Your comprehensive guide to the Essential Eight Maturity Model

In FY 2023, the Australian Signals Directorate (ASD) reported 1,100 cybercrime incidents, alongside 94,000 incidents reported via ReportCyber. The average cost per attack rose by 14%, with small businesses facing an average loss of $46,000 and large businesses $71,600.?

Only two weeks after this report, the Australian Signals Directorate (ASD) published updates to the Essential Eight Maturity Model to support organisations in further strengthening their cyber security posture and minimising financial damages. These updates, along with the ASD’s latest statistics, signify that it is time to align your business with the Essential Eight as a starting point. Even if you have implemented this model before, with the recent changes, now is a good time to revisit your controls and prepare your business for 2024.

What are the Essential Eight?

The Australian Signals Directorate (ASD) developed the Essential Eight Maturity Model to guide organisations in enhancing their cyber defences. It outlines eight critical strategies across four maturity levels to protect against cyber threats and improve overall cyber security resilience. The ASD’s Strategies to Mitigate Cyber Security Incidents recommends organisations implement the Essential Eight as a baseline.

The Essential Eight provides a structured approach for organisations to improve cyber security maturity. Each element maps to specific points in the Information Security Manual (ISM) to further support alignment. The ASD has provided a comprehensive list mapping these controls.

Patch applications

Timely application patching prevents threat actors from exploiting vulnerabilities. Regular updates ensure your enterprise’s software infrastructure remains resilient against evolving cyber threats. You must update high-risk applications within two weeks of a new patch release and complete a daily scan for vulnerabilities in online services.

Patch operating systems

An outdated operating system (OS) becomes an open door for cyber criminals. Similarly to patching applications, updating operating systems prevents threat actors from exploiting vulnerabilities. Patching operating systems also improves performance, contributes to overall business efficiency and reduces the risk of operational disruptions.

Multi-factor authentication

MFA is an additional security layer if a threat actor compromises someone’s password. People must provide further evidence to verify their identity, such as a code sent to a mobile number or biometric data. It is one of the most straightforward steps to meeting the Essential Eight and reduces the risk of unauthorised access to sensitive corporate data.

Restrict administrative privileges

Limiting administrative privileges to only essential personnel and only to the functions that are required minimises internal security risks. Similarly to how we once locked filing cabinets with sensitive data, restricting administrative privileges ensures that only approved personnel can access and alter parts of your IT infrastructure.

Application control

Application control specifies a verified list of safe software that people can run and execute. It ensures that employees can only install and use pre-approved applications, preventing people from using unauthorised or potentially harmful software.

Restrict Microsoft Office macros

Restricting the use of Microsoft Office macros prevents document-based malware. For instance, a macro in an Excel file might contain malicious code. Allowing only trusted macros protects your enterprise from sophisticated cyber-attacks that exploit Microsoft Office programs.

User application hardening

Strengthening your applications against attacks is a proactive security measure. Your organisation should disable unnecessary features and regularly update applications with the latest security patches. Users should not be able to alter security settings, ensuring consistent protection.

Regular backups

Regular backups of critical data, applications, and settings are essential for operational resilience. These backups should be tested regularly for reliability and availability, ensuring your organisation can use them in case of a data loss incident. This practice helps in mitigating the impact of data breaches or system failures.

Understanding the four maturity levels

The Essential Eight uses four maturity levels to help organisations gauge the controls required based on their risk profile. It is best to identify the maturity level most suited to your organisation and incrementally add controls until you achieve that level across each of the Essential Eight.

Level 0

At Level 0, an organisation has weaknesses that make it easy for threat actors to compromise systems and data. This level reflects a minimal or non-existent cyber security posture, offering little to no defence against even the most common attacks.

Level 1

At Level 1, opportunistic threat actors could use commodity tradecraft or publicly known vulnerabilities to execute an attack. The organisation might have adopted some cyber security measures to prevent these attacks, but their controls may not be sufficient to guard against more sophisticated attacks, such as targeted phishing or advanced persistent threats (APTs).

Level 2

Organisations at Level 2 have implemented controls to protect against threat actors willing to invest more time exploiting a target. For example, they might execute sophisticated phishing and social engineering to breach their targets and plant malicious applications in their business systems. At Level 2, the organisation’s cyber security practices may deter these attacks, but there will still be gaps for advanced threat actors to exploit.

Level 3

At Level 3, an organisation has strengthened their controls enough to deter sophisticated threat actors who make targeted attempts to infiltrate and then dwell in their targets’ systems. These threat actors tend to target specific organisations rather than using commodity tradecraft to opportunistically exploit a company. Maturity level 3 indicates comprehensive protection against these attacks.

What are the benefits of aligning with the Essential Eight?

Aligning with the Essential Eight provides the following benefits:

Improved compliance and trust

The Essential Eight is often a requirement for organisations that work with Defence or receive government funding.?

While it does not result in a formal certification, demonstrating adherence to these standards can significantly boost trust among partners and clients. Increasingly, enterprises are asking for these controls of their suppliers and partners as part of their supply chain risk management.

Enhanced cyber security posture

Adopting the Essential Eight strengthens your organisation’s cyber security posture through fundamental controls that significantly reduce risk. The framework provides a solid baseline for protecting data, systems and operations by effectively implementing and managing cyber security.

Resilience against evolving threats

The Essential Eight serves as a starting point and a foundation for ongoing security enhancement that helps your business build resilience against evolving cyber threats. The ASD updates the Essential Eight regularly. Even if you have implemented the framework in the past, regular risk assessments will pinpoint areas where you do not meet new requirements. This focus on continual improvement and assessments is key to maintaining robust defences as cyber threats change.

What challenges prevent alignment with the Essential Eight?

While we highly recommend adopting the Essential Eight Maturity Model, it is also important to note that it comes with challenges.

Complexity and technical expertise

Aligning your business with the Essential Eight can be complex and requires technical expertise to audit your current setup and establish the required controls. Implementing the Essential Eight Maturity Model requires a deep understanding of the organisation’s IT infrastructure and the controls needed. This can become a significant hurdle for businesses without cyber security expertise.

Resource allocation

Allocating sufficient resources, particularly IT staffing and budget, can become another major challenge. For organisations with internal IT teams, the costs associated with implementing and maintaining the Essential Eight can be substantial. These costs include the initial setup and the ongoing expenses related to dedicated effort and resources to ensure the security controls remain effective and up-to-date.?

Impact on employees

Restricting administrative privileges and controlling application access can significantly impact people’s workflow. As such, any controls you implement in line with the Essential Eight must balance security and usability. In addition, your organisation will need to educate staff on these controls to ensure compliance and minimise disruption to business operations.

Conclusion

The Essential Eight Maturity Model guides your business on systematically improving cyber security controls. Each control contributes to strengthening defences, with the four maturity levels ranking the strength of your organisation’s defences against varying levels of cyber attacks.

Adopting the Essential Eight can improve compliance where necessary, demonstrate trust to partners and customers, enhance cyber security posture and build resilience against evolving threats. Adopting the Essential Eight also involves challenges, such as gaining the right technical expertise, allocating resources and minimising the impact on your team. The right partner can overcome these challenges for you.

How RODIN aligns your business with the Essential Eight

Navigating the latest updates and aligning your business with the Essential Eight Maturity Model can be complex, but RODIN can assist. Our certified Essential Eight assessors offer comprehensive assessments and testing to align your organisation with the current requirements. We focus on implementing the Essential Eight while minimising impact on your users and operations.

Our Secured Managed Services simplify the alignment process and offer continuous management of your cyber security needs. Visit our Cyber Security Services page to start your journey.