Missing the Cybersecurity Mark With the Essential Eight

COMMENTARY
In recent years, Australia has made some key moves to improve the country's security posture. In 2020, the country invested AUD $1.67 billion (US$1.1 billion) as part of Cyber Security Strategy 2020.

Despite these efforts, the Australian government's "Cyber Threat Report 2022-2023" reported 58 incidents that it classified as Extensive Compromises, and 195 incidents that it classified as Isolated Compromises. Port operator DP World Australia suspended operations due to a cyberattack in November. SA Health, Services Australia, and NT Health were just a few of the healthcare providers that were breached last year, following November 2022's Medibank breach that affected nearly 10 million people.

In response, Australia updated the levels in its Essential Eight Maturity Model, the nation's comprehensive guide for businesses trying to protect themselves against cyberattacks. A framework created in 2010 to help businesses withstand cybersecurity threats, the Essential Eight has been updated several times, most notably when it added its maturity model to help companies of different sizes determine appropriate security actions to take, and most recently in November 2023.

However, with cybercrime running rampant in Australia, it's time to ask whether the Essential Eight is providing the right direction for Australian organizations and if it should be used as a model for other countries.

Inside the Essential Eight

The Essential Eight has remained intact since being published in 2010. It provides direction on patching, backups, and application control. Among other things, 2023's update recommends restricting Microsoft macros and includes directives on user application hardening.

While all those issues are important, they fail to recognize the transition to the cloud and, specifically, the use of software-as-a-service (SaaS) applications. The Essential Eight does include a section on restricting administrative privileges, a key SaaS security principle.

However, reading through the Maturity Levels, it is clear that its guidance remains tailored toward on-premises networks. Maturity Level 2 includes guidance like "Requests for privileged access to systems, applications, and data repositories are validated when first requested" and "Privileged users use separate privileged and unprivileged operating environments."

Of the 29 admin privileges recommendations in the three maturity levels relating to admin privileges, only one addresses online accounts ("Privileged accounts explicitly authorized to access online services are strictly limited to only what is required for users and services to undertake their duties").

The Essential Eight does include multifactor authentication (MFA). This is a critical step in securing online services. However, MFA is just one piece of cloud and SaaS security. Limiting guidance to just MFA does a disservice to the businesses and government entities that rely on the Essential Eight for direction in securing their entire digital footprint.

Essential Eight Misses on Today's Work Environment

Unfortunately, the Essential Eight and its Maturity Models miss out on today's computer environment. It doesn't contain the words "cloud" or "SaaS application." By omission, it fails to recognize the role SaaS applications play in today's business world and the data that is stored on the cloud.

Today, SaaS applications comprise 70% of all software used by businesses. Each of those applications contains business-critical data or plays a role in operations that must be secured. MFA is an important tool used to limit access to authorized users, but it falls far short of the measures required to secure SaaS and cloud instances.

Updating the Essential Eight for the Modern Workplace

The Essential Eight is missing four key cloud-centric security directives: configuration management, identity security, third-party app integration management, and resource control.

Preparing Businesses for Today's Threats

Australia, as well as cybersecurity organizations in the Middle East and Africa that look to Australia for guidance, must update its security framework to address modern network infrastructures.

Introducing security measures relating to misconfiguration management, ISPM, third-party applications, and protecting company assets stored in SaaS applications should be the next step for the Essential Eight.