From 237acb0dedcaee4198cae26311f1e0298147da0f Mon Sep 17 00:00:00 2001 From: "Joshua Hitchen (DGov)" <86041569+DGovEnterprise@users.noreply.github.com> Date: Fri, 13 Dec 2024 16:55:51 +0800 Subject: [PATCH] Updated fixes to AIR & E8 documents --- .../annual-implementation-reporting.md | 134 +++++++++++------- docs/guidelines/e8-assessment.md | 115 ++++++++------- 2 files changed, 143 insertions(+), 106 deletions(-) diff --git a/docs/guidelines/annual-implementation-reporting.md b/docs/guidelines/annual-implementation-reporting.md index 6ecca504..dc0f3172 100644 --- a/docs/guidelines/annual-implementation-reporting.md +++ b/docs/guidelines/annual-implementation-reporting.md @@ -1,58 +1,86 @@ # Annual Implementation Report -This page has been designed to accompany the 2023 WA Cyber Security Policy Annual Implementation Report Template and provides additional guidance for assessors when answering questions in the provided template. The CSU requires that WA Government entities report against the [August 2023 (first published in November 2022)](../pdfs/essential-eight-assessment-process-guide.pdf){download="Essential Eight Assessment - August 2023"} for AIR reporting. This represents the 2022 maturity model. +This page has been designed to accompany the 2024 WA Cyber Security Policy Annual Implementation Report Template and provides additional guidance for assessors when answering questions in the provided template. The CSU requires that WA Government entities report against the [August 2023 (first published in November 2022)](../pdfs/essential-eight-assessment-process-guide.pdf){download="Essential Eight Assessment - August 2023"} for AIR reporting. This represents the 2022 maturity model. ## Cyber Security Policy -This section provides guidance for the sheet **2. Cyber Security Policy** - -### Lead - -| ID | No | Yes | -| --- | -------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 1.1 | The entity does not list roles and responsibilities of the Accountable Authority within the organisation's Cyber/Information Security Policy | The entity defines roles and responsibilities of the Accountable Authority within the organisation's Cyber/Information Security Policy in line with the requirements of the WA Cyber Security Policy | - -### Identify - -| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | -| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2.1.1A | The entity does not track or maintain a list of physical devices and systems. | The entity has incomplete list of inventory and is in the process of completing its inventory list. | The entity has established inventory but not maintained | The entity maintains physical device and system inventory and manages this during their lifecycle. | -| 2.1.1B | The entity does not track or maintain a list of software and applications use to service business. | The entity has incomplete list of inventory or is in the process of completing its inventory list. | The entity has established inventory but not maintained. | The entity maintains a software platforms and applications inventory and manages this during their lifecycle. | -| 2.1.1C | The entity does not track or maintain a list of External information systems | The entity has incomplete list of inventory or is in the process of completing its inventory list. | The entity has established inventory but not maintained as agreed within service level agreement. | The entity maintains a list of External information systems and manages these through service level agreement during their lifecycle. | -| 2.1.1D | The entity does not track or maintain a list of critical functions and system dependencies. | The entity has incomplete list of critical functions and system dependencies, and is in the process of completing its inventory list. | The entity has list of critical functions and system dependencies but not regularly maintained. | The entity maintained list of critical functions and system dependencies | -| 2.1.1E | Organisation understood legal and regulatory requirements but do not have roadmap to achieve compliance. | Legal and regulatory requirements are understood, and implementation program to achieve compliance is in progress. | Legal and regulatory requirements are understood and implemented. | Legal and regulatory requirements are understood, implemented and compliance are maintained. | -| 2.1.1F | The entity does not track or maintain a list of information systems, components and services provided by suppliers or third-parties. | The entity has an incomplete list of information systems, components and services provided by suppliers and third-parties. | The entity has a list of information systems, components and services provided by suppliers and third-parties. | The entity maintains a list of Information systems, components and services maintained by suppliers and third-parties , and actively manages the lifecycle of these systems. | -| 2.3.1 | The entity has not developed a cyber security risk management strategy or has an ad-hoc approach to reducing cyber security risk within their organisation. | The entity is in the process of developing a cyber security risk management strategy or roadmap to reducing cyber security risk within their organisation. | The entity has developed a cyber cyber risk strategy, established a risk management program. | The entity has approved a cyber risk strategy updated in the last year, has established a risk management program, and tracks progress using a treatment action plan. | - -### Protect - -| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | -| ----- | ------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 3.3.5 | The entity does not have any mechanism in place for the public to report vulnerabilities. | The entity is currently developing a reporting mechanism for public to report vulnerabilities. | The entity has published mechanism for the public to report vulnerabilities, however does not respond or action vulnerabilities in a timely manner. | The entity has a established reporting mechanism is in place and and action is taken in timely manners to remediate vulnerabilities.

For example [www.wa.gov.au Vulnerability Disclosure Policy](https://www.wa.gov.au/government/publications/vulnerability-disclosure-policy) or security.txt based on [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116) | -| 3.5.1 | The entity does not perform Training and Awareness for cyber security or information security for staff. | The entity provides ad-hoc Training and Awareness for cyber security for staff.

The entity does not provide targeted or specialised education for users with privileged access or positions of authority/trust. | The entity provides regular Training and Awareness for cyber security for staff/users that focuses on influencing user behaviour.

The entity provides ad-hoc targeted or specialised education for users with privileged access or positions of authority/trust. | The entity provides structured Training and Awareness for cyber security for staff/users that focuses on influencing user behaviour and measuring improvement.

The entity provides regular targeted or specialised education for users with privileged access or positions of authority/trust. | -| 3.6.1 | The entity does not consider the security risks for staff travelling with devices overseas. | The entity understand the risk and currently in process of implementing technical and governance measures for staff travelling with devices overseas. The entity may have ad-hoc processes for device management when staff travel overseas. | The entity has effective cybersecurity measures, encompassing both technical and governance aspects, without active monitoring. The entity has processes for device management when staff travel overseas. | The entity has effective cybersecurity measures, encompassing both technical and governance aspects, and maintains active monitoring. The entity has processes for devices management such a provisioning temporary "burner" devices and have processes to reduce risk for devices returning from overseas. | -| 3.6.2 | The entity does not consider the security risks for staff travelling overseas. | The entity understands the risk and currently in process of implementing technical and governance measures. | The entity has effective cybersecurity measures, encompassing both technical and governance aspects, without active monitoring. | The entity has effective cybersecurity measures, encompassing both technical and governance aspects, and maintains active monitoring. | -| 3.7.1 | The entity does not define risk management processes or clauses for third party within procurement contract. | The entity is currently developing risk management processes for third party vendors. | The entity incorporated cyber security requirements for third-party vendors within procurement contract, without progress are being tracked through service level agreement. | The entity incorporates cyber security requirements for third party vendors within procurement contract and progress are tracked through service level agreement. | -| 3.7.5 | The entity does not review where data is stored when procuring systems. | The entity is developing formal position. | The entity has approved position to satisfy this task and assurance are not tracked | The entity has approved position that is aligned to [WA Government Data Offshoring Position](https://www.wa.gov.au/government/publications/western-australian-government-data-offshoring-position-and-guidance-0) and monitors existing contracts/suppliers to ensure that data and information systems are aligned with the entity's approved position. | -| 3.8.1 | The entity lacks processes for securing physical assets and does not track or manage access to them. | The entity tracks some assets are and efforts are underway to expand control management to the remaining areas. | The entity mostly manages access to assets however there may be areas where the management is not fully consistent. | The entity manages physical access to assets and is tracked and audited on a regular basis. | -| 3.9.1 | The entity does not securely dispose digital media. | The entity is developing disposal processes requirements or assessing vendors that could be partnered with to manage disposal of digital media. | The entity has a secure disposal process, such as media sanitisation or media destruction techniques, but does not ensure vendor compliance with certificates. | The entity has a secure disposal process, such as media sanitisation or media destruction techniques, ensuring vendor compliance with certificates. | - -### Detect - -| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | -| ----- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 4.1.1 | The entity does not capture network events from workstations. | The entity captures network events for some endpoints and is working on expanding the collection of these events to cover all workstations. | The entity captures network events from most workstation within SIEM.

The entity is developing processes to monitor and analyse network events to identify suspected cyber security incidents. | The entity captures network events are from workstations within SIEM.

The entity actively monitors and analyses these to identify suspected cyber security incidents. | -| 4.1.2 | The entity does not capture Command line processes from workstations. | The entity captures command line process from workstations and is working on expanding the collection of these event to cover all workstations. | The entity captures command line process from most workstation within SIEM.

The entity is developing processes to monitor and analyse command line processes to identify suspected cyber security incidents. | The entity captures command line processes from workstations within SIEM.

The entity actively monitors and analyses these to identify suspected cyber security incidents. | -| 4.1.3 | The entity does not capture email events and URLS visited by workstations. | The entity partially captures email events or URLS visited by workstations. | The entity captures email events and URLS visited by workstations within SIEM.

The entity is developing processes to monitor and analyse email events and URLS visited by workstations. | The entity captures email events and URLS visited by workstations within SIEM.

The entity actively monitors and analyses these to identify suspected cyber security incidents. | -| 4.1.4 | The entity does not capture identity events (logons and group/role changes). | The entity partially captures identity events across ICT infrastructure. | The entity captures identity events across most ICT infrastructure (on-premises and cloud) within SIEM.

The entity is developing processes to monitor and analyse identity events. | The entity captures identity across ICT infrastructure (on-premises and cloud) within SIEM.

