CYBER SECURITY
Essential Eight
The ACSC Essential Eight is a cyber security framework from the Australian Cyber Security Centre. It sets out eight baseline strategies, including patching, application control, access management and backups, to cut the risk of cyber attacks and keep your business resilient.
What is the ACSC Essential Eight?
The Essential Eight is a set of baseline mitigation strategies developed by the Australian Cyber Security Centre (ACSC). They are drawn from its Strategies to Mitigate Cyber Security Incidents and come with a maturity model, so you can measure how well each strategy is implemented in your business.
We believe cyber security should be accessible to every business. Our Essential Eight auditing and reporting services come in a range of packages designed to suit the smallest operation through to the largest enterprise.
The eight strategies
Each strategy shuts down a common way for attackers to get in or cause damage. Here is what each one means in practice.
01
Application control
Control which applications can run on your workstations, so staff cannot execute unapproved or malicious programs. This covers executables, DLLs, scripts and installers.
02
Patch applications
Keep third-party applications such as web browsers, Microsoft Office and PDF viewers up to date. Vulnerability scanning finds missing patches, and software the vendor no longer supports should be removed or replaced.
03
Restrict Microsoft Office macros
Block macros by default for most users. Only allow vetted macros, either from trusted locations with limited write access or digitally signed with a trusted certificate.
04
User application hardening
Reduce the attack surface of everyday software. Block web ads and Java in browsers, and disable unneeded features in Microsoft Office, browsers and PDF viewers, with users unable to change these settings.
05
Restrict administrative privileges
Manage administrative access tightly, based on user duties. Revalidate privileged access regularly, keep privileged accounts off the internet, and never use them for email or web browsing.
06
Patch operating systems
Keep operating systems up to date, with patches applied within the timeframes in the maturity model. Critical and actively exploited vulnerabilities come first, and unsupported operating systems get replaced.
07
Multi-factor authentication
Enforce MFA for all privileged access and for remote access such as VPN, RDP and SSH. Maturity starts with MFA for every user before they reach internet-facing services and third-party providers.
08
Regular backups
Back up important data, software and configuration settings regularly. Keep backups disconnected from the internet, restrict users to their own backups, and test restoration as part of your disaster recovery exercises.
How we can help
From the first assessment through to ongoing reporting, we make the Essential Eight practical for your business.
Gap assessment
We assess your environment against the Essential Eight and show you exactly where you sit today.
Remediation roadmap
You get a prioritised plan to close the gaps, built around your business and the maturity level you are aiming for.
Auditing and reporting
Auditing and reporting services in a range of packages, from the smallest operation through to the largest enterprise.
Questions about the Essential Eight?
Talk to our team about where your business sits today and what it takes to get where you need to be.