The Essential Eight Maturity Model: A Strategic Defence Framework for Cyber Security

On average, a cyber-attack occurs every 39 seconds, a figure that highlights the stark reality that businesses are facing an escalating digital arms race. It’s a major issue for everyone, from individuals to large corporations; cybercrime is recognised as a global epidemic, and Australia is no exception.

Understanding the Current Cyber Security Environment

In Australia alone, the financial impact of cybercrime exceeded $33 billion in 2022, with ransomware attacks contributing to $1.3 billion in damages. The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report for 2023-24 highlighted 87,400 cybercrime reports last financial year, or roughly one every six minutes. At its current trajectory, the cost of cybercrime is expected to reach $10.5 trillion by 2025, and $24 trillion by 2027 – driven primarily by ransomware, social engineering, and insider threats. Unfortunately, ransomware and data theft extortion remain prevalent, with business email compromise (BEC) and fraud among the top self-reported cybercrimes for businesses and individuals in Australia. Whilst cybercriminals don’t discriminate, small businesses are particularly vulnerable, facing average losses of ~$50k per incident.

Cyber threats are growing in scale, frequency, and sophistication, and nowadays, cybercriminals are rapidly capitalising on the use of AI to enhance their attacks. In fact, studies by Darktrace identified that 84% of Australian security stakeholders had been impacted by Artificial Intelligence (AI)-driven cyber-attacks. Thus, with the threat against Australia’s digitally dependent economy only growing, a robust cyber-defence strategy is critical.

Introducing the Essential Eight Maturity Model

The ASD’s Australian Cyber Security Centre (ACSC) developed the Essential Eight Maturity Model (Essential Eight) in 2017 to support Australian businesses and government agencies to enhance their cyber resilience and contribute towards Australia’s overall cyber security posture. The model provides a practical approach to help protect an organisation’s systems and infrastructure and serves as an essential component of any cyber security toolkit. Implementing the Essential Eight serves many purposes, including building cyber resilience, mitigating threats and vulnerabilities, and defending critical infrastructure. When effectively implemented, the Essential Eight can enhance an organisation’s cyber security posture and support compliance with legal and regulatory requirements, including the Australian Privacy Principles, the Security of Critical Infrastructure Act (SOCI Act), and the ASD’s Information Security Manual (ISM).

Breaking it Down

At its core, the Essential Eight highlights the most effective strategies that serve to mitigate and protect an organisation from cyber security incidents and enable them to address a wide range of traditional and AI-driven cyber threats. These are:

Application Whitelisting: Ensuring that only specific, pre-approved applications can run on a computer or a network. IT administrators compile a list of approved applications that are safe to run and configure their systems to only allow these applications to execute.
Patch Applications: Addressing vulnerabilities found in third party software (such as web browsers, office suites, audio or video editors, development tools). It involves updating software to fix vulnerabilities that could be exploited by attackers.
Patch Operating Systems: Performing regular updates on operating systems to patch any vulnerabilities that attackers could exploit to gain unauthorised access. It is essential for maintaining a secure operating environment.
Multi-Factor Authentication (MFA): Requiring users to verify their identity with two or more methods, such as entering password and a one-time code before access is granted, providing an additional layer of protection.
Restrict Administrative Privileges: Limiting the number of administrative accounts, and the privileges granted for those accounts, as they typically have higher access privileges and the power to make significant system changes (and damage should they be compromised).
Restrict Microsoft Office Macros: Preventing the use of Macros (small scripts used in programs like excel, to automate repetitive tasks, build processes and data flows), which can be leveraged to bypass security controls, gain unauthorised system access, and deliver malware.
User Application Hardening: Hardening applications by implementing robust security controls to prevent or block threats, such as advertisements running malicious scripts, malicious websites, and vulnerabilities in unsupported software.
Regular Backups: Regularly backing up systems (or even better, having automatic backups) to ensure you can recover data if it’s lost, stolen, or encrypted by ransomware, thus helping to maintain operational integrity, and making recovery possible even in the worst-case scenario.

Is the Essential Eight Framework Mandatory for all Organisations?

For private-sector businesses and enterprises, compliance with the Essential Eight is voluntary; however, implementation is strongly recommended to guide organisations in developing effective cyber security measures to uplift their cyber security posture.

For non-corporate Commonwealth entities (NCCEs) subject to the Department of Home Affairs’ Protective Security Policy Framework, it is mandatory to adopt the Essential Eight to uplift national cyber security and resilience.

At the end of the day, when it comes to information and data security, the primary objective is to ensure that the Confidentiality, Integrity, and Availability of your organisation’s data (collectively referred to as the CIA Triad) is upheld.

Why the Essential Eight?

The Essential Eight provides a baseline approach that organisations can implement to significantly reduce the risk of a cyber-attack. Focusing on practical and effective mitigation strategies will aid an organisation to build a robust and resilient cyber security posture and enhance their security hygiene.

Implementing the Essential Eight

When implementing the Essential Eight, the first step is to evaluate your organisation’s maturity level, and ensuring it aligns to your risk appetite. For example, if an organisation has a low-risk appetite, it may aim for a higher maturity level to ensure implementation of a robust approach. However, if an organisation has a higher risk appetite, it may aim for a lower maturity level, where it is willing to accept some risk in exchange for lower costs towards strategy implementation.

Evaluating your Organisation’s Maturity Levels

The beauty of the Essential Eight is that it meets an organisation where it is on its cyber security journey, and is designed to build up and strengthen an organisation’s defences in a way that is commensurate with their risk appetites:

Maturity Level Zero

Cyber security practices are minimal or non-existent.
Demonstrates the presence of weaknesses in the organisation’s cyber security posture, rendering them highly vulnerable to attacks.

Maturity Level One

Cyber security practices are partially aligned with the intent of the mitigation strategy.
Cyber security practices are adopted on an ad hoc basis. Measures in place, however inconsistent or incomplete, typically only applied in specific areas.

Maturity Level Two

Cyber security practices are structured and applied consistently across their systems.
Offers improved protection against more sophisticated threats.

Maturity Level Three

Cyber security practices are automated and fully optimised.
Designed for organisations who require a robust cyber security strategy to mitigate advanced cyber threats.

The Essential Eight: The Right Fit?

When evaluating whether the Essential Eight is sufficient and relevant for your organisation, it is important to understand its strengths and limitations:

Unlocking the Full Potential of the Essential Eight

While the Essential Eight provides a robust foundation for cyber security readiness, additional measures are necessary to achieve a comprehensive and resilient cyber security posture. Organisations can further strengthen their cyber security posture by incorporating elements from the ISO/IEC 27001 standard and NIST’s Cyber Security Framework. These frameworks will serve to complement the efforts of E8 by providing support in areas of risk management, incident response, and continuous monitoring. Moreover, by adhering to privacy and other industry specific regulations and standards, an organisation will be better positioned to achieve and maintain security requirements and controls and effectively secure their digital assets.

RightSec can Help

Here at RightSec, our team offers the expertise and tools you need to implement the Essential Eight as part of your cyber security strategy. Our mission is to ensure you have all the tools and resources to succeed in uplifting your cyber resilience and protecting your critical assets.

Book a consultation now to learn more about our tailored services and boost your preparedness for a rapidly evolving cyber threat landscape.