Contact us
Speak to one of our cybersecurity experts today.
Information provided within this form will be handled in accordance with our privacy statement.
Overview
What is the ACSC Essential Eight?
While no set of mitigation strategies are guaranteed to protect against all cyber threats, organisations are recommended to implement eight essential mitigation strategies from the ACSC’s Strategies to Mitigate Cyber Security Incidents as a baseline.
This baseline, known as the Essential Eight, makes it much harder for adversaries to compromise systems. Released in 2017, the Essential Eight is an evolution of the Australian Signals Directory’s (ASD) Top Four recommendations.
What are the Essential Eight strategies?
1. Application control
2. Application patching
3. Restrict administrative privileges
4. Patch operating systems
5. Configure Microsoft Office macro settings
6. User application hardening
7. Multi-factor authentication
8. Regular backups
Maturity model
What is the ACSC maturity model?
The new ACSC Essential Eight maturity model became available in July 2021, giving Australian organisations guidance as to how to implement the ACSC Essential Eight strategies. The maturity model uses a scoring system from 0-3 to help you identify what your organisation’s security posture is and the logical next steps to enhance your defenses.
Previously, organisations were left to cherry-pick strategies from the Essential Eight, but the current model prioritises implementing all eight as a package because of their complementary attributes and broader focus on the evolving threat landscape.
Common challenges
Overcoming common security challenges
Do you know your weakest links?
It can be hard to find direction and know what best practice looks like when building a security strategy.
As an insider, faced with a costantly changing threat environment, it can be difficult to assess your environment objectively in order to identify risks. With limited time and resources, knowing where to begin and what to prioritise when building and implementing a security strategy can be challenging.
Pro Tip: Have an external expert assess your environment to understand your security posture.
How many security tools are you managing?
Many businesses have adopted ‘productised’ security solutions that often overlap with each other or leave gaps in your security stack. These point solutions lack the integration with your broader IT environment to make sure your organisation is secure.
Managing security across many tools creates a complex environment, making it difficult to notice red flags among numerous notifications. This leads to challenges with promptly remediating issues, amplifying room for error.
Pro Tip: Don’t over-engineer your security strategy – simplicity is the ultimate sophistication.
What is the status quo costing you?
Customers without a standardised approach to security have a higher risk of attack, increased impact of attack and slower recovery. Breaches can incur heafty financial and legal penalties for non-compliance.
88% of reported breaches involve contact information, such as an individual’s name, home address, phone number or email address. This is distinct from identity information, which was exposed in 60% of breaches and includes an individual’s date of birth, passport details and driver licence details.
Pro Tip: Standardise your approach to security, to better manage your defensive strategy.
Assessment
What is an Essential Eight Assessment?
Using the ACSC recommendations as a framework, Data#3 has built an Essential Eight Assessment to help organisations understand and improve their security posture.
The Essential Eight Assessment will help you understand your current security maturity and defensive posture, in alignment with the ACSC Essential Eight.
The engagement will begin with a discovery session to understand your business, technology environment and key objectives. Technical workshops will follow, focusing on application whitelisting, patching applications, patching operating systems, multi-factor authentication, managing administrator rights, daily backups, managing Microsoft Office macros and application hardening.
The Data#3 Information Assurance Specialist will gather data and analyse your adoption of each of the above controls. Detailed findings will be compiled into a report providing evidence of your current security state, as well as expert recommendations for optimisation. A high-level roadmap will be shared outlining the projects recommended to be undertaken, indicative costs, timelines and the recommended software, hardware and services required. The report will be shared with you for review, followed by a presentation lead by the assessor to discuss your results in-depth.
Contact us to find out more about you can undertake an Essential Eight Assessment.
Assessment Outcomes
What will you achieve?
Matured cyber security practices
- Gain clear insight into your defensive posture and best practice advice for an integrated, Microsoft-based security platform.
- Understand which tools, technical controls, business systems and people processes to implement in order to mature your cyber security practices.
- Be confident that your organisation is protected using widely accepted mitigation strategies.
- Improve your cyber security policies and procedures, including the governance of information systems throughout the enterprise.
Improved budget allocation
- Standardise on one integrated platform, understand its full functionality, simplify your security stack and get better use of your currently investments.
- Eliminate the unnecessary costs of point products that often overlap in functionality.
- Simplify your team’s training and product knowledge requirements.
- Increase efficiency and save valuable IT time and resources, with less systems to manage, fewer risks, faster detection of threats and enhanced ability to action remediation for a faster recovery.
Managable compliance
- Discover and identify your gaps and overlaps, and learn how to secure them with administrative and technical controls.
- Ensure compliance with business and industry information security requirements leveraging the wealth of proactive controls in the Microsoft platform.
- Assist in achieving compliance with industry standards such as ISO27001, NIST and PCI.
Solutions
Partner solutions
Microsoft
Secure the modern workplace with Microsoft
Many of the controls needed to make an immediate difference and improve your cyber security posture may be available via your existing Microsoft investments.
By leveraging the Microsoft security portfolio across identity and access management, threat protection, cloud and network defence, information protection, endpoint security and compliance, you can achieve the desired results and reduce complexity in your environment.
Cisco
Cisco security solutions addressing the Essential Eight
Cisco Duo, a leading multi-Factor authentication (MFA) solution, directly addresses four of the Essential Eight security basics. Duo addresses security pitfalls painlessly, with easy integration to other security solutions and limited disruption to modern work environments.
Layer Duo with other Cisco security solutions, such as Cisco Umbrella and Cisco SecureX, for a comprehensive security architecture that addresses all eight of the security foundations.
Why Data#3?
Data#3 for your best defence
Combining the experience of a dedicated strategic consulting team, as well as hands-on cyber security specialists, Data#3 has one of the most mature and highly accredited security teams in Australia. Leveraging a breadth of security solutions and a strong vendor portfolio Data#3 can help you design, implement and maintain superior security measures, tailormade to protect your business. Having conducted countless security assessments, we have developed a proven model to strengthen resilience, incident response and recovery.
As Microsoft’s largest Australian partner, and a Microsoft Gold Security Partner Data#3’s expert team are globally recognised as leaders in securing your environment with the Microsoft security portfolio. Additionally, as Cisco Security Architecture Specialistswith Cisco Master Security Specialisation, Data#3 implements best-in-class Cisco security solutions.
Related resources
Mitigating cyber risk starts here
eBook
ACSC Essential Eight Explained
Authored by an Information Assurance Specialist at Data#3, this collection of works deep dives into the practical actions organisations can take to stay secure in an era of ever-changing threats.
Solution overview
Solution Overview of the Essential Eight Adoption Roadmap Service
An Essential Eight Adoption Roadmap will guide you in risk and cost reduction, but providing specific, actionable recommendations leveraging your existing investment in the Microsoft Security portfolio.