Beyond the endpoint: ASD’s new approach to enterprise cyber defence
Australia’s approach to cyber defence is shifting from protecting individual endpoints to defending the enterprise as a whole, with the launch of ASD’s new Essentials for Enterprise IT (“Essentials”) framework.
The new framework reflects a threat environment in which sophisticated adversaries increasingly target identity, privileged systems and internet-facing infrastructure, rather than relying solely on attacks against individual users and devices.
Essentials significantly expands on its predecessor, the Essential Eight, with:
- Eight Domains covering the entire enterprise IT environment rather than focusing on endpoints
- Implementation Levels ordered by priority rather than adversary capability
- Principles defining expected outcomes rather than prescribing controls
For organisations accustomed to the Essential Eight – or still working towards it – Essentials can initially look daunting. We are approaching Essentials from an existing Essential Eight Maturity Level 3 environment, and our initial experience is that its breadth makes it look more complex than it is. Its structure breaks the task into manageable priorities, allowing cyber uplift to be tackled progressively and measured.
The biggest difference between the two frameworks is scope. Essential Eight concentrated heavily on endpoints. Essentials looks across the entire enterprise through eight domains: Governance and Culture; Visibility and Response; Boundary Services; Identity Services; Critical Processes and Services; Privileged Environments; Business Systems; and User Devices.
This extends cyber defence beyond the devices employees use to include the systems determining access, internet-facing services, privileged IT environments and the critical applications and data an organisation needs to operate.
Defending the endpoint is no longer enough when an adversary can enter elsewhere, acquire privileged access and move through the organisation undetected.
The second major change is prioritisation. Rather than maturity levels based on adversary capability, Essentials uses three Implementation Levels.
Level 1 starts with Boundary and Identity Services – effectively the doors, locks and keys of the enterprise. Level 2 moves to Critical Processes and Services and Privileged Environments: the systems capable of causing the greatest damage if compromised. Level 3 addresses Business Systems and User Devices, after the organisation has strengthened the layers around them.
Governance and Culture, and Visibility and Response, sit outside this sequence because they are expected to operate – and improve – continuously.
The third change moves cyber defence from prescriptive controls towards outcomes.
Essentials draws on cyber security principles from ASD’s Information Security Manual. Rather than prescribing a particular technology or action, the principles describe the security outcome an organisation should achieve. Actions then provide practical guidance on how to get there.
Few enterprise IT environments are uniform. Government agencies and businesses operate combinations of legacy systems, cloud platforms, SaaS applications, mobile devices and infrastructure from multiple vendors. An outcome-based approach allows the same security objective to be applied across them.
For organisations wondering where to begin, the first step need not be a major technology program. A table-top exercise involving security and IT teams alongside business owners can map the principles against the existing environment and quickly identify the largest gaps.
Organisations already aligned with frameworks such as NIST or ISO 27001 are not necessarily starting again. Existing controls and practices can be mapped against the outcomes Essentials is seeking to achieve.
Essentials for Enterprise IT shouldn’t be viewed as another cyber security checklist. It marks a shift from asking whether particular controls have been implemented to asking a much bigger question: can the organisation as a whole withstand the way sophisticated adversaries now attack?
Understand ASD’s new approach to enterprise cyber defence.
ASD’s Essentials for Enterprise IT builds on the Essential Eight, with a broader focus across enterprise IT, operational technology and cloud environments. Download our guide for a clear overview of what has changed and how your organisation can start applying the framework.