- Hi, and welcome back to the channel I'm Marcus.
And in today's video
we're gonna be talking about the changes
which are coming to Cyber Central's
from the 26th of April, 2021.
Now, if you didn't know Cyber Central
has been around for many years.
In fact, it was launched way back on the 5th of June, 2014.
As time progresses,
and the security of businesses is taken more seriously
and more and more businesses implement their supply chains
the required certification.
Now, we have seen more and more companies becoming certified
over the recent years and it's just escalated massively.
Now, if Cyber Central's didn't change
and keep up to date and implement new things like that
there's certification where it gets stuck
it would get old and it just be relevant.
So from the 26th of April, there's gonna be some changes
and this is what this video's all going to be about.
So from the 26th of April 2021,
the requirements for achieving Cyber Central's
will change slightly.
Now, please note however,
for anyone undergoing Cyber Central's self-assessment
before the 26th of April 2021.
You can still complete
and still work on the old question set
or the questions that they work on under the moment.
If you start taking Cyber Centrals out
on the 26th of April and move forward,
then you will be on the new questions
and we'll go from there.
So when you look at the new questions
you'll notice several changes
which will hopefully make it easier
to complete it and understand
what it's being asked of you within the self-assessment.
As part of the changes
there are no new definitions that are going to be used
and these are gonna be pretty much related around,
bring your own devices
and anything that interacts with business debt
or a business services.
So the first terminology is gonna be a corporate VPN.
If you didn't already not a corporate VPN
is a VPN solution that helps you connect
back to the office location or to a virtual cloud firewall.
And this must be for Cyber Central,
it must be ministered by the application,
the applicant if I could spread the word out.
The applicants organisation
so that the firewall controls what can be complied.
And the next one is organisational data.
Organisational data includes any electronic data
belonging to you the applicant.
For example, it could be email,
it could be office documents, databases,
financial data, HR information, anything like that.
The next one is organisational services.
Organisational services,
will include any of the software applications
that you use in the business.
Now, this could be cloud applications, cloud services,
use it in directive, desktops as defined by Cyber Central's,
mobile device management solutions
owned or subscribed to your business.
So pretty much anything that interacts with your business
anything that touches your businesses data
is included in the scope.
Now, along with this,
for example, it could be web applications,
Microsoft Office 365, Google workspace,
MDM containers, Citrix desktop, VDI solutions,
remote desktop, or RDP desktop, and so forth.
Now, the next change will be an update
to bring your own devices of BYOD.
This update along with the both definitions
that we've just mentioned
will help to explain what we'll be able to scope
or what will be in scope, depending upon your assessment.
The new requirement for bringing your own devices
and to define whether or not the will be and that the scope,
is defined as following:
mobile or remote devices owned by the organisation,
user owned devices, which access organisational data
or services will be in scope.
However, native voice, SMS text messages or applications
will be able to scope
alongside with the factor authentication usage.
So pretty much if you have a bring your own device
or some type of device that
is either controlled by the business or the user
it will be in scope for yourself assessment,
if it accesses it and it accesses that business data.
So if you have a mobile device
that you have Outlook on that,
or some kind of Gmail or anything like that,
that access is business emails or documents,
that device will be in scope.
Now, next step is software firewalls.
Software firewalls is as in hopefully, you know
is being part of the Cyber Centrals for many, many years.
You need to ensure that you have a firewall implemented
which separates you from the internet.
Now, previously,
there's a bit of confusion about this
where it said you had to have a border firewall implemented.
Now, they're changing it so what the saying is,
if you are in a managed office
or if you're in a coffee shop
or you work from home right now you don't have an office
you need to have a firewall on your computer.
So there's no longer a requirement to say
you have to have a border firewall
that you manage and control within the office,
but sometimes people don't do that
they're working in a managed office
they don't have control to those firewalls.
Now, you only to have a firewall on your host computer.
Ideally, if you're working in an office
you'll have that firewall there
and then your host firewall on your computer.
The next change is a name change.
What used to be called patch management
and that section is now called security update management.
As part of this change, it is also expected that
you the user will have automatic updates enabled
on all software packages and devices where possible.
So this has changed a little bit.
So from our discussion
you instal security updates within 14 days.
It's now really expecting you
to instal all updates where possible,
especially if they're high or critical rated within 14 days.
The move is now gone more towards
ensuring that you have updates installed
for every application and every update.
So enabling automatic updates
wherever possible installing all updates
all within the 14 days as well.
The next section is all about user access control.
This section has been expanded
to include the third party accounts that have been,
had access to company's data.
So what this is about is
if you have a managed IT company
in place or you have some company that manages your IT
or looks after your IT,
you need to ensure that their accounts
or managing control by yourself.
So you have to say of, who can have access to your systems.
You're ensuring that you've got control in place so,
if they set up accounts
to access your system as administrator,
you have controls
and policies in place to say, yes, we have this covered.
This is what you're going to do, x, y, and z.
So what we're trying to say is
if a managing IT company has access to your systems
they should have access and policies in place to say,
they will use two factor authentication of possible,
they will have time out,
they will have controls of just to say that
their IT people won't leave them locked into these machines
all the time and they won't have the same password
for your company that they will have for over the company.
So this is just trying to block
and restrict the amount of lateral movement.
If an IT company got and owned or got compromised
if all that information got obtained
the last thing I wanna do
is get a username and password for one company,
and it works for all companies.
And that is pretty much most of the changes.
What you'll notice is
when you log into the self-assessment portal
after the 26th of April,
you'll notice that some of the questions
are just being broken down it's a little bit easier.
There's a few little name changes
and in general, it should be a lot easier to complete,
a lot more self-explanatory.
But as always, check out our channel here
and to have a look at any Cyber Central related stuff
we will be pushing more content out to Cyber Central's.
Have a look at our blog site,
if you like for more information about that
you can just go,
I'll put a link in below the video for that.
And yeah, if you have any questions or anything like that
feel free to put them in below the video,
like and subscribe as you do for YouTube.
And then, yeah, we'll go from that
and I'll see you next time.
(upbeat music)