## Before we begin: a puzzle worth solving Let's look at this list of data breaches from 2026 so far. What do they (mostly) have in common? https://www.webberinsurance.com.au/data-breaches-list#twentysix **So here's the question this whole topic is built around:** > If almost every organisation already has "security", why do cyber attacks keep succeeding? Hold that question in your mind. Before you read on, jot down what *you* think the answer is. We'll come back to it, and you might be surprised how ordinary the real weaknesses are. ### A few more questions to get curious about - Why would a national defence agency publish a list of just **eight** things, when there are hundreds of possible security controls? - Why is "install antivirus" **not** on the list? - Why might *patching your software* stop more attacks than the world's most expensive firewall? - If these eight things are so effective, why doesn't everyone just do all of them? Keep a running list of your guesses. The goal of this resource is not to memorise eight items — it's to understand *why these eight, why now, and why they work*. --- ## Why the Essential Eight exists ### The problem it was designed to solve Cyber security can feel overwhelming. There are thousands of possible threats and hundreds of possible defences. For a school, a council, a hospital or a small business, the natural questions are: *Where do we even start? What actually matters most? What gives us the biggest protection for the least cost and effort?* The Australian Signals Directorate (ASD) — the government agency responsible for cyber security and signals intelligence — investigated large numbers of real-world cyber incidents. They noticed something important: **a small number of the same weaknesses were being exploited over and over again.** Attackers weren't usually using exotic, movie-style hacking. They were walking through doors that had been left unlocked. So instead of publishing a 500-page manual that no one would read, ASD distilled its advice into a short, prioritised list of the **most effective** mitigation strategies. They called it the **Essential Eight**. ### The key idea: prioritisation, not perfection You cannot defend against *everything*. The Essential Eight accepts this. It is a **baseline** — a strong, sensible starting point — chosen because these eight strategies, when implemented together, make it *significantly harder and more expensive* for an attacker to succeed. > **Core concept:** The Essential Eight is not about being unbreakable. It is about **raising the cost of attack** so high that most attackers give up and move to an easier target. ### Where it fits in the bigger picture The Essential Eight is a subset of a longer ASD document, *Strategies to Mitigate Cyber Security Incidents*. It is designed mainly to protect **Microsoft Windows-based, internet-connected networks** — the kind used by most Australian organisations. Since 2022 it has been **mandatory for many Australian federal government (non-corporate Commonwealth) entities**, and it is widely recommended for businesses and other organisations too. --- ## The three objectives The eight strategies are grouped into **three goals**. This grouping tells a story about how a cyber attack actually unfolds — and where you can interrupt it. | Objective | What it aims to do | Strategies | |---|---|---| | **Prevent** cyber security incidents | Stop malware (malicious software) from being *delivered* and *run* on your systems | Application Control · Patch Applications · Configure Microsoft Office Macro Settings · User Application Hardening | | **Limit** the extent of incidents | If an attacker *does* get in, restrict how far they can spread and what they can reach | Restrict Administrative Privileges · Patch Operating Systems · Multi-Factor Authentication | | **Recover** data and system availability | Make sure you can get your data and systems back if the worst happens | Regular Backups | > **Curiosity check:** Notice the logic — *keep them out, contain them if they get in, recover if they do damage.* This is called **defence in depth**: layered protection, so that if one layer fails, others still stand. Ask yourself: which layer failed in the ransomware story at the top of this page? --- ## The Eight Strategies explained For each strategy below: **What it is → Why it matters → A real-world analogy.