Decoding Essential 8’s Dynamic Makeover 2024

Decoding Essential 8’s Dynamic Makeover 2024

The never-ending dance between cybersecurity and cyber threats means that staying ahead is not just an option; it’s a necessity. At Oreta, we take pride in being your trusted guardians in the digital realm. Today, we unravel the recent, pivotal updates to the Australian Signals Directorate’s (ASD) Essential Eight framework – your roadmap to fortified cyber defense Down Under.

Patching Unveiled: A Swift Dance of Defense

Picture this: a cyberattack’s zero-day vulnerability weaponised in mere hours. The game has changed, and so has the Essential Eight. The latest update demands a swift response to critical vulnerabilities, urging patches within 48 hours of exploit availability or vendor mitigation release. It’s a call to arms against the relentless pace of modern cyber threats.

But here’s the twist – a strategic reprieve. The timeframe for patching non-critical vulnerabilities in workstations, non-internet-facing servers, and devices now extends to a month. Why? Acknowledging the resource constraints faced by many organisations. Prioritise ruthlessly, patch swiftly for critical issues, and strategically plan for the rest. It’s a dance of balance in the cybersecurity tango.

MFA: Your Digital Sentry Redefined

Multi-factor authentication (MFA) isn’t a luxury; it’s your digital guardian. The Essential Eight now mandates phishing-resistant MFA for unprivileged users accessing devices and online services. Weak passwords? A relic of the past. Say hello to an extra layer of security that even the most cunning phishing attempts can’t unravel.

The MFA embrace extends further. Now, organisations must provide phishing-resistant MFA options for customer authentication on online portals storing sensitive data. It’s not just about safeguarding your organisation; it’s about fortifying trust in your online services.

Beyond the Headlines: Tightening the Bolts

The November 2023 update delves deeper into the cyber defense choreography. Centralised logging takes center stage – bid farewell to scattered logs and welcome a centralised repository for enhanced monitoring and incident response.

Application control whitelisting steps into the limelight, allowing only the approved applications to enter, curbing unauthorised software execution. And administrative privilege lockdown is the crown jewel – stricter controls and policies for managing these powerful permissions.

Essential Eight isn’t static; it’s a living framework, adapting to the ever-changing threat landscape. By staying attuned to these updates, you’re not just following a framework; you’re building a robust defense, safeguarding your organisation and its invaluable data.

The Oreta Edge: Patch, MFA, and Embrace Change

The Essential Eight updates echo a proactive stance against evolving cyber threats:
1.Swift action against critical threats.
2.MFA as a non-negotiable security layer.
3. Enhanced monitoring and control system-wide.

Implementing these changes isn’t just about compliance; it’s about significantly boosting your organisation’s cyber resilience. Stay vigilant, stay informed, and above all, stay secure. Let Oreta be your partner in this ever-evolving cybersecurity journey.

Explore our cybersecurity solutions in Australia, be a step ahead with ASD Essential Eight, and fortify your digital fortress with Oreta – Your Cybersecurity Guardians!

What is Cyber Warfare?|Types, Examples and How to Mitigate the Likelihood of a Successful Attack?

What is Cyber Warfare?|Types, Examples and How to Mitigate the Likelihood of a Successful Attack?

Nobody would have predicted that with the introduction of the Internet that the battlefield would breach outside of the physical borders and enter the digital realm. Cyber warfare, a term once confined to the realm of science fiction, has become an unsettling reality that governments, organisations, and individuals must confront in 2024.

1. What is Cyber Warfare?
2. What is the Motivation Behind Cyber Warfare?
3. Types of Cyber Warfare Attacks?
4. Examples of Cyber Warfare Attacks?
5. How to Mitigate the Likelihood of a Successful Attack?

What is Cyber Warfare?

As defined by Oxford dictionary ‘cyber warfare is the use of computer technology to disrupt the activities of a state or organisation, especially the deliberate attacking of information systems for strategic or military purposes.’ A battle fought with lines of code rather than troops traced to the increasing interconnectedness of the world, with critical infrastructure, financial systems, and communication networks relying on digital technologies.

What is the Motivation Behind Cyber Warfare?

Political and Military Objectives:
Espionage: Gathering intelligence on military, political, or economic activities of other nations.
Sabotage: Disrupting or damaging the critical infrastructure, such as power grids, communication systems, or financial networks, to gain a strategic advantage.

