HSA July 2023

M E M B E R A D V I C E
“The Essential
Eight covers eight
fundamental areas
of cybersecurity
that every
business should
focus on.”
As a business owner, you probably
won’t understand each section.
But you should have a top level
grasp of the concepts.
1. Application whitelisting: This
control involves only allowing
approved applications to run on
your systems, thereby preventing
the execution of unauthorized or
malicious software. By creating
a whitelist of trusted applications
and blocking all others, you
can significantly reduce the
risk of malware infections and
unauthorised access.
2. Patching applications: Keeping
your software up to date is
crucial in preventing cyber
attacks. This control involves
regularly applying patches and
updates to your applications,
operating systems, and firmware.
Patching helps address known
vulnerabilities and weaknesses
that can be exploited by
attackers.
3. Configuring Microsoft Office
macro settings: Microsoft Office
macros are a common vector
for spreading malware. This
control involves configuring your
Microsoft Office applications to
disable or restrict the execution
of macros, unless they are from
trusted sources. By doing so,
you can minimize the risk of
malware being delivered through
malicious macros.
4. Restricting administrative
privileges: Limiting the number
of users with administrative
privileges can significantly
reduce the impact of a security
breach. This control involves
implementing the principle of
least privilege, where users are
only given the minimum access
rights necessary to perform
their job functions. By doing
so, you can prevent attackers
from gaining full control of your
systems even if they manage
to compromise a user account.
IMPLEMENTING THE
FIRST FOUR CONTROLS
OF THE ESSENTIAL EIGHT
FRAMEWORK
Now that we have a good
understanding of the first four
controls of the Essential Eight
Cybersecurity Framework, let's
delve into how you can effectively
implement them in
your organization:
1. Application whitelisting: Start by
conducting an inventory of all
the applications running on your
systems. Identify the ones that
are essential for your business
operations and create a whitelist
of approved applications.
Implement a robust application
control mechanism that
prevents the execution of
any unauthorized software.
Regularly review and update
your whitelist as needed.
2. Patching applications: Establish
a patch management process
that ensures timely updates for
all your applications, operating
systems, and firmware. This
process should include regular
vulnerability assessments to
identify and prioritize patches
based on the level of risk
they pose. Automate patch
deployment wherever possible
to streamline the process
and minimize the window of
exposure to vulnerabilities.
3. Configuring Microsoft Office
macro settings: Configure your
Microsoft Office applications
to disable macros by default.
Only enable macros for trusted
documents or specific business
processes that require their use.
Educate your employees about
the risks associated with macros
and provide clear guidelines
on how to handle macros from
external sources. Regularly
remind your employees to
exercise caution when opening
attachments or enabling macros.
4. Restricting administrative
privileges: Conduct a thorough
review of the administrative
privileges assigned to user
accounts in your organization.
Identify accounts with
unnecessary administrative
rights and revoke them.
Back to Contents www.ahasa.asn.au | Hotel SA | 29