** ### Objective 1 — Prevent malware delivery and execution #### 1. Application Control **What it is:** Only approved, trusted programs are allowed to run. Everything else is blocked by default (an "allow-list" approach). **Why it matters:** Most malware is just an *unapproved program*. If unknown executables simply cannot run, a huge category of attacks stops dead — even brand-new malware that antivirus hasn't seen before. **Analogy:** A nightclub with a strict guest list. If your name isn't on it, you don't get in — no matter how convincing your fake ID. #### 2. Patch Applications **What it is:** Keep your applications (web browsers, Office, PDF readers, plugins, etc.) up to date, and quickly apply security updates that fix known vulnerabilities. Remove software no longer supported by the vendor. **Why it matters:** Attackers actively hunt for *known* flaws. When a vendor releases a patch, the vulnerability becomes public knowledge — a published instruction manual for attackers. Unpatched software is one of the most common ways in. **Analogy:** A locksmith announces "the Brand-X lock can be opened with a paperclip." If you don't upgrade your lock, every burglar in town now knows your exact weakness. #### 3. Configure Microsoft Office Macro Settings **What it is:** Block macros (small automated scripts inside Office documents) from the internet, and only allow macros that are vetted or digitally signed by a trusted source. **Why it matters:** Macros are legitimately useful, but they can also run malicious code. A booby-trapped Word or Excel file that asks you to "Enable Content" is a classic infection method. **Analogy:** A letter that assembles a working robot when you open the envelope. Handy if you trust the sender — dangerous if you don't. #### 4. User Application Hardening **What it is:** Configure applications to reduce their attack surface — for example, blocking Flash, ads, Java and other risky content in web browsers, and disabling unneeded features. **Why it matters:** Every extra feature is a potential doorway. Turning off the risky, rarely-needed ones removes doorways attackers love to use, especially through the web browser. **Analogy:** A house with twenty doors is harder to guard than a house with two. Brick up the doors you never use. ### Objective 2 — Limit the extent of incidents #### 5. Restrict Administrative Privileges **What it is:** Limit "admin" (privileged) accounts to only the people who genuinely need them, review them regularly, and don't use admin accounts for everyday tasks like email and web browsing. **Why it matters:** Admin accounts are the "keys to the kingdom." If an attacker compromises a normal user, the damage is limited. If they compromise an admin, they can control everything. Restricting admin rights contains the blast radius. **Analogy:** Not every employee gets a master key to every room in the building — only the facilities manager, and even they lock the master key away when doing ordinary desk work. #### 6. Patch Operating Systems **What it is:** Keep the operating system (Windows, etc.) updated and quickly patch security vulnerabilities. Retire operating systems the vendor no longer supports. **Why it matters:** The OS is the foundation everything else runs on. A flaw here can let an attacker take deep control of a machine and spread across the network. Old, unsupported systems (like an out-of-date Windows) are permanent open wounds. **Analogy:** Patching apps is fixing the windows and doors; patching the OS is repairing the *foundations*. Cracks in the foundation bring down the whole house. #### 7. Multi-Factor Authentication (MFA) **What it is:** Require more than one proof of identity to log in — something you *know* (password) plus something you *have* (a code on your phone, a hardware key) or something you *are* (a fingerprint). **Why it matters:** Passwords get stolen, guessed, reused and phished constantly. MFA means a stolen password *alone* isn't enough. It is one of the single most effective controls against account takeover. **Analogy:** An ATM needs your card *and* your PIN. Stealing just one gets a thief nowhere. ### Objective 3 — Recover data and system availability #### 8. Regular Backups **What it is:** Regularly back up important data, software and settings; store backups securely and **disconnected** from the main network; and — crucially — **test that you can actually restore from them.