ZORB software helps businesses align with multiple Cyber Essentials controls

Why ZORB aligns with Cyber Essentials

ZORB is a software application that helps businesses eliminate data theft. We achieve this by preventing the transmission of data, until it can prove that it comes from a trusted application and going to a trusted destination. Our software installs into a Microsoft operating system, so does not require any overhaul of existing IT infrastructure.

 

Cyber Essentials does not mandate the need for data theft prevention in itself. It does, however, endeavor to prevent multiple ways in which data can be maliciously exfiltrated from systems. The requirements document tends to lean towards reducing the opportunity for incoming threats – with emphasis on inbound protection tools such as firewalls, antivirus, user access controls.

 

However, it is important to also consider outbound controls as they often complement inbound controls. If inbound protection systems are evaded, outbound protection tools might just save your business from a data breach. For example, should an attacker bypass user access controls to become an administrator and install a tool to exfiltrate data, ZORB becomes your last line of defence by recognising a data theft attempt and preventing that data from being transmitted.

 

Let’s consider how this applies to the requirements outlined in the five technical control themes.

 

Cyber Essentials Requirements Document (Section D)

Section D of the requirements document describes five technical control themes:

1)  Firewalls

This theme aims to ensure “that only secure and necessary network services can be accessed from the internet”. It states that:

• • An organisation with control over its network should use a boundary firewall to “restrict the inbound and outbound network traffic.”
  • An organisation that doesn’t have control over its network “must configure a software firewall on the device.”
  • “For cloud services, you can achieve this using data flow policies.”

 

All hardware and software firewalls provide the ability to set both inbound and outbound traffic policies. Inbound traffic policies restrict the capabilities of incoming threats. Outbound traffic policies reduce the risk of intentional data exfiltration. Yet many organisations chose to only set inbound policies. This could be for many reasons, but outbound policies are a lot more complex and time-intensive to configure. They also require constant maintenance. A single misconfiguration in a firewall policy could prevent legitimate traffic from going to its destination.

 

ZORB contributes to this control by overcoming these outbound configuration challenges, to provide equivalent functionality of an outbound firewall (albeit with more granular control and stronger protection) without the upkeep overheads.

 

ZORB allows you to demonstrate:

• • Organisations with a boundary firewall have restricted outbound network traffic at the device level.
  • Organisations without a boundary firewall have restricted outbound network traffic at the device level.
  • Outbound data flow policies have been implemented for cloud services

 

2)  Secure configuration

One aim of this theme is to “reduce vulnerabilities in computers and network devices that allow unauthorised access to sensitive information.” Vulnerabilities due to hardware or software weaknesses, or device misconfiguration are exactly what a hacker targets to gain access to a network or a device. The emphasis is on REDUCING vulnerabilities. Indeed, it may not be possible to entirely eliminate all vulnerabilities. Some vulnerabilities may not have been identified by the vendor. Or a patch might not have been made available yet. Even with the best will in the world, engineers make mistakes in configurations.

 

ZORB contributes to this control by protecting outbound data when vulnerabilities are unpatched, unknown, or have yet to be identified. Should a device become compromised, we prevent data exfiltration by monitoring where data has come from and where it is going.

 

ZORB allows you to demonstrate:

• • Should a SaaS product be vulnerable, data is only sent to the SaaS provider and no other third-party.
  • For remote/hybrid workers, data is only sent via the VPN (to the HQ or SaaS provider) and the VPN is not being bypassed, or data redirected to a third-party.

 

3)  Security update management

This aims to “ensure that devices and software are not vulnerable to known security issues for which fixes are available”.

 

This is sound advice – provided that the update request has been poisoned. This is a common technique where an attacker redirects the request for an update to a malicious third-party masquerading as the legitimate vendor.

 

ZORB contributes to this control by validating the legitimacy of update requests.

 

ZORB allows you to demonstrate:

• • Updates are requested from the legitimate vendor and have not been poisoned.
  • Where a security update is not yet available, sensitive business information is not being sent to malicious third parties.