Cyber Essentials Webinar Transcript

1
00:00:05.240 --> 00:00:09.980
Bryn Morgan: Good morning, everybody just waiting for others to arrive, and we'll start very shortly.

2
00:00:24.450 --> 00:00:26.589
Bryn Morgan: Just some people ticking up. Now.

3
00:00:40.180 --> 00:01:07.130
Bryn Morgan: All right, we've moved over to 10 0 2. So in the interest of time, I'll get us started. So a very warm welcome to everybody, to our latest Webinar. Thanks for your time appreciate you coming. So just a little bit of scene settings. So cyber security is a key consideration for any company, and especially within financial services. In companies where there's a lot of regulation, a lot of compliance to consider, and obviously a lot of kind of client contact where they have these interests in cyber as well.

4
00:01:07.524 --> 00:01:25.510
Bryn Morgan: One thing that we seem to change within cyber is that it's being viewed kind of more importantly in the business, and it's got a lot more board visibility. There's also a great understanding that cyber security is not just about technology. And it's also about your processes, your controls, and how well your users are trained.

5
00:01:25.876 --> 00:01:42.050
Bryn Morgan: So today, we've got a session on cyber essentials as a concept what it is, why, it's important and what it means for your organization. And then some hints and tips around how you can get that that certification, or or what needs to be done to get the certification. We've got a managing director, Henry, who will kick us off with some

6
00:01:42.329 --> 00:02:02.740
Bryn Morgan: fundamentals around this, the drivers behind it. What is important to you. And then one of our experience security engineers, Harry, Earl, will explain things in a bit more detail. Take you through how certification works and give you some hints and tips around what you need to think about and what really certification looks like in terms of your organization, from a kind of technology and processes point of view.

7
00:02:03.112 --> 00:02:26.560
Bryn Morgan: If you've got any questions you'll see a Q&A button at the bottom. Please feel free to hit this at any time. Put your question in. These will be asked anonymously at the end, so please feel free to ask anything. We'll also run a poll at the end, we'd love you to participate again, that's all anonymized, so you know. Please feel free to be honest and truthful across that. So without any further ado. I'm going to pass over to you, Henry.

8
00:02:27.860 --> 00:02:29.920
Henry Duncombe: Great thanks. Bryn. Morning. Everyone.

9
00:02:30.640 --> 00:02:32.669
Henry Duncombe: Just go to the 1st slide, please, Harry.

10
00:02:34.070 --> 00:02:56.949
Henry Duncombe: Yeah. So I'm going to talk a little bit about the history and growth of cyber essentials in financial services. And why more and more financial firms are looking to adopt it. But before I do that I thought I'd briefly explain a very high, level kind of what it is in terms of a concept. And then Harry can go a lot more into the detail of how it works and how you can adopt it. So

11
00:02:56.950 --> 00:03:16.070
Henry Duncombe: I think a nice way I like to think about cyber essentials is it's 1 good answer to one of Lamware's classic interview questions. So imagine you've come into landware and you're being interviewed for a position within our security team. And you get asked this simple question.

12
00:03:16.070 --> 00:03:23.209
Henry Duncombe: tell me the basic security controls. Every business should have seems like a simple question.

13
00:03:23.290 --> 00:03:34.619
Henry Duncombe: but with cybersecurity, being such a huge set of technologies, practices and approaches, you know, trying to distill this down into the basics which every business should have

14
00:03:34.630 --> 00:03:56.769
Henry Duncombe: is actually quite difficult. So if you you know, you turn the clock back 10 years. As we all moved more and more online, the Uk Government, in partnership with the National Cyber Security Center effectively looked to answer this question and create a standard, a standard which firms could adopt and get certified in

15
00:03:56.770 --> 00:04:09.299
Henry Duncombe: to protect their businesses from the most common cyber threats, and also for those businesses to be able to demonstrate to the outside world their commitment to cyber security.

16
00:04:09.676 --> 00:04:13.870
Henry Duncombe: So a little bit more on the history. If we go to the next slide, please, Harry.

17
00:04:16.800 --> 00:04:31.109
Henry Duncombe: So server essentials is nothing new. So why are we talking about this now? You know it's been around for for 10 years. You know, and during that time it seems steady growth. But that growth is accelerating.

18
00:04:31.110 --> 00:04:58.310
Henry Duncombe: There's been approximately 132,000 cyber essential certifications. And currently, there are about 40,000 businesses within the Uk that hold cyber essentials and about 10,000 that hold cyber essentials, plus. And Harry's going to describe the difference between the 2 shortly. There's been kind of significant development of cyber essentials in terms of certification over the last 10 years.

19
00:04:58.310 --> 00:05:15.379
Henry Duncombe: One of the kind of key milestones happened very early on in its life is when the Uk Government mandated, that if you wanted to do business in the public sector. You had to have cyber essentials, so that immediately, actually kick started a huge amount of adoption.

20
00:05:15.440 --> 00:05:44.629
Henry Duncombe: We've also had other developments on the way. But another one I've just picked out here is back in 2022. So when we had the pandemic, the shift to remote work, also an acceleration towards Cloud. The certification got a bit of an update to ensure that it could have supported all that, and that in turn, then spurred on further adoption. One of the interesting facts, though, is that financial services have been very late to the party in terms of cyber essentials.

21
00:05:44.630 --> 00:05:53.530
Henry Duncombe: and you know I kind of always thought that was actually quite strange. But the reality is that financial services have always had to invest in their cyber security.

