Glossary

187 entries

IR hardening acsc-glossary

3-2-1 backups

Three copies, two media, one off-site. Immutable or offline beats a snapshot the ransomware also encrypted.

network dns

A record

Name to IPv4 address. The record people mean when they say the IP for the site.

network dns

AAAA record

Name to IPv6 address. Four As. Still forgotten in allow-lists that only list v4.

au-compliance frameworks acsc-glossary

ACSC

The Australian Cyber Security Centre, part of ASD. Alerts, advice, assistance. cyber.gov.au and 1300 CYBER1.

crypto concepts hardening

AES

NIST block cipher. 128-bit blocks, keys of 128, 192, or 256 bits. The algorithm is solved. Mode and key handling are the work.

crypto concepts hardening

AES-GCM

AES in Galois/Counter Mode. Confidentiality plus an integrity tag. This is the AES you actually want.

practitioner au-compliance privacy hardening

APP 11 — security of personal information

Privacy Act APP 11. Reasonable steps to protect personal information you hold, and to destroy or de-identify it when it is no longer needed. Technical and organisational measures (APP 11.3 from 11 Dec 2024). OAIC Chapter 11 + Guide to securing personal information.

practitioner au-compliance resilience supply-chain

APRA CPS 230: operational resilience, critical operations and the 24-hour, 72-hour and 20-day notices

CPS 230 is APRA's operational risk standard for banks, insurers, private health insurers and super trustees. It asks each entity to name its critical operations, set how long and how badly each may be disrupted, prove it can stay inside those limits through a severe disruption, and manage the suppliers it depends on. Here is what it requires, the three notices it creates, and how it sits beside CPS 234.

practitioner au-compliance IR

APRA CPS 234: the information security standard and its 72-hour and 10-day clocks

Banks, insurers, health funds and super trustees regulated by APRA must hold an information security capability that matches their threats, classify and protect information assets including those run by suppliers, have independent specialists test controls, and tell APRA within 72 hours of a material incident and within 10 business days of a material control weakness they cannot fix in time. Here is who is covered, what each obligation asks for, and how the clocks interact with other notifications.

au-compliance acsc-glossary

ASD

Australian Signals Directorate. Foreign signals intelligence and, through the ACSC, national cyber security.

frameworks au-compliance hardening acsc-glossary

ASD Essentials

ASD's framework series, launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. It covers enterprise IT, cloud and operational technology, and uses principles, actions and domains instead of maturity levels.

practitioner frameworks au-compliance network hardening soci

ASD Essentials for OT

The operational technology chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers OT alongside enterprise IT and cloud; neither reported the OT chapter's specific contents.

practitioner frameworks au-compliance cloud hardening

ASD Essentials for cloud

The cloud chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers cloud alongside enterprise IT and OT; neither reported the cloud chapter's specific contents.

practitioner frameworks au-compliance hardening

ASD Essentials for enterprise IT

The enterprise IT chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. Priority phases set an implementation order, not a rating (iTnews).

identity windows hardening

Active Directory

Microsoft's directory for domain authentication and authorisation. Own the directory and you usually own the estate.

concepts acsc-glossary

Advanced persistent threat (APT)

A campaign with a pattern, not a single file. Often patient, often aimed, sometimes state-linked. The persistence is the point.

malware acsc-glossary

Adware

Software that pushes ads. Sometimes you agreed. Sometimes the installer lied. Either way it is extra code on the box.

practitioner ai au-compliance frameworks

Agentic AI harnesses

ASD’s name for everything around the LLM — tools, memory, permissions. Prompt injection is not a model patch. Control what the harness can reach and do.

network hardening acsc-glossary

Air gap

Physically isolated. No cable, no Wi-Fi, no 'just this jump host' to the internet. Removable media is still a path if you let it be.

detection hardening acsc-glossary

Antivirus

Software that looks for known-bad and obvious malice, then tries to stop and clean it. Necessary. Not sufficient.

concepts hardening acsc-glossary

Attack surface

Everything a hostile party can reach: apps, IT, OT, services. Bigger surface, more raffle tickets.

