Beyond Cyber Essentials: securing critical operations

The Cyber Essentials (CE) scheme is designed to protect an organisation from up to 80% of the most common internet-born threats. It covers a broad spectrum of common cyber attacks by looking at five elemental technical controls: Firewalls, Secure Configuration, Passwords, Malware Protection and Patch Management. Cyber Essentials is a valuable first step towards cyber security, and, along with penetration testing , I recommend that every business, charity, organisation, and other entity gets CE certification. However it is crucial to understand that it represents a foundational layer of starting best practices. It’s your start line, not your finish line.

Now it’s time I talk about risk. The risks faced by organisations dealing with critical infrastructure, public incident response, emergency services supply chain, or processing highly sensitive data, go far beyond the simple, common attack vectors that CE guards against. This means that CE has completed its mission of setting a good security baseline, but it is not commensurate with the actual security challenges faced by these higher-risk organisations.

The landscape of cyber threats is continuously evolving, with nation-state actors increasingly targeting Government and Gov-aligned entities, including supply chain partners. These actors often employ sophisticated tactics, techniques, and procedures (TTPs) that are specifically designed to bypass traditional, foundational security measures such as those defined in Cyber Essentials. To effectively detect and respond to these advanced threats promptly, a comprehensive security approach that incorporates a joined up layered defence strategy. A red team engagement is the best way for a security mature organisation to test their defences.

While achieving Cyber Essentials certification offers a baseline cyber security posture, solely aiming for "minimum compliance" can create significant vulnerabilities and expose your organisation to substantial risks. I advocate for a holistic approach that incorporates continuous monitoring that goes beyond this mindset. Implementing these measures not only enhances security but also fosters trust and resilience, ultimately empowering you to reduce the risks of a rapidly evolving threat landscape.