UK businesses have experienced a sharp increase in cyber incidents over the past several years. In 2022, 39% of UK businesses reported having experienced a cyber attack, according to the government\u2019s Cyber Security Breaches Survey of 2022<\/a>.<\/p>\n\n\n\n
The most common offender by far was phishing, followed by more sophisticated security breach methods such as ransomware, malware, and denial of service. The UK government responded by increasing its list of security controls for Cyber Essentials Plus in early 2022<\/a>.\u00a0<\/p>\n\n\n\n
The recommended security framework for UK businesses now includes standards for multi-factor authentication (MFA), mobile device management (MDM)<\/a>, cloud systems, and Bring Your Own Device (BYOD)<\/a>, among other cybersecurity best practices. <\/p>\n\n\n\n
<\/p>\n\n\n\n
Meeting compliance requirements for Cyber Essentials Plus isn\u2019t as complex as it may initially seem. With the right tools and systems in place, IT admins can breeze through most checklist items fairly quickly. <\/p>\n\n\n\n
Keep reading to learn how to complete and document your organisation\u2019s Cyber Essentials Plus requirements with less stress.<\/p>\n\n\n\n
Cyber Essentials Plus is a government-backed data security framework designed to provide organisations with a strong defense against cybercrime. <\/p>\n\n\n\n
The National Cyber Security Center (NCSC)<\/a> and the IASME Consortium<\/a> worked in partnership to develop the latest security recommendations included within the Cyber Essentials framework<\/a>. <\/p>\n\n\n\n
Cyber Essentials Plus is the more stringent version of Cyber Essentials; the latter includes a lightweight self-assessment and internal vulnerability scan. <\/p>\n\n\n\n
Cyber Essentials Plus, on the other hand, requires an additional technical audit of in-scope systems, an on-site or remote assessment, internal vulnerability scans, and an external vulnerability scan conducted by the certification body. <\/p>\n\n\n\n
The internal scan is set up to check patches and system configurations. Security and anti-malware tests ensure your organisation\u2019s systems are resistant to malicious email attachments and web-downloadable binaries. <\/p>\n\n\n\n
And, finally, the external scan verifies patches and system configurations for public-facing infrastructure.<\/p>\n\n\n\n
Following the Cyber Essentials Plus security framework is crucial for any organisation wanting to avoid security breaches and safeguard stakeholder data. Here are the most common reasons businesses choose to achieve Cyber <\/p>\n\n\n\n
Essentials Plus certification:<\/p>\n\n\n\n
According to the Gauntlet Group<\/a>, many insurers have \u201clost an appetite to insure cyber risks and have withdrawn from the market. Some have chosen to tighten up policy wordings, or not cover certain cyber scenarios such as social engineering, or insist on the insured having much higher levels of cyber security protection in place.\u201d<\/p>\n\n\n
As reported by Fitch Ratings<\/a>, premiums increased a record 34% in Q4 2021 alone and standalone cyber coverage policies increased in price by 92% across the year. <\/p>\n\n\n\n
\n The IT Manager\u2019s Guide to Data Compliance Hygiene <\/p>\n
\n How to ace your audit <\/p>\n <\/div>\n
The Cyber Essentials Plus assessment includes a total of 32 data compliance requirements. Find a tool capable of checking off as many boxes as possible, and you will dramatically cut your compliance preparation time. <\/p>\n\n\n\n
This is where the JumpCloud Directory Platform comes into play. JumpCloud can assist IT managers with 20 of the 32 requirements as shown below. In most instances, the requirements JumpCloud cannot help with involve simple actions that don\u2019t require a toolkit.<\/p>\n\n\n
<\/p>\n\n\n\n
JumpCloud includes capabilities for overseeing hardware devices, software\/firmware updates, secure configurations, password management, malware protection, and identity and access management. <\/p>\n\n\n\n
Some of the Cyber Essentials Plus Element Checks it Can Simplify are:<\/p>\n\n\n\n
One of the simplest aspects of data compliance is maintaining a list of organisation-wide devices. If you don\u2019t already have a list you may need to consult with coworkers, check purchase requests\/receipts, and piece together every traceable device you can. <\/p>\n\n\n\n
Lost devices that contain proprietary information pose a significant security risk. <\/p>\n\n\n\n
The JumpCloud Directory Platform can assist in the creation of a Device List. Any workstation, mobile device, or server managed by JumpCloud will auto-populate in the Devices Section of the management console. Admins can then download the list as a CSV for auditing purposes.<\/p>\n\n\n\n
In addition to device lists, aim to always know which types of software and firmware are in use across departments. JumpCloud\u2019s System Insights feature makes it easy-peasy to determine which software has been installed on which devices. <\/p>\n\n\n\n
The platform automatically interrogates the device relative to software and allows it to be downloaded as a CSV. This functionality also extends to browser plugins, Chrome extensions, and Firefox add-ons.<\/p>\n\n\n\n
