Australian Signals Directorate Essential Eight Explained

The dynamic nature of cyber security requires constant adjustments and course corrections to address the latest threats. Businesses and governments are accustomed to broad stroke changes occurring every few years, but rarely are recommendations made that are very precise to manage specific threats.

In October 2014, BeyondTrust responded to the Australian Signals Directorate (ASD) Top 4 recommendations with a blog and white paper that addressed how to mitigate the most common cyber security risks for information technology using BeyondTrust solutions. This month, the ASD has created an addendum called the Essential Eight that provides specific recommendations, on top of the Top 4, to combat modern malware, incidents, and data recovery.

The goal of addendum is to provide a practical prioritized list of guidance to manage risk and minimize the success of a breach. It complements the established 35 best practice mitigation recommendations and maturity model recommended by the ASD and inserts these new four recommendations between the Top 4 and remaining 31 recommendations.

The Essential Eight is the existing Top 4, plus 4 new ASD recommendations

Australian Signals Directorate Top 4 (Existing)

1. Application allow listing of permitted/trusted programs, to prevent execution of malicious or unapproved programs including executables. Scripts, and installers.
2. Patch applications - e.g. Java, PDF viewer, Flash, web browsers and Microsoft Office. Patch/mitigate systems with "extreme risk" vulnerabilities within two days. Use the latest version of applications.
3. Patch operating system vulnerabilities. Patch/mitigate systems with "extreme risk" vulnerabilities within two days. Use the latest suitable operating system version. Avoid Microsoft Windows XP.
4. Restrict administrative privileges to operating systems and applications based on user duties. Such users should use a separate unprivileged account for email and web browsing.

Essential Eight (Top 4 plus 4 New Ones)

1. Disable untrusted Microsoft Office Macros so malware cannot run unauthorized routines.
2. Block Web browser access to Adobe Flash, web advertisements, and untrusted Java code on the Internet. If possible, uninstall all browser plugins that are not required.
3. Multi-factor authentication for all systems when possible to make it harder for an adversary to access a system and information
4. Daily backup of important data securely and offline to ensure even if data is compromised, protected versions are available for recovery.

These new essential recommendations are a simple course correction for the ASD to address modern threats like ransomware and drive by web attacks. BeyondTrust can help assess systems that may not be compliant to these recommendations and aid with privileged access management to secure assets and data with existing (or new) multi-factor authentication initiatives. For more information, contacts us today.