19 1106 Cisa CISA Cyber Essentials S508C
19 1106 Cisa CISA Cyber Essentials S508C
1
CYBER+INFRASTRUCTURE
Reducing your organization’s cyber risks requires a holistic approach - similar to the approach you would take
to address other operational risks. As with other risks, cyber risks can threaten:
YOUR ABILITY TO OPERATE / ACCESS INFO YOUR REPUTATION / CUSTOMER TRUST YOUR BOTTOM LINE YOUR ORGANIZATION’S SURVIVAL
Your awareness of the basics drives cybersecurity to be a major Your staff will often be your first line of defense, one that must Information is the life-blood of any business; it is often the most
part of your operational resilience strategy, and that strategy have - and continuously grow - the skills to practice and maintain valuable of a business’ intangible assets.
requires an investment of time and money. readiness against cybersecurity risks. Know where this information resides, know what applications and
Your investment drives actions and activities that build and networks store and process that information, and build security
sustain a culture of cybersecurity. into and around these.
Your Surroundings - The Digital Workplace Your Data - What the Business is Built On Your Actions Under Stress
Ensure only those who belong on your Make backups and avoid the loss of Limit damage and quicken restoration of
digital workplace have access information critical to operations normal operations
The authority and access you grant employees, managers, and Even the best security measures can be circumvented with a The strategy for responding to and recovering from compromise:
customers into your digital environment needs limits, just as those patient, sophisticated adversary. Learn to protect your information plan, prepare for, and conduct drills for cyberattacks as you would
set in the physical work environment do. where it is stored, processed, and transmitted. a fire. Make your reaction to cyberattacks and system failures an
Setting approved access privileges requires knowing who operates Have a contingency plan, which generally starts with being able to extension of your other business contingency plans.
on your systems and with what level of authorization and recover systems, networks, and data from known, accurate This requires having established procedures, trained staff, and
accountability. backups. knowing how - and to whom - to communicate during a crisis.
VOL.1 FALL 2019 CISA.gov/Cyber-Essentials For tech specs on building a Culture of Cyber Readiness, flip page
BOOTING UP
Things to Do First
Backup Data
Employ a backup solution that automatically
and continuously backs up critical data and
system configurations.
Multi-Factor Authentication
Require multi-factor authentication (MFA) for accessing
your systems whenever possible. MFA should be required
of all users, but start with privileged, administrative and
Patch & Update Management
Enable automatic updates whenever possible.
Replace unsupported operating systems, applica-
tions and hardware. Test and deploy patches quickly.
remote access users.
Yourself Your Staff Your Systems Your Surroundings Your Data Your Actions Under Stress
Drive cybersecurity strategy, Develop security awareness Protect critical assets Ensure only those who belong Make backups and avoid loss Limit damage and quicken
investment and culture and vigilance and applications on your digital workplace of info critical to operations restoration of normal
have access operations
Organizations living the culture have: Organizations living the culture have: Organizations living the culture have: Organizations living the culture have: Organizations living the culture have: Organizations living the culture have:
Lead investment in basic Leveraged basic cybersecurity Learned what is on their Learned who is on their Learned what information Lead development of an
cybersecurity. training to improve exposure network. Maintained invento- network. Maintained resides on their network. incident response and
to cybersecurity concepts, ries of hardware and software inventories of network Maintained inventories of disaster recovery plan
Determined how much of terminology and activities assets to know what is in-play connections (user accounts, critical or sensitive outlining roles and responsi-
their operations are associated with implementing and at-risk from attack. vendors, business partners, information. bilities. Test it often.
dependent on IT. cybersecurity best practices. etc.).
Leveraged automatic updates Established regular Leveraged business impact
Built a network of trusted Developed a culture of for all operating systems and Leveraged multi-factor automated backups and assessments to prioritize
relationships with sector awareness to encourage third-party software. authentication for all users, redundancies of key systems. resources and identify which
partners and government employees to make good starting with privileged, systems must be recovered
agencies for access to timely choices online. Implemented secure administrative and remote Learned how their data is first.
cyber threat information. configurations for all hard- access users. protected.
Learned about risks like ware and software assets. Learned who to call for help
Approached cyber as a phishing and business email Granted access and admin Leveraged malware (outside partners, vendors,
business risk. compromise. Removed unsupported or permissions based on protection capabilities. government / industry
unauthorized hardware and need-to-know and least responders,
Lead development of Identified available training software from systems. privilege. Leveraged protections for technical advisors and law
cybersecurity policies. resources through profession- backups, including physical enforcement).
al associations, academic Leveraged email and web Leveraged unique passwords security, encryption and
institutions, private sector and browser security settings to for all user accounts. offline copies. Lead development of an
government sources. protect against spoofed or internal reporting structure to
modified emails and Developed IT policies and Learned what is happening detect, communicate and
Maintained awareness of unsecured webpages. procedures addressing on their network. Managed contain attacks.
current events related to changes in user status network and perimeter
cybersecurity, using lessons- Created application integrity (transfers, termination, etc.). components, host and device Leveraged in-house
learned and reported events and whitelisting policies so components, data-at-rest and containment measures to
to remain vigilant against the that only approved software is in-transit, and user behavior limit the impact of cyber
current threat environment allowed to load and operate activities. incidents when they occur.
and agile to cybersecurity on their systems.
trends.
VOL.1 FALL 2019 Consistent with the NIST Cybersecurity Framework and other standards, these actions are the starting point to Cyber Readiness. To learn more, visit CISA.gov/Cyber-Essentials.