If you\u2019re subscribing to Infrastructure as a Service from a cloud service provider (e.g., Microsoft\u2019s Azure Virtual Desktop, Citrix managed desktops) you\u2019re responsible for applying the Cyber Essentials controls to the virtual environment you configure and use. <\/p>\n\n\n\n
This includes virtual desktops, virtual local area networks (VLANS) including virtual firewalls, and virtual Switches. Those who own or rent on-site servers will need to apply the Cyber Essentials controls to them. <\/p>\n\n\n\n
Translation: <\/strong>always keep everything licensed, updated, and patched. You can install the JumpCloud agent on AWS Servers, Azure Servers, and GCP servers for streamlined management and reporting. <\/p>\n\n\n\n
Ensure software is always up to date by turning on automatic updates on each of your company devices. This way patches will automatically be applied as they are released. Many devices now have automatic updates conveniently turned on by default. JumpCloud\u2019s OS patch management functionality allows for simple remote enforcement of all devices. <\/p>\n\n\n\n
Many larger organisations must consider that certain software updates can stop other software from working properly or cause features to break. If you fall into this category, aim to fully test each update on a controlled sample of devices, before applying it company-wide. <\/p>\n\n\n\n
Using JumpCloud, IT admins can seamlessly create an effective and practical plan to roll out OS patches, taking into consideration their organisation\u2019s and employees\u2019 time, resources, and needs. <\/p>\n\n\n\n
By defining and automating specific rollout schedules as needed for Windows, Mac, and Linux (Ubuntu) devices, manual work is practically eliminated. In addition, admins can customise notification settings to devices and access a Visibility Dashboard with fleet OS distribution and current OS release trains<\/p>\n\n\n\n
Cyber Essentials Plus requires admins to maintain a list of all the cloud services used within the organisation. This includes Software as a Service ( SaaS) for everyday tasks such as creating and sharing files, signing and sending contracts, and project management. <\/p>\n\n\n\n
Although JumpCloud can not audit what cloud services are being utilised within the organisation it can integrate with these services. Once completed JumpCloud can act as an inventory of cloud services used within the organisation, report on who is authorised to access them, and through directory insights provide a rich audit of who has accessed them.<\/p>\n\n\n\n
One of the major updates to the Cyber Security Plus 2022 protocols is the requirement for two-factor authentication, also known as multi-factor authentication. In addition to a username and password, users must provide a secondary for identification to access data. <\/p>\n\n\n\n
JumpCloud Conditional Access<\/a> policies make it easy to enforce MFA on cloud services using JumpCloud to protect Push, OTP, or WebAuthN such as touchID, Windows Hello, or FIDO2 keys. <\/p>\n\n\n\n
Review your devices with a view to removing services, software, or applications that are not required. This might include a server running a default web server that you don\u2019t use, additional accounts on some devices that are not required, or any additional software that you don\u2019t use.<\/p>\n\n\n\n
JumpCloud Policies and commands can be used to both report on and disable software running on devices that are not needed<\/p>\n\n\n\n
JumpCloud can assist in the auditing of user accounts on devices. If dormant accounts exist JumpCloud\u2019s commands functionality can be used to either disable or remove those accounts. Relative to cloud applications where supported user lifecycle management can be used for both provisioning and de-provisioning of accounts<\/p>\n\n\n\n
Auto-Run or Auto-Play is a setting that automatically runs software on a DVD or memory stick. It is important to disable Auto-Run or Auto-Play in order to avoid automatic installations of unauthorised software. <\/p>\n\n\n\n
When Auto-Run or Auto-Play is disabled, the user is prompted to give permission every time before the software is allowed to run or play. Use JumpCloud policies to disable autorun\/autoplay on JumpCloud managed devices<\/p>\n\n\n\n
Unfortunately, company devices sometimes get lost, stolen, or misplaced. Setting a unique 6-character or more password, pin number, or biometric method to unlock devices minimises the risk of a breach in these situations. <\/p>\n\n\n\n
JumpCloud\u2019s iOS device management allows you to configure both corporate and personal devices with device locks. Android is coming soon. <\/p>\n\n\n\n
It\u2019s not difficult to find device default passwords with a quick internet search. Attackers sometimes use a default username and password combination to attempt a connection, even if the device is within your internal network. <\/p>\n\n\n\n
Simply by changing the default password (and username if possible), you have immediately made a hacker\u2019s job more difficult. JumpCloud user management ensures employees change default passwords at first login. <\/p>\n\n\n\n
