/strategy-check

description: Verify specific Essential 8 strategy implementation

Strategy Implementation Check

Provides detailed implementation guidance and verification for a specific Essential 8 mitigation strategy.

Arguments

• `$1` - Strategy number (required: 1-8) or name
• `$2` - Target maturity level (optional: 1, 2, or 3)

Strategy Selection

1. Application Control

Prevent execution of unapproved/malicious programs

2. Patch Applications

Remediate security vulnerabilities in applications

3. Configure Microsoft Office Macro Settings

Prevent malicious macros from executing

4. User Application Hardening

Reduce attack surface of internet-facing applications

5. Restrict Administrative Privileges

Prevent privilege escalation and lateral movement

6. Patch Operating Systems

Remediate security vulnerabilities in operating systems

7. Multi-Factor Authentication

Prevent unauthorized access using stolen credentials

8. Regular Backups

Recover data and system availability after incidents

---

Strategy 1: Application Control

Maturity Level 1

**Requirements**:

• Application control implemented on all workstations
• Allowed/blocked execution rules in place
• Microsoft's recommended block rules applied
• Application control events logged

**Implementation Steps**:

1. Choose application control solution (AppLocker, Windows Defender Application Control) 2. Create baseline of approved applications 3. Configure publisher certificate rules 4. Implement path rules for authorized locations 5. Block execution from user-writable directories 6. Deploy to all workstations 7. Enable audit mode first, then enforcement 8. Log all blocked execution attempts

**Validation**:

• Test unapproved application execution (should block)
• Verify approved applications run normally
• Check event logs for blocked attempts

Maturity Level 2

**Additional Requirements**:

• Application control on all servers
• Drivers/kernel modules controlled
• PowerShell, command line, scripts controlled
• Application control events centrally logged

**Implementation Steps**:

1. Extend controls to all servers 2. Implement driver signature requirements 3. Configure PowerShell Constrained Language Mode 4. Block scripting languages (unless required) 5. Central log collection (SIEM) 6. Regular rule review and updates

**Validation**:

• Test script execution blocking
• Verify driver installation controls
• Confirm central logging operational

Maturity Level 3

**Additional Requirements**:

• Validation of application control configuration
• Application control event analysis
• Extremely hardened configuration
• Annual penetration testing

**Implementation Steps**:

1. Independent validation of implementation 2. Implement automated rule compliance checking 3. Continuous monitoring and alerting 4. Threat hunting using control events 5. Penetration testing of bypass techniques 6. Annual recertification

**Validation**:

• Third-party assessment of controls
• Penetration test with bypass attempts
• Red team exercises

---

Strategy 2: Patch Applications

Maturity Level 1

**Requirements**:

• Security vulnerabilities in applications patched **within one month** of release
• Extreme risk vulnerabilities patched **within 48 hours**
• Patches applied to internet-facing applications first

**Implementation Steps**:

1. Maintain inventory of all applications 2. Subscribe to vendor security advisories 3. Assess vulnerability severity (use CVSS) 4. Prioritize internet-facing and critical apps 5. Test patches in non-production environment 6. Deploy patches according to timeline 7. Verify successful installation 8. Document patching activities

**Extreme Risk Definition**:

• CVSS 9.0-10.0
• Actively exploited in the wild
• No mitigating controls available
• Critical asset exposure

**Validation**:

• Scan for unpatched vulnerabilities
• Review patching logs
• Verify 48-hour extreme risk compliance

Maturity Level 2

**Additional Requirements**:

• Vulnerabilities patched **within two weeks** of release
• Extreme risk still 48 hours
• Automated patch deployment where possible

**Implementation Steps**:

1. Implement automated patching tools 2. Accelerate testing procedures 3. Staged deployment approach 4. Enhanced monitoring for patch failures 5. Metrics tracking and reporting

Maturity Level 3

**Additional Requirements**:

• All vulnerabilities patched **within 48 hours**
• Automated deployment and verification
• Comprehensive patch management process

**Implementation Steps**:

1. Fully automated patch testing 2. Rapid deployment capabilities 3. Rollback procedures tested 4. Continuous vulnerability scanning 5. Real-time patch compliance dashboards

---

Strategy 3: Configure Microsoft Office Macro Settings

Maturity Level 1

**Requirements**:

• Macros disabled for files from the internet
• Macro antivirus scanning enabled
• Only macros in Trusted Locations allowed to run
• Block OLE package activation

**Implementation Steps**:

1. Configure Group Policy for Office macro settings 2. Enable "Block macros from the internet" 3. Define Trusted Locations (limited, IT-controlled) 4. Enable AMSI (Antimalware Scan Interface) 5. Block embedded OLE packages 6. Educate users on macro risks 7. Monitor macro execution events

**Validation**:

• Test internet-sourced Office files (macros should not run)
• Verify Trusted Location macros work
• Check Group Policy application

Maturity Level 2

**Additional Requirements**:

• Only macros from Trusted Locations with validation
• AMSI enabled for all Office applications
• Logging of all macro execution attempts

Maturity Level 3

**Additional Requirements**:

• Validated macro execution only
• Digital signature requirements
• Comprehensive monitoring and alerting

---

Strategy 4: User Application Hardening

Maturity Level 1

**Requirements**:

• Web browsers: Block Flash content, block or disable ads, disable Java