22
00:05:53.530 --> 00:06:09.900
Henry Duncombe: due to the kind of the sense of information that they hold the tight regulations they're under. So I think historically, a lot of firms just certainly more established firms just saw it as another kind of piece of bureaucracy that they'd have to kind of.

23
00:06:10.070 --> 00:06:28.730
Henry Duncombe: they'd have to deliver to, so which they just want you need in their business, and many larger firms, I think, also elected, perhaps to go for the global information in standard in cyber security, which is Iso 27,001. So you turn the clock back. You know, financial services was actually only about 6%

24
00:06:28.730 --> 00:06:52.299
Henry Duncombe: of the kind of market for cyber essentials. And this has actually started to increase rapidly. They're up to 10% the last few years. And it's growing. Now, what are the reasons for this? You know? Well, obviously, cyber risks continue to climb. So financial firms are the most targeted, and they're looking for more and more ways to protect them.

25
00:06:52.300 --> 00:07:16.269
Henry Duncombe: That's the obvious one. The second one is interesting is it's the regulator. The regulator is more and more referring to the standards and advice and the frameworks of the National Cybersecurity Center as ways which financial services businesses should be achieving what they call a solid

26
00:07:16.270 --> 00:07:31.049
Henry Duncombe: foundation in cyber security. So more and more the Regulators, the Fca. Is kind of looking to the Ncaa and saying, Look, there's your solid foundation. Cyber essentials forms part of that. The final one is that financial firms are having to do more and more

27
00:07:31.190 --> 00:07:57.239
Henry Duncombe: to convince their clients and their prospect clients and their stakeholders that they are secure. And you know, and this is particularly true for new startups who don't have that kind of they don't have that brand and track record. So cyber essentials is a great way of helping you attract new business and really demonstrating to your prospect clients that you're a safe business to work with.

28
00:07:57.760 --> 00:08:02.650
Henry Duncombe: So let's just go on to my final slide before I then hand over to Harry.

29
00:08:02.820 --> 00:08:06.523
Henry Duncombe: So let's just talk a little bit about some of the

30
00:08:06.900 --> 00:08:13.752
Henry Duncombe: The business case for cyber essentials. So I've mentioned, you know.

31
00:08:14.380 --> 00:08:44.109
Henry Duncombe: It helps you attract and win new clients. It gives your prospect clients confidence that you're secure. They can entrust you with their data, and you're not a supply chain risk. So a supply chain risk. And this is something which is a growing risk is where cyber criminals will ultimately, instead of going after their end target. They will go after the suppliers, and that supplier could be you

32
00:08:44.110 --> 00:08:58.269
Henry Duncombe: ultimately. If you're doing business with your customers, they want to go after the customer. They'll come through you. So we're seeing lots and more of kind of supply chain risks and attacks, and it's a great way of giving your clients and prospect clients confidence that you're not going to be a risk to them.

33
00:08:58.450 --> 00:09:12.040
Henry Duncombe: Next one is simplicity. I've talked about. You know how confusing substitute can be because it's so broad, it's so many things. So it really distills it down into a simple set of security controls.

34
00:09:12.040 --> 00:09:40.899
Henry Duncombe: especially for smaller financial firms who don't have that in-house security expertise trying to work out what the basics look like getting them working consistencies. It's really difficult can be really confusing, and everyone likes standards because it forces everyone to speak the same language and follow the same approach. The next one is again a pretty obvious one, is protecting your business with more and more data breaches and attacks going on.

35
00:09:40.900 --> 00:10:03.759
Henry Duncombe: you know. They say, you know, with cyber essentials, you can kind of take care of kind of 90%, 95% of these threats by getting this in place, people who are going to go after you, and they want to get in, then they will. But most cyber attacks really are fairly unsophisticated, and you do not want to be opening yourselves up to those next one is interesting, was reduced insurance costs.

36
00:10:03.760 --> 00:10:23.819
Henry Duncombe: You can get reductions on your insurance premium something between 5 and even up to 20% off it. But on your insurance premiums, and, as we know, insurance premiums in terms of costs are only going in one direction as a result of the increased threat landscape. So everyone's keen to keep their insurance premiums down.

37
00:10:23.820 --> 00:10:39.269
Henry Duncombe: and the last one is a real Biggie I've mentioned before. It's about the regulation the Fca. Is telling firms to adopt the advice and practices from the National Cybersecurity center of which cyber essentials is just one of those along with

38
00:10:39.290 --> 00:10:52.349
Henry Duncombe: other frameworks, such as their 10 steps to cyber security to help them meet a solid foundation. So that's it from me. I'm going to hand over to Harry now who's going to tell you all about what it is how to adopt it.

39
00:10:53.140 --> 00:10:54.398
Harry Earle: Thank you very much, Henry.

40
00:10:55.100 --> 00:11:09.920
Harry Earle: Obviously, we've gone over the the challenges the businesses are facing, and what would actually lead them to undergo that accreditation. So what I'm going to be covering is is really exploring that journey of going under cyber essentials. And actually how you can start to achieve that for your organization.

41
00:11:11.190 --> 00:11:31.949
Harry Earle: So firstly, I want to go over what cyber essentials actually is. And that's to me. It's 2 distinct levels. Each offers a different level of assurance for your business. The 1st one is simply called cyber essentials, and it's a self attested questionnaire that you'll go through, and that will confirm that you've implemented those basic controls against your organization.

