(By Morey Haber – Feb 8th, 2017) The dynamic nature of cyber security requires constant adjustments and course corrections to address the latest threats. Businesses and governments are accustomed to broad stroke changes occurring every few years, but rarely are recommendations made that are very precise to manage specific threats.
In October 2014, BeyondTrust responded to the Australian Signals Directorate (ASD) Top 4 recommendations with a blog and white paper that addressed how to mitigate the most common cyber security risks using BeyondTrust solutions. But recently the ASD created an update called the “Essential Eight” that provides specific recommendations, on top of the Top 4, to help combat modern malware, incidents, and data recovery.
The goal of this addendum is to provide a practical prioritised list of guidance to manage risk and minimize the success of a breach. It complements the established 35 best practice mitigation recommendations and maturity model recommended by the ASD, and inserts these new four recommendations between the Top 4 and remaining 31 recommendations.
The Essential Eight is the existing Top 4, plus 4 new ASD recommendations
Australian Signals Directorate Top 4 (Existing)
- Application whitelisting of permitted/trusted programs, to prevent execution of malicious or unapproved programs including executables, scripts, and installers.
- Patch applications – such as Java, PDF viewer, Flash, web browsers and Microsoft Office. Patch/mitigate systems with “extreme risk” vulnerabilities within two days. And use the latest version of applications.
- Patch operating system vulnerabilities. Patch/mitigate systems with “extreme risk” vulnerabilities within two days. Use the latest suitable operating system version. Avoid Microsoft Windows XP.
- Restrict administrative privileges to operating systems and applications based on user duties. Such users should use a separate unprivileged account for email and web browsing.
Essential Eight (Top 4 plus 4 New Ones)
- Disable untrusted Microsoft Office Macros so malware cannot run unauthorised routines.
- Block browser access to Adobe Flash, web advertisements, and untrusted Java code on the Internet. If possible, uninstall all browser plugins that are not required.
- Use multi-factor authentication for all systems when possible to make it harder for an adversary to access a system and information
- Daily backup of important data securely and offline to ensure even if data is compromised, protected versions are available for recovery.
These new essential recommendations are a simple course correction for the ASD to address modern threats like ransomware and drive by web attacks. BeyondTrust can help assess systems that may not be compliant to these recommendations and aid with privileged access management to secure assets and data with existing (or new) multi-factor authentication initiatives. For more information, contact us today.