10 Steps to Cyber Security

Keep your systems updated

• Enable automatic updates for operating systems and software where practicable. Limit the impact of problematic updates by staggering updates and have a rollback strategy available.
• Make use of managed services, such as Software as a Service solutions, from vendors with a proven track record of keeping their services updated to reduce your management burden.
• Monitor the update status of your devices and understand when updates may fail. For example, if the device needs to be connected to Wi-Fi, connected to power, powered on at a specific time of day, requires sufficient storage, isn't too far out of date, and/or requires a manual restart.
• Ensure all systems have a software update strategy. For devices that are not automatically updated, this should detail how and when updates get applied, and who is responsible for doing and checking the updates. The strategy should account for system availability requirements and relevant dependencies, while aiming to minimise the length of time before updates are applied.
• Use software products which are supported by the vendor and ensure plans are made to migrate from older products as the end of their support period approaches. After these dates, there will be no security updates published for these products, and you will need an alternative approach to managing these types of vulnerabilities.

Develop a vulnerability management process

• Establish a vulnerability management process that helps you gain an up-to-date understanding of vulnerabilities within your estate. Use this process to identify failed security updates and vulnerabilities that are not straightforward to fix so that they can be assessed at the earliest opportunity (and any necessary remedial work planned).
• Use of automated vulnerability scanning systems to help identify and assess vulnerabilities while keeping pace with new and evolving threats. Use your asset management process to identify what needs scanning, including software, infrastructure and exposed application interfaces. Your choice of scanning solution will depend on a range of factors, including types of assets, your deployment options and possible disruptive effects. Software asset management suites can help check software update statuses, however they might not check software libraries and dependencies.
• Triage vulnerabilities so you have a clear idea of the severity, risk of exploitation and the impact to your organisation, and decide which ones need fixing based on business risk. Refer to the vendor’s vulnerability advisory information as this will be the most accurate and up-to-date. However, it must be contextualised to your environment; for example, a remote code execution vulnerability may be more serious on an externally facing system than an internal one.
• Prioritise fixing vulnerabilities and put in place alternative mitigations for those which are more difficult to fix. Consider the risk of exploitation alongside the costs and practicalities of mitigating them. Ensure any unmitigated vulnerabilities are well-managed, and resultant risks captured in a risk register.
• Use manual testing methods (for example penetration testing or red team exercises) in addition to automated tools. These methods simulate attacker behaviours to find vulnerabilities and prove that they can be exploited. This can provide a more accurate, point-in-time, assessment of how secure your systems are, and can also help give you confidence that your automated scanning tools are not missing important vulnerabilities.

Manage legacy equipment

• Where it isn't possible to upgrade high risk devices and systems, ensure unsupported systems are properly segregated from the rest of the network, and apply other appropriate controls to reduce the likelihood and impact of compromise. See our guidance on Obsolete products for more information.
• When running obsolete software it is especially important to ensure an effective and proactive security monitoring capability is in place, and that action is taken based on events detected.
• Finally, even if one component of a system is obsolete, always continue to update and patch the other components of the system. For example, continue to update browsers and anti-malware products, even if the underlying operating system no longer receives updates.

Vulnerability management

Guidance to help organisations assess and prioritise vulnerabilities.

Keeping devices and software up to date

Advice for individuals and organisations on keeping software on smartphones, tablets, laptops and desktop PCs up to date.

Obsolete products

Reducing the risks from using out of date smartphones, tablets, laptops, desktop PCs, appliances or software applications.