No products in the basket.
Cyber Essentials Plus Methodology
Table of Contents
Related Articles
December 8, 2023
Cyber Essentials Plus Process
External Vulnerability Scan (unauthenticated)
To test whether an Internet-based opportunist attacker can hack into the applicant’s system with typical low-skill
methods.
- Conduct a vulnerability scan on all external/ public IP addresses
- Full TCP and UDP port scan
- Interrogate authentication portals
Internal Vulnerability Scan (authenticated)
Identify missing patches and security updates that leave easy-to-exploit vulnerabilities within the scope of the
scheme.
- Scope the assessment and provide sample requirements
- Install remote vulnerability scanning agent on selected sample
- Conduct vulnerability scans and provide results along with remediation guidance
Under the consultant’s guidance, the user performs the following tasks via screen share software.
Device Configuration
To ensure the device under assessment aligns with the devices in the authenticated vulnerability assessment
- View evidence of:
o Private IP address
o Operating system information
o Firewall settings
o Anti-malware definitions released within the 24 hours prior to testing have been installed
o Anti-malware engine updates released within the 30 days prior to testing have been installed
Malware Protection Assessment via Browser
To check that all the devices in scope benefit from at least a basic level of malware protection.
- Download benign test files from the Cyber Essentials testing platform.
Malware Protection Assessment via e-mail
To test protection against malware that is delivered via e-mail attachments.
- Send benign test files to the user’s corporate e-mail address and observe the user attempting to open each
attached test file.
Multi-Factor Authentication Configuration
To test cloud services declared in scope, they have been configured for multi-factor authentication (MFA).
- View standard users’ and administrators’ requests for MFA on all cloud services via a browser (where
applicable).
User account separation
To test that user accounts do not have administrator privileges assigned.
- Ensure the user is a standard user.
- Attempt to perform a task as an administrator and observe the output.
Daniel Phillips
get in touch
Get in touch with us for a robust penetration test that yields great return on investment.