Module 9 · 9.3

English

Nederlands English Deutsch

Your own security check and plan

Module 9: Rules and organisation · Reading time: 12 minutes

Learning objective: After this lesson, you can do your own security check using a fixed list and turn it into a priority plan.
Key concepts: basic measures, baseline, prioritising (likelihood x impact, quick and cheap first), owner and date, annual repeat

From knowing to doing

You've seen a lot in this course: passwords, phishing, email and domain, devices, backups, permissions, incidents and rules. The risk now is that you start a bit of everything and finish nothing. This lesson turns it all into two things you make yourself:

a baseline: an honest picture of where things stand now;
a plan: what you do first, who does it and when it's done.

The list below contains the basic measures: the measures that stop most opportunistic attacks (lesson 1.1) and that a client usually asks for too when they set requirements for their suppliers (lesson 9.1). It isn't a full standard like ISO 27001, and it doesn't need to be. It's the baseline that makes the difference at a small business.

The security check: twenty points

Answer each point with yes, partly or no. Be strict: "I think so" is "partly". Each point shows the lesson where you learned it.

Accounts and logging in

No.	Point	Lesson
1	There is an overview of all accounts, devices, websites, domains and suppliers, with an owner for each item. Anything no longer in use has been removed.	1.1, 7.2
2	Everyone uses a password manager and has a unique, long password per service. No passwords are shared by email or chat.	2.1, 2.2
3	Two-factor authentication (2FA) is switched on for email, bank, accounting, hosting, registrar and social media; for administrators, preferably a phishing-resistant form such as a passkey or security key.	2.3, 2.4
4	Recovery codes and spare keys are stored safely and you know what to do if a phone is lost.	2.3, 2.4
5	You've checked whether business addresses appear in known breaches, and you know how to revoke sessions and check forwarding rules.	1.4, 2.5

People and processes

No.	Point	Lesson
6	There is a payment procedure: calling back on a known number if account numbers change, and a second person for large or unusual payments.	1.2
7	Everyone can recognise phishing by the real domain of a link and knows what to do after a click.	3.1 to 3.5
8	There's one reporting point with a backup, reporting happens without blame, and there's a short refresher at least a few times a year.	9.2

Email, website and domain

No.	Point	Lesson
9	Your domain has SPF, DKIM and DMARC, and DMARC is set at least to `p=none` with a plan to move to `quarantine` or `reject`.	4.1
10	Your website works everywhere over https with a valid certificate, redirects http, and the CMS with plugins is kept up to date. HSTS and security headers are switched on or have been deliberately considered.	4.2
11	Your domain's owner details are correct, auto-renew is switched on, the registrar has 2FA, there are no dangling DNS records, and DNSSEC is switched on where possible.	4.3

Devices and network

No.	Point	Lesson
12	Updates are switched on automatically for operating systems, apps and plugins; the router, NAS and printer are also kept up to date; nothing is still running that no longer gets updates.	5.1
13	Laptops and phones have screen locks and disk encryption, can be wiped remotely, and no one works day to day with an administrator account.	5.2
14	The wifi uses WPA2 or WPA3, the router's default password has been changed, and guests and smart devices are on a guest network.	5.3

Backups

No.	Point	Lesson
15	There's a backup of everything important, including mail and cloud services, following the 3-2-1 rule.	6.1
16	At least one copy is offline or immutable and has its own login that isn't used on work computers.	6.2
17	A restore test has been done in the past year, and you know how much work you can afford to lose and how quickly things need to be back.	6.3

Access, suppliers and incidents

No.	Point	Lesson
18	Everyone has their own account with only the permissions they need, administrator accounts are separate, and when someone leaves, all access is revoked the same day.	7.1
19	Important suppliers and cloud services have been assessed, there are data processing agreements where needed, and files are shared with links that have an expiry date.	7.2, 7.3
20	There's a paper incident card on the wall, there's a data breach register, and you know when to report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), the Dutch police, and, if it applies to you, the National Cyber Security Centre (NCSC).	8.1, 8.2, 8.3, 9.1

Count your answers. A lot of "no" is no reason to panic: it's your starting point. That's why it's called a baseline.

Part of it can be checked automatically

A few points can be measured from outside, because they concern public data about your domain: point 9 (SPF, DKIM, DMARC), point 10 (https, certificate, HSTS, headers) and point 11 (DNSSEC, nameservers, expiry date). In exercise A9.3 you do this in one go for your own domain, using the same checks as in the exercises in module 4. Independent tests such as https://internet.nl and the public checks at https://www.weboke.cz/en/domain-health and https://www.weboke.cz/en/email-check look at similar points.

Note: a green result on those points says nothing about the other seventeen. Your domain can be perfectly set up while your mailbox has a password from a breach. The automatic check is part of the baseline, not a replacement for it.

