Cyber Security Best Practices: A Beginners Guide to The Essential 8

Technology is now 100% vital to running a business. As you become more and more reliant on technology though, the potential impact of a cyber-attack also increases.

As recent events have proven, most businesses are underprepared to deal with the dangers of the current cyber landscape. Dive in for the best practices in using The Essential 8 to help boost your cyber security.

What is The Essential 8?

The Essential 8 is a set of eight cyber security controls recommended by the Australian Cyber Security Centre (ACSC). In summary:

Aligning with The Essential 8 can help your business succeed and drive your growth. On the flipside, non-compliance opens doors for cyber threats to enter – which can be a disaster.

How to implement The Essential 8 cyber security solutions

The Essential 8 uses maturity level targets as guideposts. Your goal should be to keep improving your security, so your organisation moves to the higher level for each of the eight controls.

Moving up the levels can be achieved through a five-step process:

STEP 1: Assess your cyber security posture.

A cyber security risk assessment can help you identify your most vulnerable areas. (You’ll want to consult with your Managed IT Services provider for help here!)

STEP 2: Develop a maturity plan for your business.

Work with your IT provider to map out your implementation process, answering questions like:

• Which controls should be prioritised?
• What resources will you need?
• What is your implementation timeline?

STEP 3: Implement the controls.

This may involve making changes to your policies, procedures, and systems. Your IT services company can help with the implementation as well as provide any change management support for your team.

STEP 4: Keep controls up to date.

As new threats emerge, you must keep your controls up to date to keep them effective.

STEP 5: Get ready for the next step.

Once you’ve reached your first maturity alignment, it’s time to start preparing for the next level until your business has the defence it needs.

Cyber Security Best Practices Businesses Can Adopt

No need to reinvent the wheel. Others have succeeded in this before, and below are some of the ways they implement The Essential 8.

Essential 1: Application Control

Application control or whitelisting is like having a gatekeeper, who lets allowed applications to run and keeps out the ones disallowed in your systems. This prevents malicious code from spreading and running and blocks the installation or use of applications absent from your whitelist.

Here are some application control guidelines:

• Do a comprehensive inventory of all the applications installed in your systems.
• Create your whitelist – applications that are essential for your business operations.
• When using an application control software:
  • Configure it properly.
  • Monitor for unauthorised applications.
  • Keep it updated so it can identify and block new threats.

Essential 2: Patch Applications

Patching applications is the process of installing software updates that can plug security vulnerabilities and fix bugs. Here are some tips for doing it:

• Use available tools that can automate patch application.
• Patch all applications, not just the critical ones.
• Patch applications ASAP to keep you ahead of new threats.
• Test patches before applying them.
• Monitor for problems after patching.

Essential 3: Configure Microsoft Office Macro Settings

Macros are small programs used to automate tasks within Microsoft Office applications. There are macros, however, that are used to steal data or install malware, bypass security restrictions, or damage documents. Here are Microsoft’s recommendations about macros:

• Disable macros by default.
• Enable macros only from trusted sources.
• Set your macro security notification level to High.
• Use a macro virus scanner to check for malicious macros before opening documents.

Essential 4: User Application Hardening

User application hardening is like fortifying a medieval castle by adding defence layers like thick walls, sturdy gates, moats, and guards. This is used for applications installed on user workstations. Here are some hardening best practices:

• Choose to use only applications that are secure.
• Use only the latest application versions that have better security features.
• Use application configuration settings that minimise risks.

Essential 5: Restrict Administrative Privileges

Administrative privileges are like giving access to a property and its various areas, where certain people are given access only to certain areas. They are permissions that allow users to perform tasks that require elevated access, such as installing software, making changes to system settings, and accessing sensitive data.

Restrictions can be implemented via:

• Identity Governance, which manages user accounts to ensure that only authorised users have access to sensitive data and systems
• Least Privilege, where users are given the minimum amount of access to do their jobs
• Account Restrictions, which control or limit the privileges of user accounts
• Administrative Devices, where specific computers and devices are kept highly secure because they are used to manage systems and data
• Logging and Monitoring, which are controls to identify and respond to security incidents, to track down attackers, and to prevent future attacks

Essential 6: Patch Operating Systems

Unsupported or outdated operating systems are common cyber threat targets. Some of the best ways to prevent attacks are as follows:

• Identify outdated and unsupported operating system versions.
• Patch operating systems within a reasonable period, such as every two weeks.
• Use a vulnerability scanner to identify missing patches or updates.

Essential 7: Multi-Factor Authentication (MFA)

MFA is done by using two or more authentication methods like one-time passwords (OTPs), biometrics, or hardware tokens. It is one of the most effective ways to protect your system, service, or application. Here are some tips for using MFA:

• Enable MFA for all users, regardless of role or location.
• Require MFA enrolment before users can access sensitive resources.
• Monitor MFA usage to ensure it is being used effectively, problems can be identified and fixed.
• Use a cloud-based MFA solution.
• Use a strong password for your MFA app.
• Keep your MFA app up-to-date.
• Beware of phishing attempts to steal MFA codes.

Essential 8: Regular Backups

Regular backups can help to maintain business continuity in case of any disruption. Some backup best practices are as follows:

• Backup all critical data.
• Back up data regularly.
• Store backups offsite.
• Test your backups regularly to ensure they are working properly.
• Have a disaster recovery plan outlining how to restore your data in case of a disaster.
• Use a cloud-based backup solution that can be accessed from anywhere.
• Encrypt your backups to protect against unauthorised access.
• Rotate your backups to help prevent data loss.

Overall Best Practices for Using the Essential 8

Here are a few general guidelines for implementing The Essential 8 in your business:

• Holistic Assessment: A thorough cyber security assessment is a must prior to planning and implementation.
• Leadership Buy-In: Secure support from top leadership within your organisation to ensure proper allocation of resources and organisational focus.
• Training & Awareness: Train all your staff on The Essential 8 and cyber security. Build cyber awareness to make everyone a proactive cyber defender.
• Regular Updates: Keep abreast of the latest threats and vulnerabilities. Update your practices and strategies to stay ahead.
• Multi-Layered Approach: Combine The Essential 8 practices with other solutions to create a comprehensive defence system.
• Continuous Monitoring: Regularly monitor your systems and network for suspicious activities or anomalies. Use tools to quickly identify and respond to potential threats.
• Incident Response Plan: Develop a well-defined plan that outlines the steps to take in case of a cyber incident. It should be regularly tested and updated over time.
• Vendor & Third-Party Management: Assess the cyber security practices of third-party vendors and partners who have access to your data or systems. Ensure they meet similar security standards to minimise external risks.
• Data Protection & Encryption: Implement strong data encryption practices to protect sensitive information. Restrict access to data based on the principle of least privilege.
• Regular Review & Improvement: Continuously evaluate the effectiveness of The Essential 8 practices in your organisation. Learn from past incidents and adapt your cyber security strategy to strengthen weaknesses.
• Compliance & Regulation: Stay compliant with relevant industry regulations and legal requirements concerning cyber security.
• Regular Training & Drills: Conduct periodic training sessions and simulation drills to test and improve your employees’ response to various cyber incidents.

Getting help with cyber security services

The eight cyber security baseline standards are essential for any business. If your vision is to grow your business, you need to lead the way in cyber security.

The Essential 8 can help you forge a formidable path towards cyber resilience. Of course, not all businesses will find them easy to implement – and most reach out to cyber security specialists in Perth. Inspired IT can help you align with The Essential 8 – just book a free consultation with us and we will assist you all the way.