National Security:
Defensive Measures: Building capabilities to defend against cyber threats and attacks from other nations.
Deterrence: Demonstrating the ability and willingness to respond to cyber threats, thereby deterring potential adversaries.

Economic Espionage:
Stealing Intellectual Property: Nations may engage in cyber-espionage to steal trade secrets, proprietary information, and technological advancements to gain economic advantages.

Ideological or Political Motivations:
Hacktivism: Individuals or groups may conduct cyber attacks to advance their political or social agendas, expressing dissent or promoting a particular ideology.

Territorial Disputes:
State-sponsored Attacks: Governments may support cyber operations to assert dominance or advance territorial claims, especially in regions with geopolitical tensions.

Criminal Activities:
Financial Gain: Cybercriminals may conduct attacks to steal financial information, conduct ransomware operations, or engage in other activities for monetary benefits.

Proxy Warfare:
Using Non-State Actors: Some nations may use cyber capabilities indirectly through non-state actors or proxies to achieve their strategic goals without direct attribution.

Asymmetric Warfare:
Leveling the Playing Field: Smaller or less technologically advanced nations may use cyber capabilities to offset military disadvantages against more powerful adversaries.

Military Modernisation:
Investing in Cyber Capabilities: Nations may engage in cyberwarfare as part of their military modernisation efforts to keep pace with evolving technologies.

Global Influence:
Exerting Influence: Cyber operations can be used to shape global perceptions, manipulate information, and influence international events.

Types of Cyber Warfare Attacks?

Espionage: Cyber espionage involves covert infiltration and data theft by sophisticated actors, often state-sponsored, utilising advanced techniques such as malware and social engineering.

Sabotage: Perpetrators exploit vulnerabilities to compromise data integrity and disrupt operations, employing techniques such as denial-of-service attacks or manipulation of critical infrastructure control systems.

Denial-of-service (DoS) Attacks: A denial-of-service (DoS) attack is a malicious attempt to disrupt the normal functioning of a computer system, network, or online service by overwhelming it with a flood of traffic, rendering it temporarily or indefinitely unavailable to users.

Electrical Power Grid: All forms of day to day critical operations run on electricity, with the hacking of the power grid the target country can be at a complete halt which can lead to thousands of casualties from inoperable hospitals, lack of telecommunications and etc.

Propaganda Attacks: Cyber warfare extends beyond traditional attacks on infrastructure; it involves the manipulation of information to influence public opinion, sow discord, and destabilise societies. Fake news, social media manipulation, and disinformation campaigns have become potent tools in the arsenal of cyber warfare, blurring the lines between truth and falsehood

Economic Disruption: Majority of the world if not all, rely on computers and internet to run their economic facilities such as stocks and banks which makes it possible for hackers to attack and prevent their target from accessing their funds.

Examples of Cyber Warfare Attacks

Stuxnet (2010): One of the earliest and most notorious cyber warfare attacks, Stuxnet, targeted Iran’s nuclear program. Believed to be a joint effort by the United States and Israel, Stuxnet was designed to infiltrate Iran’s uranium enrichment facilities and sabotage the centrifuges. It marked a significant escalation in the use of cyber weapons for strategic purposes.

NotPetya (2017): Initially disguised as ransomware, NotPetya wreaked havoc on a global scale, affecting businesses and critical infrastructure. Ukraine bore the brunt of the attack, with government systems, banks, and energy infrastructure disrupted. NotPetya, believed to be the work of Russian hackers, highlighted the potential for cyber warfare to cause widespread economic damage.

WannaCry (2017): Attributed to the North Korean Lazarus Group, WannaCry exploited a vulnerability in Microsoft Windows to spread rapidly across the globe. The ransomware attack targeted healthcare organisations, government agencies, and businesses, encrypting files and demanding ransom payments. WannaCry underscored the importance of timely software patching and the interconnected nature of cybersecurity.

SolarWinds Supply Chain Attack (2020): A sophisticated and widespread attack, the SolarWinds incident saw Russian hackers compromise the software supply chain of SolarWinds, a major IT management company. The attackers inserted a backdoor into software updates, allowing them access to thousands of SolarWinds’ customers, including U.S. government agencies. The incident raised concerns about the vulnerability of software supply chains.

Colonial Pipeline Ransomware Attack (2021): Affecting one of the largest fuel pipelines in the United States, the Colonial Pipeline ransomware attack demonstrated the potential for cyber warfare to impact critical infrastructure. DarkSide, a ransomware-as-a-service group, was responsible for the attack, causing disruptions in fuel supply and prompting discussions on the cybersecurity of critical infrastructure.

