“How secure are we?” is a question nobody can answer, which is why it keeps getting asked. Firewalls, backups, multi-factor authentication, antivirus. All present, all in different states, all described in different words by whoever last touched them.
The Essential Eight maturity model exists to turn that one unanswerable question into eight answerable ones. It is published by the Australian Signals Directorate, it is free, and it is specific enough that two people assessing the same business should land in the same place.
Here is how to use it on your own business without hiring anyone.
What the Essential Eight is
ASD publishes a set of prioritised mitigation strategies, and the eight most effective of them are the Essential Eight:
- patch applications
- patch operating systems
- multi-factor authentication
- restrict administrative privileges
- application control
- restrict Microsoft Office macros
- user application hardening
- regular backups
The list has a scope. ASD states the Essential Eight was built to protect internet-connected information technology networks, and that while the principles may apply to mobile fleets and operational technology, it was not designed for those and other strategies may suit them better.
The four levels, and what they actually measure
This is the part most summaries get wrong. The maturity model defines four levels, Zero through Three, and apart from Zero they are graded by the attacker tradecraft and targeting they are meant to stop, not by how sophisticated your technology is.
Maturity Level Zero. There are weaknesses in the overall posture that, if exploited, could compromise the confidentiality of your data or the integrity and availability of your systems.
Maturity Level One. Aimed at attackers using widely available, off-the-shelf techniques. ASD’s description is of opportunists using a public exploit against something unpatched, or signing in with credentials that were stolen, reused, brute forced or guessed. They are “looking for any victim rather than a specific victim”.
Maturity Level Two. A modest step up. These attackers invest more in their tools, actively target credentials with phishing, and use technical and social engineering techniques to get around weak multi-factor authentication. More selective about targets, still fairly conservative about effort.
Maturity Level Three. Adaptive attackers who rely less on public tools, who take advantage of older software and thin logging to extend access and avoid detection, and who move quickly once a new exploit becomes public.
ASD’s framing is worth adopting, because it changes how you choose: “organisations should consider what level of tradecraft and targeting, rather than which malicious actors, they are aiming to mitigate”.
And a sentence that keeps everyone honest: Maturity Level Three “will not stop malicious actors that are willing and able to invest enough time, money and effort to compromise a target”.
The rule that trips most businesses up
You do not get to be Level Three at backups and Level Zero at application control and call yourself somewhere in the middle.
Because the eight strategies were designed to complement each other, ASD says organisations “should plan their implementation to achieve the same maturity level across all eight mitigation strategies before moving onto higher maturity levels”. Your maturity is your weakest of the eight. Nothing else.
That reframes the work. Money spent gold-plating the control you are already good at buys you nothing. The next dollar belongs to whichever of the eight is lowest.
How to assess yourself
Set aside two hours and be pessimistic.
- Write the eight down the left of a page. One row each.
- Read the Maturity Level One requirements for each. They are listed in full on the maturity model page as Appendix A, in plain statements you can answer yes or no to.
- Answer honestly, per requirement. If a requirement is partly met, it is not met. Application control “implemented on workstations” means all of them, not the six machines in the office where the manager sits.
- Score the row at the highest level where every requirement holds. If one item at Level One fails, that row is Level Zero. That is the whole point of the scale.
- Write down the evidence. Not “we have MFA” but “MFA is enforced on the following services, with these exceptions, checked on this date”. Evidence is what makes the assessment repeatable in six months.
Where you need more structure than a page, ASD publishes an Essential Eight assessment process guide alongside the model.
What Level One actually asks for
Two examples, because the detail is where people are surprised.
Patching is not one timeframe. A common misreading, including in the article this one replaces, is that everything must be patched within 48 hours. At Maturity Level One, 48 hours applies to online services and to the operating systems of internet-facing servers and network devices, and only when the vendor rates the flaw critical or a working exploit exists. Other flaws in those same systems get two weeks. Office suites, browsers and their extensions, email clients, PDF software and security products get two weeks. Operating systems on workstations and non-internet-facing servers get one month. Anything the vendor no longer supports is removed or replaced.
Backups are about who can delete them. Level One requires that backups are performed and retained according to business criticality, synchronised so you can restore to a common point in time, retained in a secure and resilient manner, and that restoration is tested as part of disaster recovery exercises. It also requires that unprivileged accounts cannot access backups belonging to other accounts, and are prevented from modifying and deleting backups. That last requirement is the one that decides whether ransomware takes your recovery with it.
Choosing a target level
ASD’s guidance is to identify and plan for a target level suitable for your environment, then implement each level progressively until you reach it, using a risk-based approach.
The two inputs are how attractive you are to attackers and how much the loss of confidentiality, integrity or availability would actually cost you. A four-person business with no client data of consequence and a business holding thousands of health or financial records are answering different questions, even on the same street.
Exceptions are allowed, but not casually. ASD expects them to be minimised in number and scope, compensated for with other controls, documented and approved through a proper process, then monitored and reviewed. Used that way, exceptions do not stop you meeting a level.
One more thing worth knowing before someone sells you a certificate. ASD states there is no requirement for an organisation to have its Essential Eight implementation certified by an independent party. Independent assessment comes into it only where a government directive, a regulator or a contract requires it.
One thing to do this week
Pick the single strategy you are least confident about, read its Maturity Level One requirements, and answer them line by line. You will either finish the hour feeling better, or you will have found the thing that was going to hurt you.
If you would like someone to run that assessment with you and put a number against each of the eight, get in touch.