The Essential Eight is a set of mitigation strategies published by the Australian Cyber Security Centre, part of the Australian Signals Directorate. It is designed to make it much harder for attackers to compromise systems, and it applies as well to a ten-person business as to a large organisation.
The Eight Strategies
- Patch applications: apply security updates to software such as browsers, PDF readers and Office promptly.
- Patch operating systems: keep Windows, macOS and mobile devices up to date, and replace unsupported systems.
- Multi-factor authentication: require a second factor for email, finance systems and remote access.
- Restrict administrative privileges: give admin access only to those who need it, and use separate admin accounts.
- Application control: allow only approved software to run on your devices.
- Restrict Microsoft Office macros: block macros from the internet and allow only trusted ones.
- User application hardening: configure browsers and applications to block risky content.
- Regular backups: back up important data, store copies separately and test that you can restore them.
Understanding Maturity Levels
Each strategy is assessed against maturity levels from Level Zero to Level Three. Level One protects against opportunistic attacks using widely available tools; higher levels address more targeted and capable adversaries. Most smaller organisations should aim for Level One across all eight strategies, then raise the strategies that matter most to them.
Where to Start
If you can only do three things this month: turn on multi-factor authentication for email and finance systems, switch on automatic updates, and confirm you can restore last week's data from backup.
Privacy Obligations
If your organisation is covered by the Privacy Act, eligible data breaches must be notified to affected individuals and the Office of the Australian Information Commissioner. Good cyber hygiene reduces the chance of a breach and the impact if one occurs.
