Cyber Security Report Cards

We use the Cyber Risk Profile as the basis for determining which categories of adversaries may target your organisation, then identify which attack methods they are likely to use. Characterising adversaries assists in prioritising a search for potential weaknesses in your systems or processes that could be exploited.

This checks whether your email servers are configured to send and receive emails in a secure manner. It also checks whether you have the appropriate countermeasures to stop cybercriminals sending emails purporting to come from your organisation.

We check your website is using the most recent standards to allow the public, your customers and other organisations to securely connect to you.

We'll undertake a scan of your website to identify misconfigurations, out of date software and common web application security risks.

This involves a check of selected devices to ensure:

• the Operating System is licenced, supported and appropriately updated;
• malware protection is installed, active and receiving updates;
• installed software is licenced, supported and appropriately updated;
• data is encrypted on the device, if possible;
• vulnerability patches have been applied where required; and
• administrative rights are not unnecessarily granted to normal users.

We can carry out these checks remotely with your assistance via video conferencing software.

IP address scans can reveal the services that have been made available to the public over the internet. Many of these services are innocuous and have been legitimately made public, but some services may have been inadvertently made accessible or made available in an insecure manner. The results will list all services publicly available so you can decide which of them ought to continue to be public and which need restricted access or updates.

The Internal Vulnerability Scan starts with an IP Address scan of your internal network, then takes this further by evaluating the software versions of services and identifying vulnerabilities including those exploitable by errors in configuration or where access is permitted using default credentials.

We review your policies, either the written copy or verbal confirmation of particular policies you have in place. This focusses on device management, information security, software updates, password policies, the induction process for new employees and deactivating accounts when someone leaves.

Many of our customers use the Security Report Card as a way to gain insight into how close they are to complying with Cyber Essentials requirements. The Elite package includes a full gap analysis highlighting where you may fall short of meeting this proscriptive standard. We will provide guidance on how to meet all five essential controls. Please note, the Gap Analysis cannot guarantee a pass of the Cyber Essentials assessment.