ASD Essentials Critical Processes and Privileged Environments

In the enterprise IT chapter, ASD places both domains in priority phase 2. Privileged environments concentrates on secure administration, time-bound access and accountable changes. Critical processes and services concentrates on protection, isolation and proven recovery.

ASD addresses the domains together because doing so reduces the likelihood that an adversary can escalate access and affect systems and services that are critical to organisational outcomes.

ASD defines the domain as Systems and services that support privileged activities, management services and high-impact administrative functions. The implementation planning guide offers a direct scoping test: Does it enable, broker or govern elevated control over other systems?

Having administrator accounts does not put an ordinary server in this domain. The domain covers the systems through which administrative authority is exercised. ASD’s scoping guidance names these asset types:

Authority matters more than product category. An endpoint management console may hold little business data, yet it can distribute software or change security settings across the fleet, and that puts it in scope.

Account for Overlapping Domains

Several of these systems sit in more than one domain. A privileged access management platform also belongs to Identity services, and administrative remote access may be a Boundary service. A workstation used for both everyday work and administration belongs to Privileged environments and User devices. Backup platforms administered through dedicated management tooling also belong to Privileged environments.

The starting point is an inventory of systems that can grant elevated access, execute administrative changes or control other assets. For each one, record its management function, the systems it can affect and any overlapping domains.

Administrative consoles, privileged credentials and management services can affect many systems from one point of control, which is what an attacker looks for after the first foothold. ASD’s scoping guide identifies credential theft, token manipulation and exploitation of misconfigured delegation as common post-compromise techniques. For Critical processes and services, it highlights ransomware, destructive attacks and theft of high-value information.

The MITRE ATT&CK techniques mapped to Privileged environments actions include OS Credential Dumping, Steal or Forge Kerberos Tickets, Use Alternate Authentication Material, Account Manipulation and Disable or Modify Tools.

A generic sequence, which is not an example taken from ASD, shows how these techniques chain together:

1. An administrator signs in from an everyday laptop that has already been compromised.
2. The attacker captures credentials or authentication material from the administrative session.
3. The attacker uses that access to enter a management console.
4. The attacker uses the platform’s legitimate authority to distribute tools across managed systems.
5. Security controls are disabled through the same management capabilities the IT team uses.

Each change may resemble normal administration. What separates it is where the session originated, whether the access was authorised, which tools ran and what changed. The underlying failure is at the first step, where a credential able to manage many systems was used on a device exposed to email and web browsing. A management platform needs protection in proportion to the authority it holds, even with little business data.

ASD states that Privileged environments can provide adversaries with elevated access following an intrusion, while compromise or disruption of critical systems could have significant consequences for an organisation.

In enterprise IT, priority phase 2 follows Boundary services and Identity services. The earlier domains deal with access pathways and identities. This phase protects elevated authority and the systems most affected when it is misused.

PRO-12 Least privilege access expects administrative permissions to match the work an account is authorised to perform. It covers access reviews and restrictions on account and role management, along with minimum permissions for user, administrative and non-person accounts. Relevant practices include:

Excess rights often arrive during deployment and stay, as when a service account for one integration is given broad rights to get the installation working and keeps them. Unique credentials, secrets storage, legacy authentication and phishing-resistant MFA under PRO-13 are covered in the ASD Essentials Identity services guide.

Restrict Approved Administrative Tools

PRO-07 Trustworthy software also applies to administrative tooling. The action is to Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations.

The Indicators of Good Practice expect the approved toolset to be enforced and unauthorised execution blocked, including legitimate utilities that attackers commonly misuse. Location is part of the rule. A utility in legitimate use on a hardened administration workstation may still be a concern when it runs from an ordinary device or an unexpected server.

The OSCAL release connects this action with Essential Eight application control. Existing configurations may contribute evidence, but administrative tools and their execution locations need explicit consideration.

For Critical processes and services, ASD applies identification, protection and detection principles to the systems, dependencies and information supporting essential outcomes.

Restrict Lateral Movement

PRO-18 Network segmentation and segregation organises systems into zones according to business criticality and trust level. The actions limit lateral movement between, and within, network segments to explicitly approved pathways and services.

The Indicators of Good Practice look for technically enforced segmentation, deny-by-default controls and documented approval for permitted paths. A diagram or configured rule proves little if connectivity has never been tested. Movement within a segment counts as well. Controls that operate between segments but allow unrestricted movement within them are only partially effective. Consider a firewall that separates the user network from the server network while every server can still reach every other server.

Each approved pathway has a documented business reason and a periodic review, and is removed once it is no longer justified.

Inspect Inbound and Outbound Content

PRO-09 Content filtering addresses unauthorised transfer of sensitive information and exposure to malicious or untrusted content. The actions include inspecting outbound content across applicable egress paths, blocking connections to known malicious or untrusted destinations and inspecting inbound content from external or untrusted sources. The Indicators of Good Practice also expect outbound alerts to be triaged within defined timeframes.

Evidence for Privileged environments follows the administrative path: from an authorised device, through privilege activation, to the recorded change on the target system. Evidence for Critical processes and services connects each protected asset with its backup schedule, isolated repository and tested restoration. The collection methods are common practice rather than ASD requirements. The checks in the final column draw on ASD’s Indicators of Good Practice.

Check Evidence Across the Period

A screenshot shows how a control was configured at one moment. Evidence also needs to show how the control operated. Activation history shows whether roles stayed within the configured duration, and job and restore records show whether backup protection and recovery operated during the period.

A screenshot used as the only evidence identifies the platform, date and scope. ASD’s assessment process guide asks whether evidence is recent enough to reflect the current implementation. Evidence also accounts for approved exceptions and for controls that cover only some systems.

Close Common Gaps

ThreatDefence runs a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service.

Response actions remain within the authority approved by each customer, and case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing stay in Australia. ThreatDefence does not certify organisations; the assessor determines ASD Essentials ratings.

ITDR detections cover privileged role changes and risky sign-ins to administrative accounts. Network detection and response detects lateral movement towards critical systems and exfiltration in outbound traffic. Endpoint and DFIR capabilities detect credential dumping and living-off-the-land activity on servers.

The free ASD Essentials Navigator maps every principle and action by chapter and priority phase, and turns your ratings into a board summary. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.

Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance