Frameworks
ACSC Essential Eight
The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) has developed eight strategies to assist organisations prevent or identify cyber security incidents. While there are three Maturity Levels, the focus for our Facilitated Self Assessment Workshop is on Maturity Levels 1 and 2.
Maturity Level 1:
The focus of this maturity level is adversaries who are content to simply leverage commodity tradecraft that is widely available to gain access to, and control of, a system. For example, adversaries opportunistically using a publicly available exploit for a security vulnerability in an unpatched internet-facing service, or authenticating to an internet facing service using credentials that were stolen, reused, brute forced or guessed.
Maturity Level 2:
The focus of this maturity level is adversaries operating with a modest step-up in capability from the previous maturity level. These adversaries are willing to invest more time in a target and, perhaps more importantly, in the effectiveness of their tools. For example, these adversaries will likely employ well-known tradecraft to better attempt to bypass controls implemented by a target and evade detection. This includes actively targeting credentials using phishing and employing technical and social engineering techniques to circumvent weaker methods of multi-factor authentication.
