Multifactor authentication (MFA) for the Essential Eight Maturity Model

Australia's Essential Eight Maturity Model (E8MM) establishes a baseline of mitigation strategies to help organizations protect themselves from common cyber threats. The Australian Signals Directorate (ASD) distilled the eight essential mitigation strategies from the Strategies to Mitigate Cyber Security Incidents published by the Australian Cyber Security Centre (ACSC). Multifactor authentication (MFA) implementation is a key requirement across all Essential Eight maturity levels. Here’s how UserLock can help you meet Essential Eight MFA requirements.

Understanding Essential Eight compliance

Australia’s Essential Eight Maturity Model defines three target maturity levels (levels on through three), and includes Maturity Level Zero which exists only to capture instances where Maturity Level One requirements aren’t met. The scheme aims to help organizations put in place the most essential (it’s all in the name) security strategies.

Achieving Essential Eight compliance is a way for Australian organizations to prove their commitment to cybersecurity best practices. This third-party assessment helps build trust among stakeholders, enhances resilience against cyber threats, and can open doors to new business opportunities. Australian government organizations and agencies must meet at minimum Essential Eight maturity level two requirements.

The role of MFA in Essential Eight risk mitigation

While the Essential Eight mitigation strategies lay out a strong foundation for cybersecurity, there’s a strong focus on ensuring only the right users can access organizational and third-party systems and data.

We’re big fans of how Essential Eight spells out the need for multi-factor authentication across all user accounts, both privileged and unprivileged. While any MFA is better than none, implementing MFA across all users is the only way to fully reap the security benefits. And although we all know that, it’s good to see it reinforced.

All too often, compliance standards reduce MFA to just another box to check: only on this connection type, not that one, or only on these types of users, not those.

Our developers and product team are extremely passionate about this. It’s one of the reasons why UserLock is designed to deploy across all users — because it’s the most secure way to implement MFA.

And this is not just us shouting on our little internet soapbox, this is also an essential part of applying the principle of least privilege.

Implementing MFA for Essential Eight compliance

To effectively implement MFA across all Essential Eight maturity levels, organizations should follow these best practices:

1. Choose the right MFA solution: Select an MFA solution that aligns with your organization's needs, considering factors such as usability, scalability, cost, and whether you will need to recruit to manage a solution that requires knowledge or additional time your existing IT team may not have.

2. Deploy MFA across all users: Ensure that MFA is implemented uniformly across all user accounts to maintain consistent security.

3. Educate users: Offer comprehensive cyber awareness training to users on the importance of MFA and how to use it correctly. Encourage them to use strong, unique passwords in conjunction with MFA for added security.

4. Monitor and update MFA policies: Regularly review and update MFA policies to adapt to evolving threats and changes in your organization's IT infrastructure. Monitor MFA and user access event logs for any suspicious activity and take immediate action on suspicious activity.

Essential Eight MFA methods

Essential Eight accepts MFA that uses either “something users have and something users know, or something users have that is unlocked by something users know or are.”

These factors typically fall into three categories:

1. Something you know: This includes passwords, PINs, or answers to security questions.

2. Something you have: This involves physical or hardware tokens, smart cards, or authenticator applications.

3. Something you are: This encompasses biometric identifiers such as fingerprints or facial recognition.

Meet Essential Eight MFA requirements with UserLock

Australia’s Essential Eight mitigation strategies lay the groundwork for a proactive, resilient approach to cybersecurity. Following these best practices for MFA implementation will help your organization do just that. If you’re looking to complete an Essential Eight Maturity Model assessment, implementing UserLock can help you demonstrate MFA across all users and on access to your organization's systems and applications.