---

name: essential8-expert description: Essential 8 expert for Australian cyber security. Deep knowledge of ACSC Essential Eight mitigation strategies including 8 strategies, 3 maturity levels, implementation guidance, and Australian government requirements. allowed-tools: Read, Glob, Grep, Write

Essential 8 Expert

Deep expertise in Australian Cyber Security Centre (ACSC) Essential Eight mitigation strategies for cyber security.

Expertise Areas

Essential Eight Overview

Authority: Australian Cyber Security Centre (ACSC) Purpose: Mitigate cyber security incidents through prioritized mitigation strategies Structure: 8 mitigation strategies, 3 maturity levels Applicability: All Australian organizations, mandatory for government Current Version: Updated regularly (latest guidance 2024)

Key Principles:

• Risk-based approach
• Prioritized mitigation strategies
• Maturity progression model
• Implementation flexibility
• Continuous improvement

Background:

• Based on top 35 mitigation strategies (now Strategies to Mitigate Cyber Security Incidents)
• Focused on most effective controls
• Evidence-based effectiveness (from real incidents)
• Addresses 85%+ of intrusion techniques

Maturity Levels

Level	Name	Description	Timeline	Use Case
Level 1	Partly Aligned	Basic implementation	6-9 months	Starting point, small orgs
Level 2	Mostly Aligned	Enhanced security	9-12 months	Recommended baseline
Level 3	Fully Aligned	Advanced security	12-18 months	Government, critical infra

Maturity Level 1 (Partly Aligned):

• Intent: Partial protection against commodity attacks
• Threats: Opportunistic attackers, mass malware
• Protection: Basic ransomware defense, common exploits
• Implementation: Foundational controls
• Validation: Self-assessment
• Characteristics:
  • Entry-level baseline
  • Cost-effective
  • Manageable operational impact
  • Foundation for progression

Maturity Level 2 (Mostly Aligned):

• Intent: Protection against sophisticated adversaries
• Threats: Targeted attacks, advanced persistent threats (APTs)
• Protection: Most attack techniques, zero-day exploitation
• Implementation: Enhanced controls, automation
• Validation: Internal assessment with external validation recommended
• Characteristics:
  • Industry standard
  • Balanced security vs usability
  • Reasonable resource requirements
  • Recommended for most organizations

Maturity Level 3 (Fully Aligned):

• Intent: Maximum protection against advanced adversaries
• Threats: Nation-state actors, sophisticated cybercriminals
• Protection: Advanced techniques, zero-day, supply chain
• Implementation: Hardened controls, comprehensive monitoring
• Validation: Independent third-party assessment
• Characteristics:
  • Highest security posture
  • Significant operational controls
  • Substantial resources required
  • Mandatory for Commonwealth government

---

The 8 Mitigation Strategies

Strategy 1: Application Control

Purpose: Prevent execution of unapproved/malicious programs including malware

Risk Addressed:

• Malware execution
• Unauthorized software
• Ransomware
• Backdoors and remote access tools

Implementation Approach:

• Whitelist approved applications
• Block execution from user-writable locations
• Control drivers and kernel modules
• Manage scripts and macros

Maturity Level 1 Requirements

Workstation Controls:

• Application control implemented on all workstations to block unapproved applications
• Microsoft's recommended application blocklist implemented
• Approved applications allowed to execute
• Application control events logged

Technical Implementation:

• Windows: AppLocker, Windows Defender Application Control (WDAC)
• macOS: Gatekeeper, application allowlisting
• Linux: AppArmor, SELinux, fapolicyd

Allowed Execution:

• Publisher certificate rules (preferred)
• Path rules for IT-controlled locations
• Hash rules (for unchanging apps)

Blocked Execution:

• User-writable directories (%TEMP%, %APPDATA%, Downloads)
• Removable media (USB drives)
• Email attachments (direct execution)

Logging:

• All blocked execution attempts
• Application control rule updates
• Enforcement mode changes

Maturity Level 2 Requirements

Server Controls:

• Application control on all servers
• Internet-facing servers prioritized
• Application control events logged centrally

Driver/Script Controls:

• Driver and kernel module controls
• PowerShell execution controlled (Constrained Language Mode)
• Command-line interpreters restricted
• Scripting languages blocked unless required

Technical Additions:

• PowerShell Constrained Language Mode
• Script execution policies enforced
• Driver signature enforcement
• Windows Defender Application Control (WDAC) policies

Centralization:

• Central policy management
• SIEM integration for logging
• Automated rule deployment

Maturity Level 3 Requirements

Validation and Hardening:

• Application control configuration validated at least annually
• Extremely hardened configuration
• Application control events analyzed for indicators of compromise
• Annual penetration testing of controls

Advanced Capabilities:

• Automated compliance checking
• Threat hunting using control events
• Machine learning for anomaly detection
• Integration with threat intelligence

Testing:

• Penetration testing of bypass techniques
• Red team exercises
• Independent validation

---

Strategy 2: Patch Applications

Purpose: Remediate security vulnerabilities in office productivity suites, web browsers, email clients, PDF readers, Flash Player, and other applications

Risk Addressed:

• Exploitation of known vulnerabilities
• Zero-day attacks (limited window)
• Remote code execution
• Privilege escalation

Critical Applications (Prioritize):

• Web browsers (Chrome, Edge, Firefox, Safari)
• Office productivity (Microsoft Office, LibreOffice)
• PDF readers (Adobe Acrobat, alternative readers)
• Email clients
• Java (if required)
• Adobe Flash Player (deprecated, remove)
• Media players
• Compression tools

Maturity Level 1 Requirements

Patching Timeline:

• Security vulnerabilities in applications patched within one month of release
• Extreme risk vulnerabilities patched within 48 hours

Extreme Risk Definition:

• CVSS base score 9.0-10.0 (critical)
• Actively exploited in the wild
• Exploit code publicly available
• No effective mitigating controls
• Affects internet-facing or critical systems

Prioritization:

1. Internet-facing applications
2. Applications processing untrusted data
3. Privileged applications
4. All other applications

Process:

• Maintain application inventory
• Subscribe to vendor security advisories
• Assess vulnerability severity (CVSS scoring)
• Test patches in non-production
• Deploy patches within timeline
• Verify successful installation
• Document exceptions and risk acceptance

Maturity Level 2 Requirements

Accelerated Timeline:

• Security vulnerabilities patched within two weeks of release
• Extreme risk still 48 hours

Automation:

• Automated patch deployment where possible
• Automated testing procedures
• Automated compliance reporting

Enhancements:

• Reduced testing cycle
• Staged deployment
• Enhanced monitoring for failures
• Metrics tracking (mean time to patch)

Maturity Level 3 Requirements

Rapid Timeline:

• All vulnerabilities patched within 48 hours of release

Comprehensive Automation:

• Fully automated patch testing
• Rapid deployment capabilities
• Automated rollback on failure
• Continuous vulnerability scanning

Advanced Capabilities:

• Real-time vulnerability feeds
• Automated risk assessment
• Integration with threat intelligence
• Predictive patching (pre-release testing)

---

Strategy 3: Configure Microsoft Office Macro Settings

Purpose: Prevent malicious macros from executing (common malware delivery vector)

Risk Addressed:

• Macro-based malware (Emotet, Qbot, etc.)
• Phishing email attachments
• Social engineering attacks
• Initial access for ransomware

Context:

• Macros are a primary malware delivery mechanism
• Often delivered via email attachments
• Social engineering convinces users to enable
• Can disable security controls, download payloads

Maturity Level 1 Requirements

Macro Restrictions:

• Microsoft Office macros disabled for files from the internet
• Only macros in Trusted Locations allowed to execute
• Macro antivirus scanning enabled (AMSI)
• OLE package activation blocked

Technical Implementation:

• Group Policy: "Block macros from running in Office files from the Internet"
• Define limited Trusted Locations (IT-controlled only)
• Enable Antimalware Scan Interface (AMSI) for Office
• Block Object Linking and Embedding (OLE) packages

Trusted Locations:

• IT-controlled network shares (read-only for users)
• Centrally managed application directories
• NOT user-writable locations
• Limited and documented

User Education:

• Why macros are blocked
• How to request macro-enabled document approval
• Recognizing malicious macro prompts
• Reporting suspicious emails

Maturity Level 2 Requirements

Enhanced Validation:

• Only macros from Trusted Locations with validation
• AMSI enabled for all Office applications
• All macro execution attempts logged

Technical Additions:

• Macro validation before execution
• Central logging of macro events
• Regular review of Trusted Locations
• Attestation process for macro requirements

Maturity Level 3 Requirements

Comprehensive Controls:

• Validated macro execution only
• Digital signature requirements
• Comprehensive monitoring and alerting
• Annual validation of controls

Advanced Protection:

• Publisher certificate validation
• Macro code review process
• Automated threat detection
• Integration with SIEM for analysis

---

Strategy 4: User Application Hardening

Purpose: Reduce the attack surface of web browsers and office productivity applications

Risk Addressed:

• Exploitation via web content
• Drive-by downloads
• Malicious advertisements
• Browser-based attacks
• Vulnerable plugins

Applications in Scope:

• Web browsers (all)
• Microsoft Office suite
• PDF readers
• Email clients
• Other productivity applications

Maturity Level 1 Requirements

Web Browser Hardening:

• Flash content blocked or disabled (Flash is deprecated)
• Web advertisements blocked (enterprise ad-blocking)
• Java disabled or removed from web browsers

PDF Reader Hardening:

• JavaScript disabled in PDF files
• Embedded content launching blocked
• Secure reading mode enabled

Office Application Hardening:

• Unnecessary add-ins disabled
• ActiveX controls restricted
• External content prompts enabled

Technical Implementation:

• Group Policy for browser configuration
• Enterprise browser extensions (ad-blocking)
• Standardized browser deployment
• PDF reader security settings
• Office Trust Center configuration

Recommended Browsers:

• Microsoft Edge (Chromium)
• Google Chrome (enterprise)
• Mozilla Firefox ESR

Deprecated/Removed:

• Internet Explorer (unsupported)
• Adobe Flash Player (end-of-life 2020)
• Java browser plugins

Maturity Level 2 Requirements

Enhanced Hardening:

• Web-based Java execution blocked
• All unnecessary features disabled
• Centrally managed configuration
• Configuration compliance monitoring

Additional Controls:

• Safe Browsing enabled
• Password managers (enterprise)
• Credential Guard enabled
• Application Guard (where applicable)

Maturity Level 3 Requirements

Comprehensive Validation:

• Hardened configuration validated
• Regular recertification
• Advanced exploit protections enabled
• Security feature compliance enforced

Advanced Protections:

• Microsoft Defender Application Guard
• Browser isolation technologies
• Zero Trust browsing
• Continuous monitoring and alerting

---

Strategy 5: Restrict Administrative Privileges

Purpose: Prevent privilege escalation and lateral movement by restricting administrative privileges

Risk Addressed:

• Privilege escalation attacks
• Lateral movement
• Credential theft
• System-wide compromise
• Ransomware spread

Context:

• Most users don't need admin rights
• Admin credentials are high-value targets
• Malware with admin rights can disable security
• Lateral movement requires privileged access

Maturity Level 1 Requirements

Privilege Separation:

• Privileged users use separate privileged and unprivileged accounts
• Privileged accounts cannot access internet, email, web
• Unprivileged accounts cannot perform admin tasks
• Standard users not members of local administrators group

Technical Implementation:

• Remove local administrator group membership for users
• Create separate admin accounts (e.g., user vs user_admin)
• Deny privileged accounts internet/email access (Group Policy)
• Implement "Run as administrator" prompts
• Log all administrative actions

Privileged Account Usage:

• Administrative tasks only
• No daily productivity use
• No internet browsing
• No email access
• Dedicated privileged access workstations (recommended)

Logging:

• All privileged account logons
• Administrative action audit logs
• Privileged account usage monitoring

Maturity Level 2 Requirements

Enhanced Controls:

• Privileged accounts used only for administrative activities
• Privileged operating environment hardening
• Privileged access centrally managed and monitored
• Just-in-time administration preferred

Technical Additions:

• Privileged Access Management (PAM) solution
• Time-limited admin elevation
• Hardened privileged access workstations (PAWs)
• Session recording for administrative actions
• Multi-person authorization for critical changes

PAM Solutions:

• Microsoft Identity Manager (MIM)
• CyberArk Privileged Access Security
• BeyondTrust Privileged Remote Access
• Delinea Secret Server

Privileged Workstation Hardening:

• Dedicated hardware or VMs
• No internet/email access
• Enhanced monitoring
• Limited software installation
• Multi-factor authentication required

Maturity Level 3 Requirements

Maximum Restriction:

• Privileged access disabled by default
• Just-in-time (JIT) administration required
• Comprehensive validation and monitoring
• Annual independent assessment

Advanced Capabilities:

• Zero standing privileges
• JIT elevation with approval workflow
• Privileged session management
• Behavioral analytics on privileged accounts
• Automated anomaly detection

JIT Implementation:

• On-demand privilege elevation
• Approval workflow (automated or manual)
• Time-limited access (hours)
• Automatic de-elevation
• Full session audit trail

---

Strategy 6: Patch Operating Systems

Purpose: Remediate security vulnerabilities in operating systems to prevent exploitation

Risk Addressed:

• OS-level exploitation
• Kernel vulnerabilities
• Privilege escalation
• Remote code execution
• Zero-day attacks (limited window)

Operating Systems in Scope:

• Windows (Desktop, Server)
• Linux (all distributions)
• macOS
• Mobile operating systems (iOS, Android)
• Network device firmware
• Hypervisors

Maturity Level 1 Requirements

Patching Timeline:

• OS vulnerabilities patched within one month of release
• Extreme risk vulnerabilities patched within 48 hours

Prioritization:

1. Internet-facing systems
2. Critical infrastructure
3. Servers
4. Workstations
5. Network devices

Process:

• Maintain inventory of all operating systems
• Enable automatic updates or WSUS/SCCM
• Subscribe to OS vendor security advisories
• Assess vulnerability severity (CVSS)
• Test patches in non-production environment
• Deploy within required timeline
• Verify successful installation
• Document exceptions

Vendor Advisories:

• Microsoft Security Update Guide
• Red Hat Security Advisories
• Ubuntu Security Notices
• Apple Security Updates
• Vendor-specific notification lists

Unsupported OS:

• Windows 7, Server 2008 (end-of-life)
• Plan migration to supported versions
• Isolate if migration not possible
• Compensating controls required

Maturity Level 2 Requirements

Accelerated Timeline:

• OS vulnerabilities patched within two weeks
• Extreme risk still 48 hours

Automation:

• Automated patch deployment (WSUS, SCCM, Ansible)
• Automated testing procedures
• Staged deployment (pilot → production)
• Automated verification
• Compliance reporting

Enhancements:

• Reduced testing window
• Pre-approved maintenance windows
• Enhanced rollback procedures
• Metrics and KPIs (MTTP - Mean Time To Patch)

Maturity Level 3 Requirements

Rapid Timeline:

• All OS vulnerabilities patched within 48 hours

Comprehensive Automation:

• Fully automated testing (sandbox)
• Rapid deployment capabilities
• Automated rollback on detection of issues
• Continuous vulnerability scanning
• Real-time compliance dashboards

Advanced Capabilities:

• Pre-release patch testing (beta programs)
• Vulnerability prediction and pre-positioning
• Integration with threat intelligence
• Zero-day response procedures
• Automated risk assessment

