Australian Signals Directorate Essential Eight Explained

Morey Haber, Chief Technology Officer
February 8th, 2017

Australian Signals Directorate Essential Eight Explained

The dynamic nature of cyber security requires constant adjustments and course corrections to address the latest threats. Businesses and governments are accustomed to broad stroke changes occurring every few years, but rarely are recommendations made that are very precise to manage specific threats.

In October 2014, BeyondTrust responded to the Australian Signals Directorate (ASD) Top 4 recommendations with a blog and white paper that addressed how to mitigate the most common cyber security risks for information technology using BeyondTrust solutions. This month, the ASD has created an addendum called the Essential Eight that provides specific recommendations, on top of the Top 4, to combat modern malware, incidents, and data recovery.

The goal of addendum is to provide a practical prioritized list of guidance to manage risk and minimize the success of a breach. It complements the established 35 best practice mitigation recommendations and maturity model recommended by the ASD and inserts these new four recommendations between the Top 4 and remaining 31 recommendations.

The Essential Eight is the existing Top 4, plus 4 new ASD recommendations

Australian Signals Directorate Top 4 (Existing)

  1. Application whitelisting of permitted/trusted programs, to prevent execution of malicious or unapproved programs including executables. Scripts, and installers.
  2. Patch applications – e.g. Java, PDF viewer, Flash, web browsers and Microsoft Office. Patch/mitigate systems with “extreme risk” vulnerabilities within two days. Use the latest version of applications.
  3. Patch operating system vulnerabilities. Patch/mitigate systems with “extreme risk” vulnerabilities within two days. Use the latest suitable operating system version. Avoid Microsoft Windows XP.
  4. Restrict administrative privileges to operating systems and applications based on user duties. Such users should use a separate unprivileged account for email and web browsing.

Essential Eight (Top 4 plus 4 New Ones)

  1. Disable untrusted Microsoft Office Macros so malware cannot run unauthorized routines.
  2. Block Web browser access to Adobe Flash, web advertisements, and untrusted Java code on the Internet. If possible, uninstall all browser plugins that are not required.
  3. Multi-factor authentication for all systems when possible to make it harder for an adversary to access a system and information
  4. Daily backup of important data securely and offline to ensure even if data is compromised, protected versions are available for recovery.

These new essential recommendations are a simple course correction for the ASD to address modern threats like ransomware and drive by web attacks. BeyondTrust can help assess systems that may not be compliant to these recommendations and aid with privileged access management to secure assets and data with existing (or new) multi-factor authentication initiatives. For more information, contacts us today.

 

Morey Haber, Chief Technology Officer

With more than 20 years of IT industry experience and author of Privileged Attack Vectors, Mr. Haber joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. He currently oversees BeyondTrust technology for both vulnerability and privileged access management solutions. In 2004, Mr. Haber joined eEye as the Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was a Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. Mr. Haber began his career as a Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelors of Science in Electrical Engineering from the State University of New York at Stony Brook.