What are the Essential 8 in cyber security?

The Essential 8 cyber security framework, developed by the Australian Cyber Security Centre (ACSC), is a prioritised list of eight mitigation strategies designed to enhance an organisation’s resilience against various cyber threats. This framework is Essential for safeguarding sensitive data and maintaining robust security systems. In this article, we delve into what is the Essential 8, its significance, and how it forms a part of the broader strategies to mitigate cyber threats.

Why implement the Essential 8 security controls?

The ACSC’s Essential 8 list forms the core of the strategies to mitigate cyber security incidents. Implementing these controls is crucial for any organisation looking to safeguard against targeted cyber intrusions, ransomware, and threats from malicious insiders. This framework not only protects customer data but also ensures compliance with Australian government regulations.

Federal and NSW Government mandatory requirements

Initially published in February 2017, the Essential 8 was mandated by the Australian Federal Government for federal departments, with additional requirements set by the Attorney-General’s Department’s PSPF (Protective Security Policy Framework). The Australian Signals Directorate (ASD) endorses the Essential 8 as a cyber resilience baseline for all organisations, a stance reinforced in the December 2019 release of the Australian Government Information Security Manual (ISM).

Understanding maturity levels in the Essential 8 framework

The ASD Essential 8 maturity checklist or the Essential Eight Maturity Model comprises three levels, each indicating the degree of alignment with the intended mitigation strategy:

• Maturity level one: Partial alignment.
• Maturity level two: Substantial alignment.
• Maturity level three: Full alignment.

Organisations are advised to aim for Maturity Level Three to ensure optimal security.

The Essential 8 explained: Strategies for enhanced cyber security

1. Application control: Prevents execution of unapproved or malicious programs, including .exe, scripts, and installers. Key to stopping non-approved applications from executing.
2. Patch applications: Involves patching applications like Flash, web browsers, and Microsoft Office. Critical to mitigate ‘extreme risk’ vulnerabilities within 48 hours.
3. Configure Microsoft Office Macro settings: Blocks macros from the internet and allows only vetted macros, thereby preventing malicious code execution.
4. User application hardening: Configures web browsers to block or uninstall Flash, ads, and Java, reducing the risk of malicious code execution.
5. Restrict administrative privileges: Based on user duties, this strategy limits access to systems such as administrator accounts to essential personnel only, a critical step in protecting sensitive information.
6. Patch operating systems: Ensures that operating systems are up-to-date and patches ‘extreme risk’ vulnerabilities promptly.
7. Multi-factor authentication: Strengthens user authentication to protect against unauthorised access to sensitive data.
8. Daily Backups: Involves daily backups of critical data, ensuring data availability post-cybersecurity incidents like ransomware attacks. Essential for effective incident response.

Aiming for higher maturity levels

Organisations should strive to reach maturity level three across all Essential 8 strategies. The ACSC offers tailored advice for those needing to exceed this level, ensuring a customised approach to cyber security. Achieving this level significantly makes it harder for adversaries to exploit vulnerabilities.

Further resources and compliance

The Australian Government’s ISM offers additional guidelines on protecting sensitive information. For alternative guidance, the Center for Internet Security (CIS) publishes the CIS critical security controls for effective cyber defense.

Get your free ISO 27001 Gap Analysis Checklist

To further strengthen your organisation’s cyber security posture, consider conducting an ISO 27001 Gap Analysis. This checklist will help you identify areas for improvement in line with international standards and JAS-ANZ accreditation.

By adopting the Essential 8 cyber security strategies and understanding what Essential 8 is, organisations can significantly enhance their ability to mitigate cyber security incidents, ensuring compliance with the Australian Signals Directorate (ASD) and ACSC Essential 8 requirements. Remember, the Essential 8 maturity checklist is a valuable tool in assessing and improving your organisation’s cyber security maturity levels.