The entity actively monitors and analyses these to identify suspected cyber security incidents. | -| 4.3.1 | The entity does not have a Security Information and Event Management (SIEM) solution. | Entity has a Security Information and Event Management (SIEM) solution to perform real-time automated aggregation and correlation of logs from multiple sources to identify patterns of suspicious behaviour is in place.

SIEM has low levels of visibility, low coverage of assets (sources) or logs may be distributed in other security solutions not captured by the SIEM.

SIEM Logs are stored for only 12 months.

The entity has started testing Incident response plan, processes and technical capabilities. | Entity has a Security Information and Event Management (SIEM) solution to perform real-time automated aggregation and correlation of logs from multiple sources to identify patterns of suspicious behaviour is in place.

SIEM has good of visibility, high coverage of assets (sources) or logs may be distributed in other security security solutions not captured by the SIEM.

Logs are stored for only 12 months.

Incident response plan, processes and technical capabilities are not regularly tested. | Entity has a Security Information and Event Management (SIEM) solution to perform real-time automated aggregation and correlation of logs from multiple sources to identify patterns of suspicious behaviour is in place.

SIEM has excellent visibility, high coverage of assets (sources) and logs from other security security solutions are captured by the SIEM.

Logs are stored for at least 18 months retention period or to meet regulatory requirements. | -| 4.5.1 | The entity does not respond to security alerts. | The entity is developing capabilities to respond to security alerts or is ad-hoc in their approach to responding to security alerts. | The entity has capabilities to respond to security alerts and has developed repeatable processes for security operations staff to respond to security alerts. | The entity has robust capabilities to respond and triage security alerts in a timely manner. | - -### Respond - -| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | -| ----- | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 5.1.1 | The entity does not have an Incident Response Plan. | The entity has developed an Incident Response Plan.

The entity has not tested the Incident Response Plan for greater than one year. | The entity has developed an Incident Response Plan.

The entity has tested the Incident resposne plan within the past year. | The entity has developed robust Incident Response Plans that may include "playbooks" for common cyber threats. The plans are updated on an annual basis or when significant changes to ICT systems occur.

