Essential Eight Assessments

Application Control prevents malware from executing by allowing only approved applications to run. When an employee opens a malicious attachment or visits a compromised website, the executable simply will not run. Maturity Level 1 requires it on workstations, Level 2 extends it to internet facing servers, and Level 3 adds non internet facing servers.

Attackers exploit known vulnerabilities in unpatched software, commonly through web browsers, PDF readers, and office applications. Critical vulnerabilities in online services must be patched within 48 hours of being assessed as critical, or otherwise within two weeks. Commonly targeted applications must be patched within two weeks of release, and other applications within one month.

Macros in Microsoft Office documents remain one of the most effective ways attackers deliver malware, often through a seemingly legitimate document that executes code once macros are enabled. At Maturity Level 1, macros are disabled by default for users without a demonstrated business need and blocked from internet sourced files. At Level 3, only macros from a sandboxed environment, a Trusted Location, or a trusted digital signature are permitted to run.

Web browsers, PDF readers, and email clients handle external content constantly. User Application Hardening reduces risk by disabling commonly exploited features, including Java execution in browsers, untrusted web advertisements, and other potentially malicious web content.

A compromised administrative account gives an attacker control of the entire system, so Restricting Administrative Privileges follows the principle of least privilege. At Maturity Level 1, privileged users must use a separate unprivileged account for standard tasks like email and web browsing, reserving administrative accounts for administrative functions only. Higher levels require privileged users to operate from separate, hardened workstations.

Unpatched operating systems give attackers a foothold to install malware, escalate privileges, and compromise the environment. Critical vulnerabilities in internet facing servers and network devices must be patched within 48 hours of being assessed as critical, or otherwise within two weeks. Workstations and non internet facing servers must be patched within one month.

Passwords alone no longer provide adequate protection against phishing and credential stuffing. At Maturity Level 1, MFA is required for users accessing sensitive online services. Level 2 requires phishing resistant MFA such as FIDO2 keys or Windows Hello for Business. Level 3 extends phishing resistant MFA to data repositories and privileged workstation access, with MFA event logs centrally monitored across all systems.

Backups are your last line of defence when prevention fails, covering ransomware, hardware failures, and accidental deletions. At Maturity Level 1, backups of data, applications, and settings are performed and retained according to business criticality, stored securely, and synchronised to enable restoration to a common point in time.