Essential Eight Maturity Level Mapping

 

Free Trial

 

Endpoint Central is a trusted solution for organizations striving to meet the Essential Eight requirements. The table below highlights how Endpoint Central’s capabilities align with the maturity levels of the Essential Eight framework.

Mitigation Strategy

Maturity Level One

Maturity Level Two

Maturity Level Three

How Endpoint Central helps

Patch applications

An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.

An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.

An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.

Endpoint Central uses its agents to fetch the complete details of the inventory present in your IT.

Refer to the types of Inventory scans leveraged by Endpoint Central for monitoring your IT.

Admins can configure Inventory Alerts in case of any unauthorized changes taking place inside your IT network.

A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.

A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.

A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.

Endpoint Central provides comprehensive vulnerability management in terms of constant assessment and visibility of threats from a single console.

Apart from vulnerability assessment, it also provides built-in remediation of the vulnerabilities detected.

A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.

A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.

A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.

Endpoint Central detects web server misconfigurations for widely deployed web server vendors like Apache, Tomcat, IIS, Nginx.

A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.

A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.

A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.

Endpoint Central provides comprehensive vulnerability management in terms of constant assessment and visibility of threats from a single console. Apart from vulnerability assessment, it also provides built-in remediation of the vulnerabilities detected.

Endpoint Central also integrates with Tenable for extensive vulnerability detection.

Endpoint Central provides comprehensive patch support for Windows, Linux, and macOSs and Windows Server OS. It also can patch 1,000+ third party applications, hardware drivers, and BIOS.

Endpoint Central has a vulnerability age matrix and vulnerability severity summary, which can provide rich insights about the impact of patch implementation. Besides, Endpoint Central also provides comprehensive reports on vulnerable systems and missing patches in your IT.

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.

Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Endpoint Central supports web server hardening for widely deployed web server vendors like Apache, Tomcat, IIS, Nginx.

Endpoint Central also supports patch for Windows Server OSs.

Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Endpoint Central provides comprehensive patch support for Windows, Linux, and macOSs and Windows Server OS. It also can patch 1,000+ third party applications, hardware drivers, and BIOS.

For Mobile devices, Endpoint Central can provide firmware updates, OS updates and streamline app updates.

Endpoint Central's SLA for patches:

i)Third-party updates are supported within 6-9 hours from vendor release.

ii) Security updates are supported within 12-18 hours from vendor release.

iii)Non-security updates are supported within 24 hours from vendor release.

Endpoint Central's comprehensive patching solution helps you to achieve high patch compliance.

Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release.

Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release.

Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within one month of release.

Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within one month of release.

Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed.

Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed.

Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed.

Endpoint Central helps monitoring your network endpoints continuously and detect end of life softwares, peer to peer softwares and remote sharing tools present in them.

It also presents the admins with details on the expiry date and the number of days before software in your network becomes end of life.

Applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed.

Patch operating systems

An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.

An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.

An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.

Endpoint Central uses its agents to fetch the complete details of the inventory present in your IT.

Refer to the types of Inventory scans leveraged by Endpoint Central for monitoring your IT.

Admins can configure Inventory Alerts in case of any unauthorized changes taking place inside your IT network.

A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.

A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.

A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.

Endpoint Central provides comprehensive vulnerability management in terms of constant assessment and visibility of threats from a single console.

Apart from vulnerability assessment, it also provides built-in remediation of the vulnerabilities detected.

Endpoint Central integrates with Tenable for extensive vulnerability detection. Endpoint Central could be your remediation tool for detected vulnerabilities.

A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.

A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.

A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.

Endpoint Central provides comprehensive vulnerability management in terms of constant assessment and visibility of threats from a single console. Apart from vulnerability assessment, it also provides built-in remediation of the vulnerabilities detected.

Endpoint Central integrates with Tenable for extensive vulnerability detection.


Endpoint Central provides comprehensive patch support for Windows, Linux, and macOSs and Windows Server OS. It also can patch 1,000+ third party applications, hardware drivers, and BIOS.

Endpoint Central has a vulnerability age matrix and vulnerability severity summary, which can provide rich insights about the impact of patch implementation. Besides, Endpoint Central also provides comprehensive reports on vulnerable systems and missing patches in your IT.

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.

For updating patches and detecting vulnerabilities in non-internet facing servers and network devices,Endpoint Central's DMZ architecture can be leveraged.

Endpoint Central provides comprehensive vulnerability management in terms of constant assessment and visibility of threats from a single console. Apart from vulnerability assessment, it also provides built-in remediation of the vulnerabilities detected.

Endpoint Central integrates with Tenable for extensive vulnerability detection.

Endpoint Central can check if the OS version of the mobiles and update them to latest versions.

Endpoint Central provides comprehensive patch support for Windows, Linux, and macOSs and Windows Server OS. It also can patch 1,000+ third party applications, hardware drivers, and BIOS.

Endpoint Central has a vulnerability age matrix and vulnerability severity summary, which can provide rich insights about the impact of patch implementation. Besides, Endpoint Central also provides comprehensive reports on vulnerable systems and missing patches in your IT.

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.

Endpoint Central provides comprehensive vulnerability management in terms of constant assessment and visibility of threats from a single console. Read more about Vulnerability assessment for network devices.

Endpoint Central provides comprehensive patch support for Windows, Linux, and macOSs and Windows Server OS. It also can patch 1,000+ third party applications, hardware drivers, firmware and BIOS.

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Endpoint Central provides comprehensive patch support for Windows, Linux, and macOSs and Windows Server OS. It also can patch 1,000+ third party applications, hardware drivers, and BIOS.


Endpoint Central's SLA for patches:

i)Third-party updates are supported within 6-9 hours from vendor release.

ii) Security updates are supported within 12-18 hours from vendor release.

iii)Non-security updates are supported within 24 hours from vendor release.

Endpoint Central's comprehensive patching solution helps you to achieve high patch compliance.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

The latest release, or the previous release, of operating systems are used.

Endpoint Central's OS Deployment feature help you upgrade your OS from older version to the latest version.
(OS Deployment Applicable for Windows and Windows Server OS)

Endpoint Central also provides a comprehensive view, listing the computer hardware which are incompatible with Windows 11.

Operating systems that are no longer supported by vendors are replaced.

Operating systems that are no longer supported by vendors are replaced.

Operating systems that are no longer supported by vendors are replaced.

Multi Factor Authentication

Multi-factor authentication is used to authenticate privileged users of systems.

Multi-factor authentication is used to authenticate privileged users of systems.

Endpoint Central helps in leveraging Windows' Hello for Windows devices. Admins can also configure Two- Factor authentication for Windows end- users.

Endpoint Central console can be accessed using a two-factor authentication.

Restrict administrative privileges

Requests for privileged access to systems, applications and data repositories are validated when first requested.

Requests for privileged access to systems, applications and data repositories are validated when first requested.

Requests for privileged access to systems, applications and data repositories are validated when first requested.

In the case of blocklisted or greylisted applications, Endpoint Central can admins provide temporary, on-demand access to users. Hence the end-users requestes are validated


Endpoint Central also has a Permission management configuration (for Windows) through which the admins can restrict the users from accessing a particular file or folder or registry key

Privileged access to systems, applications and data repositories is disabled after 12 months unless revalidated.

Privileged access to systems, applications and data repositories is disabled after 12 months unless revalidated.

Endpoint Central leverages the principle of least privilege and has a robust endpoint privilege management capability, providing for application specific privilege management and just-in-time access to the end users.


The privilege management can be revisited periodically by the admins

Privileged access to systems and applications is disabled after 45 days of inactivity.

Privileged access to systems and applications is disabled after 45 days of inactivity.

Endpoint Central can help in removing unnecessary local admins.

Privileged access to systems, applications and data repositories is limited to only what is required for users and services to undertake their duties.

Endpoint Central leverages the principle of least privilege and has a robust endpoint privilege management capability, providing for application specific privilege management and just-in-time access to the end users.   


It has conditional access policies to validate authorized users to access business critical systems and data

Privileged users use separate privileged and unprivileged operating environments.

Privileged users use separate privileged and unprivileged operating environments.

Privileged users use separate privileged and unprivileged operating environments.

Endpoint Central's Custom Group feature allows the admins to logically segregate systems of their convenience so that they can manage and secure them effectively.

Admins could create different static or dynamic groups for different operating environments based on their requirements.

Just-in-time administration is used for administering systems and applications.

Endpoint Central can help admins provide temporary, on-demand access to users for unmanaged or blocked applications, ensuring security while meeting user needs.

Administrative activities are conducted through jump servers.

Administrative activities are conducted through jump servers.

Endpoint Central has Secure Gateway server preventing the exposure of Endpoint Central Server directly to the internet

Application control

Application control is implemented on workstations.

Application control is implemented on workstations.

Application control is implemented on workstations.

Endpoint Central leverages the principle of least privilege and has a robust endpoint privilege management capability, providing for application specific privilege management and just-in-time access to the end users.


It has conditional access policies to validate authorized users to access business critical systems and data.


Endpoint Central's Application Control module allows the admins to allowlist/ blocklist software applications in critical endpoints.

Endpoint Central also can block executables, preventing the files from automatically getting executed.

Endpoint Central also empowers admins to control the child processes arising out of other applications.

All applications present in the allowlist and the unmanaged applications will be allowed to run smoothly in audit mode, and log collection will be enabled. The admin can monitor logs for as long as needed as a reference to know when to shift applications from the unmanaged application list to the allowlist, depending on the frequency and legitimacy of their use.