JumpCloud MDM ensures no shared usernames and passwords exist. When shared usernames and passwords are unavoidable the JumpCloud password manager allows for the auto-creation of long complex passwords that can be securely shared between team members. <\/p>\n\n\n\n
The password manager also allows for the sharing of OTP codes giving JumpCloud users the unique ability to share both passwords and OTPs.<\/p>\n\n\n\n
A password policy must detail the process for creating passwords for all work<\/p>\n\n\n\n
accounts. A password for a work account must include one of the following:<\/p>\n\n\n\n
JumpCloud\u2019s password policy allows you to centrally configure a password policy that meets your requirements in terms of length, complexity, originality, and aging. <\/p>\n\n\n\n
Brute force attacks use computers to target a login page where hackers may try different character combinations until the correct combination is found to crack the password.<\/p>\n\n\n\n
Depending on the length and complexity of the password, cracking it can take anywhere from a few seconds to many years! Using a long and complicated password is a good way to protect your data from a brute-force attack. <\/p>\n\n\n\n
Use JumpCloud to implement MFA for SaaS apps, device login, LDAP, and radius-connected resources. A central configurable lockout policy further enhances protection against brute force attacks<\/p>\n\n\n\n
You can largely avoid the potential harm from malware by:<\/p>\n\n\n\n
Although JumpCloud is not an EDR product, the platform gives admins the option of denying and\/or allowing application access to devices. It\u2019s worth emphasising that both application whitelisting and blacklisting have their respective pros and cons. <\/p>\n\n\n\n
In addition, JumpCloud provides seamless integration with antimalware software. <\/p>\n\n\n\n
Consider whether a user account creation process would help your organisation. It might be that only once someone has signed their paperwork and received clearance (if appropriate) they are issued with a computer user account. <\/p>\n\n\n\n
JumpCloud streamlines the new user account process making it both easier and more secure for IT teams.<\/p>\n\n\n\n
Consider whether you could develop a movers, leavers, or joiners process. That means when someone joins your organisation, their account permissions are recorded and approved. Conversely, when they leave, their account is disabled (or removed).<\/p>\n\n\n\n
Use JumpCloud to improve user provisioning, de-provisioning, and modification. For example, a manager notifies the HR department that an employee just put in their 2-week notice. <\/p>\n\n\n\n
If the organisation has integrated the JumpCloud platform with its HCM system<\/a>, any changes made within the HCM will automatically carry over to the central directory and IT resources. <\/p>\n\n\n\n
Not only does this save time, but it improves organisational security by reducing identity sprawl and ensures the IT department always has the most recent employee information at their fingertips. <\/p>\n\n\n\n
JumpCloud\u2019s user account creation process can help your organisation build this process. Once someone has signed their paperwork and received clearance (if appropriate) they are issued with a computer user account. <\/p>\n\n\n\n
You can then create a set of rules around administrator accounts, clarify who has the administrator accounts, and ensure that these accounts were not used for emails and web browsing. <\/p>\n\n\n\n
Regular account activity is risky on an administrator account as any compromise can happen with a higher set of permissions, meaning there is potential for greater harm to your System.<\/p>\n\n\n\n
JumpCloud can be used in conjunction with a policy to centrally control what rights a user has on any device. Users can be easily switched from standard users to admins and back again centrally from the JumpCloud admin consoles<\/p>\n\n\n\n
Staff should have separate user accounts if they are expected to perform both administrative and routine functions and they should log in with their standard user accounts for day-to-day tasks.<\/p>\n\n\n\n
Administrator accounts should be used only to install or modify the software and to change system settings. It\u2019s often necessary to use a combination of policy and staff training to achieve this requirement. <\/p>\n\n\n\n
Use JumpCloud to ensure all user accounts are standard accounts and elevated to admin accounts when required. Click here to check out a complete CyberSecurity Plus checklist.<\/a><\/p>\n\n\n\n
Unifying your stack with JumpCloud simplifies the compliance process by relieving admins from tool sprawl overwhelm. The platform combines Linux, Windows, Mac, and iOS devices behind one pane of glass for convenient heterogeneous device management.
JumpCloud also handles patch management, multi-factor authentication (MFA), and several other crucial cybersecurity measures. Learn more about how much easier compliance can be<\/a> with the JumpCloud Directory platform.<\/p>\n","protected":false},"excerpt":{"rendered":"