When Cybersecurity isn’t Perfect Yet

Cybersecurity world standards can be divided into two types: comprehensive security management systems (ISMS, NIST CSF), and sets of specific requirements (such as CyberEssentials, Australian Essential 8). The DigVel standard is an example of a balance between these two extremes. It combines the necessary processes, basic requirements, and best practices relevant to modern organizations with IT infrastructure. We have already talked about the standard itself and the first level of resilience. Today, we are pleased to present the second level, which demonstrates the advantages of the standard.

Passing the first level of the standard gives the organization an understanding of current risks and priorities. After that, we are ready to start eliminating the identified threats. Since the number of risks in an organization can be very significant, we focus primarily on processing the ones assessed as critical. For each of them, existing vulnerabilities, a plan for their elimination, and further reduction of the risk level are determined. Thus, the organization’s efforts focused on what it sees as a priority.

If no critical risks are identified, you can proceed to the second part of the level — the implementation of the universal security measures. We know very well that there is no “silver bullet” that will perfectly suit all organizations. However, we cannot underestimate the value of basic security measures, the absence of which causes catastrophic losses for companies around the world. The next part of this level focuses on the implementation of such tools. The most charming thing is that most of these tools are so basic that most of us have not only heard about them, but also implemented them:

• Using strong passwords — nowadays, it is not a secret for anyone that having a strong password is like having a lock on the door.
• Multi-Factor Authentication (MFA) —today, it is just as basic security tool as passwords.
• The presence of antivirus and protection against malware is a common means of protection.
• Regular updating of antivirus software — a tool that allows you to avoid hacking systems that actively interact with the Internet, or are accessible from the public network.

Despite their importance and clarity, these simple tools are pretty often “not a priority” for implementation, since there are always more important tasks. That is why we highlight them as requirements for completing the second level, where the main task is to close common and critical IT security risks.

The last sub-stage of the second level is devoted to incident preparedness. Readiness to detect and neutralize an incident with a high potential impact on the organization’s activities is a significant indicator. It is well known that no investments and technical means guarantee 100% protection against threats. That is why, while protection is only being built, it is important to understand which threats exactly may occur and how we can stop them today, in the event of their occurrence.

The DigVel standard is a simple and understandable tool developed in Ukraine and for Ukraine. Ready for practical steps? Download a detailed description of the second level or contact our specialists.

Stay one step ahead of cyber threats!