FREQUENTLY
ASKED QUESTIONS

Cyber monitoring typically uses a combination of technologies, such as intrusion detection systems (IDS), intrusion prevention systems (IPS), and security information and event management (SIEM) solutions, to collect and analyse data from various sources.

Breached Data made available on the internet can also be monitored to identify further risks to an organisation or individual.

Many security consultancy firms (including Collective Security) offer a range of additional security services to meet the needs of their clients.

A security consultancy engagement typically involves:

• A detailed assessment of the organisation’s security needs
• Development of a customised security plan
• Implementation of recommended security measures
• Ongoing monitoring and support

When choosing a security consultancy firm, consider factors such as:

• Their experience and expertise
• Their certifications and accreditations
• Their references and case studies
• Their pricing and service level agreements

Security consultancy can help organisations improve their security posture, reduce their risk of cyber-attacks, and comply with industry regulations.

Security consultancy services can cover a wide range of topics, including:

• Risk assessment: Identifying and evaluating an organisation’s security risks.
• Policy development: Creating and implementing security policies and procedures.
• Compliance assessment: Ensuring compliance with industry regulations and standards.
• Security architecture design: Designing secure network and system architectures.
• Security awareness training: Developing and delivering security awareness training programs.
• Incident response planning: Creating and testing incident response plans.

Security consultancy involves providing expert advice and guidance on security matters to organisations of all sizes.

An incident management support provider should be able to:

• Respond quickly to incidents
• Provide expert guidance and support
• Help organisations recover from incidents efficiently
• Conduct post-incident reviews to identify lessons learned

When choosing an incident management support provider, consider factors such as:

• Their experience and expertise
• Their response times
• Their incident management processes
• Their pricing and service level agreements

The benefits include:

• Reduced downtime
• Minimised financial loss
• Improved reputation
• Enhanced compliance with industry regulations

Incident management support can help organisations minimise the impact of security incidents and recover quickly.

The key steps in incident management include:

• Detection: Identifying the incident.
• Response: Containing the incident and preventing further damage.
• Investigation: Determining the root cause of the incident.
• Eradication: Removing the threat from the environment
• Recovery: Restoring systems and data to a normal state.
• Lessons learned: Analysing the incident to identify ways to prevent similar incidents in the future

Incident management support can handle a wide range of incidents, including:

• Data breaches
• Malware/Ransomware infections
• Phishing attacks
• Denial-of-service (DoS) attacks
• Insider threats

Incident management support involves providing assistance to organisations in responding to and resolving security incidents.

A typical security testing engagement involves:

• A detailed assessment of the organisation’s structure and requirements
• A detailed scope that includes the necessary requirements without being too broad
• Identification and prioritisation of vulnerabilities
• Recommendations for remediation
• A final report detailing the findings of the assessment

When choosing a security testing provider, consider factors such as:

• Their experience and expertise
• The types of testing they offer
• Their certifications and accreditations
• Their pricing and service level agreements
• Their flexibility and tailored solutions to fit YOUR requirements

The benefits include:

• Improved security posture
• Reduced risk of data breaches
• Enhanced compliance with industry regulations
• Increased customer and partner confidence
• Reduced risk of financial impacts

The frequency of security testing depends on factors such as the organisation’s risk tolerance, industry regulations, and the complexity of its systems.

• Penetration Testing – Many organisations conduct full security penetration testing annually or biannually (or more if required).
• Vulnerability scanning can take place much more frequently due to the automated nature. This can range from monthly scans down to daily or even hourly!

Security testing helps organisations identify and address vulnerabilities before they can be exploited by malicious actors.

There are several types of security testing, including:

• Vulnerability scanning: Identifying known vulnerabilities in systems and applications.
• Penetration testing: Simulating attacks to assess an organisation’s security posture and attempt to exploit identified vulnerabilities.
• Web application testing: Testing web applications/web sites for vulnerabilities such as SQL injection and cross-site scripting.
• Social engineering testing: Assessing the effectiveness of an organisation’s social engineering prevention measures.
• Wireless network testing: Testing the security of wireless networks.

Security testing is the process of identifying and assessing vulnerabilities in computer systems, networks, and applications.

Once certified, organisations must maintain their security controls and undergo annual reassessments to retain their certification.

Certificates are provided and also published on the NCSC (National Cyber Security Centre) website which can be reviewed publicly.

The trusted ‘Certified Cyber Essentials Certified’ logo can be published on your website to promote both your business and certification

While it’s possible to achieve certification on your own, many organisations find it easier and more efficient to work with a trusted qualified partner.

The certification process typically takes a few weeks, depending on the organisation’s existing security controls and the speed of the assessment process

The benefits include:

• Improved security posture
• Reduced risk of cyber attacks
• Enhanced customer and partner confidence
• Potential insurance discounts
• Access to contracts that require Cyber Essentials as a baseline minimum

Cyber Essentials is suitable for organisations of all sizes, from small businesses to large enterprises.

The five technical controls are:

• Firewalls
• Secure configuration
• Security Update / Patch management
• User access control
• Malware protection

Cyber Essentials is a certification scheme designed to help organisations protect themselves from common cyber threats. It provides a baseline standard of security controls that organisations must implement to achieve certification

You can measure effectiveness by:

• Tracking employee participation rates
• Conducting simulated phishing attacks
• Monitoring incident reports
• Gathering employee feedback through surveys or interviews

The benefits include:

• Reduced risk of data breaches
• Improved security posture
• Increased employee awareness and engagement
• Enhanced compliance with industry regulations

Training should be conducted regularly, as a minimum annually, but ideally on a more regular basis in ‘bite-size’ modules to reinforce key concepts and keep employees updated on emerging threats.

Regular training and communication throughout the year enables flexible approaches to train individuals based on current events

A comprehensive program should cover topics such as:

• Phishing scams
• Social engineering attacks
• Strong password management
• Data privacy and protection
• Safe browsing practices

Employees are often one of the first lines of defence against cyber threats. By educating employees on security best practices, organisations can reduce their risk of data breaches and other security incidents.

Cyber/information security awareness and education involves training employees and other stakeholders on how to recognise and prevent cyber threats

When choosing a cyber monitoring solution, consider factors such as:

• Your business’s specific needs and requirements
• The types of threats you are most concerned about
• Your budget
• The solution’s ease of use
• Scalability

The benefits of cyber monitoring include:

• Reduced risk of data breaches
• Improved security posture
• Faster detection and response to threats
• Enhanced compliance with industry regulations

Cyber monitoring should be conducted continuously, 24/7, to ensure that threats are detected and addressed promptly.

Cyber monitoring can detect a wide range of threats, including:

• Malware attacks
• Ransomware attacks
• Phishing attempts
• Denial-of-service (DoS) attacks
• Data breaches
• Insider threats

Cyber monitoring typically uses a combination of technologies, such as intrusion detection systems (IDS), intrusion prevention systems (IPS), and security information and event management (SIEM) solutions, to collect and analyse data from various sources.

Breached Data made available on the internet can also be monitored to identify further risks to an organisation or individual.