The entity has tested the Incident Response Plan within the past year. Test results or lessons learnt from enacting plans are captured and used to improve existing plans. | +This section provides guidance for the sheet **2. Cyber Security Policy**. + +### 1. Govern + +| ID | No | Yes | +| --- | --- | --- | +| 1.1.1 | The entity does not have a cybersecurity/information security policy, or the entity does have a cybersecurity/information security policy, but it does not clearly outline the responsibilities of the Accountable Authority and the allocation of executive responsibility for cybersecurity. | The entity has a cybersecurity/information security policy that clearly outlines the responsibilities of the Accountable Authority and the allocation of executive responsibility for cybersecurity. | +--- +| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | +| --- | --- | --- | --- | --- | +| 1.4.1 | The entity has not yet begun to implement cyber security governance to align with its business strategies and risk management objectives. | The entity is currently in the process of implementing cyber security governance to align with its business strategies and risk management objectives. | The entity has implemented cyber security governance to align with its business strategies and risk management objectives, but there are ongoing issues that need to be addressed. | The entity has fully implemented cyber security governance to align with its business strategies and risk management objectives, and it is actively monitoring the effectiveness of these measures. | +| 1.5.1 | The entity does not manage or govern risks associated with data offshoring, which is not in alignment with [WA Government policies](https://www.wa.gov.au/system/files/2023-06/1.2wa-government-data-offshoring-position-and-guidance.docx). It has not conducted a comprehensive and rigorous risk assessment process or obtained written endorsement from the Director General or Chief Executive Officer for any business case. | The entity has begun to manage and govern risks associated with data offshoring, in alignment with [WA Government policies](https://www.wa.gov.au/system/files/2023-06/1.2wa-government-data-offshoring-position-and-guidance.docx). It is in the process of conducting comprehensive and rigorous risk assessments and seeking written endorsement from the Director General or Chief Executive Officer for each business case, but this process is not yet fully completed. | The entity is managing and governing risks associated with data offshoring in alignment with [WA Government policies](https://www.wa.gov.au/system/files/2023-06/1.2wa-government-data-offshoring-position-and-guidance.docx), but there are issues with policy implementation. These issues may include incomplete risk assessments, delays in obtaining written endorsements from the Director General or Chief Executive Officer, or challenges in confidently managing the behaviour of offshore partners. | The entity is fully managing and governing risks associated with data offshoring in alignment with [WA Government policies](https://www.wa.gov.au/system/files/2023-06/1.2wa-government-data-offshoring-position-and-guidance.docx). It conducts comprehensive and rigorous risk assessments, obtains written endorsement from the Director General or Chief Executive Officer for each business case, and confidently manages the behaviour of offshore partners. The entity is actively monitoring the effectiveness of these processes and making necessary adjustments. | +| 1.5.2 | The entity has not yet implemented or aligned with the [Western Australian Information Classification Policy](https://www.wa.gov.au/government/publications/western-australian-information-classification-policy). It does not clearly and consistently identify the sensitivity of its information, apply appropriate protective security measures, or communicate the sensitivity of information within the agency, with other agencies, and third-party organisations. | The entity is in the process of implementing and aligning with the [Western Australian Information Classification Policy](https://www.wa.gov.au/government/publications/western-australian-information-classification-policy), but it has not yet been fully completed. Efforts are underway to clearly and consistently identify the sensitivity of information, apply appropriate protective security measures, and communicate the sensitivity of information within the agency, with other agencies, and third-party organisations. | The entity has implemented the [Western Australian Information Classification Policy](https://www.wa.gov.au/government/publications/western-australian-information-classification-policy), but there are ongoing issues that need to be addressed. These issues may include inconsistencies in identifying the sensitivity of information, gaps in applying protective security measures, or challenges in communicating the sensitivity of information within the agency, with other agencies, and third-party organisations. | The entity has fully implemented the [Western Australian Information Classification Policy](https://www.wa.gov.au/government/publications/western-australian-information-classification-policy) and is actively monitoring its effectiveness. It clearly and consistently identifies the sensitivity of its information, applies appropriate protective security measures, and effectively communicates the sensitivity of information within the agency, with other agencies, and third-party organisations. | +| 1.6.1 | The entity has not yet implemented secure disposal processes for devices, computers, or media that hold digital information. | The entity is currently developing secure disposal processes for devices, computers, and media that hold digital information. This includes establishing requirements for secure disposal, such as media sanitisation or destruction techniques, and assessing vendors that could be partnered with to manage the disposal of digital media. | The entity has established secure disposal processes for devices, computers, and media that hold digital information, including secure disposal methods such as media sanitisation or destruction techniques; however, it does not ensure vendor compliance with certifications, or there are inconsistencies in following these processes. | The entity has fully established secure disposal processes for devices, computers, and media that hold digital information, including secure disposal methods such as media sanitisation or destruction techniques. It ensures vendor compliance with certifications and follows these processes fully, actively monitoring their effectiveness and making necessary adjustments. | +| 1.7.1 | The entity has not yet implemented [vulnerability management governance](https://soc.cyber.wa.gov.au/baselines/vulnerability-management/). It does not identify assets, triage and prioritise vulnerabilities, own the risk of not updating, or verify and regularly review vulnerability management processes. | The entity is in the process of implementing [vulnerability management governance](https://soc.cyber.wa.gov.au/baselines/vulnerability-management/), but it has not yet been fully completed. Efforts are underway to identify assets, triage and prioritise vulnerabilities, owning the risk of not updating, and establish processes to verify and regularly review vulnerability management. | The entity has implemented [vulnerability management governance](https://soc.cyber.wa.gov.au/baselines/vulnerability-management/), including identifying assets, triaging and prioritising vulnerabilities, owning the risk of not updating, and verifying and regularly reviewing vulnerability management processes. However, there are ongoing issues such as incomplete asset identification, inconsistent prioritisation, or gaps in the review process that need to be addressed. | The entity has fully implemented [vulnerability management governance](https://soc.cyber.wa.gov.au/baselines/vulnerability-management/). It consistently identifies assets, triages and prioritises vulnerabilities, owns the risk of not updating, and verifies and regularly reviews vulnerability management processes. The entity is actively monitoring the effectiveness of these processes and making necessary adjustments. | +| 1.8.1 | The entity does not have a mechanism in place for the public to report vulnerabilities.| The entity is currently developing a mechanism for the public to report vulnerabilities. | The entity has an established mechanism for the public to report vulnerabilities; however, it does not respond to or addresses vulnerabilities in a timely manner. | The entity has an established reporting mechanism in place, and action is taken in a timely manner to remediate vulnerabilities. To establish a Vulnerability Disclosure Policy, use the example found at [www.wa.gov.au Vulnerability Disclosure Policy](https://www.wa.gov.au/government/publications/vulnerability-disclosure-policy), or implement a security.txt file based on [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116). This provides clear guidelines and a standardised method for the public to report vulnerabilities. | +| 1.9.1 | The entity does not have governance in place to monitor and review whole-of-government cybersecurity advice or directives issued by the GCIO. It does not utilise methods such as emails, advisories, Cyber Security Working Group (CSWG) updates, or SOC reports provided by DGov and GCIO to stay informed. | The entity is in the process of establishing governance to monitor and review whole-of-government cybersecurity advice or directives issued by the GCIO, but it has not yet been fully completed. Efforts are underway to incorporate methods such as emails, advisories, CSWG updates, and SOC reports provided by DGov and GCIO to stay informed. | The entity has established governance to monitor and review whole-of-government cybersecurity advice or directives issued by the GCIO, but there are ongoing issues that need to be addressed, or the entity does not consistently act on the advice. There may be inconsistencies in utilising methods such as email, advisories, CSWG updates, and SOC reports provided by DGov and GCIO to stay informed. | The entity has fully established governance to monitor and review whole-of-government cybersecurity advice or directives issued by the GCIO, and is actively monitoring its effectiveness and acting on the advice. It consistently utilises methods such as emails, advisories, CSWG updates, and SOC reports provided by DGov and GCIO to stay informed. | +| 1.9.3 | The entity does not consider threat intelligence and advice provided by DGov in its operations. It does not utilise methods such as SOC advisories, emails, or working groups provided by DGov CSU to stay informed. | The entity is in the process of integrating threat intelligence and advice provided by DGov into its operations, but this process is not yet fully completed. Efforts are underway to incorporate methods such as SOC advisories, emails, and working groups provided by DGov CSU to stay informed. | The entity has integrated threat intelligence and advice provided by DGov into its operations, but there are ongoing issues that need to be addressed, or the entity does not consistently act on this intelligence and advice. There may be inconsistencies in utilising methods such as SOC advisories, emails, and working groups provided by DGov CSU to stay informed. | The entity has fully integrated threat intelligence and advice provided by DGov into its operations, and is actively monitoring its effectiveness and making necessary adjustments. It consistently utilizes methods such as SOC advisories, emails, and working groups provided by DGov CSU to stay informed. | + +### 2. Identify + +| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | +| --- | --- | --- | --- | --- | +| 2.1.1A | The entity does not track or maintain an inventory of devices, servers, and other ICT equipment. | The entity currently has an incomplete inventory of devices, servers, and other ICT equipment, and is in the process of finalising it. | The entity has established inventories of devices, servers, and other ICT equipment, but they are not actively maintained. | The entity actively maintains an inventory of devices, servers, and other ICT equipment. | +| 2.1.1B | The entity does not track or maintain an inventory of application systems and servers in use. | The entity currently has an incomplete inventory of application systems and servers in use, and is in the process of finalising it. | The entity has an established inventory of application systems and servers, but it is not maintained. | The entity actively maintains an inventory of application systems and servers. | +| 2.1.1C | The entity does not track or maintain an inventory of critical databases and information assets. | The entity currently has an incomplete inventory of critical databases and information assets, and is in the process of finalising it. | The entity has an inventory of critical databases and information assets, but it is not regularly maintained. | The entity actively maintains an inventory of critical databases and information assets. | +| 2.1.1D | The entity does not track or maintain an inventory of any relevant personnel and third-party providers. | The entity currently has an incomplete inventory of any relevant personnel and third-party providers, and is in the process of finalising it. | The entity has an inventory of any relevant personnel and third-party providers, but it is not regularly maintained. | The entity actively maintains an inventory of any relevant personnel and third-party providers. | +| 2.1.1E | The entity does not track or maintain an inventory of any social media applications or accounts owned within the entity. | The entity currently has an incomplete inventory of any social media applications or accounts owned within the entity, and is in the process of finalising it. | The entity has an inventory of any social media applications or accounts owned within the entity, but it is not regularly maintained. | The entity actively maintains an inventory of social media applications or accounts owned within the entity. | +| 2.1.1F | The entity does not track or maintain an inventory of system dependencies and related risks. | The entity currently has an incomplete inventory of system dependencies and related risks, and is in the process of finalising it. | The entity has an inventory of system dependencies and related risks, but it is not regularly maintained. | The entity actively maintains an inventory of system dependencies and related risks. | +| 2.1.1G | The entity does not track or maintain an inventory of its anticipated future cybersecurity needs. | The entity currently has an incomplete inventory of its anticipated future cybersecurity needs and is in the process of finalising it. | The entity has an inventory of its anticipated future cybersecurity needs, but it is not regularly maintained. | The entity actively maintains an inventory of its anticipated future cybersecurity needs. | +| 2.1.1.H | The entity does not track or maintain an inventory of any relevant legal and regulatory requirements. | The entity currently has an incomplete inventory of any relevant legal and regulatory requirements, and is in the process of finalising it. | The entity has an inventory of any relevant legal and regulatory requirements, but it is not regularly maintained. | The entity actively maintains an inventory of relevant legal and regulatory requirements. | +| 2.2.3 | The entity does not have a cyber security risk management strategy or roadmap in place or has an ad-hoc approach to reducing cyber security risk within the entity. | The entity is in the process of developing and implementing a cyber security risk management strategy or roadmap. | The entity has implemented a cyber security risk management strategy, but there are ongoing issues that need to be addressed, or the strategy is not consistently applied. | The entity has approved a cyber security risk management strategy updated in the last year, has established a risk management program, and tracks progress using a treatment action plan. | + +### 3. Protect + +| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | +| --- | --- | --- | --- | --- | +| 3.2.1 | The entity does not have cyber security training and awareness processes in place for staff. | The entity is in the process of establishing cyber security training and awareness processes. Currently, it provides ad-hoc training and awareness for staff but does not offer targeted or specialised education for users with privileged access or positions of authority/trust. | The entity has implemented cyber security training and awareness processes, providing regular training for staff/users that focuses on influencing user behaviour. However, it only provides ad-hoc targeted or specialised education for users with privileged access or positions of authority/trust, indicating ongoing issues that need to be addressed. | The entity has fully implemented structured cyber security training and awareness processes for staff/users, focusing on influencing user behaviour and measuring improvement. It also provides regular targeted or specialised education for users with privileged access or positions of authority/trust, and is actively monitoring the effectiveness of these processes and making necessary adjustments. | +| 3.3.1A | The entity does not have the capability to monitor and manage corporate issued mobile devices or harden applications residing on them from cyber security threats. | The entity is in the process of establishing capabilities to monitor and manage corporate issued mobile devices and harden applications residing on them from cyber security threats, but this process is not yet fully completed. | The entity has established capabilities to monitor and manage corporate issued mobile devices and harden applications residing on them from cyber security threats, but there are ongoing issues that need to be addressed, or the capabilities are not consistently applied. | The entity has fully established capabilities to monitor and manage corporate issued mobile devices and harden applications residing on them from cyber security threats, and is actively monitoring their effectiveness and making necessary adjustments. | +| 3.3.1B | The entity does not have the capability to monitor and manage corporate issued mobile devices during overseas business travel or harden applications residing on them from cyber security threats. | The entity is in the process of establishing capabilities to monitor and manage corporate issued mobile devices during overseas business travel and harden applications residing on them from cyber security threats, but this process is not yet fully completed. | The entity has established capabilities to monitor and manage corporate issued mobile devices during overseas business travel and harden applications residing on them from cyber security threats, but there are ongoing issues that need to be addressed, or the capabilities are not consistently applied. | The entity has fully established capabilities to monitor and manage corporate issued mobile devices during overseas business travel and harden applications residing on them from cyber security threats, and is actively monitoring their effectiveness and making necessary adjustments. | +| 3.3.1C | The entity does not have the capability to monitor and manage privately owned mobile devices accessing organisational resources or harden applications residing on them from cyber security threats. | The entity is in the process of establishing capabilities to monitor and manage privately owned mobile devices accessing organisational resources and harden applications residing on them from cyber security threats, but this process is not yet fully completed. | The entity has established capabilities to monitor and manage privately owned mobile devices accessing organisational resources and harden applications residing on them from cyber security threats, but there are ongoing issues that need to be addressed, or the capabilities are not consistently applied. | The entity has fully established capabilities to monitor and manage privately owned mobile devices accessing organisational resources and harden applications residing on them from cyber security threats, and is actively monitoring their effectiveness and making necessary adjustments. | +| 3.3.1D | The entity does not have the capability to monitor and manage privately owned mobile devices accessing organisational resources during overseas business travel or harden applications residing on them from cyber security threats. | The entity is in the process of establishing capabilities to monitor and manage privately owned mobile devices accessing organisational resources during overseas business travel and harden applications residing on them from cyber security threats, but this process is not yet fully completed. | The entity has established capabilities to monitor and manage privately owned mobile devices accessing organisational resources during overseas business travel and harden applications residing on them from cyber security threats, but there are ongoing issues that need to be addressed, or the capabilities are not consistently applied. | The entity has fully established capabilities to monitor and manage privately owned mobile devices accessing organisational resources during overseas business travel and harden applications residing on them from cyber security threats, and is actively monitoring their effectiveness and making necessary adjustments. | +| 3.4.1 | The entity does not have processes in place to manage cyber security risks associated with third party vendors, and these risks are not addressed within procurement contracts or tracked through service level agreements. | The entity is in the process of establishing processes to manage cyber security risks associated with third party vendors. Some initial steps have been taken to include these risks within procurement contracts, but progress is not yet fully tracked through service level agreements. | The entity has established processes to manage cyber security risks associated with third party vendors, and these risks are included within procurement contracts. However, there are ongoing issues with tracking progress through service level agreements, or the processes are not consistently applied. | The entity has fully implemented processes to manage cyber security risks associated with third party vendors. These risks are comprehensively addressed within procurement contracts, and progress is actively tracked through service level agreements, with regular monitoring and necessary adjustments being made. | +| 3.5.1 | The entity does not have processes in place to manage or track the security of physical assets. | The entity is in the process of establishing processes to manage and track the security of physical assets, but these processes are not yet fully completed or consistently applied. | The entity has implemented processes to manage and track the security of physical assets, but there are ongoing issues that need to be addressed, or the processes are not consistently applied. | The entity has fully implemented processes to manage and track the security of physical assets and is actively monitoring their effectiveness and making necessary adjustments. | +| 3.6.1A | The entity does not have processes in place for the appropriate management of the user lifecycle that supports [Personnel Management](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance-applicable-to-incident-response:~:text=the%20organisation%27s%20computers.-,Personnel%20management,damage%20such%20as%20destroying%20data%20and%20preventing%20computers/networks%20from%20functioning.,-Implementation%20guidance). | The entity is in the process of establishing processes for the appropriate management of the user lifecycle that supports [Personnel Management](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance-applicable-to-incident-response:~:text=the%20organisation%27s%20computers.-,Personnel%20management,damage%20such%20as%20destroying%20data%20and%20preventing%20computers/networks%20from%20functioning.,-Implementation%20guidance), but this process is not yet fully completed. | The entity has established processes for the appropriate management of the user lifecycle that supports [Personnel Management](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance-applicable-to-incident-response:~:text=the%20organisation%27s%20computers.-,Personnel%20management,damage%20such%20as%20destroying%20data%20and%20preventing%20computers/networks%20from%20functioning.,-Implementation%20guidance), but there are ongoing issues that need to be addressed, or the processes are not consistently applied. | The entity has fully established processes for the appropriate management of the user lifecycle that supports [Personnel Management](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance-applicable-to-incident-response:~:text=the%20organisation%27s%20computers.-,Personnel%20management,damage%20such%20as%20destroying%20data%20and%20preventing%20computers/networks%20from%20functioning.,-Implementation%20guidance) and is actively monitoring their effectiveness and making necessary adjustments. | +| 3.6.1B | The entity does not follow the principle of least privilege when providing access. | The entity started to follow the principle of least privilege when providing access, but it is not yet fully implemented. | The entity follows the principle of least privilege when providing access, but there are inconsistencies or issues that need to be resolved. | The entity fully follows the principle of least privilege when providing access and is actively monitoring and adjusting as needed and in alignment with [Essential Eight Restrict Administrative Privileges](https://soc.cyber.wa.gov.au/guidelines/e8-assessment/#assessment-guidance_3:~:text=by%20the%20user.-,Restrict%20administrative%20privileges,if%20they%20intend%20to%20eventually%20implement%20requirements%20for%20Maturity%20Level%20Two.,-Assessment%20guidance) and [Personnel Management](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance-applicable-to-incident-response:~:text=the%20organisation%27s%20computers.-,Personnel%20management,damage%20such%20as%20destroying%20data%20and%20preventing%20computers/networks%20from%20functioning.,-Implementation%20guidance) (DGov Further 5 Strategies) guidance. | +| 3.6.1C | The entity does not have a password filtering solution for all users across all systems. | The entity is in the process of implementing a password filtering solution for all users across all systems, but it is not yet fully enforced. | The entity has implemented a password filtering solution for all users across all systems, but there are ongoing issues that need to be addressed. | The entity has fully implemented a password filtering solution for all users across all systems and is actively monitoring its effectiveness and making necessary adjustments. | +| 3.6.1D | The entity is not aligned with principles mentioned in the WA Government Authentication Guidelines. | The entity is working towards alignment with principles mentioned in the WA Government Authentication Guidelines, but it is not yet fully achieved. | The entity is aligned with principles mentioned in the WA Government Authentication Guidelines, but there are issues that need to be resolved or inconsistencies. | The entity is fully aligned with the principles mentioned in the WA Government Authentication Guidelines and is actively monitoring compliance and making necessary adjustments. | +| 3.6.1F | The entity has not implemented improvements in [networking controls](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance_1:~:text=Emails%C2%A0publication.-,Network%20segmentation,gain%20access%20to%20the%20organisation%27s%20important%20(sensitive%20or%20high%2Davailability)%20data.,-Implementation%20guidance). | The entity is in the process of improving [networking controls](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance_1:~:text=Emails%C2%A0publication.-,Network%20segmentation,gain%20access%20to%20the%20organisation%27s%20important%20(sensitive%20or%20high%2Davailability)%20data.,-Implementation%20guidance), but these improvements are not yet fully implemented. | The entity has improved [networking controls](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance_1:~:text=Emails%C2%A0publication.-,Network%20segmentation,gain%20access%20to%20the%20organisation%27s%20important%20(sensitive%20or%20high%2Davailability)%20data.,-Implementation%20guidance), but there are ongoing issues that need to be addressed or inconsistencies. | The entity has fully implemented improvements in [networking controls](https://soc.cyber.wa.gov.au/guidelines/further-five/#implementation-guidance_1:~:text=Emails%C2%A0publication.-,Network%20segmentation,gain%20access%20to%20the%20organisation%27s%20important%20(sensitive%20or%20high%2Davailability)%20data.,-Implementation%20guidance) and is actively monitoring their effectiveness and making necessary adjustments. | +| 3.7.1 | The entity does not have cyber security insurance that covers either first-party losses/expenses incurred by the organisation due to a cyber security incident or third-party liability claims against the organisation due to a cyber security incident. | The entity is in the process of obtaining cyber security insurance. Currently, it may have partial coverage or is negotiating terms for first-party coverage for losses/expenses incurred by the organisation due to a cyber security incident and third-party coverage for liability claims against the organisation due to a cyber security incident, but the process is not yet fully completed. | The entity has obtained cyber security insurance that includes both first-party coverage for losses/expenses incurred by the organisation due to a cyber security incident and third-party coverage for liability claims against the organisation due to a cyber security incident. However, there are ongoing issues with the coverage, such as gaps in the policy, limitations, or inconsistencies in claims processing. | The entity has fully obtained comprehensive cyber security insurance that covers both first-party losses/expenses incurred by the organisation due to a cyber security incident and third-party liability claims against the organisation due to a cyber security incident. The entity is actively monitoring the insurance coverage and making necessary adjustments to ensure it meets the organisation's needs. | + +### 4. Detect + +| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | +| --- | --- | --- | --- | --- | +| 4.1.1 | The entity does not log network events on endpoints (workstations and laptops). | The entity is in the process of establishing logging of network events on endpoints (workstations and laptops), but this process is not yet fully completed. | The entity logs network events on endpoints (workstations and laptops), but there are ongoing issues with the logging process, such as incomplete logs or inconsistencies in capturing events. | The entity fully logs network events on endpoints (workstations and laptops) and is actively monitoring the logs for accuracy and making necessary adjustments. | +| 4.1.2 | The entity does not log command line processes on endpoints (workstations and laptops). | The entity is in the process of establishing logging of command line processes on endpoints (workstations and laptops), but this process is not yet fully completed. | The entity logs command line processes on endpoints (workstations and laptops), but there are ongoing issues with the logging process, such as incomplete logs or inconsistencies in capturing processes. | The entity fully logs command line processes on endpoints (workstations and laptops) and is actively monitoring the logs for effectiveness and making necessary adjustments. | +| 4.1.3 | The entity does not capture email events and URLs in its SIEM. | The entity is in the process of establishing the capture of email events and URLs in its SIEM, but this process is not yet fully completed. | The entity captures email events and URLs in its SIEM, but there are ongoing issues with the capture process, such as incomplete data or inconsistencies in capturing events. | The entity fully captures email events and URLs in its SIEM and is actively monitoring the capture process for effectiveness and making necessary adjustments. | +| 4.1.4 | The entity does not capture identity events (logons and group/role changes) in its SIEM. | The entity is in the process of establishing the capture of identity events (logons and group/role changes) in its SIEM, but this process is not yet fully completed. | The entity captures identity events (logons and group/role changes) in its SIEM, but there are ongoing issues with the capture process, such as incomplete data or inconsistencies in capturing events. | The entity fully captures identity events (logons and group/role changes) in its SIEM and is actively monitoring the capture process for effectiveness and making necessary adjustments. | +| 4.1.7 | The entity does not have the capability to review adverse events within 24 hours or report potential cyber security events. | The entity is in the process of establishing the capability to review adverse events within 24 hours and report potential cyber security events, but this process is not yet fully completed. | The entity has the capability to review adverse events within 24 hours and report potential cyber security events, but there are ongoing issues such as delays in the reporting process or incomplete event reviews. | The entity has fully established the capability to review adverse events within 24 hours and report potential cyber security events, and is actively monitoring the effectiveness of these processes and making necessary adjustments. | +| 4.1.8 | The entity does not have an understanding of the potential impact of adverse events. | The entity is in the process of developing an understanding of the potential impact of adverse events, but this understanding is not yet fully developed or consistently applied. | The entity has an understanding of the potential impact of adverse events, but there are ongoing issues such as gaps in risk assessment or inconsistent application of this understanding across the entity. | The entity has a comprehensive understanding of the potential impact of adverse events and is actively monitoring and updating this understanding as needed. | +| 4.1.9 | The entity does not have processes in place to share threat intelligence with [DGov](https://wasoc.atlassian.net/servicedesk/customer/portal/2/user/login?destination=portal%2F2%2Fgroup%2F1%2Fcreate%2F8) within 24 hours of acquiring it. | The entity is in the process of establishing processes to share threat intelligence with [DGov](https://wasoc.atlassian.net/servicedesk/customer/portal/2/user/login?destination=portal%2F2%2Fgroup%2F1%2Fcreate%2F8) within 24 hours of acquiring it, but these processes are not yet fully completed. | The entity has processes in place to share threat intelligence with [DGov](https://wasoc.atlassian.net/servicedesk/customer/portal/2/user/login?destination=portal%2F2%2Fgroup%2F1%2Fcreate%2F8) within 24 hours of acquiring it, but there are ongoing issues such as delays in communication or incomplete sharing of intelligence. | The entity has fully implemented processes to share threat intelligence with [DGov](https://wasoc.atlassian.net/servicedesk/customer/portal/2/user/login?destination=portal%2F2%2Fgroup%2F1%2Fcreate%2F8) within 24 hours of acquiring it and is actively monitoring the effectiveness of these processes and making necessary adjustments. | +| 4.2.1 | The entity has not implemented a Security Information and Event Management (SIEM) system. | The entity is in the process of implementing a Security Information and Event Management (SIEM) system, but this process is not yet fully completed. | The entity has implemented a Security Information and Event Management (SIEM) system, but there are ongoing issues such as incomplete integration with existing systems, frequent false positives, or insufficient staff training to effectively use the system. | The entity has fully implemented a Security Information and Event Management (SIEM) system and is actively monitoring its effectiveness, making necessary adjustments to ensure optimal performance. | +| 4.5.1 | The entity has not implemented the guidance under "Baseline for Detection Coverage (MITRE ATT&CK)". It does not have processes in place for telemetry collection and detection analytics aligned to the MITRE ATT&CK framework. | The entity is in the process of implementing telemetry collection and detection analytics aligned to the MITRE ATT&CK framework, but this process is not yet fully completed. | The entity has implemented the guidance under "Baseline for Detection Coverage (MITRE ATT&CK)", but there are gaps in data sources, telemetry sensors, detection assets, and analytics guidance. A checklist has been created and undertaken to calculate the percentage of assets for a given retention log window, but reviews are not performed regularly. | The entity has fully implemented the guidance under "Baseline for Detection Coverage (MITRE ATT&CK)", which covers data sources, telemetry sensors, detection assets, and analytics guidance. A checklist has been created and undertaken to calculate the percentage of assets for a given retention log window, and assessments are performed regularly to ensure ongoing alignment and effectiveness. | + +### 5. Respond + +| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | +| --- | --- | --- | --- | --- | +| 5.1.1 | The entity does not have an Incident Response Plan for cyber incidents. | The entity has developed an Incident Response Plan for cyber incidents, but it has not tested the plan for greater than one year. | The entity has developed an Incident Response Plan for cyber incidents and has tested the plan within the past year. However, there may be issues such as incomplete testing or gaps in the plan that need to be addressed. | The entity has developed robust Incident Response Plans for cyber incidents, which may include "playbooks" for common cyber threats. The plans are updated on an annual basis or when significant changes to ICT systems occur. The entity has tested the Incident Response Plan within the past year, and test results or lessons learned from enacting the plans are captured and used to improve existing plans. | +| 5.1.4 | The entity does not respond to security alerts. It lacks the capability to triage and develop an appropriate timely response to cyber security incidents. | The entity is developing capabilities to respond to security alerts or is ad-hoc in its approach to responding to security alerts. Efforts are underway to establish processes for triaging and developing timely responses to cyber security incidents, but these processes are not yet fully completed. | The entity has capabilities to respond to security alerts and has developed repeatable processes for security operations staff to respond to security alerts. However, there are ongoing issues such as inconsistencies in response times or gaps in the triage process that need to be addressed. | The entity has robust capabilities to respond and triage security alerts in a timely manner. It has fully developed and implemented processes for responding to cyber security incidents and is actively monitoring the effectiveness of these processes, making necessary adjustments to ensure timely and appropriate responses. | + +### 6. Recover + +| ID | Not Started | Implementation in Progress | Implemented with Issues | Implemented and Monitoring | +| --- | --- | --- | --- | --- | +| 6.1.2 | The entity does not have a Business Continuity or Incident Management Plan, and no Recovery Time Objectives or Maximum Tolerable Outage timeframes are defined. | The entity is in the process of implementing a Business Continuity Plan or Incident Management Plan. The entity defined timeframes for Recovery Time Objectives or Maximum Tolerable Outage but has not tested response times yet to ensure alignment with these timeframes. | The entity has implemented a Business Continuity Plan or Incident Management Plan. Entity tested the restoration timeframes for Recovery Time Objectives or Maximum Tolerable Outage, but there are gaps in the organisation's preparedness such as not consulting with business owners on an annual basis to ensure these timeframes meet business needs, or lessons learnt have not been reviewed and included to improve process and future reponses. | The entity has a Business Continuity Plan or Incident Management Plan. The entity has tested the restoration timeframes for Recovery Time Objectives or Maximum Tolerable Outage, confirming timeframes are met and consulting with business owners on an annual basis. Lessons learned are captured and used to improve process and future responses. | ## ACSC Strategies @@ -72,7 +100,7 @@ The [ACSC strategies to Mitigate Cyber Security Incidents](https://www.cyber.gov | Control | Strategy | Not Started | In-Progress | Implemented With Issues | Implemented and Monitoring | ACSC Guidance | | :-----: | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | -| **5** | **Automated dynamic analysis of email and web content run in a sandbox** | The entity has not deployed sandbox analysis of inbound email or web content. | The entity has deployed a sandbox analysis solution for inbound email and/or web content that is not fully functional or in audit/passive only mode. | The entity has deployed a sandbox analysis solution for inbound email and/or web content but it uses untuned rule-sets, excessive bypass lists or does not receive timely vendor intelligence definitions. | The Entity has deployed a sandbox analysis solution for inbound email and web content. The solution has finely tuned rule-sets, minimal bypass lists, receives regular vendor intelligence definitions. | [link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=Automated%20dynamic%20analysis,machine%20or%20honeypot.) | +| **5** | **Automated dynamic analysis of email and web content run in a sandbox** | The entity has not deployed sandbox analysis of inbound email or web content. | The entity has deployed a sandbox analysis solution for inbound email and/or web content that is not fully functional or in audit/passive only mode. | The entity has deployed a sandbox analysis solution for inbound email and/or web content but it uses untuned rule-sets, excessive bypass lists or does not receive timely vendor intelligence definitions. | The Entity has deployed a sandbox analysis solution for inbound email and web content. The solution has finely tuned rule-sets, minimal bypass lists, receives regular vendor intelligence definitions. | [link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=Automated%20dynamic%20analysis,machine%20or%20honeypot.) | | **6** | **Email content filtering** | The entity does not perform content filtering of inbound email. | The entity has deployed an email content filtering solution is present that is not finely tuned or left as system defaults for inspection of email content types including file attachments, hyperlinks or is configured in audit/passive mode only. | The Entity has deployed an email content filtering solution and has fine tuned configuration for inspection of email content types, however rulesets are overly permissive.