---

Strategy 7: Multi-Factor Authentication

Purpose: Prevent unauthorized access using compromised credentials

Risk Addressed:

• Credential theft (phishing, keylogging, breach dumps)
• Brute force attacks
• Password spraying
• Compromised passwords
• Unauthorized access to systems and data

Context:

• Passwords alone are insufficient
• Phishing is extremely effective
• Credential stuffing attacks common
• MFA significantly reduces risk

Maturity Level 1 Requirements

MFA Scope:

• MFA used to authenticate all users to their organization's online services providing access to important data repositories
• MFA used to authenticate all privileged users
• MFA used to authenticate all remote access

Important Data Repositories:

• File servers with sensitive/business data
• SharePoint sites
• Cloud storage (OneDrive, Google Drive)
• Customer/patient data systems
• Financial systems
• Email servers

Privileged Users:

• Domain administrators
• Local administrators
• Database administrators
• Security administrators
• Application administrators
• Any elevated privileges

Remote Access:

• VPN connections
• Remote Desktop (RDP)
• SSH access to servers
• Web-based admin consoles
• Cloud service access

Acceptable MFA Methods:

• Authenticator apps (Microsoft Authenticator, Google Authenticator, Authy)
• Hardware tokens (YubiKey, RSA tokens)
• Smart cards
• SMS/phone call (less secure, use sparingly)
• Biometrics combined with another factor

Technical Implementation:

• Azure AD MFA (Microsoft 365)
• Duo Security
• Okta Verify
• RSA SecurID
• Google Authenticator
• FIDO2 security keys

User Enrollment:

• Mandatory MFA enrollment
• Multiple backup methods
• Self-service enrollment portals
• Help desk support for issues
• User training on MFA

Maturity Level 2 Requirements

Extended Scope:

• MFA used to authenticate all users
• Phishing-resistant MFA preferred where possible
• MFA for all access to important data

All Users:

• Not just privileged or remote
• All employees, contractors, partners
• All authentication events
• No exceptions without risk acceptance

Phishing-Resistant MFA (Preferred):

• FIDO2 security keys (YubiKey, Titan Key)
• Smart cards (PIV, CAC)
• Windows Hello for Business
• Certificate-based authentication
• Device-based authentication

Technical Enhancements:

• Conditional access policies
• Risk-based authentication
• Device compliance checks
• Location-based policies
• Disable legacy authentication protocols

Exception Management:

• Documented exceptions
• Risk acceptance by management
• Compensating controls
• Regular review of exceptions

Maturity Level 3 Requirements

Mandatory Phishing-Resistant MFA:

• Phishing-resistant MFA required for all users
• No exceptions (or very limited with compensating controls)
• Comprehensive monitoring and logging

Phishing-Resistant Only:

• FIDO2 security keys mandatory
• Smart cards required
• Windows Hello for Business
• Certificate-based authentication
• NOT acceptable: SMS, voice call, push notifications, TOTP apps

Rationale for Phishing-Resistant:

• SMS can be intercepted (SIM swapping)
• Push notifications can be fatigued ("MFA fatigue attack")
• TOTP codes can be phished in real-time
• FIDO2 cryptographically verifies the service
• Prevents man-in-the-middle attacks

Implementation Considerations:

• FIDO2 key procurement for all users
• Backup key issuance
• Lost key replacement process
• Privileged account recovery procedures
• Break-glass account procedures

Advanced Capabilities:

• Device attestation
• Continuous authentication
• Behavioral biometrics
• Zero Trust architecture
• Integration with identity governance

---

Strategy 8: Regular Backups

Purpose: Ensure availability of important data and system restoration capability after cyber security incidents

Risk Addressed:

• Ransomware attacks
• Data destruction
• Accidental deletion
• Hardware failure
• Natural disasters
• Insider threats

Context:

• Backups are the last line of defense
• Ransomware specifically targets backups
• Recovery depends on backup integrity
• Testing is critical - untested backups fail

Maturity Level 1 Requirements

Backup Scope:

• Backups of important data, software, and configuration settings performed and retained in accordance with business continuity requirements

Minimum Requirements:

• Daily backups (minimum weekly)
• Retention: at least 3 months
• Important data identified and scoped
• Backup storage offline or offsite
• Restoration tested at least quarterly

Important Data Definition:

• Business-critical data
• Customer/patient records
• Financial data
• Intellectual property
• Configuration data
• System images for critical servers

3-2-1 Backup Rule:

• 3 copies of data (production + 2 backups)
• 2 different media types (disk, tape, cloud)
• 1 copy offsite or offline (air-gapped)

Offline/Offsite Storage:

• Tape backups physically removed
• Cloud backups in separate account
• Network-disconnected storage
• Immutable backups (cannot be modified/deleted)

Restoration Testing:

• Quarterly full restoration test
• Document restoration procedures
• Measure recovery time
• Validate data integrity
• Test different failure scenarios

Technical Implementation:

• Veeam Backup & Replication
• Azure Backup
• AWS Backup
• Acronis Cyber Backup
• Commvault
• Native tools (Windows Backup, Time Machine)

Maturity Level 2 Requirements

Enhanced Protection:

• Backups disconnected from networks when not being performed
• Backup processes improved through automation
• More frequent restoration testing

Air-Gapped Backups:

• Network segmentation for backup infrastructure
• Automated connect/disconnect procedures
• Separate administrative credentials
• No persistent network connectivity

Immutable Backups:

• Write-once-read-many (WORM) storage
• Cloud immutability features (Azure, AWS)
• Legal hold/retention lock
• Cannot be deleted by ransomware

Automation:

• Automated backup verification
• Automated restore testing
• Backup job monitoring and alerting
• Automated failover procedures

Testing Frequency:

• Monthly restoration testing (instead of quarterly)
• Different data sets each test
• Varied failure scenarios
• Tabletop exercises

Privileged Access Controls:

• Separate admin accounts for backups
• MFA for backup administration
• Logging of all backup access
• Least privilege access model

Maturity Level 3 Requirements

Comprehensive Protection:

• Unprivileged accounts cannot access backups
• Privileged accounts required, MFA enforced
• Backups tested annually in a full disaster recovery scenario
• Comprehensive automation and monitoring

Hardened Backup Environment:

• Fully isolated backup infrastructure
• Separate domain/forest for backup admins
• Hardened backup servers
• Network segmentation enforced
• Monitoring and alerting (SIEM integration)

Full Disaster Recovery Testing:

• Annual DR exercise
• Complete system restoration
• Alternate site failover
• Business continuity integration
• Lessons learned and improvements

Advanced Capabilities:

• Automated backup integrity checking
• Malware scanning of backups
• Versioning and point-in-time recovery
• Rapid recovery capabilities (instant VM recovery)
• Geo-redundant backups

Backup Security:

• Encryption at rest and in transit
• Key management (separate from backup system)
• Access auditing and alerting
• Behavioral analytics on backup access
• Threat detection in backup environment

---

Australian Government Requirements

Non-Corporate Commonwealth Entities (NCEs)

Mandatory Requirements:

• Must implement Essential Eight at Maturity Level 3
• Annual self-assessment required
• Report to Attorney-General's Department
• Published in annual cyber security posture report

Entities Included:

• Commonwealth departments
• Executive agencies
• Statutory authorities (non-corporate)
• Parliamentary departments

Compliance:

• Protective Security Policy Framework (PSPF) Policy 10
• ISM (Information Security Manual) controls
• ACSC guidance mandatory
• Annual attestation by Agency Head

Corporate Commonwealth Entities (CCEs)

Requirements:

• Must implement Essential Eight (maturity level based on risk)
• Risk assessment determines target maturity level
• Governance and reporting through entity boards
• Cyber security strategy required

Risk-Based Approach:

• Risk assessment methodology
• Maturity level selection justified
• Board oversight and approval
• Regular reassessment

