Cloud Security Framework: Aligning with ASD Essential Eight Strategies
OSKY prioritises a robust security posture for its cloud services, aligning with the Australian Signals Directorate’s (ASD) ‘Essential Eight Strategies for Mitigating Cyber Security Incidents’ at maturity level 3. Our framework encompasses comprehensive measures to ensure the confidentiality, integrity, and availability of data within cloud environments.
One of the fundamental strategies we implement is patching applications. Regular monitoring for patches and updates released by software vendors is conducted, and automated tools are utilised to assess vulnerabilities. Once patches are identified, they undergo thorough testing to ensure compatibility and stability before being applied promptly to our cloud environments.
Patching operating systems is another crucial aspect of our security methodology. We conduct regular scanning and monitoring to identify vulnerabilities in operating systems, employing automated patch management systems to apply security updates promptly. Our procedures are meticulously documented, and schedules are established to minimise disruption to services during patching activities.
Multi-factor authentication (MFA) is a cornerstone of our security framework, enhancing authentication security for all users accessing our cloud services. We enforce MFA for all user accounts, leveraging a combination of factors such as passwords, biometrics, smart cards, or tokens. This additional layer of protection significantly reduces the risk of unauthorised access to our systems and data.
To mitigate the risk of unauthorised access and potential misuse of privileges, we strictly restrict administrative privileges at OSKY. Following the principle of least privilege, we grant administrative access only to authorized personnel who require it for their roles. Access control mechanisms are implemented based on job responsibilities, and regular reviews and audits are conducted to ensure appropriate access levels are maintained.
Application control is another vital aspect of our security strategy. We employ application whitelisting to control the execution of software within our cloud environment, permitting only approved applications to run. This measure effectively reduces the risk of malware and unauthorised software execution, with regular updates to the application control list to reflect changes in software requirements and security considerations.
We have stringent policies in place to manage and restrict the execution of Microsoft Office macros within our cloud services. Macros are disabled by default, and users are educated about the associated risks. Approved macros undergo rigorous validation and testing before being allowed to execute, minimising the potential for malicious code execution.
User application hardening is a proactive measure we undertake to enhance the security of our cloud services. We optimise security settings and configurations for user applications such as web browsers and email clients, minimising the attack surface and bolstering resilience against exploits. Regular security awareness training is provided to users to reinforce safe browsing habits and increase awareness of potential risks.
OSKY employs robust backup procedures to safeguard the integrity and availability of data within its cloud environment, utilising automated backup systems to routinely back up critical data and configurations. This backup data is securely stored with stringent encryption measures and access controls in place. Additionally, regular testing of backup restoration procedures is conducted to validate and ensure the efficacy of data recovery capabilities, further bolstering the resilience of our backup systems.