Content which cannot be scanned is not blocked. | The entity has deployed an email content filtering solution that has fine tuned and robust rulesets configured capturing all inbound mail and the inspection of hyperlinks and attachments. Filtering solution receives regular vendor intelligence definitions.

Content that cannot be scanned is blocked/quarantined.

Inbound mail is blocked if the external sender address is the same as the internal domain. | [Link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=machine%20or%20honeypot.-,Email%20content%20filtering,mitigation%20strategies%20is%20available%20in%20the%20Malicious%20Email%20Mitigation%20Strategies%20publication.,-Web%20content%20filtering) | | **7** | **Web content filtering** | The entity does not perform filtering of web content. | The entity deploys web content filtering is available but not all traffic is subject to filtering or rules are overly submissive. HTTPS traffic is not filtered. | The entity deploys web content filtering for most for HTTP and HTTPs traffic. Filtering rules restrict access to uncategorised, web advertisement, anonymity services, free and anonymous domains used by adversaries. Access to websites via IP address is blocked. | The entity deploys web content filtering for all HTTP and HTTPs traffic. Filtering rules restrict access to uncategorised, web advertisement, anonymity services, free and anonymous domains used by adversaries. Access to websites via IP address is blocked. Filtering rules restrict access to malicious executables, Flash/ActiveX/Java content and Microsoft Office files containing macros. Vendor intelligence definitions are updated regularly. | [Link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=Mitigation%20Strategies%20publication.-,Web%20content%20filtering,but%20temporarily%20compromised%20websites%20and%20a%20range%20of%20other%20web%20infrastructure.,-Deny%20corporate%20computers) | | **8** | **Deny corporate computers direct internet connectivity** | The entity's perimeter firewall is configured to allow corporate computers direct internet access. | The entity's perimeter firewall is configured to only allow corporate computers outbound access to approved ports and protocols including HTTP and HTTPS. | The entity's perimeter firewall is configured to only allow corporate computers outbound access to approved ports and protocols.

Corporate Computers outbound internet traffic for HTTP and HTTPS is routed via a proxy. | The entity's perimeter firewall is configured to only allow corporate computers outbound access to approved ports and protocols.

Corporate Computers outbound internet traffic for HTTP and HTTPS is routed via an authenticated proxy.