identity acsc-glossary

Authentication

Prove who is knocking. Users, services, and devices all count. A username is a claim, not a proof.

identity acsc-glossary

Authorisation

What the proven identity is allowed to do. Authn is who. Authz is how far.

network dns concepts

Authoritative vs recursive DNS

One holds the zone. The other hunts for an answer and caches it. Mixing them up is how outages get misread.

practitioner au-compliance privacy ai

Automated decisions in your privacy policy (APP 1.7–1.9): what must be disclosed from 10 December 2026

From 10 December 2026, an organisation covered by the Privacy Act that lets software, including AI, make or materially shape decisions that significantly affect people must say so in its APP privacy policy. The three-part test, why human review does not get you out of it, what the policy has to list, and a six-week readiness checklist.

concepts acsc-glossary

Availability

Authorised users can actually use the system when the work needs it. Uptime theatre without backups is a bet.

network detection

BGP

Border Gateway Protocol. How networks exchange routes. A hijack shows up as an unexpected origin ASN or RPKI invalid.

IR hardening acsc-glossary

Backup

A copy stored somewhere else so you can restore after loss. If ransomware can reach it with the same credentials, it is not a backup.

network hardening identity

Bastion host

Jump host. The one box allowed to administer the rest. Harden it like it holds the keys.

detection IR network

Beaconing

Regular callbacks from a host that should be quieter. Interval plus jitter, not a perfect metronome.

malware network acsc-glossary

Botnet

A herd of hijacked devices taking orders. Spam, floods, miners, and stuffing logins all rent the same cattle.

practitioner hardening supply-chain

Browser extension supply chain

Chrome and Edge auto-update means a bought extension can turn hostile overnight. Inventory, least privilege, and remove what you do not need.

identity acsc-glossary

Brute force

Try all the guesses until one works. Rate limits, MFA, and long secrets make this expensive. Shame is free.

identity IR acsc-glossary

Business email compromise

Email fraud aimed at an organisation's money or data. Invoice redirection is the local dialect.

network dns hardening

CAA record

Which certificate authorities may issue for this domain. A DNS policy, not a certificate.

concepts acsc-glossary

CIA triad

Confidentiality, integrity, availability. Lose one and the system is already failing, even if the dashboard is green.

network concepts

CIDR

Classless Inter-Domain Routing. Addresses plus a prefix length. 203.0.113.0/24, not class C.

practitioner au-compliance soci

CIRMP (Critical Infrastructure Risk Management Program)

Part 2A of the SOCI Act. If you are a responsible entity for a covered critical infrastructure asset, you must have a written risk management program, keep it current, and report on it each year.

practitioner au-compliance IR supply-chain

CIRMP annual report

Board-approved CIRMP annual attestation under SOCI Part 2A/2AA. FY 2025–26 90-day window closed 28 September 2026 — if you missed it, treat late lodging as a compliance failure and close the evidence pack now.

practitioner vulnerability frameworks hardening

CISA KEV

Known Exploited Vulnerabilities catalogue plus BOD 26-04 deadlines. If it is on KEV and you are internet-facing, treat exposure as an incident trigger, not a backlog item.

network dns

CNAME

An alias: this name is that name. People sometimes say "C record"; they mean CNAME. There is no DNS type called a C record.

concepts vulnerability practitioner

CVE vs CVSS

CVE names a flaw. CVSS scores a severity model. EPSS estimates exploit likelihood. KEV records known exploitation. Your triage joins all four to exposure and asset value.

crypto concepts network

ChaCha20-Poly1305

The other modern AEAD. A stream cipher plus a tag. First-class in TLS 1.3, especially where AES hardware is missing.

practitioner IR identity hardening

ClickFix (fake CAPTCHA / Run-dialog paste)

Victim becomes the delivery path: fake Cloudflare/reCAPTCHA verify stages a command on the clipboard, then Win+R → Ctrl+V → Enter. No malicious download needed. Pair with third-party.com placeholder abuse and browser-extension supply chain.

detection IR network

Command and control

C2. How the operator talks to a compromised host after they are in. DNS, HTTPS, and traffic that looks like SaaS are common.

