Build a practical cybersecurity baseline

Lista de acciones

1. 01

   Map what needs protection

   Inventory accounts, devices, applications, data and external dependencies. Assign an owner to each asset and identify the services whose disruption would matter most. Distinguish a discovered asset from an attributed asset: a domain resembling your brand does not prove you administer it. Record each service’s owner, environment, data and business dependency. Retain the discovery date and method so the inventory can be reproduced.

2. 02

   Protect identities

   Enable phishing-resistant authentication where available, separate administrator accounts and remove unnecessary access. Test account recovery before a device is lost. Include service accounts, API tokens and support recovery procedures. Strong authentication loses value if uncontrolled recovery bypasses it. Evidence should combine a login test, rejection of prohibited access and supervised account recovery.

3. 03

   Prioritise remediation

   Combine Internet exposure, asset criticality and evidence of active exploitation. Alert catalogues and CISA KEV help prioritise; a CVSS score alone does not describe your risk. CVSS describes technical severity; EPSS estimates exploitation probability within its own model. Neither replaces an assessment of local exposure. Document why each item is prioritised and verify remediation on the service people actually use.

4. 04

   Prove you can restore

   Keep isolated, monitored backups. Restore a representative service in a controlled environment, measure the actual recovery time and document what is missing. A successful backup job does not demonstrate that a service can restart. Check key access, dependencies, restored data integrity and a business journey. Separate technical restoration duration from the total time needed to resume the service.

5. 05

   Make events observable

   Centralise useful logs, synchronise clocks and test an alert end to end. Define who receives a signal, who decides and how long evidence should be retained for your context. Trigger an authorised test event, follow it through collection and verify that someone can make a decision. Record blind spots: missing sources, clock drift, ownerless alerts or retention too short for investigation.

6. 06

   Rehearse response

   Prepare contacts, containment decisions and alternative communications. Run a tabletop exercise, preserve evidence and check local obligations with the relevant authorities. Choose a bounded scenario, such as suspected email account compromise. Rehearse who approves containment, preserves evidence and confirms recovery. Close an action only after checking its outcome.

   Worked example: an Internet gateway has a reported vulnerability, but its installed version and enabled component are unknown. Check both with the administrator first. If affected, record exposure reduction, remediation and a working-service retest. An absence of log alerts cannot establish an absence of compromise when collection did not cover the relevant period.