Servers are restricted from browsing the internet and accessing email services." | [Link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=other%20web%20infrastructure.-,Deny%20corporate%20computers%20direct%20internet%20connectivity,internet%2Daccessible%20websites%20need%20to%20be%20authenticated%20by%20a%20web%20proxy.,-Operating%20system%20generic) | @@ -86,7 +114,7 @@ The [ACSC strategies to Mitigate Cyber Security Incidents](https://www.cyber.gov | **16** | **Antivirus software with up-to-date signatures** | The entity does not install antivirus software to computers or gateways. | The entity has signature based antivirus software from reputable vendor installed on some computers or has commenced the deployment on gateways. | The entity has signature based antivirus software from reputable vendor installed on most computers or has commenced the deployment on gateways.

Antivirus software definitions update automatically.

Antivirus software is configured to scan files upon opening or scanned on a regular basis. | The entity has signature based antivirus software from reputable vendor is deployed to all computers and gateways to detect more sophisticated malware.

Antivirus software definitions update automatically and regularly.

Antivirus software is configured to scan files upon opening and scanned on a regular basis. | [Link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=Antivirus%20software%20with,a%20scheduled%20basis.) | | **17** | **TLS encryption between email servers** | The entity does not enable Transport Layer Security (TLS) on email servers. | The entity has commenced configuration of Transport Layer Security (TLS) on email servers for inbound or outbound email communication. | The entity has configured Transport Layer Security (TLS) for both inbound and outbound email communication to prevent legitimate emails being intercepted and subsequently leveraged for social engineering. | The entity has enforced Transport Layer Security (TLS) for both inbound and outbound email communication to prevent legitimate emails being intercepted and subsequently leveraged for social engineering.

The entity configures content scanning after email traffic is decrypted as part of ""Email content Filtering"" strategy. | [Link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=a%20scheduled%20basis.-,TLS%20encryption%20between%20email%20servers,Perform%20content%20scanning%20after%20email%20traffic%20is%20decrypted.,-Mitigation%20strategies%20to) | -### Limit the Extent of Cyber Security Incidents +### Limit the Extent of Cyber Security Incidents | Control | Strategy | Not Started | In-Progress | Implemented With Issues | Implemented and Monitoring | ACSC Guidance | | :-----: | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | @@ -98,7 +126,7 @@ The [ACSC strategies to Mitigate Cyber Security Incidents](https://www.cyber.gov | **26** | **Software-based application firewall, blocking outgoing network traffic** | The entity has disabled or does not configure Software-based application firewalls (e.g. Windows Firewall) to prevent outgoing network connections. | The entity has commenced configuration of software-based application firewall for outgoing network traffic. | The entity has configured software-based application firewall with limited rule set to block malicious and unintended outgoing network traffic. | The entity has configured software-based application firewall to block malicious and unintended outgoing network traffic. Rules are configured to provide the minimum levels of network activity designed for the user or system (following least privilege access principles). | [Link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=Software%2Dbased%20application%20firewall%2C%20blocking%20outgoing,includes%20software%2Dbased%20application%20firewall%20functionality.) | | **27** | **Outbound web and email data loss prevention** | The entity does not deploy Data Loss Prevention solutions to identify or prevent exfiltration of sensitive organisational data. | The entity has commenced considering applying Data Loss Prevention solutions to identify or prevent exfiltration of sensitive organisational data.

Sensitive Data may be identified and labelled with Data Classification Sensitivity labels, or via sensitive data patterns/keywords.

Some prevention controls may limit exfiltration of sensitive data by logging or blocking access to unapproved cloud computing services including personal webmail. | The entity has configured Data Loss Prevention solutions to identify or prevent exfiltration of sensitive organisational data.

Sensitive Data is identified and labelled with Data Classification Sensitivity labels, or via sensitive data patterns/keywords.

Prevention controls limit exfiltration of sensitive data by logging or blocking access to unapproved cloud computing services including personal webmail.

Outgoing email with sensitive data patterns, size and frequency are logged and reported. | The entity has configured Data Loss Prevention solutions to identify and prevent exfiltration of sensitive organisational data.

Sensitive Data is identified and labelled with Data Classification Sensitivity labels, or via sensitive data patterns/keywords.

Prevention controls limit exfiltration of sensitive data by logging or blocking access to unapproved cloud computing services including personal webmail.

