Identity
Where most incidents begin
- Accounts without multi-factor authentication
- Shared and generic logins
- Admin rights that were never reviewed
- Passwords already leaked online
Cyber Security
Security plans built on ASD Essentials, NIST and ISO 27001.
We design each plan around ASD Essentials (previously the Essential Eight), the NIST Cybersecurity Framework and ISO 27001, then work through it in the order that removes the most risk first.
- ASD Essentials
- NIST
- ISO 27001
Exposure
Layers between an attack and your business.
Most attacks succeed or fail at one of six layers: identity, email, devices, network, data and backup. In a first assessment, we most often find gaps in the four areas below.
Email and endpoints
The tools your staff use all day
- Phishing that gets through
- Laptops that leave the office
- Unmanaged personal devices
- Unpatched software
Data and suppliers
What you would lose
- Files shared more widely than intended
- Client information in the wrong place
- Suppliers holding your data
- Applications with their own logins
Recovery
The part businesses assume will work
- Backups that have never been restored
- Backup copies an attacker could reach
- No agreed recovery order
- No record of when it was last tested
In an assessment, we score your position in each area and put an owner and a date against every gap.
Frameworks
The standards our plans are built on.
Each framework answers a different question, so our plans draw on all three.
Where to start
ASD Essentials
The Australian Signals Directorate's security baseline for Australian organisations, previously the Essential Eight. It sets principles and actions across eight domains, including governance, identity and user devices, and has chapters for enterprise IT, cloud and operational technology.
How we use itIts priority phases tell us which domains to secure first, so they set the order of work. We rate each domain on how well its controls work in practice.
How we organise the work
NIST
The NIST Cybersecurity Framework organises security into five functions: identify, protect, detect, respond and recover. We group our work under the same five.
How we use itEvery plan covers all five functions, so we design recovery at the same time as prevention, before an incident happens.
How you govern security
ISO 27001
The international standard for an information security management system. It covers policy, risk treatment, evidence and continual review, and does not prescribe particular tools.
How we use itWe align the technical controls with the standard and give you the detail your own policies and risk register need.
If ISO 27001 certification is a goal, we build and align the technical controls with the standard and support you through the process. The management system, policies and audit paperwork sit with your business, and we help you prepare them.
ASD Essentials
Where you stand, domain by domain.
ASD Essentials, previously the Essential Eight, divides your environment into eight domains. In an assessment, we rate how effective your controls are in each one and show which to strengthen first.
- Eight domainsTwo domains apply to your whole environment: governance and culture, and visibility and response. The other six each cover one part of your technology, such as boundary services or user devices.
- Rated by effectivenessWe rate each domain not effective, partially effective or fully effective, based on evidence that its controls work over time.
- Priority phases set the orderPhase 1 is boundary services and identity services. Phase 2 is critical processes and services, and privileged environments. Phase 3 is business systems and user devices.
- Earlier work carries forwardControls built for the Essential Eight still count, and we map them across.
Scope
What the work covers.
The work runs as a cycle: assess, prioritise, uplift, monitor, respond and review. When the review is done, the next assessment begins, so the controls keep up as the business and the threats change.
Governance
Knowing where you stand and who owns the next step.
- Security posture assessment
- ASD Essentials assessment, domain by domain
- Risk register with owners and target dates
- Policy and process review
- Staff awareness training for phishing and social engineering
Prevention
Controls that stop common attacks getting in.
- Multi-factor authentication and conditional access in Entra ID
- Email filtering and anti-phishing, including Microsoft Defender
- Endpoint protection against malware and unauthorised access
- Application control and DNS filtering
- Device management with Intune
- Firewalls and network security
Detection and response
Finding and handling attacks that get past prevention.
- 24/7 monitoring and managed detection and response
- Dark web credential monitoring
- Alert investigation by our team
- Incident response with agreed roles
Recovery
Getting the business working again.
- Protected backup copies with administrative separation
- Documented recovery order
- Recovery testing with recorded results
- Data encryption for sensitive information
Tools and partners we work with.
Context
Insurers and auditors ask for evidence.
Insurance questions
Cyber insurance questionnaires have become longer and more detailed. Beyond multi-factor authentication and backups, they ask about patching cadence, admin access, email filtering, endpoint detection, staff training and incident response, and accurate answers need evidence.
We document the controls we put in place and the findings behind them, so you can answer those questions directly. A board or an auditor will ask for the same evidence.
A record you keep
Every finding has an owner and a target date, and you keep the record of what was done.
That record lets you show an insurer, an auditor or a client's due diligence questionnaire which controls are in place and when the work was done.
First step
Start with a free Microsoft 365 security snapshot.
A quick, high-level check of the Microsoft 365 settings attackers target first. It needs little of your time, and you keep the report whether or not you go further with us.
Need the whole environment reviewed? The paid Security and Compliance Audit covers endpoints, firewalls, servers, backups and policies, and ends with a costed roadmap.
Book your free snapshotWhat the snapshot checks
- Multi-factor authentication status for every account
- Admin accounts and Microsoft 365 permissions
- Inactive accounts and password age
- Accounts found in public data breaches
- Sign-in locations
- A short report with the first fixes to make
Questions
What businesses ask us about security.
If we only do one thing, what should it be?
Secure identity: multi-factor authentication on every account, privileged access under control, and no shared logins. That removes more risk, for less money and disruption, than any other single step.
Which frameworks do you work to?
We work to three, and each does a different job. ASD Essentials, previously the Essential Eight, sets the order of work, and we use it to rate each domain of your environment. NIST organises the plan across identify, protect, detect, respond and recover. ISO 27001 sets how you govern security. Where certification is a goal, we build and align the technical controls to the standard and support you with the management system and paperwork, which stay with your business.
Do you test that recovery works?
Yes. A configured backup does not show that a restore will work, so we test restores and record the date, scope, result and any gaps. An insurer or auditor will ask for that record.
What do we do if we think something has happened?
Call 1300 762 122. If you are an existing Managed Services client, the response follows your agreement. If you are not, tell us what you are seeing and we will advise on the immediate steps.