Essential Eight Compliance with Forescout May 2022

Essential Eight Compliancewith Forescout
Achieve Maturity Level 3 with
all Essential Eight controls

The Australian Cyber Security Centre’s Essential Eight Maturity Model is a set of
mitigation strategies designed to improve cybersecurity posture by making it hard foradversaries to compromise networks. With three maturity levels, even organisations
with scarce IT resources can achieve baseline compliance and protection fromincreasing cyber threats. And with continuous visibility, compliance assessment andautomated workflows using the equipment and security tools you already have, yournetwork can adapt to your ever-changing digital terrain.

How Forescout helps
The Essential Eight is a set of mitigation strategies, not a single solution or technologythat can be bought through a single vendor. They address three areas that require not
only different security tools but tight communication and coordinated actions.
Either natively or by coordinating automated actions among security tools, Forescout
enables you to achieve Maturity Level Three for all eight controls, with continuous
visibility into granular compliance status.

By continuously monitoring
every asset on your networkand sharing collective
insights among security
products, Forescout
enforces policies to drive
the right automated actions
and ensure compliance.

Automate cybersecurity acrossyour digital terrain
The Essential Eight are designed to protect Microsoft Windows-based, internetconnected networks. For many organisations, that represents a fraction of theirenvironment. Digital transformation has led to explosive growth in IT, IoT, IoMTand OT/ICS assets connecting to your network and expanding the attack surface.
To manage this, you don’t need more point products. You need a force multiplier –a platform that makes your security team more effective and enabled to focus onwhat really matters.
The Forescout Continuum Platform automates the near real-time and continuous
discovery, assessment, and governance of all cyber assets across your environment,with special consideration for IoMT and OT/ICS assets that require different
approaches. When you need to enforce continuous compliance across a mix ofnetwork and security infrastructure technologies, Forescout is here.
1Essential Eight Compliance with Forescout May 2022

ESSENTIAL 8CONTROLHOW FORESCOUT HELPS
Mitigation strategies to prevent malware delivery and execution▶ Continuously monitor the Application Control compliance status on every managed endpoint, ensuring each one isusing the expected application control policies

ApplicationControl▶ Check Enforcement Agents are installed and running▶ Ensure central logging is functioning▶ Continuously monitor the last vulnerability scan date for all endpoints based on events instead of schedules; ensuringscans are being performed and looking for missing patches/updates for security vulnerabilities as required

PatchApplications▶ Ensure the vulnerability manager has not detected any No Longer Supported results and that all patches are applied
within required timeframes▶ Continuously assess Microsoft Office macro settings by monitoring the windows registry and sending evidence ofmacro execution data to the central logging system

Configure MS
Office Macros▶ Verify endpoint security agents are installed and running▶ Check that devices have applied Group Policies (RSoP) to detect GPO deployment issues▶ Continuously monitor installed applications to ensure no high-risk applications or frameworks are installed

ApplicationHardening▶ Verify via Policy that applications are installed, updated and licensed for use as required▶ Monitor endpoints with SCAP policies to ensure application hardening settings have applied

Mitigation strategies to limit the extent of cybersecurity incidents▶ Audit network traffic to ensure admin connections come only from defined area, such as the Privileged Access system

Restrict
Admin Priv

▶ Continuously monitor group membership and attributes on privileged accounts, e.g., to ensure training andcertification are current▶ Ensure devices with privileged account users logged in are not accessing the internet, using email or web services▶ Continuously monitor operating system versions to detect old or unpatched operating systems on all types of devices:
Windows, Linux, MacOS and firmware on IoT, OT/ICS and IoMT devices

Patch OS’s

▶ Monitor vulnerability scan results and audit Microsoft SCCM client registration, collection membership and detect
pending updates▶ Continuously monitor and automatically remediate Windows Update patch status via WSUS or Microsoft Update▶ Integrate with third-party endpoint management solutions like Ivanti and ManageEngine▶ Support MFA login to our platform▶ Ensure MFA agents are installed and running on endpoints

Multi-Factor
Authentication▶ Ensure central logging agents are installed and running on critical MFA servers▶ Audit network traffic is seen to/from the MFA servers

Mitigation strategies to recover data and system availability▶ Enforce stricter policies for device compliance when used by privileged accounts▶ Detect network access to the backup system and enforce user and device policies in near real-time

RegularBackups▶ Ensure Microsoft’s Shadow Volume Service is running on Windows devices▶ Support local and remote backup of the Forescout solution itself

Forescout Technologies, Inc.

© 2022 Forescout Technologies, Inc. All rights reserved. Forescout Technologies,

Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

Inc. is a Delaware corporation. A list of our trademarks and patents is available at
Other brands, products or service names may be trademarks or service marks ofLearn more at Forescout.com

their respective owners. Version 01_01

www.forescout.com/company/legal/intellectual-property-patents-trademarks.

2