42
00:11:32.060 --> 00:11:35.779
Harry Earle: It requires a board member to be approving that submission.

43
00:11:35.840 --> 00:11:39.230
Harry Earle: and it's marked by a 3rd party assessor.

44
00:11:39.470 --> 00:11:44.340
Harry Earle: And I like to think of this really as a foundational layer of protection that you're putting against your business.

45
00:11:45.360 --> 00:11:53.990
Harry Earle: and you can't just get ahead of yourself and jump straight to the next level. Cyber essentials is required before going up to cyber essentials, plus which is the the second step.

46
00:11:54.230 --> 00:12:04.260
Harry Earle: and it's based on the same technical requirements. But what they actually introduce is those technical verifications against the question set that you've answered for cyber essentials.

47
00:12:04.840 --> 00:12:22.379
Harry Earle: I like to think of it as a two-step pathway and kind of building that baseline for your business, where you go through the questionnaire, you start to understand what you're doing for your business. And then you actually assure clients by doing the cyber essential plus that you've actually implemented. And you've tested against real world scenarios what you're doing.

48
00:12:23.780 --> 00:12:31.449
Harry Earle: We'll go into the specifics on the next page. But for now I just want to keep it in mind that really we think of Cyber Central as a bit of a journey that you're going to be going through.

49
00:12:33.480 --> 00:12:36.270
Harry Earle: So the key difference was between cyber essentials.

50
00:12:36.420 --> 00:12:38.179
Harry Earle: Both of them are yearly.

51
00:12:38.290 --> 00:12:48.900
Harry Earle: however, cyber essentials, plus is something that comes after cyber essentials. You have 90 days to do cyber essentials plus after you've reached your cyber essentials. Accreditation.

52
00:12:49.780 --> 00:12:55.919
Harry Earle: cyber essentials is self-attested, and it comes with a 3rd party review, meaning that you go through that questionnaire.

53
00:12:56.880 --> 00:13:05.050
Harry Earle: However, when you go to cyber essentials, plus, it comes with an external auditor coming into your organization and actually testing those controls that you've put into place.

54
00:13:05.410 --> 00:13:23.540
Harry Earle: And with cyber essentials, it allows you to have a few exclusions. So if you're not just right there, on a couple of points within the question set, you're allowed to exclude them and take those as what they like to call as major failures. However, when you move on to cyber essentials, plus, you're not allowed any exclusions at all. So you have to remediate those actions that you have in place

55
00:13:26.690 --> 00:13:35.069
Harry Earle: with cyber essentials. They like to lay a baseline down. And that's what they call their 5 core controls. So these are the

56
00:13:35.150 --> 00:13:40.009
Harry Earle: standards that they're going to have that will lay the foundation that you go through with your questionnaires.

57
00:13:40.850 --> 00:14:02.999
Harry Earle: Firstly, again, as I mentioned, both of the cyber centrals and cyber essentials plus are based on these 5 core controls with things like firewalls being in place, making sure that you have them within your office networks on your devices on your roaming laptops, making sure that they're configured in such a way as to not let threat actors come in to your business from it kind of externally

58
00:14:03.400 --> 00:14:14.189
Harry Earle: next up, that you have things like your malware protection. This will again make sure that you have things like your antiviruses installed on your machine, and that they're up to date, and that you're staying ahead of the the latest threats

59
00:14:15.060 --> 00:14:34.900
Harry Earle: next up, it's access control. It's securing access to your sensitive information coming into your business, and this is achieved by doing things like having multi-factor authentication on your accounts, making sure that you have a good, complex password policy, or that you're not sharing accounts across your organization to make sure that people aren't getting into your systems where they don't need to be

60
00:14:36.010 --> 00:14:49.009
Harry Earle: a big one. And this is something that we'll carry on with later. And it's something that people trip on. Quite a lot is security update management. And this really emphasizes the importance of making sure that your systems and your software stay up to date

61
00:14:49.460 --> 00:14:59.880
Harry Earle: a big area of this is making sure that you get the latest security patches on your machines within 14 days, if they are rated as a critical or high level of vulnerability to your systems.

62
00:15:00.330 --> 00:15:14.980
Harry Earle: And finally, it's it's having a secure configuration, which means that you're following established best practices and doing things like removing unnecessary software on your machines, disabling unnecessary features as well so to minimize any vulnerabilities that you might have in your systems.

63
00:15:18.220 --> 00:15:30.099
Harry Earle: So now that we've got a bit of an understanding of the core controls that you're going to be following for your organization. I really want to focus on how to actually start that journey and what the steps that you'll take as you go through cyber essentials and cyber essentials plus

64
00:15:30.930 --> 00:15:37.959
Harry Earle: the biggest area that you're going to be doing. And and this is a tough decision really is defining your scope.

65
00:15:38.130 --> 00:15:50.209
Harry Earle: Most organizations will want to go for the full scope, and that will cover all of your devices, all of your networks and all of your software, including things like cloud applications. And that really is the goal that people want to aim for.

66
00:15:50.450 --> 00:16:08.239
Harry Earle: However, there are situations where you might need to exclude specific areas, and that really comes down to having devices or software that are no longer in support. And you might need to segregate those inside of your organization so that they can't contact other areas of the network. And that will lower your scope if you need to.

67
00:16:09.250 --> 00:16:21.350
Harry Earle: Once you've done that step, the next area that you're going to go on to is performing that gap analysis against your organization and that can include looking at the, I asked me questionnaire. That's public on their website.

