We offer a range of web security services, including website vulnerability assessments, penetration testing, security audits, web application firewall (WAF) implementation, incident response, and security consulting.

Web security is crucial to protect your website, user data, and online reputation. It helps prevent unauthorized access, data breaches, malware infections, and other cyber threats that can disrupt your business and harm your customers.

Absolutely. We provide expert guidance and implementation support for a wide range of global and industry-specific security and compliance frameworks, including:

• ISO 27001 – Information Security Management Systems
• ACSC ASD Essential Eight – Australian Cyber Security Centre security maturity model
• IRAP – Information Security Registered Assessors Program (Australian Government)
• PCI DSS – Payment Card Industry Data Security Standard
• SOC 2 – Service Organization Controls for data security and privacy
• HIPAA – Health Insurance Portability and Accountability Act (US healthcare privacy)
• GDPR – General Data Protection Regulation (EU data privacy)

Our team works with you to assess your current posture, close compliance gaps, and maintain certification readiness year-round.

Yes, we provide ongoing website security monitoring services to detect and respond to potential security threats in real-time. We can also help implement security patches and updates to keep your website protected.

If your website has been hacked or compromised, it is essential to take immediate action. Contact us, and our web security specialists will guide you through the incident response process and help restore the security of your website.

While no set of mitigation strategies are guaranteed to protect against all cyberthreats, organisations are recommended to implement eight essential mitigation strategies from the Strategies to mitigate cybersecurity incidents as a baseline. This baseline, known as the ASD Essential Eight, makes it much harder for malicious actors to compromise systems.
The mitigation strategies that constitute the Essential Eight are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.

Implementing the ASD Essential Eight proactively can be more cost-effective in terms of time, money and effort than having to respond to a large-scale cybersecurity incident.

• The E8MM is designed to assist organisations to implement the ASD Essential Eight in a graduated manner based upon different levels of malicious actors’ tradecraft (i.e. tools, tactics, techniques and procedures) and targeting.
• The different maturity levels can also be used to provide a high-level indication of an organisation’s cybersecurity maturity.

• The Australian Signals Directorate (ASD) is committed to providing cybersecurity advice that is contemporary, fit for purpose and practical. This includes regular updates to the E8MM.
• Malicious actors continually evolve their tradecraft to defeat preventative measures that organisations put in place.
• ASD continually learns of advances in malicious actors’ tradecraft through its cyberthreat intelligence and cybersecurity incident response functions.
• ASD also learns of how our cybersecurity advice is implemented within organisations as part of ASD Essential Eight implementation assessments and uplift activities.
• Updates to the E8MM follow a thorough review by ASD, which includes consultation with government and industry partners.

Organisations are strongly encouraged to use the latest version of the E8MM to protect themselves against contemporary tradecraft used by malicious actors. Note, legacy versions of the E8MM will often no longer be fit for purpose due to the continual evolution of tradecraft used by malicious actors.

• The applicability of controls within the Information security manual (ISM) is based on the classification of data that a system will store, process or communicate whereas the E8MM is based on prioritising the implementation of controls to mitigate different levels of malicious actors’ tradecraft and targeting.
• A mapping between the E8MM and ISM is provided within the Essential Eight maturity model and ISM mapping publication.
• The ISM also provides OSCAL baselines for the E8MM which can be used by organisations to track their implementation of the E8MM within their governance, reporting and compliance tools.
• Organisations should consider their E8MM and ISM requirements independently. For example, an organisation contractually required to implement Maturity Level Two from the E8MM should not assume that controls within the ISM that are mapped to Maturity Level Three are out of scope when building and deploying a system. For non-corporate Commonwealth entities subject to the Department of Home Affairs’ Protective Security Policy Framework, this means that while Maturity Level Two is considered a mandatory baseline, controls mapped to Maturity Level Three within the ISM are still applicable for their systems, however, their implementation may be risk managed.

• ASD has developed an ASD Essential Eight assessment course and partnered with TAFEcyber for the delivery of the course to cybersecurity professionals across Australia.
• The ASD Essential Eight assessment course is a face-to-face three-day course that uses a blend of specialist expertise, knowledge and hands-on technical training. Further information on the Essential Eight Assessment Course is available from TAFEcyber.

Information on changes made as part of the November 2023 update of the E8MM can be found within the associated Essential Eight maturity model changes publication.