** **Why it matters:** Backups are your safety net against ransomware, hardware failure, accidents and disasters. But an untested or connected backup is a false sense of security. If ransomware can reach and encrypt your backups too, they're worthless. **Analogy:** A spare house key is only useful if (a) you know where it is, (b) it actually works in the lock, and (c) you didn't leave it taped to the front door where the burglar found it. > **Return to the puzzle:** Look back at the ransomware story. The victim technically *had* backups — but they were old, untested, and on the same server. Which of the eight strategies would have saved them? (Answer: several — but #8, done properly, would have meant paying *nothing*.) --- ## The Maturity Model Doing a strategy isn't simply "on" or "off." How *well* you do it matters. ASD defines **maturity levels** so an organisation can measure how robust its implementation really is. | Level | Name | Protects against… | |---|---|---| | **Maturity Level 0** | Not implemented / insufficient | The organisation is exposed even to common, unsophisticated attacks. Weaknesses exist that adversaries can readily exploit. | | **Maturity Level 1** | Partly effective | Adversaries using widely-available, "commodity" tools and techniques (basic, opportunistic attackers). | | **Maturity Level 2** | More effective | Adversaries willing to invest more time, effort and tools, and to target specific victims. | | **Maturity Level 3** | Robust | Sophisticated, well-resourced, targeted adversaries who adapt and persist. | **Key ideas:** - An organisation chooses a **target maturity level** based on the threats it faces and the sensitivity of its data. Higher isn't always necessary — but neither is Level 0 ever acceptable. - ASD recommends implementing all eight strategies **to the same maturity level** before moving up. A chain is only as strong as its weakest link — being Level 3 at backups but Level 0 at MFA leaves an obvious gap. - The model is **regularly updated** as the threat landscape and technology change, so it stays relevant. > **Discuss:** Why does ASD insist you raise *all eight* together rather than perfecting one? Connect your answer to the idea of "defence in depth." --- ## Strengths and limitations (think critically) The Essential Eight is influential and effective, but a good Applied Computing student evaluates rather than just accepts. Consider both sides. **Strengths** - **Prioritised and practical** — a clear starting point instead of an overwhelming list. - **Evidence-based** — built from analysis of real incidents. - **Cost-effective** — high protection relative to effort and money. - **Measurable** — the maturity model lets organisations assess and improve. **Limitations** - **Windows-centric** — designed mainly for Microsoft Windows, internet-connected networks; less directly applicable to cloud-only, macOS, Linux or operational-technology environments. - **Not exhaustive** — it's a *baseline*, not a complete security program. It doesn't cover physical security, staff training, incident response planning, network segmentation, etc. - **Implementation is hard** — reaching higher maturity levels takes real time, money, skills and cultural change, which is why many organisations sit at low maturity. - **Not a guarantee** — no framework makes you unhackable; it reduces risk, it doesn't eliminate it. > **Curiosity check answered:** Remember "why doesn't everyone just do all eight?" The honest answer is that security has *costs* — money, convenience, and effort — and organisations constantly trade these off against risk. Understanding that trade-off is central to Unit 4. --- ## Activities ### Activity 1 — Predict and check (individual, 10 min) Before re-reading the strategies, write your own one-sentence guess for *why* each of the eight matters. Then compare your guesses to the explanations. Where were you right? What surprised you? ### Activity 2 — Match the attack (pairs, 15 min) For each scenario, identify **which Essential Eight strategy** (or strategies) would have best prevented or limited it: 1. An employee reuses their work password on a hacked shopping site; an attacker logs into the company email with it. 2. A finance officer opens an Excel file that asks to "Enable Content," and malware installs. 3. Attackers exploit a three-year-old, unpatched vulnerability in an old version of Windows. 4. Ransomware encrypts the entire network, but the company restores everything by lunchtime and pays nothing. 5. A helpdesk worker's everyday account is compromised — but because it isn't an admin account, the attacker can't spread far. ### Activity 3 — The trade-off debate (small groups, 20 min) Each strategy improves security but can reduce convenience or increase cost. Pick two strategies and argue: *Is the inconvenience worth it?* Present the strongest case **for** and **against** to the class. (This mirrors the real decisions organisations make.) ### Activity 4 — Maturity self-audit (individual/home, 15 min) Assess your **own** digital life against a simplified version of the Eight: Do you use MFA? Do you install updates promptly? Do you have tested backups? Do you use an admin account for everyday browsing? Estimate your personal "maturity level" and write one improvement you'll make this week. ### Activity 5 — Extension research (individual) Find one real, publicly reported Australian cyber incident. Explain which Essential Eight strategy failed or was missing, and how a higher maturity level might have changed the outcome. --- ## Review questions **Knowledge** 1. What is the Essential Eight, and which organisation created it? 2. List the eight mitigation strategies. 