Cyber Essentials - Secure Configuration

The Cyber Essentials control for secure configuration is one of the five technical controls that form the basis of the Cyber Essentials certification scheme. This control is designed to help organizations protect their systems and networks against common cyber threats by ensuring that their systems are configured in a secure manner.

The control for secure configuration includes several key components, such as:

  1. Configuring systems to use secure protocols: Organizations should configure their systems to use secure protocols such as HTTPS, SSH, and SFTP, instead of insecure protocols such as FTP or Telnet, which are easily compromised.
  2. Securing operating systems: Organizations should ensure that their operating systems are configured securely. This includes ensuring that all unnecessary services and ports are disabled, and that the latest security patches and updates are installed.
  3. Securing applications: Organizations should ensure that all applications installed on their systems are configured securely. This includes disabling any unnecessary features or services and applying the latest security patches and updates.
  4. Restricting access to administrator and privileged accounts: Organizations should restrict access to administrator and privileged accounts to only those who need it, and use strong authentication methods, such as Multi-factor Authentication.
  5. Regularly review and update configurations: Organizations should regularly review and update their system and network configurations to ensure that they are secure, updated and comply with the latest security best practices.

By implementing these controls and practices, organizations can meet the Cyber Essentials control for secure configuration and reduce the risk of common cyber threats. Organizations should also have a clear incident management process in place to address any vulnerabilities that cannot be patched, to minimize the risk of a successful attack.

It's also important to note that secure configuration is an ongoing process and systems need to be regularly monitored and updated to stay ahead of the latest security risks and threats.

More from our security wiki

Continuous learning for your organisation, our knowledge base to help you grow

Cyber Essentials Self Assessment: Password-Based Authentication
This security wiki provides guidelines for implementing password-based authentication practices within your organisation. Follow these recommendations to enhance the security of user accounts and protect against unauthorised access.
Cyber Essentials Self Assessment: Administrative Accounts
This security wiki provides guidelines for the proper management and control of administrative accounts within your organisation. Follow these recommendations to establish secure administrative account practices.
Cyber Essentials Self Assessment: Malware Protection
This security wiki provides guidelines for implementing malware protection measures across your organisation's devices. Follow these recommendations to safeguard your desktop computers, laptops, tablets, and mobile phones from malware threats.
Cyber Essentials Self Assessment: Security Update Management
This security wiki provides guidelines for effective security update management to ensure that your organisation's devices and software remain protected against known vulnerabilities. Follow the recommendations below to establish a robust security update management process.
Cyber Essentials Self Assessment: Device Locking
This security wiki provides guidelines for implementing device locking mechanisms to enhance the security of your organisation's devices. Follow the recommendations below to protect against unauthorised access to software and services.
Cyber Essentials Self Assessment: Secure Configuration
This security wiki provides guidelines for achieving secure configuration of devices and services within your organisation. Follow the recommendations below to minimise potential vulnerabilities and enhance the overall security posture.
Now we're partners, you have unlocked:
Threat reports
1 Vuln scan
Security Wiki
Templates
Cyber Essentials logoCyber Essentials logo
©Periculo
Your Security Partner