Corporate Security #1

Question 1

Note: Cyber Essential ‘the 5 Basic Requirements’ are also refered to as ….

Answer 1

the 5 Technical Controls’

Question 2

What are the 5 Cyber Essentials Basic Requirements?

Answer 2

1) Firewalls 2) Security Configurations 3) Security Update Management 4) User Access Control 5) Malware Protection

Question 3

The five Cyber Essentials Requirements (Firewall, etc) apply to all software/devices that do what 3 things?

Answer 3

1) Accept incoming connections from Internet 2) Establish outbound connections to Internet 3) Control the flow of data between devices and internet

Question 4

What is a Firewall?

Answer 4

A Firewall is a Network Security Device

Question 5

What does a Firewall do?

Answer 5

Firewalls block/allow traffic

Question 6

What is the Goal/Aim of a Firewall?

Answer 6

Make sure only necessary network services are accessed by the Internet

Question 7

A Firewall has three requirements. What is the first requirement, about a Firewall’s default behaviour?

Answer 7

By default, Firewalls block all inbound connections

Question 8

A Firewall has three requirements. What is the second requirement, about a Firewall’s inbound connection rules?

Answer 8

Every inbound rule that accepts connections must be motivated and documented

Question 9

A Firewall has three requirements. What is the third requirement, about uneccessary Firewall rules?

Answer 9

Remove or disable Firewall rules when they’re not needed

Question 10

What is Secure Configuration?

Answer 10

A set of best practices for the configuration of computers/devices

Question 11

What is the first Goal/Aim of Secure Configuration, about network device vulnerabilites?

Answer 11

Ensure that network devices are properly configured to reduce vulnerabilities

Question 12

What is the second Goal/Aim of Secure Configuration, about network device services?

Answer 12

Ensure that network devices are properly configured to only offer the services required of their role

Question 13

Secure Configuration has 4 requirements. What is the first requirement, about unnecessary software?

Answer 13

Remove or disable unnecessary software

Question 14

Secure Configuration has 4 requirements. What is the second requirement, about auto-run?

Answer 14

Disable auto-run features

Question 15

Secure Configuration has 4 requirements. What is the third requirement, about passwords?

Answer 15

Change guessable passwords

Question 16

Secure Configuration has 4 requirements. What is the fourth requirement, about authentication?

Answer 16

Authenticate users before granting access

Question 17

What is Security Update Management?

Answer 17

A set of best practices for the maintenance and update of software

Question 18

What is the Aim of Security Update Management?

Answer 18

Ensure that devices and software are not vulnerable to known security issues that have patches available

Question 19

Security Update Management has 3 requirements. What is the first requirement, about software licensing?

Answer 19

All software must be licensed or removed

Question 20

Security Update Management has 3 requirements. What is the second requirement, about automatic updates?

Answer 20

Have automatic software updates enabled where possible

Question 21

Security Update Management has 3 requirements. What is the third requirement, about when to apply updates?

Answer 21

Make sure updates are applied (manually, if required) within 14 days of release

Question 22

What is User access control?

Answer 22

A set of processes to manage accounts

Question 23

What is the Aim of User access control?

Answer 23

Ensure that user accounts are assigned to authorised people only, and provide access only to the things the user needs to carry out their role

Question 24

User access control has 3 requirements. What is the first requirement, about removing accounts?

Answer 24

Remove/disable accounts when no longer required

Question 25

User access control has 3 requirements. What is the second requirement, about removing privileges?

Answer 25

Remove/disable special access privileges when no longer required

Question 26

User access control has 3 requirements. What is the third requirement, about administrative accounts?

Answer 26

Use separate accounts to perform administrative activities only

Question 27

What is the Aim of Malware Protection?

Answer 27

To restrict execution of known malware and untrusted software, from causing damage or accessing data

Question 28

What does Malware Protection do?

Answer 28

Verify if software is malicious

Question 29

Malware Protection has two listed requirements for each device. What is the first requirement?

Answer 29

Anti-malware software

Question 30

What is the second requirement for Malware Protection, about applications?

Answer 30

Application whitelisting: only approved applications are allowed to execute on devices