Application control
Prevent execution of unapproved or malicious code, including executables, scripts, installers and compiled HTML.
Australia · Australian Signals Directorate (ASD) / ACSC · Essential 8
Essential Eight
The eight baseline mitigation strategies the ASD considers most effective against targeted cyber intrusion.
What it is
The Essential Eight is the ASD's prioritised list of mitigation strategies, drawn from the broader Strategies to Mitigate Cyber Security Incidents. Each strategy is measured against a three-level Maturity Model (ML1, ML2, ML3) that describes progressively stronger adversary capability being mitigated. It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework (PSPF) and widely adopted by state government, local government and regulated private sector as a reasonable baseline.
Who it applies to
Mandatory for non-corporate Commonwealth entities (via PSPF). Recommended by the ACSC for all Australian organisations and is commonly referenced by state governments, insurers and boards as a minimum expectation.
Requirements
Patch applications
Apply patches to internet-facing applications within 48 hours; other applications within two weeks.
Configure Microsoft Office macros
Disable macros for users without a demonstrated business need; block macros from the internet by default.
User application hardening
Configure web browsers to block Flash, ads and Java; disable untrusted Office add-ins.
Restrict administrative privileges
Limit privileged access to those with a demonstrated need; regularly revalidate.
Patch operating systems
Apply patches for internet-facing operating systems within 48 hours; others within two weeks.
Multi-factor authentication
MFA for privileged users, remote access and access to important data repositories.
Regular backups
Daily backups of important data, retained for three months, tested and held offline or immutable.
Read next
Other places this turns up on the site.
Security, engineered around you.
Talk to an engineer - not a call centre. Most Vectra conversations start with a 30-minute technical briefing and end with a written plan.