What does Essential Eight Maturity Level One require?
Maturity Level One means all eight strategies are in place against opportunistic attackers: critical patches for internet-facing systems within 48 hours, MFA on services holding sensitive data, dedicated administrator accounts off the internet and email, application control on workstations, internet macros blocked, browsers blocking Java and web advertisements, tested backups.
In detail
ASD's maturity model defines four maturity levels, Maturity Level Zero through to Maturity Level Three. Maturity Level One is aimed at malicious actors content to use commodity tradecraft that is widely available: a publicly available exploit for a vulnerability in an unpatched online service, or credentials that were stolen, reused, brute forced or guessed. They look for any victim.
Patching is the most specific part. An automated method of asset discovery runs at least fortnightly, and a vulnerability scanner runs at least daily over online services and the operating systems of internet-facing servers, at least weekly over office productivity suites, web browsers, email clients, PDF software and security products, and at least fortnightly over workstation operating systems.
| Strategy | What Level One requires |
|---|---|
| Patch applications | Online service fixes within 48 hours when critical or exploited and within two weeks otherwise; office suites, browsers, email clients, PDF software and security products within two weeks; unsupported software removed |
| Patch operating systems | Internet-facing servers and network devices within 48 hours when critical or exploited and two weeks otherwise; workstations and other servers within one month; unsupported operating systems replaced |
| Multi-factor authentication | On the organisation's own and third-party online services that hold its sensitive data, on online customer services holding sensitive customer data, and for the customers of those services |
| Restrict administrative privileges | Requests for privileged access validated; dedicated privileged accounts with no internet, email or web access; separate privileged and unprivileged operating environments |
| Application control | On workstations, applied to user profiles and temporary folders, restricting executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an approved set |
| Restrict Microsoft Office macros | Disabled for users without a demonstrated business requirement; macros in files from the internet blocked; macro antivirus scanning enabled; settings users cannot change |
| User application hardening | Internet Explorer 11 disabled or removed; web browsers do not process Java or web advertisements from the internet; browser security settings users cannot change |
| Regular backups | Performed and retained to business continuity requirements, synchronised to a common point in time, restoration tested in disaster recovery exercises, and unprivileged accounts unable to modify or delete them |
The multi-factor rule at this level accepts something users have and something users know, or something users have that is unlocked by something users know or are. Maturity Level Two adds phishing-resistant MFA for users of online services and systems, and central logging of successful and unsuccessful MFA events.
Privileged users get a dedicated account used solely for duties that need it, and that account cannot access the internet, email or web services unless it is explicitly authorised to reach particular online services. Privileged and unprivileged work happen in separate operating environments, and an unprivileged account cannot log on to the privileged one.
Compensating controls are accepted where the system owner demonstrates an equivalent level of protection. Risk acceptance without a compensating control, or risk transference such as sourcing cyber insurance, as the reason for not implementing an entire strategy is assessed as Maturity Level Zero for that strategy and for the whole implementation.
Level One is a package. ASD's FAQ has an organisation identify a target maturity level suitable for its environment and implement each level in turn, achieving one before moving on to the next.
The FAQ says Maturity Level One may be suitable for small to medium enterprises, Maturity Level Two for large enterprises and Maturity Level Three for critical infrastructure providers and other organisations that operate in high threat environments.
For an Australian organisation
The Essential Eight is designed to protect internet-connected information technology networks. There is no requirement for an implementation to be checked by an independent party, but an independent assessment may be required by a government directive or policy, a regulatory authority, or as part of contractual arrangements.
For non-corporate Commonwealth entities under the Protective Security Policy Framework, Maturity Level Two is the mandatory baseline. What counts as sensitive customer data is for the organisation to decide, considering OAIC guidance as it relates to the Privacy Act 1988.