From check to plan: prioritising

You may now have eight or ten points marked "no" or "partly". You can't do everything at once. You choose the order using two questions.

1. How big is the risk? Use likelihood x impact (lesson 1.1). A point that opportunistic attacks target, such as reused passwords without 2FA or a website without updates, has a high likelihood. A point that would shut down your whole business if it went wrong, such as a backup that doesn't work, has a high impact.

2. How much effort does it take? Some measures cost an hour and nothing else, such as switching on two-factor authentication or agreeing a payment procedure. Others take weeks, such as replacing all laptops.

Put the points into a simple grid:

	Little effort	A lot of effort
High risk	Do now (this week)	Plan it (this quarter)
Low risk	Fit it in when convenient	Later or accept deliberately

The rule is: quick and cheap first, provided the risk is high. For most small businesses, the "do now" box ends up containing: two-factor authentication on mail and bank (3), the payment procedure (6), switching on automatic updates (12), and checking whether a backup copy is kept out of reach (16).

Accepting deliberately

You're also allowed to accept a risk: you decide not to fix it, because the risk is small or the cost too high. That's a valid choice, as long as you make it deliberately and write it down. "Forgetting" is not acceptance.

An owner and a date per point

A plan without names goes nowhere. Give each point:

an owner: one person who makes sure it happens. That doesn't have to be the person who does the work; the IT company can do the work, but someone in your own business checks that it's done;
a date: when it needs to be finished;
a definition of done: how do you know it's finished? Not "sort out 2FA", but "2FA is switched on for the five accounts on the list, recovery codes are in the safe".

An example of three lines from the plan of Bakkerij Example:

Point	Action	Owner	Done by	Done when
3	2FA on mail, bank, accounting and registrar	Petra	in 1 week	Switched on for all four, recovery codes in the password manager and on paper in the safe
6	Payment procedure on A4, discussed with Joost and Sanne	Petra	in 2 weeks	A4 sheet is on the wall by the office, both have read it
16	Weekly copy to a drive that then goes loose into the safe	Joost	in 1 month	First three weeks done, one file restored as a test

Repeating

Security is never finished. There are new employees, new services, new devices and new tricks. So agree to do:

the full check again every year, in a fixed month, and update the plan;
the check in between for big changes: a new web developer, a move to new hosting, new accounting software, a growth spurt;
a review of the relevant points after an incident (lesson 8.3).

Keep the results of each check. Then after a year you'll see in black and white what's improved, and you'll have an answer when a client asks how your security is doing. The NCSC also has its own Cyberveilig Check for sole traders and SMEs, which you can use alongside this list; it produces an action list.

Summary

A baseline with twenty fixed points gives an honest picture; each point refers to the lesson where you learned it.
Part of it (email, website, domain) can be checked automatically, but that says nothing about the other points.
Prioritise using likelihood x impact and effort: high risk with little effort first.
Each point in the plan gets an owner, a date and a definition of done; accepting is allowed, but deliberately and on paper.
Repeat the check every year and after big changes, and keep the results.

Quiz

Exercise

Exercise A9.3: The automatic check of your domain. Enter your own domain. The tool checks email (SPF, DKIM, DMARC), website (https, certificate, redirects, HSTS, headers) and domain (nameservers, DNSSEC, expiry date) all at once and shows which points of the security check are green, orange or red.

Exercise D9.3: Your security check and plan. Do the twenty-point check for your own business. Then choose at least five points, place them in the risk and effort grid, and make a plan with an owner, a date and a definition of done for each point. Put a reminder in your calendar for when you'll do the check again.

Exercise D9.3: Your security check and plan

Here's how to go about it: (1) Go through the twenty points from the lesson and fill in for each one: yes, partly or no. For points 9, 10 and 11, use the result from A9.3 (the button takes over the red and orange points). (2) Place every point marked "partly" or "no" in the risk (big/small) and effort (little/much) table. (3) Choose at least five points. Start with the boxes "big risk, little effort". (4) Give each chosen point an action, an owner, a date and a definition of done. (5) Write down which points you're consciously accepting, with the reason. (6) Put a fixed month in your calendar for the next full check, and write down which changes would make you check again sooner. (7) Save the result (the course saves your completed check if you want it to; only yes/partly/no per point and your plan, no other data).

All twenty points have been filled in.
The points marked "partly" or "no" are placed in the risk and effort table.
At least five points have an action, owner, date and definition of done.
Consciously accepted risks are written down with a reason.
The next check is in the calendar.

Which point surprised you most in the baseline check?

Which point from "big risk, little effort" can you finish this week?

If a big client asked tomorrow how your security stands (lesson 9.1), which three points would you most like to already have on "yes"?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing