and data. 

Here are some key elements of an engagement and training strategy for cyber security: 

1. Establish security policies: Develop clear and concise policies for cyber security that outline the expectations for all employees and contractors. These policies should be regularly reviewed and updated to reflect changes in technology and threats. 
2. Train employees: Provide regular training to all employees to ensure they understand the risks of cyber threats and their role in preventing them. This training should cover topics such as password security, email phishing, and mobile device security. 
3. Foster a security culture: Encourage all employees to take responsibility for cyber security by promoting a security-first mindset. This can involve promoting secure behavior, such as locking devices when away from their desk, and reporting any potential security incidents to the IT team. 
4. Collaborate on security measures: Engage all employees in the development and implementation of cyber security measures, as they may have insights into specific risks or vulnerabilities in their area of work. 
5. Test employee readiness: Regularly test the effectiveness of your engagement and training program by conducting simulated phishing exercises or other security awareness tests.

Asset Management

Asset management refers to the importance of understanding and managing the systems, data, and other assets that your organization relies on, in order to effectively protect them from cyber threats. 

1. Identify and inventory assets: Start by identifying all of the systems and data assets in your organization, and creating an inventory of these assets. This should include information on their location, criticality, and the business processes they support. 
2. Classify assets by sensitivity: Classify your assets based on their level of sensitivity, and use this information to determine the level of protection they require. 
3. Implement access controls: Use access controls, such as passwords or two-factor authentication, to restrict access to sensitive data and systems only to authorized users. 
4. Monitor assets for changes: Regularly monitor your assets for changes, such as software updates or configuration changes, that could introduce new security risks. 
5. Develop a plan for asset disposal: Develop a plan for disposing of assets, such as hard drives or other media, that may contain sensitive data. This plan should ensure that all data is securely wiped or destroyed before disposal.

Architecture and Configuration

Architecture and configuration refers to the importance of designing and maintaining your organization’s systems with security in mind, and ensuring that they are configured securely to prevent unauthorized access or data breaches. Here are some key elements of an architecture and configuration strategy for cyber security: 

1. Develop secure system architectures: Start by developing secure system architectures that follow best practices and industry standards. This could include using firewalls, segmentation, and other security controls to protect sensitive data. 
2. Securely configure systems: Ensure that all systems are configured securely to prevent unauthorized access or data breaches. This could involve disabling unnecessary services, closing unused ports, and implementing access controls. 
3. Maintain systems regularly: Regularly maintain and update your systems to ensure that they are protected against the latest threats. This could include installing security patches and updates, and monitoring system logs for suspicious activity. 
4. Manage privileged access: which have the ability to make changes to systems and access sensitive data. This could involve implementing two-factor authentication, and monitoring privileged accounts for unusual activity. 
5. Conduct regular security assessments: such as penetration testing and vulnerability scans, to identify any potential security weaknesses in your systems.

Vulnerability Management

Vulnerability management refers to the importance of identifying, assessing, and managing vulnerabilities in your organization’s systems and software throughout their lifecycle. Here are some key elements of a vulnerability management strategy for cyber security: 

1. Identify vulnerabilities: Use automated tools, such as vulnerability scanners, to identify vulnerabilities in your organization’s systems and software. 
2. Prioritize vulnerabilities: Prioritize vulnerabilities based on their severity and potential impact, and address the most critical vulnerabilities first. Mitigate vulnerabilities: Develop and implement a plan to mitigate identified vulnerabilities, such as applying security patches or implementing other security controls. 
3. Monitor for new vulnerabilities: Regularly monitor for new vulnerabilities in your systems and software, and take action to mitigate any newly discovered vulnerabilities. 
4. Conduct regular vulnerability assessments: Conduct regular vulnerability assessments, such as penetration testing, to proactively identify potential vulnerabilities before they can be exploited by attackers. 
5. Develop a vulnerability management policy: Develop a formal policy for vulnerability management that outlines the process for identifying, assessing, and mitigating vulnerabilities in your organization’s systems and software.

Identity and Access management

Identity and access management refers to the importance of controlling who and what can access your organization’s systems and data. Here are some key elements of an identity and access management strategy for cyber security: 

1. Manage user identities: Manage user identities and access permissions using a formal identity and access management (IAM) system. This can include multi-factor authentication, password policies, and role-based access control. 
2. Monitor for unusual activity: Monitor user activity on your systems and data, and proactively investigate any unusual activity that could indicate a security breach. 
3. Limit user privileges: Limit the privileges of users to only those resources and data that they need to perform their job functions. This can help minimize the impact of a security breach. 
4. Implement access controls: Implement access controls, such as firewalls and intrusion prevention systems, to prevent unauthorized access to your organization’s systems and data. 
5. Regularly review access privileges: Regularly review user access privileges and revoke access for any users who no longer require access to your organization’s systems and data. 
6. Train users on security best practices: Provide regular training to users on security best practices, such as password hygiene and how to recognize and report suspicious activity.

