Essential Eight assessment and uplift.

The model rates each strategy at one of four levels. Maturity Level 0 means significant weaknesses in a strategy that an adversary could exploit. The three levels above it are defined by the adversary they counter, and every requirement in the model follows from that framing.

Maturity Level 1 counters adversaries content to use commodity tradecraft that is widely available: a public exploit against an unpatched online service, or a login with credentials that were stolen, reused, brute forced or guessed. They want any victim, not a particular one. Maturity Level 2 counters adversaries with a modest step up in capability, who invest time in a target and in the effectiveness of their tools, phish for credentials, and work around weak multi-factor authentication. Maturity Level 3 counters adversaries who are adaptive and far less reliant on public tools, who exploit older software and thin logging to extend access and evade detection, and who steal authentication tokens to get past stronger multi-factor authentication.

Two points to note. The rating is per strategy, and the ASD's guidance is to reach the same level across all eight before targeting the next one, so seven strategies at Maturity Level 2 and one at Level 0 is a Level 0 result in practice. The right target follows the obligation: Maturity Level 1 across all eight is the baseline supplier questionnaires commonly have in mind, and contracts touching government supply chains increasingly specify Level 2.

Every level starts with the same two disciplines: an automated asset discovery run at least fortnightly, and a vulnerability scanner with a current database. What changes between levels is how much of the estate the scanner covers and how fast a patch has to land.

For applications, online services are scanned daily and patched within 48 hours when the vendor rates the flaw critical or a working exploit exists, otherwise within two weeks, at every level. Office suites, browsers and their extensions, email clients, PDF software and security products are scanned weekly and patched within two weeks at Levels 1 and 2; Level 3 pulls the critical and exploited cases to 48 hours. Level 2 adds fortnightly scanning and a one-month patch window for every other application. Unsupported software is removed at every level.

For operating systems, internet-facing servers and network devices follow the same 48 hours or two weeks rule at every level. Workstations and internal servers are patched within one month at Levels 1 and 2; Level 3 pulls their critical and exploited cases to 48 hours, adds fortnightly scanning and the same windows for drivers and firmware, and requires the latest or previous operating system release. Unsupported operating systems are replaced at every level.

Privilege at Maturity Level 1 means every request for privileged access is validated when first made, privileged users hold a dedicated account used only for privileged duties, those accounts cannot reach the internet, email or web services unless explicitly authorised, and privileged and unprivileged operating environments are kept apart with no logon across the line. Level 2 revalidates privileged access after 12 months and disables it after 45 days without use, forbids privileged environments virtualised inside unprivileged ones, routes administration through jump servers, requires long, unique, managed credentials for break glass, local administrator and service accounts, and centrally logs privileged access and security group management events. Level 3 limits privileged access to what each duty requires, uses Secure Admin Workstations and just-in-time administration, and enables memory integrity, Local Security Authority protection, Credential Guard and Remote Credential Guard.

Multi-factor authentication at Level 1 covers users of the organisation's own and third-party online services holding sensitive data, and customers of online customer services holding sensitive customer data, using something the user has together with something they know or are. Level 2 extends it to privileged and unprivileged users of systems, requires it to be phishing-resistant for users of online services and systems, offers customers a phishing-resistant option, and centrally logs every successful and failed authentication. Level 3 extends it to users of data repositories and makes it phishing-resistant everywhere, customers included.

From Maturity Level 2 the model adds a logging and incident layer to every strategy. Event logs are protected from unauthorised modification and deletion. Logs from internet-facing servers are analysed in a timely manner to detect cyber security events, events are analysed to identify incidents, incidents are reported to the chief information security officer or a delegate and to the ASD as soon as possible, and the incident response plan is enacted when one is identified.

In practice this is the requirement that separates a Level 1 estate from a Level 2 one. The Level 1 controls are configuration; the Level 2 layer is an operating discipline that has to be running, with records, before it can be evidenced.

Uplift is configuration work. A typical program: multi-factor authentication enforced on remote access and administrative portals first, phishing-resistant where Level 2 is the target. Administrative privilege separated into dedicated accounts, limited to the people who need it, and put on the 12-month revalidation and 45-day inactivity clocks. A patch cadence with owners and the model's timeframes, driven by exploitability. Application control rolled out in audit mode, then switched to enforce once the exceptions are understood. Office macros blocked from the internet, with the business macros that remain vetted and signed. Backups restructured so a restore is rehearsed and a compromised administrator cannot delete them.

Sequencing matters because several of these controls break things when switched on carelessly. Uplift runs as a milestone program: each mitigation lands, is evidenced and is confirmed working before the next one tightens. Black Shard can do the hands-on work or hand your IT provider a plan precise enough to execute, and verify each milestone.

Cost follows the size of the environment: how many environments and tenancies, the size of the endpoint fleet, the attack surface in scope, and whether Black Shard executes the uplift or plans it. The work runs as a fixed-scope assessment with a defined target, timeframe and deliverable, or as a program with milestones toward the target maturity level or an audit date.

Send a brief to info@blackshard.com.au with the rough shape of the environment and the maturity level being asked for.