Essential Eight Assessments

Most ransomware infections succeed because malicious software executes freely on unprotected systems. Application Control prevents this by allowing only approved applications to run.

When an employee accidentally downloads a file from a phishing email or visits a compromised website, any malicious executable simply won’t run. At Maturity Level 1, Application Control is required on workstations only. Level 2 extends this to internet-facing servers. Level 3 adds non-internet-facing servers.

Attackers don’t need to break through your defences if they can exploit known vulnerabilities in unpatched software. Web browsers, PDF readers, and office applications are common targets because they handle external content.

At all maturity levels, critical vulnerabilities in online services must be patched within 48 hours when assessed as critical by vendors or when working exploits exist, otherwise within two weeks. Commonly targeted applications such as office productivity suites, web browsers, email clients, PDF software, and security products must be patched within two weeks of release. Other applications must be patched within one month.

Macros in Microsoft Office documents remain one of the most effective ways attackers deliver malware. A seemingly legitimate Excel spreadsheet arrives via email, the user enables macros, and malicious code executes with full system access.

At Maturity Level 1, macros are disabled by default for users without a demonstrated business need, macros in files originating from the internet are blocked, and antivirus scanning of macros is enabled. At Maturity Level 3, only macros running from a sandboxed environment, a Trusted Location, or digitally signed by a trusted publisher are permitted to run.

Web browsers, PDF readers, and email clients handle external, potentially malicious content constantly. User Application Hardening reduces risk by disabling features attackers commonly exploit, including preventing Java execution in browsers, blocking web advertisements from untrusted sources, and restricting potentially malicious web content.

If an attacker compromises a user account with administrative privileges, they gain control of the entire system. Restricting administrative privileges follows the principle of least privilege.

At Maturity Level 1, privileged users must use a separate unprivileged account for standard tasks like email, web browsing, and office productivity work. Administrative accounts are used only when performing administrative functions. At higher maturity levels, privileged users operate from separate, hardened workstations when performing administrative tasks.

Unpatched operating systems are a primary target for attackers. Vulnerabilities in Windows, macOS, or Linux give attackers a foothold to install malware, escalate privileges, and compromise the entire environment.

At all maturity levels, critical vulnerabilities in operating systems of internet-facing servers and network devices must be patched within 48 hours when assessed as critical by vendors or when working exploits exist, otherwise within two weeks. Operating systems of workstations and non-internet-facing servers must be patched within one month.

Passwords alone no longer provide adequate protection. Phishing attacks and credential stuffing regularly compromise passwords, and once attackers have valid credentials, they appear as legitimate users.

Multi-factor authentication adds a second verification step beyond passwords. At Maturity Level 1, MFA is required for users accessing online services that process, store or communicate sensitive data. Level 2 requires phishing-resistant MFA such as FIDO2 security keys, Windows Hello for Business, or smart cards that cryptographically bind authentication to the legitimate site and cannot be intercepted or replayed. Level 3 extends phishing-resistant MFA to data repositories, requires privileged users to authenticate to their workstations using a phishing-resistant method, and mandates that MFA event logs from all systems including workstations and non-internet-facing servers are centrally logged and actively monitored.

Backups are your last line of defence when prevention fails. Ransomware attacks, hardware failures, and accidental deletions happen despite best efforts, and reliable backups allow you to recover without catastrophic data loss or paying ransoms.

At Maturity Level 1, backups of data, applications and settings are performed and retained in accordance with business criticality and continuity requirements, stored securely, and synchronised to enable restoration to a common point in time.