[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:essential-eight\u002Foverview":3},{"item":4,"lessons":15,"controls":21,"related":34},{"family":5,"item":6,"code":7,"title":7,"citations":8,"publisher":9,"summary_md":10,"official_text":11,"official_attribution":11,"official_url":12,"link_label":13,"note":11,"updated_at":14},"essential-eight","overview","Essential Eight",1,"Australian Signals Directorate (ASD)","**What it covers.** The Essential Eight is a set of baseline mitigation strategies published by the Australian Signals Directorate's Australian Cyber Security Centre. The eight strategies are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. A maturity model defines levels from zero to three based on the attacker capability each level is meant to counter.\n\n**In practice.** Organisations assess their maturity for each strategy, aim for a consistent target level across all eight and implement them together rather than selectively. For patching applications, that means timely updates for internet facing services and common applications, removal of unsupported software and vulnerability scanning to find what is missing. Evidence includes maturity assessments, patching metrics and configuration evidence.\n\n**Common gaps.** Organisations often reach a high level on some strategies but not others, which leaves gaps. Unsupported applications are commonly left in place.",null,"https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fasds-cyber-security-frameworks\u002Fessential-eight","Read it at cyber.gov.au","2026-10-18T15:18:43.664+00:00",{"total":8,"list":16},[17],{"slug":18,"title":19,"published_at":20},"unpatched-cms-platforms-targeted-in-ai-accelerated-global-campaign","Unpatched CMS Platforms Targeted in AI-Accelerated Global Campaign","2026-07-11T16:20:20.144+00:00",[22,26,30],{"slug":23,"name":24,"problem":25,"stories":8},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":27,"name":28,"problem":29,"stories":8},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":31,"name":32,"problem":33,"stories":8},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[35,40,44,48,53,56,61,65],{"family":36,"item":37,"code":38,"title":39,"together":8},"cis","12","Control 12","Network Infrastructure Management",{"family":36,"item":41,"code":42,"title":43,"together":8},"13","Control 13","Network Monitoring and Defense",{"family":36,"item":45,"code":46,"title":47,"together":8},"7","Control 7","Continuous Vulnerability Management",{"family":49,"item":50,"code":51,"title":52,"together":8},"gdpr","32","Article 32","Security of processing",{"family":54,"item":6,"code":55,"title":55,"together":8},"itil","ITIL",{"family":57,"item":58,"code":59,"title":60,"together":8},"nist-800-53","au-6","AU-6","Audit Record Review, Analysis, and Reporting",{"family":57,"item":62,"code":63,"title":64,"together":8},"si-2","SI-2","Flaw Remediation",{"family":57,"item":66,"code":67,"title":68,"together":8},"si-7","SI-7","Software, Firmware, and Information Integrity"]