concepts acsc-glossary

Confidentiality

The right eyes only. Encryption, access control, and not leaving copies in the wrong tray.

identity acsc-glossary

Credential stuffing

Reuse leaked username/password pairs on other sites. Your 'unique' login was the same as the breach last year.

practitioner au-compliance hardening IR

Critical advisory intake

Getting a vendor critical into change control the same day — including record Patch Tuesday bundles. Owner, source list, exploited-first triage, evidence. ASD patching meets the NDB clock.

practitioner au-compliance IR

Cyber Incident Review Board: no-fault reviews of major incidents

Part 5 of the Cyber Security Act 2024 sets up an independent board that reviews significant cyber incidents after the response is over and publishes lessons and recommendations. It does not assign blame, but it can compel documents from private entities, so know how a review works before you are asked to take part.

network concepts

DHCP

Dynamic Host Configuration Protocol. Addresses and options handed out on the LAN so you do not type them.

identity hardening acsc-glossary

DMARC, DKIM, and SPF

Three DNS records. Receivers use them together so your domain is harder to wear.

network dns concepts

DNS

The internet's name system. Stub asks recursive; recursive walks to authoritative. Analysts live in the query log.

network dns

DNS over HTTPS and DNS over TLS

Encrypt DNS on the path. The resolver still sees the names. DoH can walk around enterprise DNS logging.

network dns detection

DNS spoofing

A fake DNS answer wins. Cache poisoning is the recursive version. Logging and resolver choice matter.

dns detection network

DNS tunnelling

Data moved through DNS queries and answers. Detection is odd volume, long labels, and unusual types.

network dns hardening

DNSSEC

Signatures on DNS data. Authenticity and integrity of answers. Not a VPN. Not HTTPS.

IR au-compliance acsc-glossary

Data breach

Data lost, peeked, changed, or leaked without authorisation. In Australia the NDB clock may also be running.

practitioner au-compliance IR

Data breach response plan

OAIC Part 2 (updated February 2025). Write the plan before the incident. Roles, containment, assessment, notify, and records — so the NDB clock is not where you invent process.

practitioner au-compliance IR

Data breaches involving more than one entity (NDB)

Your supplier was breached, but whose breach is it? Under the NDB scheme, every entity that holds the record shares the duty. One can assess and notify for all, but if nobody does, all of you are exposed. Agree who does what in the contract, before the incident.

detection hardening

Data loss prevention

DLP. Stop or log sensitive data leaving through the paths you actually instrumented. Policy plus telemetry, not a magic classifier.

identity hardening acsc-glossary

Default passwords

The password the vendor shipped. Fine for unboxing. Malpractice if it is still there at go-live.

hardening concepts acsc-glossary

Defence in depth

Stacked controls so one failure is not game over. Redundancy, not twelve dashboards of the same alert.

practitioner identity IR phishing

Device-code phishing

Victim completes a real Microsoft (or other IdP) device-code login for an attacker-controlled client. No fake password form required. Pair with AiTM and helpdesk-impersonation playbooks.

identity acsc-glossary

Dictionary attack

Guessing with a list of likely passwords instead of every possible string. 'Password1' is in the book. Yours should not be.

network IR acsc-glossary

Distributed denial of service (DDoS)

Many compromised machines, one target, a flood. Availability dies; the data may still be fine. That is not comfort during checkout.

dns detection IR

Domain generation algorithm

Malware derives many domains so blockers lag. Hunt high NXDOMAIN and labels that look generated, not a brand.

malware acsc-glossary

Drive-by download

Hostile code lands because you visited. No attachment required. The click was the URL.

detection IR

EDR

Endpoint detection and response. Behaviour plus the ability to isolate. An agent without an owner is inventory.

cloud concepts acsc-glossary

Encryption

Turn readable data into ciphertext with an algorithm and a key. The keys are the asset. A key taped to the data is theatre.

frameworks au-compliance hardening

Essential Eight

ASD's baseline of eight mitigation strategies. Maturity 0 to 3. The work is picking a level you can actually hold.