How to Mitigate the Likelihood of a Successful Attack?

In the case of a potential cyber warfare attack organisations, states and countries must collectively prioritise and invest in their cybersecurity posture. The predictability of an attack on a specific area would be difficult to pre-determine therefore cybersecurity efforts should be a high priority across all sectors.

To analyse an organisations readiness for a cyber warfare attack, a cyber war game could be implemented. A cyberwar game is structured to simulate the experience of a real attack. Testing different situations and unusual scenarios highlights the areas of improvements that would need to be implemented.

As technology continues to advance, the future of cyber warfare holds both promise and peril. Artificial intelligence, quantum computing, and emerging technologies introduce new dimensions to the cyber landscape. Striking a balance between innovation and security will be crucial in navigating the evolving dynamics of digital conflict. Organisation can implement controls to mitigate the risk for their organisation, some controls listed below.

  • Regular Software Updates
  • Employee Training
  • Strong Password Policies
  • Multi-Factor Authentication (MFA)
  • Network Security
  • Data Encryption
  • Regular Security Audits
  • Incident Response Plan
  • Access Controls
  • Backup and Recovery

Cyber warfare forces us to reevaluate our understanding of conflict in the 21st century. It transcends geographical boundaries, challenges traditional notions of warfare, and underscores the need for a comprehensive and collaborative approach to cybersecurity. As we stand at the intersection of technology and geopolitics, the choices we make today will shape the future landscape of digital conflict.

Contact Us Now

Protect Your Digital Privacy: A 9-Step Roadmap to Erase Your Online Footprint and Safeguard Your Identity

Protect Your Digital Privacy: A 9-Step Roadmap to Erase Your Online Footprint and Safeguard Your Identity

This step-by-step guide outlines the importance of managing your digital footprint, emphasizing the impact of online presence on job prospects and personal reputation. It acknowledges the permanence of online content and highlights the risks associated with misjudged posts.

The guide suggests that control over digital identity is crucial, especially in cases of identity theft, stalking, or bullying. The overarching message is to be mindful of what is shared online and provides steps to reduce and manage one’s digital footprint for enhanced privacy and control over personal data.

Summary Lead:
1. Check Google and other search engines.
2. See if you have the right to be forgotten.
3. Run your details through the ‘Have I Been Pwned’ service.
4. Run a Google security checkup.
5. Consider using a service to restrict data access to brokers.
6. Lock down your social media or delete accounts entirely.
7. Consider deleting your social media accounts.
8. Remove old accounts and blog posts.
9. Hide yourself.

How to remove yourself from internet search results?

1. Check Google and other search engines.

The Google search engine, among others, is a double-edged sword: It provides links and website addresses to users in response to search queries, but unless the right controls are in place, your search queries can be cataloged for marketing purposes. Google can also be used to uncover exactly what information about you is in the public domain.

Not every search engine will reveal the same results. For a more comprehensive look, try out other search engines such as Bing.

Once you know what is online, you can start tackling the problem. Run a quick search for your full name and note any website domains that flag you, social media account links, YouTube videos, and anything else of interest.

Quick tip: To stop your search queries from being tracked, switch to DuckDuckGo. DuckDuckGo is a privacy-focused search engine that does not log your search queries.

2. See if you have the right to be forgotten.

In the E.U., citizens can request the removal of information from Google search results. After filling in this form, requests are reviewed by Google employees on a case-by-case basis. You must provide the specific URLs you want to be delisted, and search queries related to these URLs, and you must explain why the tech giant should agree to your request.

“Broadly, the reviewer will consider whether and how the information may be in the public interest and weigh this against your rights under the applicable data protection law,” Google says. “There are several reasons why information may be in the public interest. As part of the balancing exercise, Google looks to a number of different sources, such as the guidelines developed by European data protection regulators.”

Google may not accept every request to remove links relating to you. Reasons given for refusal include technical reasons, duplicate URLs, information deemed “strongly in the public interest,” and whether the content on a web page relates to professional lives, past convictions, work positions, or self-authored content.

At the time of writing, Google has received a total of just under 1.4 million delisting requests and around 5.4 million URL delisting requests.

If you are a resident of the U.S., or elsewhere, you may be able to request for limited information to be removed from search results, such as phone numbers or home addresses that could be used for identity theft and may have been leaked through doxxing.