68
00:16:21.880 --> 00:16:25.109
Harry Earle: seeing what gaps that you have within your technical areas.

69
00:16:25.500 --> 00:16:38.990
Harry Earle: other things that you can also do, and these are widely published by the Isme and Ncsc. They have their own tools that you can use to to kind of get a readiness check. And and they're all kind of clear on their website of the boundaries that you need to start doing

70
00:16:40.180 --> 00:16:56.879
Harry Earle: once you've gone through that gap analysis. You've answered those questions, or you've at least kind of got an understanding of what you need to start doing for your organization. There's most likely going to be some level of remediation and some changes that you might need to do to your organization or setting up any exceptions for areas that you know you're not going to be able to reach.

71
00:16:58.130 --> 00:17:15.329
Harry Earle: This is probably going to be there that you spend the most time on. And this is the area that you kind of free to spend the most time on, as there's no real restriction in time limits here. So it's good to get a foundation. Set up everything that you need, and then move forward to the next step which is is going for your cyber essentials, questionnaire submission.

72
00:17:15.650 --> 00:17:35.900
Harry Earle: So typically, when you go for the cyber essentials, submission. What you'll do is you can either go through the Isme website, or you can specifically go to a certain Isme certified body going through the Isme website, you'll be assigned to a kind of a random company, or if you go to a specific company, then you'll be able to work with with them and them only

73
00:17:36.830 --> 00:17:50.750
Harry Earle: you'll submit the questionnaire, and they'll go through and review it, and and then they'll provide any feedback. If you failed, and if you do fail you'll have 2 days to resubmit, otherwise you'll have to go through that entire process again which potentially could occur some some costs.

74
00:17:52.630 --> 00:18:01.239
Harry Earle: Once you've done, you should then be awarded your certification, and what you'll have is 90 days to go on to the next step, which is is your cyber essentials plus

75
00:18:03.030 --> 00:18:12.419
Harry Earle: going on to your cyber essentials, plus obviously, if you have any exceptions that you outlined within cyber essentials. You will need to start getting rid of those exceptions.

76
00:18:13.070 --> 00:18:19.209
Harry Earle: That main main, a big, some big areas are kind of your round of Sas applications. But we'll we'll kind of touch on that a bit later.

77
00:18:20.150 --> 00:18:36.409
Harry Earle: The next step that you'll need to start doing is actually preparing your environment for that 3rd party assessment. This really involves going for things like installing a vulnerability scanner or providing the 3rd party assessor with access to your systems to perform those tests.

78
00:18:37.520 --> 00:18:59.440
Harry Earle: What they'll do here is they'll select around about 10% of your devices to cover a wide range of the operating systems within your environment. So let's say you have a number of windows, 11 devices. You have a handful of iphone devices and a handful of android devices. They might select 5 windows devices and 2 iphone devices and 2 android devices. And those are the ones that they're going to be performing those tests on.

79
00:18:59.830 --> 00:19:23.009
Harry Earle: It's really, really big to note here, though, that Byod, or bring your own device is in the scope. If you have email systems or other systems that you're going to be accessing. So please be aware that if you're going through these tests you will potentially be required to actually hand over access to your personal devices. So that's a big consideration that people have when they go for cyber essentials.

80
00:19:24.550 --> 00:19:27.430
Harry Earle: The test that they do against your

81
00:19:27.470 --> 00:19:50.760
Harry Earle: environment are things like an external vulnerability scan on your office locations, an internal scan on those sample devices that they've chosen, and observation based testing on things like your malware protection, your email protection, and every single one of your cloud services that you have listed and is within scope to ensure that they have things like multi-factor, authentication or account separation on those accounts.

82
00:19:51.620 --> 00:20:02.589
Harry Earle: Finally, again, once all of those tests have been done by the assessor, and they've came back, and you've given me feedback. If there's anything that you need to remediate again you should pass, and you should be given that certification.

83
00:20:05.530 --> 00:20:11.389
Harry Earle: So now that we've got an idea of the steps that we're going to be taking to actually go through that that accreditation.

84
00:20:11.640 --> 00:20:17.530
Harry Earle: We really want to go over some of the common pitfalls and failures that companies might encounter when they go through that process.

85
00:20:18.070 --> 00:20:22.530
Harry Earle: as mentioned earlier. And I touched upon unpacked software is one of the biggest ones

86
00:20:22.710 --> 00:20:36.130
Harry Earle: really getting that good vulnerability program. And that good patch management program in your organization is a massive step forward to getting cyber essentials, as you need to be patching those high risk and critical vulnerabilities within 14 days of those releases.

87
00:20:36.600 --> 00:20:47.810
Harry Earle: any outdated or unsupported software will be on automatic failure. And that's both for cyber essentials and cyber essentials plus. So it's really key to keep everything up to date as you go through the cyber essentials process.

88
00:20:48.690 --> 00:21:14.229
Harry Earle: Again, as I mentioned, bring your own devices that may be accessing company data have to have some level of mobile device management over them. You know, a big area that people move towards is technical controls like intune or many others out there, to kind of give you a level of app protection and segregate those applications on your systems to make sure that they're, you know, not able to exfiltrate company data, etcetera.

