Action Item

If you own or rent servers which are housed on site or within a data centre, and you configure the hypervisor software to create virtual machines, you will need to apply the Cyber Essentials controls to the servers and hypervisors. A hypervisor is software and this means you need to keep it licenced, updated and patched.

Action Item

For some larger organisations, there is a concern that some software updates may stop other software from working or cause some features to break. Most IT teams in larger organisations aim to fully test each update on a controlled sample of devices, before applying it company wide.

Action Item

Think about going through all the software / firmware used within your organisation and ensuring that it is all in support. This might seem like a lot of work, however, in many ransomware attacks out of support software is deliberately targeted by attackers as they know which vulnerabilities are there, and that they will not be fixed. By completing this piece of work, you can look at what software or firmware is not supported and create an action plan to either get software / firmware back into support or update to a more recent supported version.

Action Item

As part of your asset register, create a list of all the cloud services used within your organisation.

This might be Software as a Service (SaaS) for everyday tasks such as creating and sharing files, signing and sending contracts and project management. Examples are: Microsoft Office 365, Jira, Dropbox, Adobe Sign, Gmail.

Platform as a Service (PaaS) which would offer your organisation a platform for software development and deployment over the internet, enabling you to access up-to-date tools. Examples include Azure Web Apps and Amazon Web Services Lambda.

Infrastructure as a Service (IaaS) provides infrastructure components (servers, storage, networking hardware) that typically exist in an on-premises data centre. This can offer solutions for program development and testing, disaster recovery and backing up, hosting complex websites, high computing performance and big data analysis. Examples include Rackspace, Google Compute Engine, or Amazon EC2.

Action Item

As well as providing extra protection for passwords that are not protected by other technical controls, multi-factor authentication should always be used to provide additional protection to administrative accounts and user accounts that are accessible from the internet. No matter how an attacker acquires a password, if multi factor authentication is enabled, it will act as a safeguard on the account.

When you are setting up your cloud service account, you will be asked to set a password, this must have at least 8 or more characters. You must also enable MFA on your account, this means that in addition to the password, account holders will be asked to prove their identity with one or more other ways. This could be through a code sent to another device such as a text message to a mobile phone or a single use code generated by an authenticator app or physical token. There are four types of additional factor that may be considered for businesses:

• A managed/enterprise device
• An app on a trusted device
• A physically separate token
• A known or trusted account

Additional factors should be chosen so that they are usable and accessible. This may require user testing to verify if a factor is suitable for the users. For more information see NCSC's guidance on MFA

Action Item

In its simplest terms, a shared responsibility model denotes that providers are responsible for the physical security and hardware infrastructure of the cloud service and customers are responsible for securing the data they put in the cloud. Depending on the type of deployment—IaaS, PaaS, or SaaS—customer responsibilities will be different.

The major cloud service providers publish 'Shared responsibility models' such as Microsoft, Amazon Web services (AWS). The less well-known cloud service providers may not have a published model, in this instance check the contract in place with the provider or contact them directly to discuss. It is important for you to know what aspects of security you are responsible for and what aspects the provider has in place.

Action Item

Do you have a username and favourite password combination that you tend to use on most of your accounts to make life easier? If just one of your accounts becomes compromised (and you might never know) your username/ password combination can be stolen. Attackers have lists of compromised username/passwords combinations and this enables them to try and access any account where that combination works. If you use different passwords for different systems, one compromised password does not mean that attackers can then get onto all your systems.

Action Item

A password policy must detail the process for creating passwords for all work accounts. A password for a work account must include one of the following:

• Using multi-factor authentication
• A minimum password length of at least 12 characters, with no maximum length restrictions
• A minimum password length of at least 8 characters, with no maximum length restrictions and use automatic blocking of common passwords using a *deny list.

*An automatic deny list will block users from using passwords that are on a pre-configured list of common passwords that have been breached. Organisations can create a deny list from a file of the 100,000 most commonly breached passwords compiled by the NCSC.



• There is an established process to change passwords promptly if the applicant knows or suspects the password or account has been compromised.

Action Item

The following ways can help your employees create more secure passwords:

• Educating people on how to avoid common or discoverable passwords, such as a pet's name, common keyboard patterns or passwords they have used elsewhere. This could include teaching people to use the password generator feature built into some password managers.
• Encouraging people to choose longer passwords. This can be done by promoting the use of multiple words (a minimum of three) to create a password, (e.g., 'Three Random Words')
• Providing usable secure storage for passwords (for example a password manager or secure locked cabinet) with clear information about how and when it can be used.
• Not enforcing regular password expiry
• Not enforcing password complexity requirements

Action Item

Brute force attacks use computers to target a login page where they try many different combinations of characters until the correct combination is found to crack the password. Depending on the length and complexity of the password, cracking it can take anywhere from a few seconds to many years.

Using a long password is a good way to protect your data from a brute-force attack. A password that is created by a password manager or three random words can be used to achieve this.

By implementing at least one of the following measures can help protect your passwords against brute-force password guessing:

• Using multi-factor authentication
• 'Throttling' the rate of attempts. This means the time the user must wait between attempts increases with each unsuccessful attempt. This should permit no more than 10 guesses in 5 minutes.
• Locking accounts after no more than 10 unsuccessful attempts

Action Item

Staff should have separate user accounts if they are expected to perform both administrative and routine functions and they should log in with their standard user accounts for day-to-day tasks. Administrator accounts should be used only to install or modify software and to change system settings. It is often necessary to use a combination of policy and staff training to achieve this requirement.