The purpose of Australia’s Essential Eight is to provide a clear, easy-to-follow set of guidelines that can be applied to protect Australian organizations and their information technology systems against cyberattacks.
The Essential Eight Maturity Model helps support the implementation of Essential Eight principles and provides a transparent assessment of how easy an organization’s systems are to exploit. These mandatory guidelines can be implemented in phases, known as maturity levels, so that no matter where an organization is on its cyber maturity journey, it can gain a foothold and begin to rise in maturity.
Implementing a robust Managed File Transfer (MFT) solution can help make your file transfer software harder to exploit and therefore more mature by Essential Eight Maturity Model standards.
Who Needs to Adhere to the Essential Eight Model?
All Australian government agencies and departments are required to abide by the Essential Eight standards. Specifically, it is mandatory for all non-corporate Australian Commonwealth entities that are subject to the PGPA Act (per the PSPF Policy 10).
Australian enterprises are also required to comply to the extent that the Essential Eight coincides with their individual requirements. Additionally, the Australian government is increasingly encouraging private entities to use it, as its goal – to help organizations mitigate cyberattacks and increase their cyber resilience - is one that serves the entire Australian digital economy.
As an organization’s risk tolerance necessarily factors in third parties, the Essential Eight model should responsibly be applied to all vendors, suppliers, contractors, service providers, and upstream partners of any Australian entity, public or private, as well.
While doing so isn’t strictly mandatory, the proactive application of the framework by these third parties could increase their chances of a contract. After all, doing the security and compliance legwork ahead of time makes a supply chain partner all the more competitive and desirable.
Essential Eight Maturity Levels Defined
By advancing in the Essential Eight Maturity levels, Australian businesses, government agencies, and organizations operating within the country will be progressively better prepared to mitigate “increasing levels of tradecraft...and targeting,” or the various tools, techniques, tactics, and procedures used by cybercriminals today. Because cybercrime gangs may use different levels of tradecraft (the techniques used in their attacks) against different companies, organizations are encouraged to identify and mitigate the skill level, not the threat actor. The maturity levels are as follows:
- Maturity Level Zero: A weak overall cybersecurity posture that is highly at risk of failing to protect the confidentiality, availability, and integrity of data.
- Maturity Level One: This level is capable of preventing low-level attacks. These include publicly available exploits, credential-based attacks, common social engineering ploys, and the like.
- Maturity Level Two: At this stage, companies can protect against mid-level attackers who take their easy exploits one step further. Attacks seen at this level can include actively phishing for credentials (not just buying them off the dark web), focusing in on specific targets (you), getting around weak MFA, seeking and exploiting accounts with special privileges, and destroying data and backups, among others.
- Maturity Level Three: Organizations are prepared for an all-out attack. Threat actors at this level are using advanced tactics and sparing no expense to target your organization directly. While there may still be some reliance on publicly available tools, their arsenal will also include ways to bypass stronger MFA, steal authentication token values, exploit weaknesses in older software, pilfer and mine data in transit (and at rest), and crack encryption codes to get what they want.
By fending off attacks that target cryptography and data transfers – in other words, by protecting data both at rest and in motion - companies can travel upwards in their Essential Eight maturity and be better prepared to address advanced exploits, engage in third-party partnerships, and be ready for compliance audits.
MFT Encryption Can Help Support Maturity Level Three
The Essential Eight have been developed by the Australian Signals Directorate (ASD) as part of their Strategies to Mitigate Cybersecurity Incidents and map to the more comprehensive Information Security Manual (ISM). The ISM lays out specific cryptographic fundamentals that will help keep organizations focused on the capabilities needed. These give a good picture of the level of security preparedness required to fend off attackers at Essential Eight Level Three (and even to an extent, Level Two).
ASD cryptographic guidelines note that “when an organisation uses encryption for data at rest or data in transit...they are [reducing] the immediate consequences of the data being accessed by malicious actors.” Those immediate consequences are the threat actor having useful information they can hold over your head, sell, or publish publicly to diminish your security posture.
While not explicitly mandated, encryption can prove indispensable to accomplishing the overarching aims of the Essential Eight, and your security strategy, by extension. At a time when data breaches are perceived as inevitable, responsible organizations plan for that possible and unfortunate contingency by layering defenses, not only securing the storage space in which the data is housed but encrypting the data itself. That way, if an attacker gets in, their efforts will ultimately be thwarted (or at least vastly slowed) by the barricade of cryptography.
Encrypting Data at Rest and in Transit
MFT solutions, such as Fortra's GoAnywhere MFT, can automatically encrypt files within the designated folders as they are written in real-time, helping maintain an environment of security against potential at-rest data attacks. GoAnywhere protects data at rest with:
And GoAnywhere protects files in transit via:
This robust encryption can automatically help secure your files across all stages of the data transfer process. For example, GoAnywhere can schedule time-based and event-based workflows, enabling you to send secure batches of data when you want, to where you want. This includes to and between internal systems, users, and trading partners.
Choosing Which Encryption Method is Right for You
With a robust MFT solution in place, you can afford to be choosy as to which encryption method to use. You can narrow your choices down by asking a few key questions:
- How sensitive is the data being sent?
- How large are the files, and do they need to be compressed?
- Do these files need to be encrypted at rest (even before sending and at the recipients' destination)?
- What level of encryption do my trading partners require?
And ultimately, what technology solutions or software will help protect your data and systems against the potential of more than just low-level attacks?
Increase Your Essential Eight Maturity with MFT in Security Stack
The Essential Eight is designed to benchmark and improve any Australian entity’s cybersecurity posture, no matter where they are on the maturity ladder. However, the larger picture is for your organization to ascend the maturity levels in time to fend off whatever attacks may be around the corner. While the Essential Eight may make allowances for your development, cybercriminals won’t.
Essential Eight Maturity Level Three is characterized by the tools threat actors use and the lengths they will go to in order to pilfer data and breach your networks. The way to fight high-powered technology is with other high-powered technologies, hence the assimilation of Managed File Transfer methods into your security stack. While the specifics may tempt you to get stuck in the weeds, the big picture is clear – the harder you make it for advanced attackers to compromise your enterprise in any fashion, the more your Essential Eight Maturity advances.
GoAnywhere Can Help You Move Up the Essential Eight Ladder
This robust solution can automatically help secure your files across all stages of the data transfer process.