1. Cyber Security & Critical Controls Chris Few Industry Enabling Services CESG February 2011 © Crown Copyright. All rights reserved.

2. Cyber Essentials An HMG scheme for testing security controls to defeat common Internet based threats Covers five control areas: –Internet Gateways; Secure configuration; User access control; Malware protection; Patch management Includes a two tier assurance framework: –Cyber Essentials: verified self-assessment Organisation completes self assessment questionnaire Responses reviewed as reasonable by assessor –Cyber Essentials PLUS: independently tested Tests whether controls implemented are sufficient to defeat common Internet based attacks February 2011 © Crown Copyright. All rights reserved.

3. Relevance of Cyber Essentials to LMN Policing of connections to shared academic networks Criterion for selecting suppliers accessing academic data Demonstrating commitment to cyber security Incorporation into ESISS penetration testing improves clarity of scope of testing February 2011 © Crown Copyright. All rights reserved.

4. February 2011 © Crown Copyright. All rights reserved. CESG & industry partners Cyber Security Industry Standards Products Systems Services People Education & Training Organisations Certify Supply Consumers Information risk owning organisations In the public sector, industry or academia Buy Employ The Assurance Landscape

5. CESG Service Catalogue OrganisationsTraining & Education PeopleProductsSystemsServices Information Assurance Maturity Model Certified Training Certified Professional Assisted Products Scheme Cyber Essentials Cyber Incident Response MSc in Cyber Security Listed Advisors Commercial Product Assurance Tailored Advice Service CHECK penetration testing Academic Centres of Excellence Common Criteria Technical Design Review Secure Destruction TEMPESTGovCertUK Further details at www.cesg.gov.ukContact us at Enquiries@cesg.gsi.gov.uk

6. Questions for LMN Which parts of the CESG service catalogue are most relevant to you? How can CESG develop its portfolio of schemes to meet your needs? Can CESG facilitate closer relationships between academia and industry on the topic of cyber security? February 2011 © Crown Copyright. All rights reserved.