Top 35 Mitigation Strategies
At least 85% of the targeted cyber intrusions that the Defence Signals Directorate (DSD) responded to in 2010 could have been prevented by following the first four mitigation strategies listed in our Top 35 Mitigation Strategies:
- patch applications such as PDF readers, Microsoft Office, Java, Flash Player and web browsers
- patch operating system vulnerabilities
- minimise the number of users with administrative privileges
- use application whitelisting to help prevent malicious software and other unapproved programs from running.
The Top 35 Mitigation Strategies are ranked in order of overall effectiveness. Rankings are based on DSD’s analysis of reported security incidents and vulnerabilities detected by DSD in testing the security of Australian Government networks.
Additional information
Differences between the 2010 and 2011 versions
- Differences between the 2010 and 2011 versions of the Top 35 Mitigation Strategies (HTML)
- Differences between the 2010 and 2011 versions of the Top 35 Mitigation Strategies (295K PDF)
Further advice
- Top 4 Mitigation Strategies to Protect Your ICT System (PDF)
- Implementing DSD's Top 4 in a Windows Environment (1.8Mb PDF)
- Assessing Security Vulnerabilities and Patches (HTML)
- Assessing Security Vulnerabilities and Patches (750K PDF)
- Technical Information about the Top 35 Mitigation Strategies (HTML)
- Technical Information about the Top 35 Mitigation Strategies (300K PDF)
Examples
- Example Implementation of Sanitising PDF Email Attachments to Disable Malicious Content (external link)
- Example Implementation of Web Domain Whitelisting (external link)
Contacts
- For Australian government agencies.
- For Australian businesses and other private sector organisations.