Data Security

Data security refers to the importance of protecting your organization’s data, which is often a prime target for cyber attackers. Here are some key elements of a data security strategy for cyber security: 

1. Encrypt sensitive data: Use encryption to protect sensitive data, such as personally identifiable information, both at rest and in transit. 
2. Use strong authentication: Implement strong authentication methods to protect against unauthorized access to your organization’s data. 
3. Backup data regularly: Regularly backup your organization’s data and store backups in a secure location, such as an offsite backup facility. 
4. Monitor for data exfiltration: Monitor for any data exfiltration attempts, which involve attackers attempting to steal sensitive data from your organization. 
5. Develop a data classification policy: Develop a data classification policy that outlines how data should be classified based on its sensitivity, and the level of protection it requires. 
6. Manage data access: Control and monitor access to sensitive data to ensure that it is only accessible by authorized personnel who require it to perform their job functions.

Logging and Monitoring

The eighth checklist to securing a system according to the National Cyber Security Centre (NCSC) is logging and monitoring. This refers to the importance of designing your system to be able to detect and investigate security incidents. Here are some key elements of a logging and monitoring strategy for cyber security: 

1. Collect system logs: Collect logs from your organization’s systems, networks, and applications to provide visibility into the activity on your network. 
2. Monitor logs for unusual activity: Monitor logs for unusual or suspicious activity, which could indicate a security incident. 
3. Develop a security incident response plan: Develop a security incident response plan that outlines the steps to take in the event of a security incident. 
4. Train staff on incident response: Train staff on the incident response plan and provide regular training on incident response best practices. 
5. Use security information and event management (SIEM) tools: Use SIEM tools to aggregate and analyze logs from different sources, and identify potential security incidents. 
6. Regularly review incident response procedures: Regularly review and update incident response procedures to ensure that they remain effective and up-to-date.

Incident Management

The ninth checklist to securing a system according to the National Cyber Security Centre (NCSC) is incident management. This refers to the importance of planning in advance for how your organization will respond to cyber incidents. Here are some key elements of an incident management strategy for cyber security: 

1. Develop an incident response plan: Develop an incident response plan that outlines the steps to take in the event of a security incident. This plan should include procedures for identifying and containing the incident, assessing the impact, and restoring normal operations. 
2. Test the incident response plan: Test the incident response plan regularly to ensure that it remains effective and up-to-date. This could involve conducting simulations of potential security incidents to test the plan. 
3. Establish an incident response team: Establish a team of personnel who will be responsible for responding to security incidents, and ensure that they have the necessary training and resources to effectively respond to incidents. 
4. Define roles and responsibilities: Define the roles and responsibilities of personnel involved in incident response, and ensure that they understand their responsibilities. 
5. Establish communication protocols: Establish communication protocols for notifying relevant stakeholders, such as customers or regulatory agencies, in the event of a security incident. 
6. Conduct post-incident reviews: Conduct post-incident reviews to identify lessons learned and opportunities for improvement, and update the incident response plan accordingly.

Supply Chain Security

The tenth checklist to securing a system according to the National Cyber Security Centre (NCSC) is supply chain security. This refers to the importance of collaborating with your organization’s suppliers and partners to ensure that their cyber security measures are also effective. Here are some key elements of a supply chain security strategy for cyber security: 

1. Identify supply chain risks: Identify potential supply chain risks that could impact your organization’s cyber security. This could include third-party suppliers or vendors who have access to your organization’s data or systems. 
2. Conduct due diligence: Conduct due diligence on suppliers and partners to ensure that they have adequate cyber security measures in place. This could involve reviewing their security policies and procedures, as well as their incident response capabilities. 
3. Establish security requirements: Establish security requirements for suppliers and partners, and ensure that these requirements are included in any contracts or service level agreements. 
4. Monitor supply chain activity: Monitor supply chain activity for any unusual or suspicious behavior, and investigate any potential security incidents that may involve a supplier or partner. 
5. Provide training and awareness: Provide training and awareness to suppliers and partners on cyber security best practices, and ensure that they understand their roles and responsibilities in maintaining the security of your organization’s data and systems. 
6. Regularly review and update supply chain security measures: Regularly review and update supply chain security measures to ensure that they remain effective and up-to-date.