89
00:21:15.760 --> 00:21:35.110
Harry Earle: The final really major one is those Sas account controls. And this is an area that can trip up it teams as there's sometimes a level of shadow it that you have within your organizations. You know, if a department needs something to do their business. They need a Saas application. They might just go out and purchase that through the procurement team

90
00:21:35.110 --> 00:21:47.579
Harry Earle: they might not let the It team know, but every single application that is used across your entire business needs to have multi-factor authentication. And it needs to have account separation. That's a really, really big area that can trip people up

91
00:21:49.440 --> 00:22:06.150
Harry Earle: are there areas that people can trip up on or things like your firewall rules? You need to have good firewall rules across your servers. Some people think that you just need your physical firewall in your network, and they they neglect their servers, they neglect their devices, and they don't have that software-based firewall in their devices.

92
00:22:07.460 --> 00:22:30.470
Harry Earle: Another one is administrative rights. Again, a big thing that you need to have is a clear separation between your user and administrative count tasks. Again, that comes down to having non admin users, not needing an administrative account or administrative rights to those systems. And if you are an administrative user. You must have a separate account. And again, it has to have those stringent Mfa controls on them.

93
00:22:31.650 --> 00:22:55.429
Harry Earle: Email attachment rules is an area, especially in finance that people trip up on some of the things that they will test to. Things like Macro enabled documents, as they can often be used to deliver malware into your company again, things like Pdfs, making sure that there's strict scanning happening on those as they could have malicious software or vulnerabilities hidden inside them again on your email gateway are very, very important.

94
00:22:56.350 --> 00:23:03.019
Harry Earle: and the last one here is actually having a bit too much detail on your questionnaire. And this is something that people do trip up often on

95
00:23:03.170 --> 00:23:13.610
Harry Earle: a lot of the questions within. Cyber essentials are yes and no questions, and there are some that require detail. But if you do have a yes and no question, it's advised just to answer yes or no.

96
00:23:13.670 --> 00:23:23.269
Harry Earle: You have the option to provide more detail. If you need to outline specific requirements that you might have. However, that can add complexity, and it might trip you up or

97
00:23:23.290 --> 00:23:31.250
Harry Earle: extend the amount of time that you you go through questioning or having that answered. So that's that's an area that people definitely trip up on quite often.

98
00:23:34.400 --> 00:23:36.980
Harry Earle: So we've gone through. What cyber essentials is

99
00:23:37.140 --> 00:23:44.790
Harry Earle: what it involves and the journey that you can take, and some of the common pitfalls. But what can you actually start to do today to kickstart that process.

100
00:23:45.320 --> 00:24:06.569
Harry Earle: Well, firstly, as I mentioned earlier, the questionnaire is public and it's available on the Iasmi website. And it's a absolutely great place to start when you want to go and review your organization again. Understand those core requirements, understand the controls that are expected within the questionnaire and paint a bit of a clear picture on where your organization stands, and what areas that might need an attention.

101
00:24:07.570 --> 00:24:14.059
Harry Earle: The next one is really ensuring that your team has a clear assignment and a clear understanding of what they need to do.

102
00:24:14.210 --> 00:24:32.860
Harry Earle: making sure that you have a well documented roadmap for the changes that needed, and that everyone in the business understands the requirements. Because, again, one thing that I like to stress is it's not just an It initiative. It's a business wide initiative. Everyone needs to be involved with this, especially if you have a variety of tech or sas applications that you use across your business

103
00:24:33.810 --> 00:24:52.910
Harry Earle: ensuring leadership. Buy-in is another major one making sure that you have those top down decisions can make it much easier for your it team to implement the changes that they need and and really get that security control culture built into your organization so that people understand why you're making these decisions and how it can benefit your business.

104
00:24:53.930 --> 00:25:03.819
Harry Earle: The last one is really considering a readiness check. Again. As we mentioned, there are isme tools out there, or we, as landware as well, can assist with performing a readiness check on your systems.

105
00:25:03.840 --> 00:25:13.350
Harry Earle: And it's just to get an understanding of, you know, some areas that you might have issues with, or that you need to start addressing really early along in the process and not leaving it to last minute.

106
00:25:17.590 --> 00:25:44.669
Harry Earle: So you've gone through the cyber essentials journey. As we mentioned, it's not. It's about as a foundation. It's a baseline for your cyber kind of posture, you know. Things like cyber essentials and cyber essentials, plus are great to assure clients that you're doing the right steps as you go through this. But there are other security programs that we think would be great to mature your business things like having a good risk management strategy having security training for your staff members.

107
00:25:44.670 --> 00:26:04.260
Harry Earle: going over your policy and compliance management and starting to implement things like Iso 2, 7, 0 0 1, or implementing standards like the NIST. And again, this is all outlined within our Vcso service. So that again, these are things that we can start to help you with, to mature your business and really have a strong cyber security posture as you go on.

108
00:26:07.450 --> 00:26:09.759
Harry Earle: Now, if you're an existing landmark client.

109
00:26:09.830 --> 00:26:25.879
Harry Earle: You should already have a number of these controls in place, and these will help strengthen your business. So again, we have. We have your firewall standards in place. We have a robust firewall standard. We do have your managed detection and response systems in place. And we have our sock team that monitors, these systems.

