5 basic cyber security controls that protect most organisations

Cyber attacks are now a routine business risk. While there are many advanced tools and frameworks available, studies show that most successful attacks still exploit simple weaknesses. 

At GSI Associates, our cyber security and IT advisory work focuses first on getting the fundamentals right. These five controls significantly reduce risk for organisations of any size. 

1. Multi-factor authentication (MFA)
   Enable MFA on email accounts, VPNs, remote access tools and all critical business systems. This simple extra step blocks a large proportion of unauthorised login attempts.
2. Strong, unique passwords managed properly
   Long, unique passwords should be used for all accounts and stored in a secure password manager, not reused or written down.
3. Regular updates and patch management
   Operating systems, business applications and network devices need timely updates. Unpatched systems are a common entry point for attackers.
4. Role-based access control
   Staff should only have access to the data and systems they genuinely need for their role. Limiting access reduces the impact of any compromise.
5. Clear, simple incident response steps
   Every employee should know what to do if they suspect a phishing email, malware or other issue: who to inform, what to disconnect and how to record details.

These are not complex measures, but they require clear policies, training and accountability. Once the fundamentals are in place, organisations can build additional layers of protection as needed. 

If you would like to review your cyber security posture or implement a practical improvement plan, the cyber advisory team at GSI Associates can support you.