What is Cyber Security? Definition and Best Practices

Cyber security is the application of technologies, processes, and controls to protect systems, networks, programs, devices and data from cyber attacks.

It aims to reduce the risk of cyber attacks and protect against the unauthorised exploitation of systems, networks, and technologies.

Cyber security basics

Before diving into advanced security measures, it’s essential to understand the fundamental concepts and practices that form the foundation of effective cyber security.

Essential security concepts

Understanding these basic principles is crucial for protecting your organisation:

Authentication is how systems verify who’s trying to access them. Think of it as showing your ID to prove who you are. Modern authentication often uses multiple factors:

• Something you know (password)
• Something you have (security key)
• Something you are (fingerprint)

Authorisation determines what verified users can access. Just as employees have different access levels to building areas, digital authorisation ensures users can only access appropriate resources.

Confidentiality keeps sensitive information private. This means ensuring data is only accessible to those who need it, using tools like encryption and access controls.

Integrity ensures data hasn’t been tampered with. Systems must maintain the accuracy and completeness of information throughout its lifecycle.

Availability means keeping systems and data accessible to authorised users when needed while protecting against disruptions like cyber attacks.

Common threat types

These are the most frequent cyber threats your organisation may face:

Social engineering involves manipulating people to reveal confidential information. The attacker might pose as a trusted person or authority figure to gain access or information.

Malware (malicious software) can damage systems or steal data. This includes:

• Viruses that spread between systems
• Spyware that monitors user activity
• Trojans that appear legitimate but contain harmful code

Phishing attempts to steal sensitive data by masquerading as trustworthy entities. These attacks often arrive via email and can target specific individuals or organisations.

Ransomware encrypts your data and demands payment for its release. This can halt operations and cause significant financial damage.

Data breaches occur when unauthorised parties gain access to confidential information, often through a combination of the above methods.

Basic security measures

Implement these fundamental practices to establish basic protection:

Strong password practices

• Create unique passwords for each account
• Use at least 12 characters combining letters, numbers, and symbols
• Enable multi-factor authentication wherever possible
• Consider using a password manager to secure and organise credentials

Regular software updates

• Enable automatic updates where appropriate
• Check for updates weekly on critical systems
• Apply security patches as soon as they’re available
• Maintain an inventory of all software requiring updates

Data backup

• Back up critical data at least weekly
• Store backups in multiple locations
• Keep at least one backup offline
• Regularly test your ability to restore from backups

Access control

• Give users only the access they need for their role
• Review access rights quarterly
• Remove access immediately when employees leave
• Use role-based access control for systems and data

Warning signs of security issues

Watch for these common indicators of potential security problems:

• Systems running slower than usual
• Unexpected pop-up windows
• Password changes you didn’t make
• Unusually high network traffic
• Disabled security tools or antivirus
• Unauthorised programs starting automatically
• Strange outbound network connections

Understanding and implementing these basics creates a strong foundation for your organisation’s cyber security strategy. These fundamentals support more advanced security measures and help protect against common threats.

The costs of cyber security breaches are rising.
Organisations that suffer cyber security breaches may face significant fines. There are also non-financial costs to be considered, like reputational damage.

Cyber attacks are increasingly sophisticated.
Cyber attacks continue to grow in sophistication, with attackers using an ever-expanding variety of tactics. These include social engineering, malware and ransomware.

Cyber security is a critical, board-level issue.
New regulations and reporting requirements make cyber security risk oversight a challenge. The board needs assurance from management that its cyber risk strategies will reduce the risk of attacks and limit financial and operational impacts.

Cyber crime is a big business.
According to a study by McAfee and the CSIS, based on data collected by Vanson Bourne, the world economy loses more than $1 trillion each year due to cybercrime. Political, ethical, and social incentives can also drive attackers.

1. Critical infrastructure cyber security: Critical infrastructure organisations are often more vulnerable to attack than others because SCADA (supervisory control and data acquisition) systems often rely on older software. Operators of essential services in the UK’s energy, transport, health, water and digital infrastructure sectors, and digital service providers are bound by the NIS Regulations. The Regulations require organisations to implement appropriate technical and organisational measures to manage their security risks.
2. Network security: Network security involves addressing vulnerabilities affecting your operating systems and network architecture, including servers and hosts, firewalls and wireless access points, and network protocols.
3. Cloud security: Cloud security is concerned with securing data, applications, and infrastructure in the Cloud.
4. IoT (Internet of Things) security: IoT security involves securing smart devices and networks connected to the IoT. IoT devices include things that connect to the Internet without human intervention, such as smart fire alarms, lights, thermostats, and other appliances.
5. Application security: Application security involves addressing vulnerabilities resulting from insecure development processes in designing, coding, and publishing software or a website.

Cyber security vs information security

Cyber security is often confused with information security.

• Cyber security focuses on protecting computer systems from unauthorised access or being otherwise damaged or made inaccessible.
• Information security is a broader category that protects all information assets, whether in hard copy or digital form.

The legal requirement for cyber security

The GDPR and DPA 2018 require organisations to implement appropriate security measures to protect personal data. Otherwise, you risk substantial fines.

Cyber security is a critical business issue for every organisation.

Challenges of cyber security

Mitigating the cyber security risks facing your organisation can be challenging. This is especially true if you have moved to remote working and have less control over employees’ behaviour and device security.

An effective approach must encompass your entire IT infrastructure and be based on regular risk assessments.

Learn more about cyber security risk assessments

What are the consequences of a cyber attack?

Cyber attacks can cost organisations billions of pounds and cause severe damage. Impacted organisations stand to lose sensitive data and face fines and reputational damage.

Learn more about cyber crime and how it affects you

Learn about the cyber threats you face

Managing cyber security

Effective cyber security management must come from the top of the organisation.

A robust cyber security culture, reinforced by regular training, will ensure that every employee recognises cyber security as their responsibility.

Good security and effective working practices must go hand in hand.

How to approach cyber security

A risk-based approach to cyber security will ensure your efforts are focused where they are most needed.

Using regular cyber security risk assessments to identify and evaluate your risks is the most effective and cost-efficient way of protecting your organisation.

Learn more about cyber risk management

Cyber security checklist

Boost your cyber defences with these must-have security measures:

1. User education: Human error is the leading cause of data breaches. Therefore, you must equip staff with the knowledge to deal with the threats they face. Staff awareness training will show employees how security threats affect them and help them apply best-practice advice to real-world situations.
2. Application security: Web application vulnerabilities are a common point of intrusion for cyber criminals. As applications play an increasingly critical role in business, it is vital to focus on web application security.
3. Network security: Network security is the process of protecting the usability and integrity of your network and data. This is achieved by conducting a network penetration test, which assesses your network for vulnerabilities and security issues.
4. Leadership commitment: Leadership commitment is key to cyber resilience. Without it, it is tough to establish or enforce effective processes. Top management must be prepared to invest in appropriate cyber security resources, such as awareness training.
5. Password management: Almost half of the UK population uses ‘password’, ‘123456’ or ‘qwerty’ as their password. You should implement a password management policy to guide staff to create strong passwords and keep them secure.

For more than 15 years, we’ve helped hundreds of organisations with our deep industry expertise and pragmatic approach. Browse our wide range of cyber security solutions below to kick-start your project.

• Security in the Digital World
• Cyber Security: Essential principles to secure your organisation – a pocket guide
• Cyber Essentials Toolkit
• Build a Security Culture
• Cyber Essentials Certification
• Complete Staff Awareness E-learning Suite
• Cyber Security for Remote Workers Staff Awareness E-learning Course