The cyber threats businesses are exposed to daily are:  diverse, rampant and only ever increase in potency.  The cost and complexity of most security vendors' services and technology are well beyond the small enterprise budget and are just for a large enterprise.
 
Netsafe IT uses tried and practical methods, technology and experience to give effective protection against today's cyber threats and reduce the risk of cyber attack-related costs in your business.

People

People are at the heart of cyber-security.  Without policies, controls and training your people may represent one of your biggest weaknesses and an easy target for cyber-criminals.  However, you can take control and turn them into one of your best cyber defences.
 
Netsafe IT provides practical and effective cyber-awareness training, bespoke in-person training or as continuous cyber-awareness training service with three pillars:
  1. Regular engaging training modules, most with a short quiz to all staff in the organisation, keep track of their results and generate regular reports for managers. Every new staff member is given an initial quiz to gauge their level of cyber awareness so the modules selected are not too easy or too hard, to increase their engagement.
  2. Phishing email simulations are sent at regular intervals, either created to be bespoke for the organisation or from a library of quality templates and record both click-through and credential entry to gauge how well your staff identify and resist phishing attacks.
  3. Custom training modules and policy documents can be added, with acceptance tracking and reporting

 

Technology

Using the right technology in the right places can reduce the risk of a security breach.  Netsafe IT can supply, configure and manage:

  • Enterprise-class firewalls, with inter-office and 'road warrior' VPNs using recognised open standards - Wireguard and OpenVPN
  • Enterprise-class email services from Microsoft or Google, and configure them to be secure based on current best practices, and review their configuration for you
  • Secure and segregated networking, separating groups of users and devices who should not share the same connections on your network - copiers and printers don't need access to security IP cameras that don't need access to the Internet etc
  • Secure Wi-Fi networks, so your staff do not share the same Wi-Fi with your visitors, and your visitors cannot reach or interact with other visitors' devices
  • Multi-factor authentication on critical accounts, like Microsoft365 email, Google Workspaces, Internet service providers, utilities, Amazon, etc

The technology and computers within your business must to be managed and regularly have their software updated.   Weaknesses regularly discovered by security professionals and cyber-criminals that must be systematically removed - before they're exploited by cyber-criminals. 

Netsafe IT can arrange ad-hoc and automated network scanning to discover every device connected on your network, and verify they are legitimately connected for a business related purpose, check any available updates and install those updates either manually or automatically (whenever possible). 

Policy & Process

The NCSC recommend simple steps for small business to protect themselves;
  1. Backup data - Think about how much you rely on your business-critical data, such as customer details, quotes and orders, and payment details.
  2. Protect against malware - Install and/or enable anti-virus software, avoid or prevent the installation of dodgy apps, keep software up to date, and restrict the use of USB drives.
  3. Keep portable devices safe - Enable password protection, make sure you can track lost/stolen devices and lock or wipe the data on them, don't connect to unknown Wi-Fi
  4. Passwords passwords passwords - Apply passwords to protect data, use 2-step verification on important accounts, use password management tools, change default passwords
  5. Avoid Phishing attacks - train people to spot a phishing email, create a no-blame culture and encourage reporting phishing attacks, consider and control public information used by attackers to create more convincing phishing messages.

Medium and larger businesses are advised to follow NCSC guidance on how to protect against cyber threats:

10 Steps to Cyber Security:

  1. Risk Management
  2. Engagement and Training
  3. Asset Management
  4. Architecture and Configuration
  5. Vulnerability Management
  6. Identity and Access Management
  7. Data Security
  8. Logging and Monitoring
  9. Incident Management
  10. Supply Chain Security

Frameworks

Cyber Essentials is an effective, Government backed scheme that will help you to protect your organisation, whatever its size, against a whole range of the most common cyber attacks.  More details are found at the UK government National Cyber Security Centre here: https://www.ncsc.gov.uk/cyberessentials/overview

Why should you get Cyber Essentials?

Cyber Essentials logoCertified cyber security!

  • Reassure customers that you are working to secure your IT against cyber attack
  • Attract new business with the promise you have cyber security measures in place
  • You have a clear picture of your organisation's cyber security level
  • Some Government contracts require Cyber Essentials certification

Netsafe IT will make it easy for you to implement and document the 5 required controls, make the changes required with you and prepare you for the application for Cyber Essentials.

What are the five controls?

1) Firewalls

Firewalls prevent intruders connecting to your internal business network but do allow authorised people and external services, such as a virtual private network, to connect.  Firewalls can also limit outgoing connections to approved destinations depending on the type of connection - for example they can allow website access to those with a good reputation, but block those known to be part of cyber-criminal activities.  Naturally firewalls must be correctly configured and maintained, and at regular intervals they should also be tested to check they are effectively doing what was intended without unintended consequences.

There is a very wide range of firewall products available with diverse capabilities, ranging from low cost but basic to sophisticated and very high cost.

2) Secure configuration

Many IT services have default configurations that are insecure to make them easier to implement and use, which must not be allowed to persist in your business.  The defaults can allow cyber criminals to access and act on your business IT in direct or indirect ways that could become very damaging for your business.  A ruthless process of checking every configuration items of every device to eliminate unnecessary functionality and control access and use is important.

Whenever new IT services are added with the policy to permit only the minimum workable set of IT services and resources to avoid unnecessary complexity and configuration.

3) User access control

Knowing who has access to what is a step to granting access only to the minimum set of resources needed for a person's role and preventing access to everything else.  At regular intervals, the access each person has should be checked and verified - checking if access remains appropriate and removing access no longer required. 

Whenever staff change their role (new staff join the business, for internal moves and as they leave) the access granted or removed should match the needs to perform their role, and closing down access when someone leaves (even temporarily).  Contractor and supplier (support) access is is most cases temporary, so they should have expired access set to be temporary too.

4) Malware protection

Virus and malware protection is a basic requirement that can be simple to put in to place but must not be underestimated.  Free Anti-malware is occasionally good quality, but not often so.  Picking a trusted malware protection product and maintaining the configuration is very important.  As well as having anti-malware service it should be considered that a successful malware attack is a certainty - and planning the response (before it happens) time well spent.  Who is controlling the response and who will act to provide the response, who needs to be informed, when will information updates be provided - how will customers be contacted?

5) Patch management

All IT devices, computers and appliances need to be managed - available software patches installed in a short time frame (within 2 weeks).  Best practice is to check for weaknesses using a vulnerability scanning service, such as by specialist vendors like Qualsys, Tenable and Rapid7, and remove critical and important security issues by patching to remove the weakness or, if that is not possible, isolating the devices to limit the scope of an exploited weakness.