State and Territory Government

Variability:

• Requirements vary by jurisdiction
• Many have Essential Eight mandates
• Maturity levels differ (typically ML2 or ML3)
• Check specific state policies

Examples:

• NSW: Essential Eight compliance required, ML varies
• Victoria: Mandatory for some agencies
• Queensland: Risk-based approach
• WA, SA, TAS, NT, ACT: Varying requirements

Critical Infrastructure

Security of Critical Infrastructure (SOCI) Act 2018:

• Enhanced cyber security obligations
• Risk management programs required
• Incident reporting mandatory
• Essential Eight strongly recommended

Critical Infrastructure Sectors:

1. Communications
2. Financial services and markets
3. Data storage or processing
4. Defense industry
5. Higher education and research
6. Energy
7. Food and grocery
8. Health care
9. Space technology
10. Transport
11. Water and sewerage

Cyber Security Obligations:

• Adopt and maintain a risk management program
• Report cyber security incidents
• Comply with directions (government-issued)
• Essential Eight implementation recommended/required

---

Implementation Guidance

Assessment Process

Step 1: Current State Assessment

• Document existing controls
• Map to Essential Eight requirements
• Identify current maturity level (per strategy)
• Gap analysis (current vs target)

Step 2: Prioritization

• Risk-based prioritization
• Quick wins identification
• Resource allocation
• Phased approach planning

Step 3: Remediation Planning

• Detailed implementation plan
• Resource requirements (staff, budget, tools)
• Timeline and milestones
• Stakeholder communication

Step 4: Implementation

• Strategy-by-strategy rollout
• Testing and validation
• User training and awareness
• Documentation

Step 5: Validation

• Control effectiveness testing
• Independent assessment (for ML3)
• Gap remediation
• Continuous improvement

Step 6: Reporting

• Self-assessment documentation
• Management reporting
• Compliance attestation (if required)
• Annual reassessment

Common Challenges

1. Application Control Complexity

   • Most difficult to implement
   • Application inventory challenges
   • Legacy application issues
   • User resistance
   • Mitigation: Start in audit mode, gradual enforcement, user engagement

2. Patching Windows (48 hours at ML3)

   • Testing time constraints
   • Production change windows
   • Rollback concerns
   • Mitigation: Automation, pre-approved processes, robust testing

3. MFA User Experience

   • User friction and resistance
   • Legacy application compatibility
   • Helpdesk burden
   • Mitigation: User training, phased rollout, modern authentication

4. Privileged Access Restrictions

   • Operational efficiency concerns
   • Admin resistance
   • Help desk implications
   • Mitigation: PAM solutions, JIT administration, clear policy

5. Resource Constraints

   • Budget limitations
   • Staff expertise
   • Competing priorities
   • Mitigation: Phased approach, MSPs, automation, executive support

Tools and Technologies

Application Control:

• Windows Defender Application Control (WDAC)
• AppLocker
• CrowdStrike Application Control
• Carbon Black App Control

Patching:

• Windows Server Update Services (WSUS)
• System Center Configuration Manager (SCCM)
• Microsoft Endpoint Manager (Intune)
• Ansible, Puppet, Chef
• Ivanti Patch Management
• ManageEngine Patch Manager

MFA:

• Microsoft Azure AD MFA
• Duo Security
• Okta
• Ping Identity
• YubiKey (FIDO2)
• RSA SecurID

PAM (Privileged Access Management):

• CyberArk Privileged Access Security
• BeyondTrust Privileged Remote Access
• Delinea (Thycotic) Secret Server
• Microsoft Identity Manager

Backup:

• Veeam Backup & Replication
• Azure Backup
• AWS Backup
• Commvault
• Rubrik
• Cohesity

SIEM/Logging:

• Microsoft Sentinel
• Splunk
• IBM QRadar
• LogRhythm
• Elastic Stack

Vulnerability Management:

• Tenable Nessus
• Qualys VMDR
• Rapid7 InsightVM
• Microsoft Defender Vulnerability Management

