Essential Eight

Want to be seen as a valued partner while generating more revenue and establishing a competitive edge for your MSP? Learn about Essential Eight, and then use Compliance Scorecard to sell it, implement it, and manage it.

The first-of-its-kind Compliance as a Service (CaaS) platform, Compliance Scorecard features policy management, risk assessment, reporting, and auditing capabilities. Combined with a whole lot of cybersecurity integrations, we enable MSPs to effectively guide clients through the Essential Eight compliance journey. Be the proactive security partner your clients have been looking for, and build business while you’re at it.

The Essential Eight cybersecurity controls

1. Patch applications
   Patches are intended to update applications with new features, bug fixes, and security enhancements. These patches safeguard applications against malicious actors who exploit vulnerabilities to gain unauthorized access and spread harmful code. Regular scans can help identify missing patches, which should be applied in a timeframe commensurate with exposure to the vulnerability.

2. Patch operating systems
   Patches for operating systems, much like those for applications, are essential to addressing vulnerabilities that can be exploited by malicious actors. Conducting regular scans for patch updates and promptly applying them prevents unauthorized access and data breaches. Organizations should also be testing the safety of patches prior to installing them.

3. Multifactor authentication (MFA)
   Multifactor authentication (MFA) enhances account protection by requiring users to provide multiple forms of identification. MFA adds an extra layer of security to traditional passwords, making it significantly harder for unauthorized individuals to access systems and data. Even if a user's password is compromised, attackers are unlikely to obtain the second authentication factor.

4. Restrict administrative privileges
   Once a malicious actor has breached a system, one of their primary goals is to escalate their privileges, allowing them to move laterally and spread malware. Restricting administrative privileges involves implementing controls that limit what users can do on a system or network. This makes a system far more predictable, and if a breach happens, it’s much easier to catch.

5. Application control
   Without application control, malicious actors can execute unauthorized applications and compromise a system. Application control involves creating a list of approved applications and implementing rules to prevent unauthorized software from running. Regular validation of these rules is essential to ensure their effectiveness and prevent malicious actors from bypassing them.

8. Restrict Microsoft Office macros
   Macros automate tasks and make life more efficient, but they can also be used by malicious actors to gain unauthorized access to systems and data. To mitigate that risk, organizations should implement strict controls for macro usage, including having independent assessors review all macros for safety before they are digitally signed or placed in trusted locations.
9. User application hardening
   Some applications require elevated privileges to perform their intended functions, and others may have been granted excessive permissions due to oversight or lack of proper security controls. This can create vulnerabilities that are easily exploited by malicious actors to carry out harmful activities. Organizations should implement application hardening measures that include disabling unnecessary or high-risk functions.
10. Regular backups
    Data loss can occur due to hardware failures, software malfunctions, human errors, or cyberattacks. Having reliable backups in place enables organizations to recover their data and minimize the impact of such incidents, preventing disruptions to their operations. The frequency of backups should be determined by the rate at which data changes and its importance.