3. What are the three objectives, and which strategies belong to each? 4. What is the purpose of the maturity model, and what does each level (0–3) represent? **Understanding** 5. Explain why "prioritisation, not perfection" is central to the Essential Eight. 6. Why does ASD recommend implementing all eight strategies to the *same* maturity level? 7. Explain the difference between patching applications and patching operating systems, and why both are needed. 8. Why is an untested or network-connected backup potentially worthless? **Analysis / Evaluation** 9. Evaluate the Essential Eight: give two strengths and two limitations. 10. "The Essential Eight makes an organisation unhackable." Discuss whether this statement is true, using evidence from this resource. 11. Multi-factor authentication is often called the single most effective control. Argue for or against this claim. 12. Choose one strategy and analyse the trade-off between the security it provides and the cost/inconvenience it creates. --- ## Key terms glossary | Term | Meaning | |---|---| | **ASD** | Australian Signals Directorate — the government agency responsible for foreign signals intelligence and cyber security. | | **Mitigation strategy** | An action taken to reduce the likelihood or impact of a cyber security incident. | | **Malware** | Malicious software designed to damage, disrupt or gain unauthorised access to systems (e.g. viruses, ransomware, spyware). | | **Ransomware** | Malware that encrypts a victim's data and demands payment to restore access. | | **Vulnerability** | A weakness or flaw in software or systems that an attacker can exploit. | | **Patch** | An update released by a vendor to fix vulnerabilities or bugs. | | **Application control** | Allowing only approved programs to run and blocking all others (allow-listing). | | **Macro** | A small automated script embedded in a document (e.g. Microsoft Office) that can be exploited to run malicious code. | | **Attack surface** | The total set of points where an attacker could try to enter or extract data from a system. | | **Administrative (privileged) account** | An account with elevated rights to change systems, install software and access sensitive resources. | | **Multi-factor authentication (MFA)** | Requiring two or more independent proofs of identity to log in. | | **Backup** | A secure copy of data used to restore information after loss, corruption or attack. | | **Defence in depth** | Using multiple layers of security so that if one fails, others still protect the system. | | **Maturity level** | A measure (0–3) of how completely and robustly a strategy is implemented. | | **Baseline** | A minimum recommended standard of protection to build upon. | --- ## Teacher notes **Suggested sequence (2–3 lessons):** 1. **Hook lesson** — Open with the ransomware scenario and the four curiosity questions *before* defining anything. Collect student guesses on the board; don't correct them yet. This primes engagement and surfaces misconceptions. 2. **Content lesson** — Work through the three objectives and eight strategies, returning to the opening puzzle after strategy 8. Use the analogies to anchor abstract ideas. 3. **Application lesson** — Run Activity 2 (Match the attack) and Activity 3 (trade-off debate), then the review questions. **Assessment links:** The evaluation and analysis review questions align well with VCE Applied Computing key skills around *evaluating the effectiveness of security strategies* and *analysing threats and controls*. Activity 5 works as an extended-response or SAC-style task. **Common misconceptions to address:** that antivirus/firewalls alone are sufficient; that "having backups" equals "being safe"; that security is a one-off purchase rather than an ongoing practice; that stronger security is always better regardless of cost. --- ## Sources and further reading - [Essential Eight explained — Cyber.gov.au (ASD)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-explained) - [Essential Eight maturity model — Cyber.gov.au (ASD)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model) - [ASD Essential Eight Maturity Model: A Complete Guide — Matrix Solutions](https://www.matrixsolutions.com.au/essential-eight-maturity-model-guide/) - [ASD Essential 8 Mitigation Strategies — Compliance Council](https://compliancecouncil.com.au/insights/asd-s-essential-8/) *Always confirm the latest details on the official ASD website (cyber.gov.au), as the Essential Eight and its maturity model are updated over time.*