The ‘Essential Eight’ is no longer relevant….

...or is it even more relevant today?

The expression ‘May you live in interesting times’ is claimed to be an English translation of a traditional Chinese curse. At face value this appears to be a blessing, however such ‘interesting times’ are usually times of turmoil.

The past year has certainly been ‘interesting’, from global ravages of the pandemic, political upheaval and natural disasters such as the one in New South Wales Australia at the moment.

Even though the turmoil is highly unsettling, this is no time to ‘take your eye off the ball’- to use another saying.

‘The Essential Eight’ was developed by the Australian Cyber Security Centre (ACSC) to help organisations mitigate occurrences caused by cyber threats, and form a solid foundation for all organisations.

This valuable, free resource defines eight of the most effective strategies along with three maturity levels for each.

Application control prevents the execution of unapproved/malicious programs.

Patch applications with ‘extreme risk’ vulnerabilities within 48 hours. Use the latest version of applications where possible.

Configure MS Office macro settings to block macros from the Internet. Allow only vetted macros either in ‘trusted locations’ with restricted write access, or digitally signed with a trusted certificate.

User application hardening, configure web browsers to block or uninstall Flash and Java on the Internet. Disable unneeded features in Web browsers, MS Office and PDF viewers.

Restrict admin privileges to operating systems and apps based on user duties. Reevaluate the need for privileges regularly.

Patch operating systems with ‘extreme risk’ vulnerabilities within 48 hours. Use the latest operating system version where possible.

Use multi-factor authentication for users performing a privileged action or access a sensitive/high-availability data repository.

Create daily backups of important new or changed data, software and configuration settings. Store these in a disconnected, ‘off network’ location, and retain them for at least three months. Test restores at the start of your backup regime, annually and as infrastructure changes.

The maturity levels are defined as:

Level One: Partly aligned with the intent of the mitigation strategy.

Level Two: Mostly aligned with the intent of the mitigation strategy.

Level Three: Fully aligned with the intent of the mitigation strategy.

Where does your organisation lie?

https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model