110
00:26:25.880 --> 00:26:48.180
Harry Earle: Again, we have strong conditional access policies to keep your data secure. We have high frequency patching on both your servers, your desktops, and your 3rd party applications, and we have our finance forward. 3, 65, standard. That, again, is continually refined and updated to keep an established best practice. So if you are an existing client. We like to think of you as cyber central, ready

111
00:26:50.410 --> 00:27:10.749
Harry Earle: now, if you're not an existing landmark client, or if you're a new landmark client. Don't worry. These are still areas that we can help you with, or even these areas that you should get your current incumbent providers to start looking at, you know again, if there's any gaps or any areas that you need to look at, always remember the 5 core kind of controls that you need to be following.

112
00:27:14.040 --> 00:27:25.400
Harry Earle: So what can Landwey actually provide for you going through this process? So, as we have gone through again, we can follow that journey, and we can assist you with every step of that journey along the way.

113
00:27:25.400 --> 00:27:44.790
Harry Earle: so we can come into the business and help you with scoping support and outlining what kind of scope you want to have your business again. We can assist you with going through that questionnaire performing a gap. Analysis against your environment, helping provide any recommendations against the remediations, or even actually assisting with those technical remediations as well.

114
00:27:45.170 --> 00:28:03.350
Harry Earle: Another thing that we can help you with is is setting you up with the 3rd party, Iazme body and helping you go through that submission process in terms of actually answering those questions and getting that submission done with you, so we can act as a kind of intermediary between you to help you with any questions that they they might have as a 3rd party

115
00:28:04.010 --> 00:28:24.100
Harry Earle: again moving on to cyber essentials plus once you've received cyber essentials, we can help you with any exceptions that you have, we can start to assist you with preparing your environment, we can help you do the vulnerability scans. We can also do a pretest. So we can actually go through some of the areas that the assessor might go through as they do their

116
00:28:24.360 --> 00:28:25.719
Harry Earle: as they do their assessment.

117
00:28:26.490 --> 00:28:39.900
Harry Earle: And finally, again, we can help you actually get that assessment. So you know we can set you up with a 3rd party body, and we can be that kind of intermediary to help you with any questions or any remediations that they might have as they're going through that testing process.

118
00:28:41.380 --> 00:28:57.000
Harry Earle: So that's the journey that you can take for cyber essentials. We've gone through the 5 core controls. We've gone through the 2 levels, and we've gone through what you can start to doing today and how Lama can help you. So I'm going to pass you back to Henry. Now, who's, I believe, going to have a poll and and a bit of a Q&A as well.

119
00:28:59.980 --> 00:29:15.100
Bryn Morgan: Thanks, Harry. You're actually coming back to me. But thanks for that. It's very informative. I would encourage anybody who's got any questions that have come up from both what Henry and Harry have said to please use the Q&A at the bottom for now I'm just going to launch a poll.

120
00:29:15.676 --> 00:29:19.419
Bryn Morgan: It'd be really oh, sorry. Bear with me.

121
00:29:23.290 --> 00:29:35.370
Bryn Morgan: Okay, hopefully. You should be seeing some poll questions on your screen. Now? So number one, have you been asked by clients, potential clients, or your board? If you hold a cyber essentials, certification?

122
00:29:37.386 --> 00:29:43.929
Bryn Morgan: Number 2, what would be your primary driver for achieving cyber essentials, cyber essentials plus

123
00:29:48.180 --> 00:29:54.950
Bryn Morgan: and number 3. What priority would you give to gaining cyber essentials, cyber essentials, plus certification?

124
00:29:55.455 --> 00:29:58.209
Bryn Morgan: I'm just giving you a short while to answer those.

125
00:29:58.572 --> 00:30:03.510
Bryn Morgan: I'm expecting there'll be quite a broad amount of answers here. Across these.

126
00:30:04.160 --> 00:30:19.579
Bryn Morgan: And it'll give us some indication of where people are now, but also I think if we were to run this in the future we'd probably see something different, because, as Per Henry's point of view, we're seeing more and more people talking about this as a as a concept and as a certification.

127
00:30:19.980 --> 00:30:28.600
Henry Duncombe: I was gonna say, but you might on the poll sometimes need to scroll down in the window as well, just to see that 3rd question. Sometimes it depends how it comes up on your screen.

128
00:30:28.840 --> 00:30:29.260
Bryn Morgan: Yeah.

129
00:30:29.260 --> 00:30:34.097
Henry Duncombe: There are. There are 3 questions in that window. Just need to scroll down. Okay.

130
00:30:35.090 --> 00:30:38.910
Bryn Morgan: Yeah. So I think just as we're getting those polls, answered

131
00:30:39.020 --> 00:30:40.770
Bryn Morgan: surprisingly.

132
00:30:41.750 --> 00:30:54.019
Bryn Morgan: we are getting less. People have been asked around the certification. There's been 12 out of 14 not asked, and and 2 out of 14 asked. I don't know if any of my my panel have got anything to comment. There.

133
00:31:00.660 --> 00:31:02.269
Bryn Morgan: that surprise. You guys.

134
00:31:04.900 --> 00:31:15.069
Harry Earle: I think a little bit in in, you know, as more kind of companies are working with government for contracts, etc. You know you are required to have that.

135
00:31:15.100 --> 00:31:17.880
Harry Earle: And again down the supply chain. A lot of

136
00:31:17.990 --> 00:31:22.420
Harry Earle: kind of insurance providers are asking that to make sure that you're, you know, kind of

137
00:31:22.640 --> 00:31:29.860
Harry Earle: having that for your business, and you you have those core controls. So I would expect more people to have been at least asked about it, or kind of.