Outgoing email with sensitive data patterns, size and frequency are logged and reported. | [Link](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents/strategies-mitigate-cyber-security-incidents-mitigation-details#:~:text=Outbound%20web%20and,as%20regular%20expressions.) | -### Detect Cyber Security Incidents and Respond +### Detect Cyber Security Incidents and Respond | Control | Strategy | Not Started | In-Progress | Implemented With Issues | Implemented and Monitoring | ACSC Guidance | | :-----: | ------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | diff --git a/docs/guidelines/e8-assessment.md b/docs/guidelines/e8-assessment.md index e7b86adf..d9fdb104 100644 --- a/docs/guidelines/e8-assessment.md +++ b/docs/guidelines/e8-assessment.md @@ -4,6 +4,7 @@ ## Introduction + The Australian Signals Directorate (ASD) has developed prioritised mitigation strategies, in the form of the _[Strategies to Mitigate Cyber Security Incidents](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents)_, to help organisations protect themselves against various cyber threats. The most effective of these mitigation strategies are the Essential Eight. @@ -14,16 +15,17 @@ underpin the Essential Eight – as articulated within the _[Essential Eight Mat This publication should be read and used in conjunction with other ASD guidance and tools. This includes the: -- [Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight) -- [Essential Eight Maturity Model FAQ](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model-faq) -- [Essential Eight Assessment Report Template](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-assessment-process-guide) -- [Essential Eight assessment toolkit.](https://partners.cyber.gov.au/login?ec=302&startURL=/s/) + - [Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight) + - [Essential Eight Maturity Model FAQ](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model-faq) + - [Essential Eight Assessment Report Template](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-assessment-process-guide) + - [Essential Eight assessment toolkit.](https://partners.cyber.gov.au/login?ec=302&startURL=/s/) Note, all vendor products mentioned within this publication are for illustrative purposes only and should not be interpreted as an explicit endorsement by ASD. ## Overview + Assessments against the Essential Eight are conducted using the _[Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight)_. This maturity model describes three target maturity levels (Maturity Level One through to Maturity Level Three) which are based on mitigating increasing levels of targeting and tradecraft. The maturity model also includes Maturity Level Zero which @@ -42,6 +44,7 @@ Finally, in determining compensating control effectiveness, assessors should ens that have been implemented provide an equivalent level of protection to those recommended under the Essential Eight. This will assist in ensuring that an equivalent level of overall protection against a specific level of targeting and tradecraft can be achieved and maintained. + ## Evidence quality In conducting an assessment, assessors need to gather and review credible evidence to support conclusions they draw @@ -49,11 +52,11 @@ on the effectiveness of controls. In general terms, the evidence used to determi in quality depending on the approach taken. As such, when conducting an assessment, assessors should seek to gather and use the highest quality evidence where reasonably practicable. This guide defines four levels of evidence quality: -- **Excellent evidence:** Testing a control with a simulated activity designed to confirm it is in place and effective (e.g. attempting to run an application to check application control rulesets). -- **Good evidence:** Reviewing the configuration of a system through the system’s interface to determine whether it should enforce an expected policy. -- **Fair evidence:** Reviewing a copy of a system’s configuration (e.g. using reports or screenshots) to determine - whether it should enforce an expected policy. -- **Poor evidence:** A policy or verbal statement of intent (e.g. sighting mention of controls within documentation). + - **Excellent evidence:** Testing a control with a simulated activity designed to confirm it is in place and effective (e.g. attempting to run an application to check application control rulesets). + - **Good evidence:** Reviewing the configuration of a system through the system’s interface to determine whether it should enforce an expected policy. + - **Fair evidence:** Reviewing a copy of a system’s configuration (e.g. using reports or screenshots) to determine +whether it should enforce an expected policy. + - **Poor evidence:** A policy or verbal statement of intent (e.g. sighting mention of controls within documentation). ## Determining effective implementation of mitigation strategies @@ -61,6 +64,7 @@ Upon concluding assessment activities, assessors will need to determine whether implemented effectively or not. This determination requires a combination of judgement and consideration of the following factors: + - adoption of a risk-based approach to the implementation of mitigation strategies - ability to test the mitigation strategies across an accurate representative sample of workstations (including laptops), servers and network devices - level of assurance gained from assessment activities and any evidence provided (noting the quality of evidence) @@ -83,25 +87,26 @@ strategy must be assessed as ‘effective’ or ‘alternate control’. If one cannot be claimed to have been met). Where exceptions to a mitigation strategy’s controls have been identified, the assessor should review and evaluate any compensating controls that are in place to determine whether they address the intent of the original controls and are implemented effectively. Two examples have been provided below. +| | | +|--|--| +| **Example 1** | During an internal review, an organisation identified a low-risk Windows server that could not be patched. As a result, the organisation implemented a plan to decommission the server within two months. In this situation, it was still important for the organisation to apply compensating controls that reduced the risk to an acceptable level, and to align with the requirements of the Essential Eight’s exception process. As a result, a risk owner was assigned, and strong compensating controls were put in place. In this instance, as the exception was being effectively managed and strong compensating controls were in place, an assessor determined that the exception should not preclude the organisation from reaching their target maturity level. Conversely, if the organisation had not applied strong compensating controls, it would not have aligned with the requirements of the Essential Eight’s exception process and should have precluded the organisation from reaching their target maturity level. | +|**Example 2**| During an internal review, an organisation identified a low-risk Windows server that could not be patched. As a result, the organisation implemented a plan to decommission the server within two months. In this situation, it was still important for the organisation to apply compensating controls that reduced the risk to an acceptable level, and to align with the requirements of the Essential Eight’s exception process. As a result, a risk owner was assigned, and strong compensating controls were put in place. In this instance, as the exception was being effectively managed and strong compensating controls were in place, an assessor determined that the exception should not preclude the organisation from reaching their target maturity level. Conversely, if the organisation had not applied strong compensating controls, it would not have aligned with the requirements of the Essential Eight’s exception process and should have precluded the organisation from reaching their target maturity level.| -| | | -| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| **Example 1** | During an internal review, an organisation identified a low-risk Windows server that could not be patched. As a result, the organisation implemented a plan to decommission the server within two months. In this situation, it was still important for the organisation to apply compensating controls that reduced the risk to an acceptable level, and to align with the requirements of the Essential Eight’s exception process. As a result, a risk owner was assigned, and strong compensating controls were put in place. In this instance, as the exception was being effectively managed and strong compensating controls were in place, an assessor determined that the exception should not preclude the organisation from reaching their target maturity level. Conversely, if the organisation had not applied strong compensating controls, it would not have aligned with the requirements of the Essential Eight’s exception process and should have precluded the organisation from reaching their target maturity level. | -| **Example 2** | During an internal review, an organisation identified a low-risk Windows server that could not be patched. As a result, the organisation implemented a plan to decommission the server within two months. In this situation, it was still important for the organisation to apply compensating controls that reduced the risk to an acceptable level, and to align with the requirements of the Essential Eight’s exception process. As a result, a risk owner was assigned, and strong compensating controls were put in place. In this instance, as the exception was being effectively managed and strong compensating controls were in place, an assessor determined that the exception should not preclude the organisation from reaching their target maturity level. Conversely, if the organisation had not applied strong compensating controls, it would not have aligned with the requirements of the Essential Eight’s exception process and should have precluded the organisation from reaching their target maturity level. | It is important that the use of exceptions for a system are documented and approved by an appropriate authority through a formal process. Documentation for exceptions should include the following: - detail, scope and justification for exceptions - detail of compensating controls associated with exceptions, including: - - detail, scope and justification for compensating controls - - expected implementation lifetime of compensating controls - - when compensating controls will next be reviewed + - detail, scope and justification for compensating controls + - expected implementation lifetime of compensating controls + - when compensating controls will next be reviewed - system risk rating before and after the implementation of compensating controls - any caveats placed on the use of the system as a result of exceptions - acceptance by an appropriate authority of the residual risk for the system - when the necessity of exceptions will next be considered by an appropriate authority (noting exceptions should - not be approved beyond one year). +not be approved beyond one year). + The appropriate use of a formal exception process, along with compensating controls, should not preclude an organisation from being assessed as meeting the requirements for their target maturity level. @@ -131,13 +136,12 @@ require the assessor to discuss with the system owner: - where the security assessment report will be developed (e.g. on an assessor’s device or on an alternative device) - approach to stakeholder engagement and consultation (including key points of contact) - whether any managed service providers or other outsourced providers manage any aspects of the system - (including appropriate points of contact) +(including appropriate points of contact) - access to any relevant prior security assessment reports for the system - appropriate use, retention and marketing of the security assessment report by both parties. -Assessors may also develop an assessment test plan and share it with the system owner. Example assessment test plans are included as Annex A through Annex C. +Assessors may also develop an assessment test plan and share it with the system owner. -Note, test cases listed within the example assessment test plans included as Annex A through Annex C should not be treated as mandatory assessment requirements. Rather, assessors should apply their own judgement and experience in the development of their own assessment test plans. ## Stage 2: Determination of assessment scope and approach @@ -194,7 +198,6 @@ When conducting assessments, paths for standard user profiles and temporary fold  %tmp%\*  %windir%\Temp\*. ``` - To check if application control is implemented within the user profile directory, attempt to run a benign executable file inside the directory. The executables tested should cover .exe, .com, .dll, .ocx, .ps 1 , .bat, .vbs, .js, .msi, .mst, .msp, .chm, .hta, and .cpl. If any of the executables run within the user profile directory or operating system temporary folders, application control is ineffective. Note, while a dedicated application control solution is not required at Maturity Level One (i.e. file system permissions can be used instead), organisations may still choose to implement a dedicated application control solution if they intend to eventually implement requirements for Maturity Level Two. @@ -202,7 +205,6 @@ Note, while a dedicated application control solution is not required at Maturity #### Assessment guidance The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. - @@ -220,6 +222,7 @@ The section below provides guidance tailored to the assessment method. When sele
Control
+ #### Patch applications #### Context @@ -227,10 +230,10 @@ The section below provides guidance tailored to the assessment method. When sele Most vendors of internet-facing services regularly release updated versions of their applications to fix vulnerabilities. Applications that exist on a system can be compared to the latest versions available from the vendor to determine whether existing versions are the latest, and if not, how long-ago updates were made available by the vendor, based on release dates and patch notes. Services such as the [SANS Internet Storm Centre](https://isc.sans.edu/), [Microsoft Security Response Centre](https://www.microsoft.com/en-us/msrc?oneroute=true) or the Cybersecurity and Infrastructure Security Agency’s _[Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)_ can be used to determine whether public exploits exist for a given internet-facing service. + #### Assessment guidance The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. - @@ -272,7 +275,11 @@ Finally, in addition to identifying assets for follow-on vulnerability scanning - + + + +
ControlAlternatively, PowerShell can be used to identify applications with registered uninstall functionality. However, this method alone will not always cover all applications that are installed on a system. As a result, it should be combined with the list of installed applications within ‘Programs and Features’.
While this approach can be used for assessments, the limitations in coverage should be noted. For key applications though, it will likely be sufficient. If any key applications appear to be missing in reports provided, this should be raised for clarification.
Below is a PowerShell script to output a list of installed applications with registered uninstall functionality. This list should be reviewed in conjunction with the list of installed applications within ‘Control Panel – Programs – Programs and Features’ to ensure no applications are missed.
function Analyze( $p, $f) {
  Get-ItemProperty $p |foreach {
     if (($_.DisplayName) -or ($_.version)) {
         [PSCustomObject]@{
             From = $f;
             Name = $_.DisplayName;
             Version = $_.DisplayVersion;
             Install = $_.InstallDate
           }
       }
   }
}
$s = @()
$s += Analyze ‘HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*’ 64
$s += Analyze ‘HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*’ 32
$s | Sort-Object -Property Name

The combined list of installed applications must be reviewed alongside the date of release for each application patch to determine whether the timeframe has been met.
If tools cannot be used, request a demonstration that shows the versions of installed applications and their install date. This allows for manual checking against the latest versions available from vendors.
Internet-facing services, office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed. A vulnerability scanner can be used to assess applications and whether they are end of life.
+
Request a demonstration that shows the versions of the referenced applications and services. This allows for manual checking against the list of supported versions. In addition, check if hotfix KB4577586 has been applied to demonstrate that Adobe Flash Player is no longer supported. Note, this hotfix will only remove Adobe Flash Player if it was installed by Windows. If Adobe Flash Player was installed manually from another source, it will not be removed by this hotfix.
@@ -518,7 +525,7 @@ environments have been implemented. Unprivileged accounts cannot logon to privileged operating environments. -Attempt to logon to a privileged workstation using a standard user account. +Attempt to logon to a privileged workstation using a standard user account.
Bloodhound can be used to assess whether any unprivileged accounts have connected to privileged environments by looking for cached credentials. @@ -533,12 +540,13 @@ workstation. Note, the moment a privileged account’s username and password are entered into a standard user workstation, the account should be considered compromised (noting this is the reason behind having separate operating environments). This test should be done using a privileged account set up specifically for this purpose. -The privileged account should then be removed immediately after testing is complete. +The privileged account should then be removed immediately after testing is complete.

