Sponsored: The evolution of ASD's Essential Eight

0:03Tom Uren: Hello everyone, this is Tom Uren. I am here with a Risky Business sponsor interview. Today I have with me Peter Baussmann, the CTO and Chief Security Officer of Airlock Digital. G'day Peter, how are you? Hello, I am well, thank you. Hope you're doing well too, Tom. I'm very well. This week, in the last month I suppose, ASD, the Australian Signals Directorate, has released ASD's Essentials, which is like an evolution of what once upon a time was the top four, then became the Essential Eight. And they were originally a very simple set of recommendations for security. And I remember back when I was at ASD, the top four had come out relatively recently and people said that they were quite innovative because ASD actually made a call and said, these are the most important things.

0:56Tom Uren: And it was things like, I think, application whitelisting, probably three other things that escaped me. Patching, restricting privilege. You're probably sounding familiar. Yep. Yep. Four things. And it was based on their incident response. So they analyzed what they'd done and said, here are four things that would have made a difference. I seem to remember like 85 % of cases. That was the stat. Yeah, that's the stat that they released, I think. And so to me, that was always, here's a simple recipe, just go do this. And other people told me at the time that it cut through because a lot of other official agencies kind of wanted to hedge and make things more complicated.

1:44Tom Uren: Now, that's evolved to the Essential 8. The environment's changed. and now we've got the ASD Essentials, which in a way I feel like it's lost that simplicity. It's pushing out a whole lot of work to the target audience to try and figure out what their risks really are. So first of all, Peter, good idea, bad idea. What's driving this shift? Yeah, and I think you've summed it up really nicely to start with. It's been this evolution of top four to essential eight to the ASD essentials. Now we've got more of a flexible risk-based principles framework rather than prescriptive controls. We've moved away with the essentials.

2:28We've moved away from a fixed maturity to what they call a priority phased implementation. So it's a little bit different from that perspective. In terms of drivers, I think why they're doing it. Firstly, there is alignment with other Five Eyes organizations that they're trying to achieve, the US and the UK in particular. There is the Australian government's cybersecurity strategy. So aligning with the goals and objectives of that, which included updating the cybersecurity advice and guidance, including the essential eight. And even the ASD corporate plan actually talks about updating the essential eight to reflect sort of modern threat landscape.

3:10And I guess that's the other defining factor. Aside from those things, it's also actually trying to update to reflect the modern threat landscape as ASD see it. And I think you touched on it before, Tom, saying that the top four was originally in response to incidents that ASD are seeing and the threat landscape. And I think that's similarly the intent here with the Essentials Framework too.

3:35Tom Uren: So essentially, they're saying back in the day, you could do simple stuff and make a measured improvement. And now they're saying everything's so complicated, you really need to understand what you're doing and I guess, prioritize what's most important for you. Yeah. I think essential eight and top four before it, simplicity was one of the strengths of those mitigating strategies, I guess. Not necessarily simplicity in the implementation, but in the understanding. There's eight things or there's four things you need to do. Now with the essentials framework, it's a broader framework. So it's broadened the approach sort of considerably across a number of different areas across the enterprise.

4:16And that's why they call it they have essentials for enterprise IT as a chapter and essentials for OT as a chapter that they've released as well. And I think there are others coming. Those are the only two at the moment, but they're really trying to encompass a broader scope, I guess, with the framework itself. And that, of course, is going to lead to more complexity, but it's also going to lead to probably bigger challenges for organisations to align in some ways as well.

4:47Tom Uren: Yeah, so I was wondering about how I would, if I was a CISO or a CISO, get into selling this to management as a thing I needed to do. So there must be some organisations where it's because you're Australian government or whatever, you must do this. And so therefore, in a sense, that's an easy sell. But there must be a lot of places where you've used the top four and then the essential eight because you thought it was a good idea. And now this is quite a big sea change, I think, in terms of your relationship to management and how you sell it to them. And in, I guess, get buy-in at the board level.

5:29Tom Uren: It felt like this required more buy-in at the board level than previous iterations. So I was wondering if you have any thoughts on that and how you would tell people, how do you sort of cut through and get adoption? I do agree with that point in that previously to talk to boards, we would have the essential aid, it would have maturity levels. It would be a reasonably straightforward conversation to say, okay, we're at maturity level two of the essential aid across application control and patching and we need to improve. around Microsoft Office macros, for example. And so that would be a relatively straightforward conversation for the board level.

6:14I think the challenge is now going to be that this is a much broader framework. There's not the same measures, and so there will be much more of a risk conversation with the board, which is not necessarily a bad thing. I think it's great to sort of frame risk. A lot of boards really understand risks well, and I think that that is not a bad pathway to take. But I think there's going to be an education. I think there's just going to be a bit of an uplift to make that clear, especially as boards and the executive have really been trained on these are the mitigating strategies that we need to look at.

6:51And now we're changing to not necessarily forget about all of that, but there's another framework that we need to sort of align with. Because the essential aid still remains relevant today. They've got to really run two frameworks in parallel, really, for a while yet. So there might be that boards still report on one thing, but then they also have to hear about, I guess, this framework as well and how you're going to align from a risk perspective there.