Find & remove personal contact

3. Run your details through the ‘Have I Been Pwned’ service.

You can’t control your digital footprint without knowing where and what information concerning you is stored.

More importantly, you should know if your information has been leaked online, and when we have data breaches occurring daily, it’s more a question of what, not if.

The ‘Have I Been Pwned’ service is run by cybersecurity expert Troy Hunt and can be a useful tool for discovering if any account information belonging to you has been compromised or included in a data breach.

If you find an email address or telephone number that has been “pwned,” check to see what data breaches you have become embroiled in, and make sure to change any vulnerable passwords as quickly as possible. You won’t be able to do much about the data leak itself, but this also could serve as a reminder of where you have opened online accounts.

Thankfully, many companies have now become aware of the issue and services including credit monitors and password vaults will often run periodic checks online for any compromised passwords. If they have been found, you should change them immediately.

Breaches you were pwned in

4. Run a Google security checkup.

Make sure to visit the Google Account page, where there are numerous settings that can boost your privacy, reduce data collection, or remove you altogether from the ecosystem.

Privacy checkup:The Google Privacy checkup allows you to tell Google to stop saving search queries and your location history.

You can choose to disallow Google from saving web and app activities, Chrome history, YouTube logs, voice and audio, and other data. Google has also introduced an autodelete function for data that is stored. In this section, you can also choose whether to allow Google to use your information for tailored advertising, and what you want to happen to the data in your account if it goes inactive.

Security checkup: The Google Security checkup can be used to show you which devices have access to your account, including laptops, PCs, and handsets. You can also find a list of any third-party applications that have been granted permission to access your account. Revoke permissions as necessary.

Quick tip: If you have upgraded your phone, tablet, or another device recently and you no longer use your old one, you should make sure you sign out. It might not be likely, but if that device ends up in the wrong hands and is not properly protected, your account may become compromised.

Delete me: Found under Account Preferences, Google’s deletion service can be used to delete select products or remove your account entirely. You can also download a copy of all your data.

Take a Privacy Checkup

5. Consider using a service to restrict data access to brokers.

There are services available where you can pay to keep your information away from data brokers.

One example is DeleteMe, a paid subscription service that maintains tabs on data collectors and removes data such as names, current and past addresses, dates of birth, and aliases on your behalf.

This monitoring can keep your private information out of search results and away from platforms such as open people search databases.


6. Lock down your social media or delete accounts entirely.

On Facebook

In the settings tab, you can download all of Facebook’s information on you.

In the privacy tab, you should restrict your posts to “friends only” and limit your past posts, and you can decide to disallow lookups by your provided email address or phone number.

You also have the option to remove your Facebook profile from search engine results outside of the social networking platform. Under the location tab, consider turning off location data collection by Facebook, too.

If you look at apps and websites, you can see what is connected to your Facebook account. If you choose to delete these, Facebook can also automatically remove posts, videos, and events the connected service posted on your behalf.

On Twitter  

Twitter also allows users to request its archive, which is all the information collected from you. This option can be found under the settings and privacy tab.

In the settings area, you can choose to lock down your account and make tweets private by choosing to “protect your tweets.” You can also turn off tweets containing location data, decide whether or not to allow email and phone number searches to connect others to your profile, and choose whether to allow others to tag you in photos.

Under the safety portion of the tab, you can prevent your tweets from appearing in the search results of blocked users. You can also deactivate your account entirely.

On Instagram

Facebook-owned Instagram has a number of privacy settings you can also change to maintain an acceptable level of privacy.

By default, anyone can view your photos and videos on your Instagram account unless you are a minor, in which case your account should be private by default. However, by going to your profile, clicking settings, account privacy, and switching “private account” on, you can make sure your content is only viewed by approved users.

Most Popular Social Media Channels

7. Consider deleting your social media accounts.

Remove everything: A more extreme option is to delete all of your primary social media accounts completely.

On Facebook, you can go to settings & privacy, then settings, select your Facebook Information, and click on deactivation & deletion to deactivate it. This gives you the option to return at a later time and does not delete your data. Your settings, photos, and other content are saved, but your Facebook presence will not appear beyond unclickable text.

You can also permanently delete your account. If you have trouble finding this setting, you can type “delete Facebook” in the Help Center tab.

You are given a grace period to change your mind and log back in. It can take up to 90 days before the deletion of content on your Facebook wall and in your account will begin.

