Cyber Security Essentials

[m0bov]

Hi all, what's the deal regarding schools/trusts and CSE? Are schools getting certified or just using the free tools?

 

I did search some schools and trusts I know but none seem to be listed.

 

Thanks for any info.

[RLR]

We've done Cyber Essentials and Cyber Essentials+ for the last few years . A lot of it is self reporting but the cyber essentials+ has someone remote in and do some Nessus testing on different machines of your choosing.

[supportman]

Hi all, what's the deal regarding schools/trusts and CSE? Are schools getting certified or just using the free tools?

 

I did search some schools and trusts I know but none seem to be listed.

 

Thanks for any info.

 

We did it a few years back, was a good exercise if you involve people higher up.

 

I found it genuinely useful to get things upgraded and helped prioritize cyber security in the school.

Edited January 23, 2024 by supportman

[mavhc]

Seems to be mostly making sure you have policies/paperwork

 

Then throwing away hardware because it's "out of support"

 

And finally running a network scanner.

 

My advice:

 

Run a network scanner first, eg https://greenbone.github.io/docs/latest/22.4/container/index.html (free fork of nessus)

 

Run https://specopssoft.com/product/specops-password-auditor/

 

Enable MFA

 

And https://www.pingcastle.com/

 

Fix all those bugs.

 

Bitlocker, LAPS, and SRP/Applocker

 

Have immutable backups so the hacker can't delete the backups

 

https://www.ncsc.gov.uk/blog-post/cyber-tools-for-uk-schools

 

Maybe https://github.com/cisagov/lme or https://wazuh.com/ or https://securityonionsolutions.com/software or https://www.elastic.co/security or https://graylog.org/products/security/ or https://utmstack.com/pricing/ (all have free versions)

Edited January 23, 2024 by mavhc

[Kitkatninja]

We're currently going for our 3rd accreditation for CSE (we've had our latest application returned for further clarification), unfortunately because of the Christmas break and workloads, there's a lapse between our last one and this one (by a couple of weeks).

 

So yes, there are a few schools/academies/trusts that have gone/got CSE, a smaller amount that have gained the CS+. The free tools are a great way to get started. And the program as a whole is also a good way to justify the purchase of new equipments, projects, etc.

 

Other useful tools/information include:

DfE Standards

Cyber Secure Check for Schools

[jmak]

Not a school, but we've done CE for a few priority groups. It looks like there's going to be an organisation wide programme with almost indistinguishable standards - I presume the driver is to reach the standard without spending the money.

 

Most of it is what you already know should be happening already, but the requirement for CE accreditation gave us the leverage to implement things (mostly policies) that had previously been resisted. One thing that did get authorised and probably wouldn't have done if we weren't seeking accreditation was a centralised patch management system which I've been after for years.

 

You will need full backing from SLT. We had lots of people who said it was impossible or too invasive and they went whinging to managers, but in fairness, SLT led by example and told everyone else to get on with it.

[MatthewL]

If you are new to this there will be lots of things picked up, do the work first using some of the tools available, there will be lots of things more than likely the first time run, it will be a steep learning curve to some but worth it in the long run.

[Tones]

I was a pilot school for CE and never re-certified. I'm happy with just using the RPA insurance instead of having the commercial insurance CE gets you. FYI the insurance provider with RPA is: https://cyberclan.com/gb/

 

I check the questions still to make sure we stay updated and I know we'd fail as cloud is in scope and we don't restrict using context aware tools older systems from being able to access Google Workspace.