Continuous Proof: Navigating Australia’s New Cybersecurity Reality

Continuous Proof: Navigating Australia's New Cybersecurity Reality

We recently explored the revised Australian Signals Directorate (ASD) Essentials framework and what it means for your organization. Moving away from point-in-time compliance, we show you how to leverage Tenable One to provide continuous proof of your cyber exposure to the board.

[00:05:06] Changing conversations with the board

The dialogue with executive leadership has shifted from simple compliance checklists to dynamic exposure management.

• New expectations: The board no longer asks if you passed an audit, but rather how exposed you are right now.
• Continuous change: Your cyber risk changes daily as workloads spin up, permissions drift, and new vulnerabilities emerge.
• Evidence-based reporting: You must answer these questions with continuous proof of your actual security posture, rather than a snapshot from a specific day.

[00:06:30] The revised ASD Essentials framework

On October 15, the ASD introduced a major update to its framework, fundamentally changing how organizations measure their security outcomes.

• Beyond the Essential Eight: The older framework assessed controls at a single point in time, while the new Essentials focus on whether outcomes are being achieved today.
• New assessment structures: The framework now uses principles, actions, and domains to categorize and evaluate your environment.
• Historical data: A fully effective action now requires historical data to demonstrate consistent performance over time.

[00:07:59] The limitations of point-in-time assessments

Traditional compliance audits create a blind spot that leaves organizations vulnerable between assessment periods.

• The snapshot problem: Being compliant on Monday does not account for new cloud workloads, privilege changes, or non-exploited vulnerabilities that occur later in the week.
• Growing cyber exposure: Your cyber exposure grows every day, even if your audit report claims you remain compliant.
• Continuous visibility: Moving to continuous proof ensures you accurately understand your cyber risk at any given moment.

[00:10:37] Transitioning from the Essential Eight

Good news for organizations currently using the Essential Eight — your previous work carries forward but requires a different assessment approach.

• Baseline and gap analysis: Start by establishing your baseline and identifying what is missing under the new requirements.
• Finding-based assessments: Actions are now marked as addressed, partially addressed, or not addressed, shifting the focus to specific findings.
• Maintain current compliance: Keep adhering to your current Essential Eight requirements until your governing body advises a change.

[00:12:33] The structure of principles, actions, and domains

Every chapter in the new Essentials framework — whether IT, OT, or cloud — shares a consistent three-layer structure.

• Principles: The outcomes you want to achieve, derived directly from the ASD Information Security Manual (ISM).
• Actions: The specific tasks needed to meet those outcomes, mapped directly to MITRE ATT&CK techniques.
• Domains: Logical groups of assets where actions apply, including six technical domains and two capability domains.

[00:14:22] Structuring your security approach with phases

The ASD recommends implementing controls across three distinct phases, building layers of security like peeling an onion.

• Phase one: Focus on boundary services and identity services to secure common pathways for initial access.
• Phase two: Protect critical processes and privileged environments to limit escalation and safeguard essential business operations.
• Phase three: Secure business systems and user devices after establishing the first two layers of defense.

[00:20:25] Integrating AI into your security scope

There is no dedicated AI chapter in the framework; instead, AI systems are treated as assets within your existing domains.

• Categorizing AI assets: Place AI models, infrastructure, services, training data, and agents into the domains you already manage.
• Domain placement: A public AI service falls under boundary services, while an AI agent aligns with identity services.
• Ethical and secure use: Governance principles apply across all AI deployments to ensure they remain secure and controllable.

[00:21:58] Overcoming silos to uncover toxic attack paths

Operating with siloed tools across IT, cloud, identity, and OT prevents you from seeing the full picture of a cyber attack.

• Chaining vulnerabilities: A phishing attack, an over-privileged account, and an exposed OT controller can represent a single, continuous attack path.
• Toxic combinations: Individual routine findings become severe breaches when combined across multiple domains.
• 统一的可见性：You can only identify and prioritize these interconnected cyber threats when your data lives in one central platform.

[00:24:30] Unifying visibility with Tenable One

Tenable One consolidates data from multiple environments to deliver continuous proof and actionable business metrics.

• Comprehensive ingestion: The platform aggregates data from Tenable sensors, third-party integrations, and AI systems.
• Exposure data fabric: We correlate assets, identities, and vulnerabilities to assess what can actually be exploited in your environment.
• Prioritization and mapping: Tenable One maps attack paths and provides automated remediation insights so you can view all your domains in a single risk dashboard.

[00:28:58] Real-world application: The PHP CGI vulnerability

We map a critical vulnerability to the ASD Essentials framework to demonstrate how to track and report on real-world cyber threats.

• Asset identification: Use automated discovery to find every PHP instance across your environment.
• 基于风险的优先级分析：Focus on internet-facing assets first, basing remediation on exploitation and criticality metrics.
• Verifying effectiveness: Run continuous assessments to prove that patches were applied and that lateral movement is restricted.

[00:33:39] Assisting assessments with Hexa AI

Hexa, our agentic AI layer within Tenable One, streamlines the process of mapping your environment to the new framework.

• Automated correlation: Use plain English prompts to ask Hexa to tag assets by ASD domain or to build dashboards based on specific principles.
• Customized reporting: Hexa links data to ticketing systems and generates compliance summaries to provide evidence for your assessors.
• Continuous updates: As your environment changes, Hexa helps maintain current evidence by constantly feeding information from your sensors.

[00:35:28] Live demonstration in Tenable One

We provide a hands-on look at configuring Tenable One Vulnerability Management to align with the ASD Essentials.

• Dynamic tagging: Watch how to build dynamic asset tags within Tenable One Vulnerability Management that map directly to the framework's phases and domains.
• Dashboard creation: See how to create custom dashboards that monitor specific principles, such as vulnerability management and legacy system detection.
• Exposure response: Learn to track remediation initiatives and generate real-time reports to demonstrate compliance.

[00:46:58] Key takeaways for your organization

As you navigate this transition, focus on four main actions to strengthen your cybersecurity posture.

• Adopt the new framework: Treat the Essentials as required outcomes across IT, cloud, OT, and AI while maintaining your current evidence collection.
• Break down silos: Bring your disparate Active Directory, IT, OT, and cloud environments into a single, unified risk view.
• Identify critical risks: Expose toxic combinations and excessive privileges that create real-world attack paths.
• Deliver continuous proof: Leverage comprehensive platforms to provide on-demand, evidence-based reporting of your cyber exposure.

Watch the Full Webinar

Watch the on-demand webinar to see the full presentation, including the complete Tenable One platform demonstration and Q&A session.