To deactivate Twitter, you need to click on settings and privacy from the drop-down menu under your profile icon. From the account tab, you can then click deactivate.

To delete your Instagram account, log in and go to the request deletion page. Once you have submitted an answer as to why you are deleting your account, you will be prompted to re-enter your password, and then a delete account option will appear.

Delete Me

8. Remove old accounts and blog posts.

Is it necessary to preserve what you had for breakfast one morning in 2017 or your review of a now-defunct retail shop near you? Probably not.

Time and effort are required to comb through old posts, but the result is worth it, and this may also train you to be more selective about the information you share in the future. Unless the account is one you use frequently, consider deleting it permanently. It is a pain to find, remembering credentials, and recovering passwords associated with old accounts, but this is an important step in locking down your data.

To find your old accounts, visit ‘Have I Been Pwned’, check the lists of connected apps in your Facebook and Google accounts, and, if you have a password manager, check it for the credentials of accounts you have used since signing up.

You may have to manually log in to each account you want to remove and, depending on the service, delete your info from there or contact the service provider with the request.

Justdeleteme is a helpful directory containing guides to removing accounts from countless online services and a rating on how hard each type of account is to remove, ranging from “easy” to “impossible.”


9. Hide yourself.

If you’re unable to delete online accounts and can only deactivate them, the advice is to first delete as much content as possible. If the account is no longer relevant, consider changing personal details and photos to generic alternatives before deactivating. For active accounts, maintaining anonymity or using aliases can help separate digital and physical presence. While using your full, correct name is typically required, many individuals still change their surname at least to prevent work and personal accounts from overlapping, a practice often tolerated despite terms of service. Deleting or changing personal photos to avoid identification is also recommended.

In cybersecurity, our renowned mantra is ‘better safe than sorry’. While concealing your online identity may demand a certain level of effort, the investment pays dividends in the enduring expanses of our rapidly evolving digital terrain. The Australian Security Directorate found itself addressing over 1,100 cybersecurity incidents originating from local entities, while ReportCyber received a staggering 94,000 reports to law enforcement – an alarming frequency of one report every six minutes. In light of this escalating trend in cyber breaches, the imperative is clear: fortify and curate your online presence to navigate the digital landscape securely. The statistics and recent upward trend of breaches underscore the urgency to prioritise and safeguard your digital footprint and online citizenship.

Navigating the Australian Cybersecurity Talent Shortage: Impact on Businesses

Navigating the Australian Cybersecurity Talent Shortage: Impact on Businesses

In today’s threat landscape, cybersecurity is paramount for any business operating in Australia or around the world. With the increasing frequency and sophistication of cyber threats, having a skilled cybersecurity workforce has become a necessity. However, a critical issue looms large over the Australian business landscape – according to the ASCS report the shortage of cybersecurity talent is predicted to be approximately 17,000 by 2026. In addition, there is over 7,500 unfilled cyber security roles as of August 31, 2023. From a global perspective, over 3.5 million Cyber Security positions unfilled with a workforce shortage of 3.4 million. In this blog, we will delve into the consequences of this shortage and how it affects businesses operating Down Under.

Summary Lead:
1. Escalating Cyber Threats
2. Increased Costs
3. Delayed Incident Response
4. Compliance and Regulatory Risks
5. Innovation and Competitive Disadvantage
6. Outsourcing Concerns
7. Education and Skill Gap

1. Escalating Cyber Threats

One of the most immediate and apparent impacts of the Australian cybersecurity talent shortage is the escalating number and complexity of cyber threats faced by businesses. As the demand for cybersecurity professionals far outstrips the supply, Australian companies are left vulnerable to an array of cyberattacks, from ransomware attacks to data breaches, the shortage of skilled Cyber Security professionals means that Australian companies will struggle to defend against these threats effectively.
ACSC -Annual-Cyber-Threat-Report-2022-2023
ACSC -Annual-Cyber-Threat-Report-2022-2023

2. Increased Costs

The scarcity of cybersecurity talent also translates into higher costs for businesses to attract and retain skilled professionals in this competitive field, companies often find themselves offering substantial salaries and benefit packages. Due to the complexity of cyber-attacks, according to Deloitte Insights, businesses spend 10.9% of their IT budget on cybersecurity. This expense can strain budgets, especially for smaller businesses, diverting resources away from other essential areas of operation.

