Module 4 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: multi-factor authentication and restricting administrative privileges explained for business owners, why ASD's Maturity Level Two attackers get around weak MFA with phishing and social engineering while Level Three attackers steal authentication token values to get around stronger methods, why phishing-resistant options such as passkeys and security keys behave differently, why admin accounts should never be used for email, and what evidence an insurer or assessor will ask to see.
Who Gets In, and What They Can Do
Two controls, one question
Two of the eight controls deal with people rather than software. Multi-factor authentication, and restricting administrative privileges. They answer the two questions every attacker has to solve: how do I get in, and once I am in, what can I do?
Patching, from the last module, is about closing holes in code. These two are about the front door and the keyring. Almost every serious incident we see in Perth businesses involves at least one of them, usually in the same order: a password gets stolen, the second factor was weak or missing, and the account that got taken over turned out to have far more power than anyone realised.
Proving it is really you with something beyond a password. It exists because passwords leak constantly, get reused across sites, and get typed into convincing fake login pages by sensible people on busy mornings. This is the control that keeps a stolen password from being enough.
Making sure the accounts that can change everything are few, deliberate, and not used for everyday work. This is the control that decides whether one compromised login is an annoying afternoon or the end of your business as it currently exists.
Good multi-factor authentication on an account that can do anything is still a single point of failure. Tight admin controls on accounts with no second factor are a locked cabinet in an unlocked building. ASD lists them separately because they are different jobs, but in practice you cannot get much value from one without the other.
"We have MFA turned on" is one of the most common answers to a security questionnaire, and it is where a lot of businesses get a surprise. The maturity model does not just ask whether multi-factor authentication exists. As you climb the levels, it starts caring a great deal about which kind you use.
ASD describes what the attacker is doing at each level, and the description is the clearest explanation of why. At Maturity Level Two, attackers actively go after credentials with phishing, and they use both technical and social engineering to get around weak multi-factor authentication. At Maturity Level Three, they get around stronger multi-factor authentication too, by stealing authentication token values rather than by fooling anyone.
Codes by SMS or email
Better than nothing, and for a business currently running on passwords alone it is a genuine improvement worth making today. It is also the method attackers have the most practice at getting around.
- A convincing fake login page can ask for the code as well as the password
- Phone numbers can be moved to another SIM by someone patient and persuasive
- The code works no matter which site is asking for it, and that is the core weakness
Authenticator apps, especially with number matching
A code or an approval prompt generated in an app on the phone. Meaningfully stronger than SMS, and number matching helps a lot because it stops people approving a prompt out of reflex while making a coffee.
- No SIM to steal and no message to intercept
- Number matching turns a mindless tap into a deliberate choice
- Still vulnerable if someone is tricked into approving at the exact moment an attacker is signing in
Phishing-resistant methods: passkeys and security keys
These bind the sign-in to the real website, cryptographically. If the site is a convincing fake, the key simply will not play along, because it can tell it is not the site it was registered with. The user does not have to spot anything.
- There is no code for anyone to read out, forward, or be talked into sharing
- Works even when the person is tired, rushed, or genuinely fooled by the page
- This is where you want your admin accounts, at minimum
Anything you can type or read aloud can be relayed. An attacker stands up a page that looks exactly like your sign-in, passes your password and your code straight through to the real site in real time, and they are in while you are still looking at a spinning wheel. Nobody was careless. The method simply does not check who is asking. Phishing-resistant methods do check, and that single difference is why ASD treats them differently.
This module is about what the framework asks for and why. If you want the step by step for actually turning it on, our Microsoft 365 multi-factor authentication module walks through the settings, the rollout, and the awkward conversations about people who do not want an app on their personal phone. Exactly which methods count at which maturity level is set out in the maturity model, so check the current version for the level you are being assessed against.
Restricting administrative privileges is the control people underestimate most, and it is the one that decides how bad your worst day gets. An admin account is not just a bigger account. It is the account that can turn off the other controls.
ASD spells this out in the maturity model. At Maturity Level Two, attackers may destroy all data, including backups, that a compromised privileged account can reach. Not the data they can find. The data that account had rights to, which in most small businesses is everything, because nobody ever narrowed it down.
At Maturity Level Three the behaviour goes further again. Attackers go looking specifically for privileged credentials and password hashes, use them to move from one system to another across the network, and then cover their tracks so nobody can work out what happened or when it started.
- Separate accounts. One for everyday work, a different one for admin tasks, never the same login
- No email and no web browsing from an admin account, because that is how the account gets phished
- Admin access granted for a reason and a period, then handed back, rather than held permanently
- A written list of who has admin rights, reviewed on a schedule and after anyone leaves
- Phishing-resistant multi-factor authentication on every one of those accounts
- Local administrator rights removed from ordinary staff laptops, so malware inherits nothing useful
- Everyone is a local admin on their own laptop, because it was easier during setup
- The owner's daily email account is also a global admin, and has been for years
- The former IT provider still has an account nobody has looked at since the handover
- One shared admin login, with the password in a spreadsheet called Passwords
- A service account with full rights, created for a project that finished in 2022
It sounds fussy until you picture it. Email and the web are how nearly everything arrives. If the account reading a dodgy attachment is also the account that can reset passwords, change security settings and reach the backups, then one bad click hands over the entire business at once. Split the account and that same click costs you one ordinary user's access. Same mistake, completely different week.
If your business runs on Microsoft 365, our module on protecting admin accounts covers the practical side: separate admin accounts, break glass accounts, and getting standing global admin rights down to a number you can count on one hand.
These two controls are where questionnaires get specific, because both are easy to verify. Whoever is asking, an insurer, a customer's security team, or a tender panel, will want something from the system rather than a sentence from you.
Not a policy saying it is required. A list, from the system itself, showing every account and what is actually registered against it. The gap between the policy and the report is where the finding lives.
Who holds admin rights, why, and when it was last reviewed. Expect a question about accounts belonging to people who no longer work there, and about your IT provider's access too.
One of the quickest things to check and one of the most commonly failed, usually because it was convenient when the laptops were first set up and nobody revisited it.
Dates, names, and what changed as a result. A review that happens every twelve months and is written down beats a perfect intention that has never once been carried out.
Find out how many accounts in your business currently hold full administrative rights, and how many of those are also somebody's everyday email login. Most owners are surprised by the answer, and it is a question your IT provider can answer in about ten minutes. Everything else in this module follows from knowing that number.
Worth remembering as you go: you cannot cherry-pick. ASD expects the same maturity level across all eight controls before you climb to a higher one, so excellent multi-factor authentication does not buy you credit against weak patching. It all moves together, which is annoying and also fair.
- cyber.gov.au: Essential Eight explained, Australian Signals Directorate
- cyber.gov.au: Essential Eight maturity model, including the tradecraft described at each level
Current at the time of writing (August 2026). ASD updates the maturity model regularly, and the exact requirements for each control at each level sit in its appendices, so read them there for the level you are being assessed against.
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. ASD describes Maturity Level Two attackers as targeting credentials with phishing and using technical and social engineering to get around weak multi-factor authentication. What does that mean for SMS codes?
2. What makes a method 'phishing-resistant', such as a passkey or a security key?
3. According to ASD's description of Maturity Level Two, what can happen to data reachable by a compromised privileged account?
4. Why should an administrative account never be used for email and web browsing?
5. Your multi-factor authentication is excellent but your patching is behind. What does that mean for your maturity level?