Application control is implemented on internet-facing servers.

Application control is implemented on internet-facing servers.

Application control is implemented on non-internet-facing servers.

Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.

Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.

Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.

Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.

Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.

Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.

Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.

Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.

Application control restricts the execution of drivers to an organisation-approved set.

Microsoft’s recommended application blocklist is implemented.

Microsoft’s recommended application blocklist is implemented.

Microsoft’s vulnerable driver blocklist is implemented.

Application control rulesets are validated on an annual or more frequent basis.

Application control rulesets are validated on an annual or more frequent basis.

Allowed and blocked application control events are centrally logged.

Allowed and blocked application control events are centrally logged.

Restrict Microsoft Office macros

Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.

Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.

Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.

Endpont Central leverages custom script configuration feature to ensure that macros are disabled for users who do not have business requirement.

Endpoint Central's Custom Group feature allows the admins to logically segregate systems of their convenience so that they can deploy macros to only to a select group of computers.

After deploying the Macros as a custom script , leveraging Endpoint Central, admins could use Collection Configuration feature. This means after the script is deployed, admins could launch the antivirus application (Scheduler configuration) so that the macros are scanned thoroughly.

Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.

Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations.

Only privileged users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.

Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.

Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View.

Microsoft Office’s list of trusted publishers is validated on an annual or more frequent basis.

Microsoft Office macros in files originating from the internet are blocked.

Microsoft Office macros in files originating from the internet are blocked.

Microsoft Office macros in files originating from the internet are blocked.

Microsoft Office macro antivirus scanning is enabled.

Microsoft Office macro antivirus scanning is enabled.

Microsoft Office macro antivirus scanning is enabled.

Microsoft Office macros are blocked from making Win32 API calls.

Microsoft Office macros are blocked from making Win32 API calls.

Microsoft Office macro security settings cannot be changed by users.

Microsoft Office macro security settings cannot be changed by users.

Microsoft Office macro security settings cannot be changed by users.

User application hardening

Internet Explorer 11 is disabled or removed.

Internet Explorer 11 is disabled or removed.

Internet Explorer 11 is disabled or removed.

Endpoint Central's Browser Restriction policy can enable admins restrict the end-users fro using Internet Explorer .

Web browsers do not process Java from the internet.

Web browsers do not process Java from the internet.

Web browsers do not process Java from the internet.

Endpoint Central's Browser Customization Configurations can help admins prevent javascript from running in the browsers

Web browsers do not process web advertisements from the internet.

Web browsers do not process web advertisements from the internet.

Web browsers do not process web advertisements from the internet.

Using Endpoint Central, admins can block websites with excessive ads to prevent users from accessing websites that display an excessive amount of advertising.

Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.

Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.

Endpoint Central's comprehenisve Browser Security feature enables admins to harden the browsers.

Web browser security settings cannot be changed by users.

Web browser security settings cannot be changed by users.

Web browser security settings cannot be changed by users.

Endpoint Central can ensure that the browser security settings deployed by admins cannot be tampered by the end-users.

Microsoft Office is blocked from creating child processes.

Microsoft Office is blocked from creating child processes.

Endpoint Central also empowers admins to control the child processes arising out of other applications.

Microsoft Office is blocked from creating executable content.

Microsoft Office is blocked from creating executable content.

Endpoint Central's Malware protection protects the endpoints from malicious executable content

Microsoft Office is blocked from injecting code into other processes.

Microsoft Office is blocked from injecting code into other processes.

Endpoint Central's Browser threat prevention configuration can ensure MS office from injecting code into other processes. 

PDF software is blocked from creating child processes.

PDF software is blocked from creating child processes.

Endpoint Central also empowers admins to control the child processes arising out of other applications.

PDF software is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.

PDF software is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.

Endpoint Central provides patching for third party applications like Adobe

Windows PowerShell 2.0 is disabled or removed.

The powershell exe file can be added into block executables and disabled for the end-users. 

Regular backups

Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.

Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.

Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.

Endpoint Central also provides instant, non-erasable backup of the files in your network every three hours by leveraging Microsoft's volume shadow copy service.

If a file is infected with ransomware, it can be restored with the most recent backup copy of the file.

Backups of data, applications and settings are synchronised to enable restoration to a common point in time.

Backups of data, applications and settings are synchronised to enable restoration to a common point in time.

Backups of data, applications and settings are synchronised to enable restoration to a common point in time.

Backups of data, applications and settings are retained in a secure and resilient manner.

Backups of data, applications and settings are retained in a secure and resilient manner.

Backups of data, applications and settings are retained in a secure and resilient manner.

Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.

Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.

Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.

 

Was this article helpful?

Thank you for your feedback!

Sorry about that!

By clicking "Submit", you agree to processing of personal data according to thePrivacy Policy.
Back to Top