3. Delayed Incident Response

In the event of a cybersecurity incident, a swift and effective response is crucial to mitigate damage. This can include preparation, detection and analysis, containment and mitigation, investigations and forensics, communications and reporting, recovery and future protection. However, with a shortage of qualified experts, Australian companies may experience delays in identifying and responding to threats. This delay can result in increased data loss, extended downtime, and even reputational damage. Australian businesses are uniquely vulnerable to compliance risks due to our complex and increasingly regulated landscape.

4. Compliance and Regulatory Risks

Many industries in Australia are subject to strict cybersecurity regulations and compliance standards, APRA, SOCI ACT 2018 to name a couple, failing to meet these requirements can lead to severe penalties and legal consequences. The shortage of cybersecurity talent makes it challenging for Australian companies to stay compliant and can expose them to unnecessary risks.

5. Innovation and Competitive Disadvantage

Innovation often goes hand in hand with digitalisation, and businesses that lack cybersecurity expertise may hesitate to adopt new technologies. This hesitation can hinder growth and put companies at a competitive disadvantage in a rapidly evolving digital landscape.

6. Outsourcing Concerns

Some businesses resort to outsourcing their cybersecurity needs to third-party providers. While this can alleviate the talent shortage problem for there organisation, it also comes with risks related to data security and privacy. Entrusting sensitive information to external entities requires meticulous vetting and management. Demand for cyber security workers is set to remain strong in coming years, meaning the skills shortage will not ease without consistent efforts to increase supply. The sector could require up to 16,600 additional workers by 2026.

7. Education and Skill Gap

Addressing the Australian cybersecurity talent shortage is a long-term challenge that involves nurturing a pipeline of skilled professionals. TAFEs and universities around the country have rapidly expanded their cyber security program offering in recent years, often in close partnership with the cyber – security industry. Approximately half of universities across Australia offer IT or computer science qualifications. Although the growth of cyber security presence has grown in the Australian education system, they take time to yield results. In the meantime, businesses continue to face the immediate consequences.


The Australian cybersecurity talent shortage is a critical issue that impacts businesses across the country. From heightened security risks and increased costs to compliance challenges and delayed incident response, the consequences are far-reaching. To navigate this landscape successfully, businesses must adopt a multi-pronged approach that includes talent development, strategic partnerships, and a proactive cybersecurity strategy. Only by addressing this shortage can Australian businesses hope to protect their digital assets and thrive in the digital age.
Multi-Factor Authentication in Microsoft 365: What You Need to Know

Multi-Factor Authentication in Microsoft 365: What You Need to Know

Multi-factor authentication (MFA) is a widely accepted security measure, but it is not foolproof. Even when MFA is enabled, organisations can still be vulnerable to attacks if their MFA policies are misconfigured.

Oreta has found that many organisations misconfigure MFA policies in their Microsoft 365 cloud environments. This can allow attackers to bypass MFA and gain unauthorised access to sensitive data.

Here are some of the most common MFA misconfigurations:

  • Enabling MFA for only some users. This leaves users who are not required to use MFA vulnerable to attack.
  • Allowing users to bypass MFA for certain applications or devices. This can make it easier for attackers to gain access to sensitive data.
  • Not enforcing MFA for all sign-in attempts. This can allow attackers to gain access to an account by simply guessing the user’s password.

Organisations should carefully review their MFA policies to ensure that they are properly configured. They should also regularly test their MFA policies to ensure that they are working as intended.

Conditional Access Policies (CAPs) are a powerful tool for controlling access to Microsoft 365 and Azure AD resources. However, CAPs can be complex to configure and manage, and misconfigurations can lead to security vulnerabilities.

We have observed several CAP issues that can be used to bypass MFA. These issues include:

  • Using the wrong conditions in a CAP rule. For example, a CAP rule that only applies to users in the United States could be bypassed by an attacker who logs in from another country.
  • Excluding certain users or devices from a CAP rule. For example, a CAP rule that requires MFA for all users could be bypassed by an attacker who uses a device that is excluded from the rule.
  • Not enforcing MFA for all sign-in attempts. For example, a CAP rule that requires MFA for all sign-in attempts could be bypassed by an attacker who uses a compromised password to log in.

Permitting Mobile Devices

Whether intentional or not, Oreta often finds mobile devices exempted from MFA CAP. This exemption is often made to reduce friction for users who need to check emails or documents on the go. However, the source of a device can be easily spoofed by changing the “User Agent” request. This means that an adversary on a Windows device could pose as an iPhone, bypassing MFA.

