The dynamic nature of cyber security requires constant adjustments and course corrections to address the latest threats. Businesses and governments are accustomed to broad stroke changes occurring every few years, but rarely are recommendations made that are very precise to manage specific threats.
In October 2014, BeyondTrust responded to the Australian Signals Directorate (ASD) Top 4 recommendations with a blog and white paper that addressed how to mitigate the most common cyber security risks for information technology using BeyondTrust solutions. This month, the ASD has created an addendum called the Essential Eight that provides specific recommendations, on top of the Top 4, to combat modern malware, incidents, and data recovery.
The goal of addendum is to provide a practical prioritized list of guidance to manage risk and minimize the success of a breach. It complements the established 35 best practice mitigation recommendations and maturity model recommended by the ASD and inserts these new four recommendations between the Top 4 and remaining 31 recommendations.
The Essential Eight is the existing Top 4, plus 4 new ASD recommendations
Australian Signals Directorate Top 4 (Existing)
- Application allow listing of permitted/trusted programs, to prevent execution of malicious or unapproved programs including executables. Scripts, and installers.
- Patch applications - e.g. Java, PDF viewer, Flash, web browsers and Microsoft Office. Patch/mitigate systems with "extreme risk" vulnerabilities within two days. Use the latest version of applications.
- Patch operating system vulnerabilities. Patch/mitigate systems with "extreme risk" vulnerabilities within two days. Use the latest suitable operating system version. Avoid Microsoft Windows XP.
- Restrict administrative privileges to operating systems and applications based on user duties. Such users should use a separate unprivileged account for email and web browsing.
Essential Eight (Top 4 plus 4 New Ones)
- Disable untrusted Microsoft Office Macros so malware cannot run unauthorized routines.
- Block Web browser access to Adobe Flash, web advertisements, and untrusted Java code on the Internet. If possible, uninstall all browser plugins that are not required.
- Multi-factor authentication for all systems when possible to make it harder for an adversary to access a system and information
- Daily backup of important data securely and offline to ensure even if data is compromised, protected versions are available for recovery.
These new essential recommendations are a simple course correction for the ASD to address modern threats like ransomware and drive by web attacks. BeyondTrust can help assess systems that may not be compliant to these recommendations and aid with privileged access management to secure assets and data with existing (or new) multi-factor authentication initiatives. For more information, contacts us today.
Morey J. Haber, Chief Security Officer, BeyondTrust
Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four books: Privileged Attack Vectors, Asset Attack Vectors, Identity Attack Vectors, and Cloud Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.