Bloodhound can be used to assess whether any privileged accounts have connected to unprivileged environments by looking for cached credentials. + #### Patch operating systems #### Context @@ -553,7 +561,6 @@ Services such as the [SANS Internet Storm Centre](https://isc.sans.edu/), [Micro The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. - @@ -665,7 +672,7 @@ patch release date. There are several free tools available to support the assess this control, including ASD’s E8MVT, Nessus Essentials, Nexpose Community Edition, OpenVAS and Qualys Community Edition. There are also several paid tools available. In choosing a tool to use, make sure that it has been thoroughly tested beforehand to -ensure it is fit-for-purpose. +ensure it is fit-for-purpose.
If using WSUS for the assessment of this control, it is important to consider that WSUS does not necessarily report accurate patch levels. Specifically, WSUS has been known to report patches or updates that have been deployed but not whether they were @@ -692,6 +699,7 @@ not.
Control
+ #### Multi-factor authentication #### Context @@ -702,6 +710,7 @@ Multi-factor authentication should be implemented for remote access solutions, u At this maturity level, any two or more authentication methods can be used as long as they are not of the same class (e.g. something users know, something users have or something users are). There is no requirement that one factor must be a memorised secret. Biometrics and [Trusted Signals](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/multifactor-unlock?tabs=intune) are also acceptable as an authentication method at this maturity level. + Note, while any two or more authentication methods can be used at Maturity Level One, organisations may still choose to implement multi-factor authentication solutions, such as those that include something the user has or are phishing-resistant, if they intend to eventually implement requirements for Maturity Level Two or Maturity Level Three. #### Assessment guidance @@ -767,6 +776,8 @@ whether customers/citizens need to set it up themselves after initial account cr + + #### Regular backups #### Context @@ -781,7 +792,6 @@ While unprivileged accounts can access (i.e. read) their own backups, it is impo The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. - @@ -872,6 +882,7 @@ Malicious actors will also often seek to compromise user accounts. If successful The guidance below outlines the requirements to be assessed in addition to the requirements of the previous maturity level. In doing so, assessments against Maturity Level Two should focus on the delta between Maturity Level One and Maturity Level Two. + #### Application control #### Context @@ -883,7 +894,6 @@ The majority of application control solutions will have a form of logging or aud #### Assessment Guidance The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. -
Control
@@ -934,7 +944,6 @@ increase in associated vulnerability scanning frequencies and scope. The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. -
Control
@@ -983,6 +992,7 @@ applications using the identified timeframes.
Control
+ #### Configure Microsoft Office macro settings #### Context @@ -995,7 +1005,6 @@ Event logs for Microsoft Office macro execution events should be collected and s The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. - @@ -1045,7 +1054,6 @@ mitigated. #### Assessment guidance The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. -
Control
@@ -1066,9 +1074,6 @@ Google hardening guidance for Google Chrome is available within their Microsoft Office is blocked from creating child processes. @@ -1202,7 +1207,7 @@ For Maturity Level Two, privileged operating environments must not be virtualise - physically separate operating environments - an unprivileged operating environment virtualised within a privileged operating environment - both a privileged and unprivileged operating environment virtualised within a physical host’s hardened operating - environment. +environment. Jump servers play an important role as a centralised logging and tool enforcement point for administrative activities, even when privileged operating environments are used. @@ -1233,7 +1238,7 @@ an expiration date that exceeds 12 months: Get-ADUser -Filter {(admincount -eq 1) -and (enabled -eq $true)} -Properties AccountExpirationDate | Where-Object {$_.AccountExpirationDate -like “” | Select @{n=‘Username’; e={$_.SamAccountName}}, @{n=‘Account Expiration Date’; -e={$_.AccountExpirationDate}}, @{n=‘Enabled’; e={$_.Enabled}} +e={$_.AccountExpirationDate}}, @{n=‘Enabled’; e={$_.Enabled}}
Get-ADUser -Filter {(admincount -eq 1) -and (enabled -eq $true)} -Properties AccountExpirationDate | Where-Object {$_.AccountExpirationDate -gt (Get- Date).AddMonths(12)} | Select @{n=‘Username’; e={$_.SamAccountName}}, @@ -1247,7 +1252,7 @@ automatically disabled after At this maturity level, an additional requirement for all privileged users logging onto systems, both locally and remotely, to use multi-factor authentication is introduced. In addition, the authentication methods that can be used, and in what combination, are restricted to avoid weaker implementations. Specifically, acceptable multi-factor authentication implementations include: - something users have (i.e. look-up secret, out-of-band device, single-factor one-time PIN (OTP) devices, single- - factor cryptographic software or single factor cryptographic device) in addition to something users know (i.e. a - memorised secret) +factor cryptographic software or single factor cryptographic device) in addition to something users know (i.e. a +memorised secret) - something users have that is unlocked by something users know or are (i.e. multi-factor OTP device, multi-factor - cryptographic software or multi-factor cryptographic device). +cryptographic software or multi-factor cryptographic device). Biometrics are not acceptable at this maturity level. This is due to biometric characteristics not being secrets, biometric matching being probabilistic rather than deterministic and there being a reliance on the security of biometric capture software installed on devices. However, biometrics can be used to unlock another authentication factor (e.g. a certificate stored in a Trusted Platform Module or an OTP generator app on a smartphone). [Trusted Signals](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/multifactor-unlock?tabs=intune) are also not acceptable at this maturity level. This is due to issues associated with placing trust in the signal itself, which can be targeted and spoofed by malicious actors. @@ -1389,7 +1397,6 @@ Note, at this maturity level organisations may choose to implement multi-factor #### Assessment guidance The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. -
Control Microsoft provides guidance on the use of PowerShell to identify inactive accounts based on when they were last used to logon to a system. Ask for a screenshot of the output of the following PowerShell command that checks for inactive accounts to -demonstrate that this activity takes place on a daily basis: +demonstrate that this activity takes place on a daily basis:
Get-ADUser -Filter {(admincount -eq 1) -and (enabled -eq $true)} -Properties LastLogonDate | Where-Object {$_.LastLogonDate -lt (Get-Date).AddDays(-45) - and$_.LastLogonDate -ne $null} | Select @{n=‘Username’; e={$_.samaccountname}}, @@ -1338,6 +1343,7 @@ At this maturity level, the timeframe for patching vulnerabilities in operating The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. + @@ -1366,6 +1372,8 @@ Level Two timeframes.
Control
+ + #### Multi-factor authentication #### Context @@ -1373,10 +1381,10 @@ Level Two timeframes.
@@ -1432,7 +1439,7 @@ value of ‘Success and Failure’. @@ -1464,7 +1471,7 @@ cannot access backups belonging to other accounts. @@ -1476,7 +1483,7 @@ and deleting backups. @@ -1592,7 +1599,6 @@ This requirement can be assessed in a similar way to Maturity Level Two, except #### Assessment guidance The section below provides guidance tailored to the assessment method. When selecting an assessment method, the quality of the evidence provided by each method should be strongly considered. -
Control
For certain MFA implementations the above guidance may not be applicable. In these instances discuss whether logging is available for all systems that users authenticate to -and seek evidence that such logging is in place. +and seek evidence that such logging is in place.
If an administrator logon was observed (per the first control in this table), request recent event logs to check that there is a corresponding event log entry.
Use the guidance provided in Maturity Level One of this guide and apply the Maturity Level Two access control requirements. Specifically, privileged accounts should only be -able to access their own backups (except for backup administrator accounts). +able to access their own backups (except for backup administrator accounts).
Active Directory queries and tools such as BloodHound can help to identify privileged accounts including backup administrator accounts.
Use the guidance provided in Maturity Level One of this guide and apply the Maturity Level Two access control requirements. Specifically, privileged accounts should no longer be able to modify and delete backups. Such activities should be restricted to -backup administrator accounts. +backup administrator accounts.
Active Directory queries and tools such as BloodHound can help to identify privileged accounts including backup administrator accounts.
@@ -1621,6 +1627,7 @@ all applications.
Control
+ #### Configure Microsoft Office macro settings #### Context @@ -1637,7 +1644,6 @@ When implementing a digitally signed Microsoft Office macro approach, an organis #### Assessment guidance The section below provides guidance tailored to the assessment method. When selecting a method, the quality of the evidence provided by each method should be strongly considered. - @@ -1663,7 +1669,7 @@ Office macros are used then Trusted Locations should be disabled.
Control Within each Microsoft Office application, request a screenshot showing Trust Center macro settings (File – Options – Trust Center – Trust Center Settings – Macro Settings). In addition, request a screenshot showing Trust Center trusted publisher settings (File – -Options – Trust Center – Trust Center Settings – Trusted Publishers). +Options – Trust Center – Trust Center Settings – Trusted Publishers).
For the assessment of Microsoft Office macro security, identify what setting is selected for ‘macro settings’. The setting should either be set to ‘Disable all macros without notification’ (if Trusted Locations are used) or ‘Disable all macros except digitally signed @@ -1741,7 +1747,7 @@ logs for signs of compromise and respond when any signs of compromise are detect At this maturity level, Internet Explorer 11 must be disabled or removed from operating systems rather than just blocked from accessing the internet or opening files from the internet. .NET Framework 3.5 (including .NET 2.0 and 3.0) is often targeted by malicious actors due to its lack of security functionality when compared to newer versions of the .NET Framework, as well as due to its linkages to PowerShell 2.0. -Within Microsoft Windows there are two separate features relating to the .NET Framework, ‘.NET Framework 3.5 (includes .NET 2.0 and .NET 3.0)’ and ‘.NET Framework 4.8 Advanced Services’. +Within Microsoft Windows there are two separate features relating to the .NET Framework, ‘.NET Framework 3.5 (includes .NET 2.0 and .NET 3.0)’ and ‘.NET Framework 4.8 Advanced Services’. Microsoft ended support for Windows PowerShell 2.0 in late 2017. At that time, Microsoft noted that Windows PowerShell 2.0 lacked the security functionality of Windows PowerShell 5.0 and higher. Constrained Language Mode for PowerShell is designed to prevent PowerShell users (which may include malicious actors) from running tools that exploit PowerShell or load Component Object Model objects, libraries and classes into a PowerShell session. @@ -1822,6 +1828,7 @@ logs for signs of compromise and respond when any signs of compromise are detect
+ #### Restrict administrative privileges #### Context @@ -1891,7 +1898,7 @@ on Windows Defender Credential Guard can be found at Control @@ -2087,6 +2094,7 @@ accounts (including backup administrator accounts) and break glass accounts. + ## Stage 4 : Development of the security assessment report In developing the security assessment report, assessors should use the _[Essential Eight Assessment Report Template](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-assessment-process-guide)_. @@ -2100,6 +2108,7 @@ Eight](https://www.cyber.gov.au/resources-business-and-government/essential-cybe A mapping between the requirements of the _[Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight)_ and the _[Information Security Manual](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism)_ can be found in the _[Essential Eight Maturity Model to ISM Mapping](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model-ism-mapping)_ publication. + A mapping between the requirements of the _Essential Eight Maturity Model_ and the _Information Security Manual_ can be found in the _Essential Eight Maturity Model to ISM Mapping_ publication. ## Contact details