How to fast track getting to ASD Essential 8 – Maturity Level 1?

1-APPLICATION CONTROL

Many cyber-attacks occur due to security vulnerabilities in applications. It is essential to ensure that all the applications used in your organisation are secure. But do you even know which applications are being used in your organisation?

One of the most important measures you can take to reach Maturity Level One is to limit staff access to approved applications that are known to be secure.

This can be achieved through using application whitelisting platforms.

These platforms allow you to create a list of approved applications. Any applications not listed will be blocked from your organisation’s computers or servers.

To create a list of approved applications, start by engaging staff across your organisation and do an audit of all the applications they are using. Then categorise the applications on a scale of 1 (nice-to-have) to 5 (business critical).

Starting from category 5, assess each application’s risk profile, including the level of functionality, integration with other systems, and access to sensitive data. Applications that pose a high level of risk should be scanned for vulnerabilities, and possibly pen tested. Also ensure that the applications are configured correctly, and privileged access is restricted to authorised individuals.

By ensuring that only secure applications are approved for use in your organisation, you can significantly increase your cyber-resilience.

2- PATCH APPLICATIONS

Once you have restricted access to secure applications only, you need to ensure that your applications continue to remain secure. This is where patching comes in.

A patch is an update to an application’s code that is designed to fix any identified security bugs or improve the application’s functionality. By rapidly rolling-out security patches as soon as developers make them available, an organisation can stay one-step ahead of cyber-criminals who are hunting for un-patched applications they can exploit.

Develop and implement a patching process for your organisation. Ensure that at least one individual is accountable for ensuring that security patches are rolled-out as quickly as possible, especially those patches that are designed to fix critical vulnerabilities in applications.

Consider designating a specific date each month when applications will be patched.

Ideally, all security patches would be rolled-out immediately upon being made available. However, this might be a challenge depending on the volume of patches and applications involved. Therefore, you should ensure that critical vulnerabilities are given top priority, while other security patches should be rolled-out as soon as practicable.

3- CONFIGURE MICROSOFT OFFICE MACROS

If, like most organisations, you use Microsoft Office applications, such as Word, Excel, PowerPoint etc., then you need to be cautious around the use of macros.

What is a macro? Macros are a feature within Microsoft Office applications that allow users to automate a range of repetitive actions. Macros allow users to save a considerable amount of time.

However, cyber-criminals can also take advantage of macros by embedding hidden malicious code into files, such as Excel or Word documents. Because macros can run automatically, they may trigger the execution of malware in your environment, without you realising it until it is too late.

It is important to ensure that macros are deactivated in your organisation unless a staff member can demonstrate an important reason why they need macros. Your IT team should be making use of tools to block macros.

4- APPLICATION HARDENING

Keep your applications simple. Applications that perform a limited number of functions are easier to protect than complex applications that perform multiple functions. As functionality increases, there is a need for more complex code, which could unwittingly introduce more security vulnerabilities.

By deactivating application functionality that is not required, a process known as ‘hardening,’ you are reducing the number of potential security vulnerabilities that cyber-criminals could exploit.

Some basic hardening measures you can take include deactivating applications’ ability to run Flash or JavaScript, as these are commonly used in cyber-security exploits.

5- RESTRICT ADMINISTRATIVE PRIVILEGES

Staff should only be able to access the systems and data required to do their job. This is known as the principle of least privilege (PoLP).

PoLP is important because if a user account with admin privileges is compromised, the cyber-criminals could access large quantities of sensitive data, manipulate configurations and bypass security settings. By restricting the number of users with admin privileges, the risk of a breach having catastrophic consequences for the organisation is reduced.

Start by undertaking a review of all the systems in your organisation and ensure that user profiles are configured correctly with appropriate privileges. Also, make sure procedures are in place to rapidly deactivate any user accounts whenever a staff member leaves the organisation.

It is also important to have procedures in place to regularly review user profiles to ensure they remain configured correctly over time.

6- PATCH OPERATING SYSTEMS

Whatever Operating System (OS) runs the computers in your organisation, it is essential to ensure that they are always updated with the latest security patches.

Just like other applications, security vulnerabilities are routinely identified in Operating Systems. As soon as patches are developed to fix these vulnerabilities, you should ensure that the OS is updated so that you will be protected from cyber-criminals who are seeking to exploit those vulnerabilities.

One of the most effective ways to achieve this is by automating OS updates, particularly on endpoints. Make sure staff understand that they should not delay rebooting their computers when prompted to do so.

When it comes to security updates for servers, designate a specific time each month for your IT team to test and roll-out security patches.

7- MULTI-FACTOR AUTHENTICATION

Compromised passwords are one of the most significant security risks.
Many people create weak passwords and routinely re-use the same passwords across multiple systems. The dark web is awash wish billions of compromised passwords that cyber-criminals use to compromise systems.
That’s where Multi-Factor Authentication (MFA) comes in.

MFA is one of the most effective measures to prevent cyber-criminals accessing systems with compromised passwords. Users wishing to access a system need to verify their identity using two or more pieces of evidence, including:

• Something they know (such as their password)
  
• Something they have (such as a one-time code sent to their mobile phone)
  
• Something they are (such as their fingerprint)

Ensuring that MFA is activated on all systems is one of the most effective ways to strengthen your organisation’s cyber-resilience.

8- REGULAR BACKUPS

Cyber-resilience is about more than preventing cyber-attacks. You also need to be able to recover quickly should a cyber-attack occur.

That’s why backing-up your critical data is so important.

With attacks like ransomware on the rise, you need to ensure that your business can continue operating, even if cyber-criminals steal or block access to your data. Back-ups allow you to quickly restore your files and systems, limiting the damage that a cyber-attack can inflict on your business.

Critical data should be backed-up on a regular basis, preferably daily. The data should be stored in a totally separate system. Set up a process to regularly monitor back-ups to ensure they are occurring as intended. Verify that backed-up data is accurate and readily recoverable.