To mitigate this risk, it is important to enforce MFA for all users, regardless of the device they are using. Additionally, organisations can implement additional security measures such as Mobile Device Management (MDM) or Mobile Application Management (MAM) compliance.

Unintentionally Permitting Linux Devices

Only relatively recently (Burrage, 2022) has Microsoft added Linux as a device platform for rules to be applied against. Organisations are often surprised to find that Linux has been retroactively applied to rules in the “bypass” state. Review old rules to ensure Linux devices are not granted unexpected additional rights.

Exempted Service Accounts

Service accounts are not designed to interact with users, so they cannot respond to multi-factor authentication (MFA) requests. As a result, administrators often disable MFA for these accounts. However, this can leave them vulnerable to attack.

During penetration tests, Oreta consultants have found service accounts that have been in use since 2010 and have passwords like “Password1.” This is a major security risk.

To mitigate this risk, organisations should use Conditional Access Workload Identities (CAWI) to block untrusted external authentication events for service accounts. CAWI allows organisations to define policies that require service accounts to only authenticate from trusted locations.

In addition, organisations should use a privileged access management (PAM) solution to ensure that service accounts are secure. PAM solutions can help to manage service account passwords, enforce least privilege, and audit access to service accounts.

Opt-In Selective Enforcement

When configuring a conditional access policy (CAP), one of the variables that must be set is “to which groups should this apply to?”. Many organisations have an ALL-STAFF group that new users are added to as part of the onboarding process. This group is then used to enforce MFA for all new users. However, if an old user is not retroactively added to this group, or slips through the onboarding process, they will not be subject to MFA. This leaves these users in a vulnerable state.

To mitigate this risk, MFA enforcement should be set to opt-out by default. This means that all users will be required to use MFA, unless they are explicitly exempted. Any exemptions should be carefully considered and audited.

By setting MFA enforcement to opt-out by default, organisations can help to ensure that all users are protected, regardless of when they joined the organisation.

Exempted Applications

Sometimes, MFA may be implemented for users and devices on a wide scale, but it may not cover all applications within an organisation. Software as a Service (SaaS) applications within a given tenancy can also be subject to exceptions in terms of conditional access policies (CAPs). For instance, one organisation enforced MFA for the Microsoft suite but neglected to include Confluence. Upon closer examination, it was discovered that this Confluence instance contained sensitive information, which allowed Oreta testers to gain remote access to the internal network without MFA. It is essential for organisations to regularly review application exemptions and ensure that users do not store their credentials in easily accessible knowledge bases.

Trusted Locations

Organisations typically have an MFA exemption policy for users originating from “trusted” networks, such as their VPN or offices. However, these network ranges are often broad and sometimes overlap with guest Wi-Fi networks. This creates a potential security vulnerability where threat actors could walk past an office, obtain an authentication token without MFA, and then continue to use that token remotely. To mitigate this risk, it is important to ensure that the designation of “trusted” locations is minimal and that these locations are genuinely trustworthy.

Oreta ran a red team/blue team exercise on a client in the finance industry. In a red /blue team exercise, the red team is made up of offensive security experts who try to attack an organisation’s cybersecurity defences. The blue team defends against and responds to the red team attack. On a red team, Oreta obtained username and password credentials via a password spray. On authenticating to Microsoft 365 it was found that MFA was enforced through the browser. Typically, the tool MFASweep (dafthack, 2022) is executed to find low-hanging fruit in CAPs – by mimicking a mobile device – but this did not result in a bypass on this test. What is important to remember is that CAP is evaluated holistically. Many rules may be evaluated during a given authentication event. As a result, Oreta testers were able to brute-force combinations of known devices, applications, and Microsoft login endpoints to find the combination of CAP to obtain access. Upon authenticating with a Linux user agent and a spoofed “Windows Config Designer” source application ID to the Microsoft Graph API endpoint, the CAP were satisfied and provided the consultant access to the organisations cloud without the need for MFA.


Microsoft Conditional Access Policies, when properly implemented, offer organisations powerful capabilities for granular control and auditing of authentication events, aligning with the principle of defence in depth. However, the complexity of these policies can lead to nested issues that may result in unexpected or unintended outcomes. Conducting a static review of policies is always recommended, but it is also beneficial to evaluate effective policies from an offensive perspective to verify that what is defined in theory aligns with actual practice. When defining Conditional Access Policies, it is important to ensure that they are:

  • Exclusive by default
  • Clear in purpose
  • Properly labelled
  • Consistently applied with minimal exceptions
  • Regularly audited to detect abnormal login flows.

