The Essential Eight Mitigation Strategies
The Essential Eight Maturity model focuses on 78 individual controls across the following eight security strategies
Application Control
Prevent the execution of unapproved/malicious programs including .exe, DLL, scripts.
Patch Applications
Patch/mitigate computers with ‘extreme risk’ security vulnerabilities within 48 hours and use the latest version of applications.
Configure Microsoft Office macro settings
Block macros from the internet, and only allow vetted macros either in ‘trusted locations’ with limited write access or digitally signed with a trusted certificate.
User application hardening
Configure web browsers to block Flash (ideally uninstall it), ads and Java on the internet. In addition, disable unneeded features in Microsoft Office (e.g. OLE), web browsers and PDF viewers.
Restrict administrative privileges
Restrict administrative privileges to operating systems and applications based on user duties. Regularly revalidate the need for privileges. Don’t use privileged accounts for reading email and web browsing.
Patch operating systems
Patch/mitigate computers (including network devices) with ‘extreme risk’ security vulnerabilities within 48 hours. Use the latest operating system version. Don’t use unsupported versions.
Multi-factor authentication
Multi-factor authentication including for VPNs, RDP, SSH and other remote access, and for all users when they perform a privileged action or access an important (sensitive/high-availability) data repository.
Regular backups
Regular backups of important new/changed data, software and configuration settings, stored disconnected, retained for at least three months. Test restoration initially, annually and when IT infrastructure changes.