7:21Tom Uren: Yeah, one thing that stood out to me, I can't remember, they've got quite a lot of documents that are basically how you get into it, like how you implement it. Yes. And it felt like here's a hand-holding exercise in getting from Essential 8 to Essentials. But one of the points they make is that they break problems into domains rather than to systems. And it felt like, well, so one was identity and access, I think, if I remember rightly. And that could span many, many different systems that might actually be owned by different people. And it felt like in the old days, it was, well, I own my own systems.

8:04Tom Uren: I can report on this thing. Whereas now it's like, I don't even know what else is being run that falls into that domain. And it becomes quite hard to say. I think in a way better because ideally you would get a more comprehensive picture of what's going on but also a hard to get that picture in the first place because someone at the top has got to say you people collaborate and figure out what the situation is before anything actually happens yeah yeah and I think this is how they've structured this framework it has principles. So there's sort of three layers. There's principles, and they're taken from the Australian Government Information Security Manual.

8:46So organisations that are already looking at the ISM will have some familiarity with those principles. There's these priority phases, and that's the phases with which ASD recommends you implement certain domains. And that's what you just touched on there. There's eight domains that they have. Identity is one, yes, absolutely. There's eight. There's a bunch of different ones. And I agree. It feels like that's a lot of complexity to add in. If we go back to that board reporting scenario, are we going to be reporting on different domains and how we've prioritized implementation of certain things across a domain to align with a principle?

9:32it starts to get like a weird matrix or table that you're going to have to put together. And with respect to ASD, they have put out a lot of documentation. You said before there was transition guidance, there's an implementation planning guide. I think last I heard, I don't know if all of them are published, but I believe they at least produced about 17 or 18 different documents. So there's a lot of guidance from that perspective. I think there's a senior

10:01Tom Uren: management guide as well, I'm pretty sure. Yeah, that was the one I looked at because there was too much. Yeah, well, there is a danger that there is just too much to get your head around, I think. And that will be a challenge for organisations that are trying to align with this, be it government agencies or organisations that want to work with government agencies. They're going to have to look at this, while probably also maintaining essential aid work as well. that's already started that they're already vested in as well, which is not, again, not an actual issue necessarily because the essential aid, all of them do actually map into the wider essentials framework.

10:44So from that perspective, that's good. You've just got to probably undertake your own exercise to do that, to map your essential aid efforts that you've done already into this wider framework to make sure you've got some alignment there yeah so it feels like to me that the

11:02Tom Uren: essential eight in well and the top four were basic security controls and basic security controls like there's nothing bad about them right but this is the essentials is just a different way of thinking about trying to find the gaps i guess so if you are perfect on the essential eight this is this is a question i think this is just me trying to wrap my head around it so if you are perfect on the essential eight, which I imagine there's probably no organization in the world that is, the whole point of the essentials would be to say, just look at the bigger picture and is that enough, right? And so in an ideal world, you'd go, okay, we're perfect at the essential eight, but stepping back and looking at it broader, here are these gaps that we've figured out because we've thought about it in a broader way, I guess.

11:50Tom Uren: Is that the intent, do you think? Yeah, I think so. I think that's a good summary. It's broadening the approach, I think. So Essential 8 is, yeah, the foundational controls, those basic controls that you're talking about, they're still embedded in this new essentials framework. So they're still there, which is pleasing to see as an organization that provides one of those foundational controls. We're always pleased to see that that still exists. And this is just almost like widening that re-knit now to look at other things that are more focused on maybe cloud or even operational technology with that separate OT chapter, for example.

12:32So they're kind of broadening their approach in a lot of ways, I think.

12:39Tom Uren: So what's your advice to organisations that are maybe looking at that swath of documentation? How do you think they should be getting into it? Yeah, I do think there is plenty of guidance. I do think they do need to have a look at it. There are some specific ones. I think if you've already gone down the pathway of doing a central eight work and there's two good documents, one is a transition guide and the other is the implementation planning guide. so I would look at those to start with and then I think I mentioned before but I would reiterate a point around mapping what you've done today against the new framework so you can understand what essentials additional actions you might have to take above and beyond what you've already done with essential eight because every essential eight strategy sort of maps to a principle in the essentials framework which is always encouraging and then I would also just use your organisation's risk management framework to determine your prioritised approach, I suppose, for mitigating or implementing controls, build that into a plan.

13:48That's probably what I would do as a pathway to start with.

13:53Tom Uren: One thing is that you can't have a security conversation today without mentioning AI. Ah, yes. So I'm afraid I've got to do it. Now, you look online and you'll invariably find people spruiking AI agentic defense. And the only way to combat really rapid attackers using AI is somehow magical AI defenders. what's your view on all that i have a i would say a little bit of a biased view just because i work at a preventative endpoint security company and preventative endpoint particularly when you think about where ai operates so ai typically agents will operate sort of on the endpoint but in the cloud or in you'll see ai deployed into sas products as well our main purpose is endpoints.

14:55I'll just briefly talk about that. But essentially, I'm a big supporter of having preventative security controls in place and the appropriate guardrails and signposts, if you like, for what an agent can and can't do, rather than an after the fact detection and response type approach, which is really almost playing catch up in a lot of ways when something has happened and an agent has already undertaken an action. So I think there's a place for that, but I think that preventative endpoint security is such a key advantage at the endpoint. And then I think preventative security in general is a great mitigating strategy, if you like,

15:37Tom Uren: to undertake across both cloud and SaaS as well. Peter Boesman, CTO and CSO of Alloc Digital. Thanks very much. Thanks, Tom.