Essential Eight compliance

What is the Essential Eight?

The Essential Eight, published in 2017, is an Australian cybersecurity framework developed and maintained by the Australian Signals Directorate (ASD). It was enacted to protect organizations from potential online threats and cyberattacks. The Essential Eight regulations are applicable across a broad spectrum of networks, systems, and applications in the digital world.

The Essential Eight compliance mandates provide a robust cybersecurity strategy for businesses, divided across three primary objectives: prevention of cyberattacks, limiting the impact of cyberattacks, and data recovery and system availability.

What are the Essential Eight Security Controls?

The following are the latest Essential Eight Security Controls:

Preventing cyberattacks

1. Patch applications
2. Application control
3. User application hardening
4. Restrict Microsoft Office macros

Limiting the impact of cyberattacks

5. Patch operating systems
6. Restrict administrative privileges
7. Multi-factor authentication (MFA)

Data recovery and system availability

8. Regular backups

What is the Essential Eight Maturity Model?

The ASD has defined four maturity levels, Maturity Level Zero through Maturity Level Three, to help organizations implement the Essential Eight Security Controls systematically. These maturity levels (excluding Maturity Level Zero) provide increasing levels of cyberattack mitigation strategies for organizations to implement based on the perceived levels of attack techniques targeted at them by cybercriminals. Organizations are expected to implement each maturity level progressively as the goal of a previous maturity level has been reached.

The following table states the MFA requirements found in each maturity level and how ADSelfService Plus helps your organization comply with them.

Make your organization adhere to the Essential Eight strategies with ADSelfService Plus

ADSelfService Plus offers strong adaptive MFA capabilities that can help your organization comply with the Essential Eight Security Control objective of limiting the impact of cyberattacks:

1. MFA for applications and endpoints: Secure user access to organizational data by enabling MFA for endpoints such as machines, enterprise applications, VPNs, RDPs, and OWAs.
2. Multiple MFA authenticators: Choose from a range of 20 different MFA authenticators, like FIDO passkeys, biometrics, and YubiKey authenticator, to verify users' identities.
3. Easy configuration: Simplify the MFA enrollment process for both admins and users using quick enrollment options, like email or push notifications and CSV file imports, and enforce different MFA methods for users based on OUs and groups.
4. Customizable trust settings: Customize MFA trust settings to allow users to establish a trusted browser or device, enabling them to skip MFA for a limited number of days to save time.

MFA

1

 

Secure user access to all enterprise applications and endpoints in your network using MFA.

2

 

Choose from 20 different authenticators to verify your users' identities.

3

 

Set up different MFA flows for different groups or departments in your organization.

Secure user access to all enterprise applications and endpoints in your network using MFA.
Choose from 20 different authenticators to verify your users' identities.
Set up different MFA flows for different groups or departments in your organization.

Benefits of using ADSelfService Plus to comply with the Essential Eight

• Increased password security

  Apart from MFA, ensure all-around protection from cyberattacks with the help of strong password policiesthat enforce passphrases and restrict common patterns from passwords.

• Strong MFA techniques

  Implement adaptive MFA techniques, like conditional access and customizable trust options, to authenticate users based on their location, IP address, and device type.

• Fine-grained flexibility

  Enforce different MFA settings for users with varying levels of access to sensitive organizational data based on their OUs or groups.

• Compliance with regulatory standards

  Deploying FIDO2 authentication with ADSelfService Plus ensures compliance with regulatory standards such as the NIST Cybersecurity Framework, HIPAA, the PCI DSS, and the PSD2.