The best protection isn't a new tool. It is a comprehensive, simple approach maintained over time. The Canadian Centre for Cyber Security offers exactly that starting point for small and medium organizations: the Baseline Cyber Security Controls.
The logic is 80/20: achieve about 80% of the benefit with 20% of the effort.
The 13 controls
- Develop an incident response plan - know who does what before it happens.
- Automatically patch operating systems and applications.
- Enable security software - antivirus and built-in protections.
- Securely configure devices - remove default settings.
- Use strong user authentication - multi-factor authentication first.
- Provide employee awareness training.
- Back up and encrypt data - and test restores.
- Secure mobility.
- Establish basic perimeter defences - firewall, Wi-Fi, remote access.
- Secure cloud and outsourced IT services.
- Secure websites.
- Implement access control and authorization - least privilege.
- Secure portable media.
Where to start?
If you only did four things this quarter: MFA everywhere, tested backups, automatic updates and employee training. Then document your incident plan.
A process, not a project
Cybersecurity is never finished. Threats, tools and your business keep evolving, which is why we favour regular follow-up, as offered by My Cyber & AI Coach.
The Cyberallié Shield is built on these 13 controls to conduct a guided review with your IT provider, within the agreed scope.
Source: Canadian Centre for Cyber Security, Baseline Cyber Security Controls for Small and Medium Organizations.