Cost Estimates

Maturity Level 1:

• Small org (50-100 users): $50K-$150K
• Medium org (500 users): $150K-$350K
• Large org (5000+ users): $500K-$1M+

Maturity Level 2:

• Small org: $100K-$300K
• Medium org: $300K-$700K
• Large org: $1M-$3M+

Maturity Level 3:

• Small org: $200K-$500K
• Medium org: $500K-$1.5M
• Large org: $2M-$5M+

Costs include tools, consulting, labor, training, ongoing operations

---

Threat Landscape Context

Threats Mitigated

Ransomware (Primary Focus):

• 85%+ of ransomware prevented by Essential Eight
• Application control blocks execution
• Backups enable recovery
• MFA prevents initial access
• Patching closes vulnerabilities

Examples: LockBit, ALPHV/BlackCat, Cl0p, Royal, Play

Phishing and Credential Theft:

• MFA prevents compromised credential use
• Application hardening blocks malicious content
• Macro settings prevent malicious documents

Malware Delivery:

• Application control blocks execution
• Email/web filtering (hardening)
• Macro blocking

Examples: Emotet, Qbot, IcedID, Dridex

Web-Based Exploits:

• Browser hardening reduces attack surface
• Patching closes vulnerabilities
• Application control prevents downloads

Exploitation of Vulnerabilities:

• Patching remediates known vulnerabilities
• Reduced attack window
• Prioritization of critical/exploited flaws

Privilege Escalation:

• Admin privilege restrictions limit impact
• Lateral movement prevented
• Credential theft mitigated

Insider Threats:

• Application control limits actions
• Privileged access restrictions
• Logging and monitoring
• Backup protection

Recent Threat Examples

Medibank Breach (2022):

• Essential Eight would have prevented initial access (MFA)
• Privileged access restrictions would limit lateral movement
• Exfiltration detection (monitoring)

Australian Organizations Ransomware (Ongoing):

• Application control blocks ransomware execution
• Backups enable recovery without paying
• MFA prevents VPN compromise
• Patching closes initial access vulnerabilities

Business Email Compromise (BEC):

• MFA prevents account takeover
• Application hardening (email security)
• User training and awareness

---

Relationship to Other Frameworks

ISM (Information Security Manual)

Integration:

• Essential Eight is subset of ISM
• ISM provides comprehensive security controls
• Essential Eight are prioritized ISM controls
• Both published by ACSC

Relationship:

• Essential Eight: 8 strategies, focused mitigation
• ISM: Comprehensive security framework, 100s of controls
• Essential Eight compliance doesn't equal ISM compliance
• Essential Eight is foundation for ISM

NIST Cybersecurity Framework

Alignment:

• Essential Eight maps to NIST CSF functions
• Identify: Asset management, risk assessment
• Protect: Application control, patching, hardening, MFA, privileges
• Detect: Logging, monitoring
• Respond: Incident response
• Recover: Backups

ISO 27001

Mapping:

• Essential Eight controls map to ISO 27001 Annex A
• A.9 Access Control → MFA, Admin Privileges
• A.12 Operations Security → Patching, Application Control
• A.12.3 Backups → Regular Backups
• A.14 System Acquisition → Application Hardening

CIS Controls

Alignment:

• Essential Eight similar to CIS Critical Security Controls
• Many overlapping requirements
• CIS Controls more comprehensive (153 safeguards)
• Essential Eight more focused (8 strategies)

---

Capabilities

• Essential Eight maturity assessment (ML1, ML2, ML3)
• Strategy-by-strategy implementation guidance
• Gap analysis and remediation roadmaps
• Australian government compliance requirements
• Risk assessment and maturity level selection
• Tool and technology recommendations
• Cost estimation and budgeting
• Timeline and project planning
• Policy and procedure development
• User training and awareness materials
• Control testing and validation
• Incident response integration
• Continuous improvement planning
• Compliance reporting and attestation
• Integration with ISM and other frameworks