Assessing Effectiveness of Cyber Essentials Technical Controls
Priyanka Badva, Partha Das Chowdhury, Kopo M. Ramokapane, Barnaby, Craggs, Awais Rashid

TL;DR
This paper evaluates the robustness of Cyber Essentials controls against cyber attacks by analyzing 45 breaches, highlighting their strengths in early attack phases and suggesting additional controls for later stages.
Contribution
It introduces an Incident Fault Tree approach to map breaches to controls, identifying gaps and proposing enhancements for improved cybersecurity resilience.
Findings
CE controls protect against initial attack phases
Additional controls are needed for later attack stages
Re-scoping skills for assessors may be necessary
Abstract
Cyber Essentials (CE) comprise a set of controls designed to protect organisations, irrespective of their size, against cyber attacks. The controls are firewalls, secure configuration, user access control, malware protection & security update management. In this work, we explore the extent to which CE remains robust against an ever-evolving threat landscape. To that end, we reconstruct 45 breaches mapped to MiTRE ATT&CK using an Incident Fault Tree ( IFT ) approach. Our method reveals the intersections where the placement of controls could have protected organisations. Then we identify appropriate Cyber Essential controls and/or Additional Controls for these vulnerable intersections. Our results show that CE controls can effectively protect against most attacks during the initial attack phase. However, they may need to be complemented with additional Controls if the attack proceeds…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsTechnology Assessment and Management · Economic and Technological Systems Analysis
