ASIO's Protective Security Top 10 identifies the essential components of a complete security framework that organisations can implement to identify, manage and prevent threats to their people, places, technology and information.
All organisations face threats that could adversely impact the wellbeing and safety of employees as well as the organisation's stability, productivity, reputation and prosperity. Organisations can manage the risk of threats by implementing multi-layered protective security measures to deter, detect, delay, respond to and recover from loss, disruption or compromise.
- Identify the threat to—and vulnerabilities of—staff, key functions, critical systems, data, assets and facilities. And know that you may also be targeted.
- Conduct a risk assessment to identify your unique risks and risk tolerance.
- Apply a risk-based approach to security: focus your attention and resources where it will achieve the best outcomes.
- Threat = intent and capability of an adversary.
- Vulnerability = a flaw or weakness which could be exploited.
- Risk = likelihood and consequence of an attack.
- Risk tolerance = an informed decision to accept a certain level of risk.
- Develop a security plan and establish a corporate body responsible for overseeing security matters and decision-making.
- Security is a shared responsibility: assign security responsibilities to trained personnel and collaborate—no single person or area can manage security alone.
- Establish sound and tested policies and procedures that are easy to follow and access and update them regularly—make doing the right thing, the right way, as easy as possible.
- Include policies and procedures to manage any risks posed by external visitors, contractors, managed service providers, staff working remotely and staff travelling overseas.
- Regularly assess the culture for trends that require attention.
- Enable: leadership, compliance and correction.
- Encourage: ownership, reporting, discipline, innovation and confidence.
- Educate: communicate and deliver security awareness training to all staff.
- Provide secure and reliable infrastructure for all staff, including those working remotely.
- Ensure highly secure areas have systems that are auditable and can control access to sensitive information and assets, detect breaches or attempted breaches of access and provide real-time alerts about unathorised access.
- Keep an inventory of all physical assets assigned to personnel (passes, tokens, laptops) and update the inventory regularly.
- Ensure physical and ICT supply chain risks are considered and addressed.
- Implement the ACSC's Essential Eight.
- Secure your accounts, devices and email—patch regularly and use complex passwords, multi-factor authentication and protection software.
- Manage the connectivity of systems and devices—anything that is connected to the internet is vulnerable (this includes PROTECTED networks).
- Secure all electronic devices: maintain physical control of them at all times; switch them off daily; limit the information stored on them; and sanitise them before destruction or disposal.
- Carefully consider the potential risks of using the cloud or data centres.
- Regularly back up devices, data and systems.
- Implement appropriate and proportionate personnel screening procedures during pre-employment, throughout employment and at the conclusion of employment.
- Include external providers, managed service providers, contractors, consultants and business partners.
- Implement a counter insider threat program.
- Remember security clearance holders have additional obligations.
- Hold sensitive activities and discussions in secure areas (for example, recently swept spaces, device-free areas, Security Zones or SCIFs).
- Handle, use, store and destroy sensitive material appropriately.
- Control information access to only those with an appropriate security clearance and/or need to know.
- Restrict mobile devices in secure areas or near sensitive discussions.
- Protect your research and intellectual property by collaborating with care.
- Conduct technical security countermeasures sweeps if required.
- Restrict, limit or securely manage the connectivity of systems and devices.
- Regularly check the security settings of online accounts and delete or deactivate accounts no longer in use.
- Periodically review, update or remove information available online or on social media that could compromise the safety of your employees, workplace or assets, or be of interest to adversaries.
- Establish a reporting mechanism that is confidential, accessible and timely.
- Educate employees on what to report and how.
- Educate security teams to recognise and respond to possible reconnaissance activities.
- Reconnaissance is the purposeful observation of people, places, vehicles and locations to gather information; it may be undertaken through physical and/or technological means.
- Educate employees to Think Before You Link when connecting online and to report suspicious approaches or persistent questioning.
- Establish emergency and security incident investigation and response procedures and know when referral to external agencies is required.
- Regularly review your security governance and controls for effectiveness and adjust if required.
- Review security incidents to assess if there were missed opportunities to intervene earlier, if additional or different measures or training could have assisted, and if it was an isolated incident or part of a trend.
- Review and test incident response and investigation procedures for effectiveness.