138
00:31:32.210 --> 00:31:39.709
Bryn Morgan: Thanks, Harry, and I'm just gonna launch the results for everybody. So I think we've got pretty much everybody who's answered. So just bear with me a second.

139
00:31:43.270 --> 00:31:46.120
Bryn Morgan: so you should be seeing the results on your screen now.

140
00:31:46.807 --> 00:31:48.892
Bryn Morgan: As I said at the start,

141
00:31:49.600 --> 00:31:57.290
Bryn Morgan: Less people than I thought would be nice around whether they got certification or not. But I do predict that will increase

142
00:31:57.807 --> 00:32:09.620
Bryn Morgan: when we look at the primary drivers. Regulation is is a very obvious one. We've got a few people saying that existing clients. So again, it's it's probably people within

143
00:32:09.650 --> 00:32:20.040
Bryn Morgan: the supply chain, you know you're part of their supply chain, or part of their client base or part of their supply base. Is a key one, but you know, as expected, all of the above

144
00:32:20.406 --> 00:32:22.140
Bryn Morgan: are getting a lot of

145
00:32:22.498 --> 00:32:28.209
Bryn Morgan: a lot of votes. I don't know if anyone else has any comments from a panel on that before I move to the 3rd

146
00:32:31.170 --> 00:32:33.550
Bryn Morgan: and yeah, priority

147
00:32:33.610 --> 00:32:36.590
Bryn Morgan: seems to be mixed between short term and longer term.

148
00:32:37.730 --> 00:33:03.039
Bryn Morgan: you know, I think. I think I think when we look at it, it depends on whether you're being asked about it. We've not very many people being asked around whether they've got the certification and possibly push it into the long term. One thing that is that is strong here, that there's there's nobody there's actually said on this on this webinar that it's not applicable to them. So so at least there's been some relevancy here. We will publish these results with a follow up

149
00:33:03.325 --> 00:33:08.039
Bryn Morgan: if I just stop sharing these. And I'm just gonna jump because I've got quite a few Q&A

150
00:33:08.487 --> 00:33:10.429
Bryn Morgan: I'm just gonna jump on those now.

151
00:33:12.630 --> 00:33:13.740
Bryn Morgan: So

152
00:33:15.803 --> 00:33:26.620
Bryn Morgan: let's start with the 1st question. And I'll probably let Dan take this so as an existing client. How quickly would we be able to achieve cyber essentials

153
00:33:27.980 --> 00:33:30.690
Bryn Morgan: and actually Harry or Dan. But, Dan, if you wouldn't mind.

154
00:33:34.650 --> 00:33:37.770
Dan O'Hara: So cyber essentials is

155
00:33:38.000 --> 00:33:40.700
Dan O'Hara: to the 1st one cyber essentials.

156
00:33:41.131 --> 00:33:51.078
Dan O'Hara: Is, it should be fairly quick for our clients. We've got you know, finance for 3, 6, 5, as Harry said. We've aligned that to the cyber essentials.

157
00:33:52.190 --> 00:33:57.710
Dan O'Hara: controls. So we're we're pretty confident it should be fairly quick.

158
00:33:58.390 --> 00:33:59.569
Dan O'Hara: one of our.

159
00:34:00.040 --> 00:34:13.970
Dan O'Hara: And as Harry mentioned, one of one of the challenges are around these sas applications, so generally they're all in scope and it. It's it's web application websites where you conduct business or

160
00:34:14.440 --> 00:34:17.290
Dan O'Hara: some function. Not.

161
00:34:18.600 --> 00:34:24.290
Dan O'Hara: It's not always that landware or other. It companies are aware of them.

162
00:34:24.723 --> 00:34:37.096
Dan O'Hara: Maybe your your finance. You know what application web application. So those are the things that we just have to to to cover off but in in terms of the basic setup,

163
00:34:38.090 --> 00:34:40.979
Dan O'Hara: we're we're pretty confident. That's that's fairly simple for us.

164
00:34:42.050 --> 00:34:52.920
Bryn Morgan: Thanks, thanks, Dan, and I think that really kind of, answered our second one, as well. So as a landwear client. Would it not be reasonable to expect land where to have done a lot of this by default. And you know, answering that that myself.

165
00:34:52.920 --> 00:35:13.374
Bryn Morgan: the the past, that land we're responsible for is, as Harry said, cyber essentials ready? I think you know you have to really look at the full scope of your providers. Across the board supply chain we talked about today and to ensure that. But we're here to help you in understanding that another one. I think I'm gonna give this to

166
00:35:13.680 --> 00:35:20.540
Bryn Morgan: to you, Henry. So does the cyber essentials, plus auditor physically visit your site, or is it done remotely or both?

167
00:35:21.080 --> 00:35:25.214
Henry Duncombe: I think I'm gonna pass that one over to Harry. Actually.

168
00:35:25.590 --> 00:35:26.180
Bryn Morgan: For reasons.

169
00:35:27.180 --> 00:35:36.669
Harry Earle: Yeah, typically, they will be remote. So they'll they'll put like a remote assistance tool on your machines, and they'll give you a tool that can do all the scanning.

170
00:35:37.136 --> 00:35:48.329
Harry Earle: However, there are instances where you can, potentially, you know, pay a bit extra and have them come and physically visit your site and do that testing with you as a bit more kind of a white glove service, so to speak.