Contact us now to evaluate your MFA policies.

The Rising Significance Of Australian Signals Directorate 8 In Cybersecurity

The Rising Significance Of Australian Signals Directorate 8 In Cybersecurity

Frequently, we encounter headlines about yet another organisation succumbing to a cyber-attack. Despite the abundant news coverage and the industry’s clear emphasis on cyber security, 48% of Australian executives still expressed low confidence in their organisation’s capability to subjectively evaluate cyber risks. To enhance your organisation’s cybersecurity stance and shift towards a proactive rather than reactive approach, it is imperative to adopt the ASD Essential 8. By doing so, you can be assured that your confidential data remains secure, and your reputation remains intact.

What is Essential 8?

The Australian Signals Directorate (ASD) Essential 8 is a set of eight security controls that organisations can implement to protect themselves against cyber threats. The Essential 8 was first published in 2016, and it has since become a widely accepted benchmark for cyber security best practices.

The growing importance of the Essential 8 stems from various factors, primarily driven by the rapidly evolving threat landscape. In recent years, attackers have adopted highly sophisticated methods to infiltrate organisations’ systems and compromise data. The ACSC received over 76,000 cybercrime reports, an increase of nearly 13 per cent from the previous financial year. This equates to one report every 7 minutes, compared to every 8 minutes last financial year. In response to these escalating threats, the Essential 8 offers a comprehensive set of controls that empower businesses to effectively counter and mitigate such risks. Consequently, the following reasons highlight why the Essential 8 has emerged as a crucial component in bolstering cybersecurity:

  • Empowers businesses to remain current and proactive in countering emerging threats.
  • Encompasses an extensive array of controls, effectively mitigating diverse security risks.
  • Endorsed by multiple government and industry organizations, lending it unwavering credibility and legitimacy.
  • Effortlessly implementable and maintainable, rendering it an ideal solution for organisations of any scale.

While the Essential 8 does not function as an impenetrable titanium shield and cannot ensure absolute immunity to cyber-attacks for organisations, its implementation can significantly raise the bar for attackers, making their success far more challenging. For those seeking to enhance their organisation’s cyber security posture, the Essential 8 serves as an excellent starting point. By adopting the Essential 8 practices, organisations can substantially bolster their defences against potential attacks.

Implementation of the Essential Eight Maturity Model

The Essential Eight Maturity Model comprises of four maturity levels (0 to 3). The higher levels of maturity protect entities against moderate-to-high degrees of sophistication in adversary tradecraft and targeting. As of July 2022, it is a core requirement of the PSPF that entities implement the Essential Eight strategies to at least Maturity Level 2.

The Essential Eight Maturity Model comprises the following eight strategies:

  • Application control: ensures only corporate approved software applications can be executed on a computer, protecting against the execution of malicious applications.
  • Patch applications: applying vendor patches or other vendor mitigations prevents known vulnerabilities in applications from being exploited.
  • Configure Microsoft Office macro settings: limits macro programs embedded in Microsoft Office files from executing, thereby preventing potential malicious activity.
  • User application hardening: limits the use of potentially exploitable user application functionality to only what is required and removes particularly vulnerable software altogether.
  • Restrict administrative privileges: limits the unnecessary provision of administrative privileges, reducing the potential for these to be exploited by adversaries to gain full access to computers and data.
  • Patch operating systems: applying vendor patches or other vendor mitigations prevents known vulnerabilities in operating systems from being exploited.
  • Multi-factor authentication: requires users to present multiple authentication credentials to log in, rather than just using a passphrase, thereby preventing adversaries logging in as a user if they know the user’s passphrase.
  • Regular backups: making a copy of data, software, and configuration settings, storing it securely and periodically testing the ability to restore it, enables data and computers to be restored after an incident such as ransomware or computer hardware failure.

The Essential Eight Maturity Model recommends that organisations implement the Essential Eight using a risk-based approach. Where the strategies cannot be implemented, these exceptions should be minimised, and compensating controls should be used to manage the resulting risk. If the gap is effectively mitigated, the entity may self-assess their maturity against that strategy.

The Essential 8 is a valuable set of security controls that can help organisations protect themselves against cyber threats. By implementing these controls, organisations can make it much more difficult for attackers to succeed.

If you are interested in learning more about the Essential 8 or would like a no obligation chat contact us now.

Find out more about Oreta’s cybersecurity services here.