171
00:35:49.080 --> 00:36:02.010
Bryn Morgan: Okay, thanks, thanks, Harry. So, Henry, you can't get away. I'm gonna I'm gonna let you have this one. Cyber center has been around for a long time as noted earlier in the presentation. Why is it taking so long to be adapted? Adopted industry wide.

172
00:36:02.530 --> 00:36:04.625
Henry Duncombe: Yeah, that that's it.

173
00:36:05.420 --> 00:36:08.495
Henry Duncombe: You know. I did mention it. Briefly.

174
00:36:10.660 --> 00:36:13.180
Henry Duncombe: cause if you you look back.

175
00:36:14.220 --> 00:36:37.259
Henry Duncombe: really, you know, cyber security has always been high up the agenda for financial firms. Yeah. And they've always been one of the most targeted and spent more money on cyber security than any other industry, and they're under more regulation. So it's always been a priority. So when cyber essential certification came along.

176
00:36:37.270 --> 00:36:43.979
Henry Duncombe: I don't think financial services Media looks at and thought, lept it, and said, Well, that's going to help me actually improve my security posture.

177
00:36:44.370 --> 00:37:08.269
Henry Duncombe: What's happened, though, is that, as I said, the regulator is now kind of making reference to all the work from National Cyber Security Center, which includes cyber essentials and saying you really should be adopting this because it constitutes what they consider to be a solid foundation from a technical security control control perspective. So in the last kind of 3 to 5 years

178
00:37:08.270 --> 00:37:24.340
Henry Duncombe: that's happened. And, as I say, we've seen it go. Them go from about 6% in terms of industry take up to 10%. And it's growing. I also think, with new startups coming on board, I think there's a lot more

179
00:37:24.350 --> 00:37:51.500
Henry Duncombe: kind of convincing that has to be done to win new clients that you're secure unsurprisingly in financial services and a way to do that is to have a cyber essentials plus certification. So all the new entrants to financial services are getting on board with cyber essentials to help them obviously get regulated and get into the market. So that's my assessment of why, only now, the last few years. It's really starting to take off

180
00:37:51.920 --> 00:37:56.120
Henry Duncombe: and hence why, we are doing this webinar today.

181
00:37:57.830 --> 00:38:05.409
Bryn Morgan: Thanks, Henry. I've got a couple more. I've got one for you, Harry, if you wouldn't mind. So what is the policy on having mfa on sas apps.

182
00:38:05.738 --> 00:38:08.819
Bryn Morgan: What would happen if a sas app doesn't support this.

183
00:38:09.710 --> 00:38:26.210
Harry Earle: So if a sas app doesn't support it, then that is fine, it's only in instances where Mfa is supported on a sas app that you must have it for all of your users and your administrators, so you can exclude those Sas apps if it doesn't have Mfa on them.

184
00:38:27.190 --> 00:38:32.479
Bryn Morgan: Brilliant. Thank you, Harry. So I've got one last one. I'm gonna let Dan and Harry

185
00:38:32.610 --> 00:38:40.799
Bryn Morgan: choose who's going to answer this. So so don't all rush at once, guys, but handing over a personal phone to an assessor to go through

186
00:38:40.830 --> 00:38:49.349
Bryn Morgan: would likely be unpopular for most of our users. Given that the personal data held is not company business. What is the best way to handle this.

187
00:38:50.490 --> 00:38:51.510
Harry Earle: Yeah, so

188
00:38:51.770 --> 00:39:06.489
Harry Earle: the tests that they do with your personal phone are very quick in comparison to things like windows or Mac OS devices or your servers. So typically what they're going to be doing is is kind of checking an area in the settings to make sure that they're properly managed.

189
00:39:06.490 --> 00:39:23.079
Harry Earle: And they just want to make sure that those apps are separated and segregated from the rest of your personal app. So they have things like app protection policies. And it is a very, very quick test. And typically that can be done with the kind of end user there, so that they can assure that they're not going through areas of your phone that they're not meant to be doing.

190
00:39:24.530 --> 00:39:29.099
Bryn Morgan: All right. Thank you. So that covers all of our questions.

191
00:39:29.620 --> 00:39:33.440
Bryn Morgan: thank you. Everybody for attending. I just can. You just flip on Harry. One slide.

192
00:39:37.930 --> 00:39:52.079
Bryn Morgan: Think there's 1 more. Yeah, there we go. So you know, just a last few points for myself. If you're not a client. We can help you on your journey if you want to speak to us around. What you currently have, how you go through this. Some of the steps.

193
00:39:52.379 --> 00:40:03.150
Bryn Morgan: You know we we've got assistance in place, so so please do get in touch. If you are a client. I said, previously, finance. 4 with 3, 6, 5 meets many of these requirements.

194
00:40:03.416 --> 00:40:23.159
Bryn Morgan: Just be clear that you know it's not just what land will provide. It's for all of your technology providers? So you know, we can help you to make sure that we understand what is and what isn't covered, and what is within the boundaries. So look, you know, please do get in. Touch any questions about the webinar, and please get in touch with myself or any of the panelists.

195
00:40:23.391 --> 00:40:26.929
Bryn Morgan: And and you know, just thank you very much for your time. I really appreciate it.

196
00:40:27.090 --> 00:40:28.570
Bryn Morgan: and, thanks to all the panelists.

197
00:40:29.430 --> 00:40:30.479
Henry Duncombe: Thanks. Brent, thanks. Everyone.

198
00:40:30.480 --> 00:40:31.180
Bryn Morgan: Thank you.