practitioner au-compliance hardening frameworks

Essential Eight evidence

How to show you actually did the Essential Eight. Scope, artefact, date, owner. Overall maturity is the weakest strategy, not the average.

detection IR network

Exfiltration

Data leaving. Bulk, slow, or stuffed into a protocol nobody is watching. DLP is a control; logs are how you know.

network dns detection

Fast flux

A hostname whose A or NS answers keep rotating. A resilience trick used by some botnets. Short TTL plus churn.

network hardening acsc-glossary

Firewall

A filter on the way in and out, driven by rules. Default allow is a very expensive switch.

network hardening concepts

HTTP Strict Transport Security

A header that tells the browser: this host is HTTPS only, for a while. Preload is a one-way door.

crypto concepts privacy cloud

Homomorphic encryption

Compute on ciphertext and get an encrypted result. The processor never sees the plaintext. Specialised, not a swap for AES.

detection acsc-glossary

Honeypot

A decoy built to attract hostile attention so you can study it. Not a substitute for patching production.

practitioner au-compliance supply-chain cloud

Hosting Certification Framework (HCF): which hosting Australian Government data needs, and what Strategic vs Assured means

The Commonwealth rule set for where sensitive government data may live. Sensitive data, whole-of-government systems and PROTECTED systems must sit on HCF-certified services; Strategic certification gives the most ownership and control protection, Assured less, Uncertified almost none. New registrations have been paused since 3 November 2025 while the framework is reformed.

IR detection

IR playbook

A written path for a class of incident. Roles, decisions, and evidence. Not a novel, and not a blank page at 2 a.m.

practitioner au-compliance frameworks cloud

IRAP

Infosec Registered Assessors Program. ASD-endorsed assessors test systems and cloud against the ISM. The report is evidence. Authorisation stays with you.

frameworks

ISO/IEC 27001

A management system standard. The certificate is proof you run the system, not that you are unbreachable.

identity acsc-glossary

Identity and access management

Join, move, leave. Who you are, how you prove it, what you may do, and how that ends when the job does.

identity acsc-glossary

Identity theft

Someone uses your personal details to commit fraud. The cleanup outlasts the incident ticket.

Incident response

Prepare, detect, contain, recover, learn. The first hour is decisions and evidence, not a slide template.

detection IR threat-intel

Indicator of compromise

An artefact that suggests a compromise: a hash, a name, an address, an email. Useful. Not a strategy.

practitioner frameworks au-compliance acsc-glossary

Information Security Manual (ISM)

ASD's control catalogue for Australian government systems — and the shared dialect for anyone who needs to speak the same language. Applicability, tailoring, and dated exceptions are the work.

identity IR acsc-glossary

Insider threat

Harm from someone who already had the keys — malice, negligence, or a very bad accident. The badge was valid.

concepts acsc-glossary

Integrity

The record is what authorised people made it. Quiet alteration is still a breach.

detection network acsc-glossary

Intrusion detection system (IDS)

Watches for unwanted activity and tells someone. Host or network. Alert without an owner is a screensaver.

detection network acsc-glossary

Intrusion prevention system (IPS)

IDS with a fist. Identifies unwanted traffic and can block it in the moment. Mis-tune it and you become the outage.

identity windows attack-path

Kerberoasting

Request a Kerberos service ticket for an SPN account, take it offline, and crack the password hash. Any authenticated user can try.

malware identity acsc-glossary

Keylogger

Software (or hardware) that records typing. Credentials and payments are the usual prize. This desk does not document how to build one.

detection IR identity

Lateral movement

After the first box, they walk. Credentials, remote admin, and trust you already granted.

identity hardening acsc-glossary

Least privilege

Only the access required, only for as long as required. Standing admin is standing blast radius.

practitioner au-compliance IR

Limited use: telling the National Cyber Security Coordinator

Part 4 of the Cyber Security Act 2024. What you voluntarily tell the National Cyber Security Coordinator about a cyber incident can be used to help you and to manage national risk, but not to investigate or penalise you for civil or regulatory breaches. It does not replace any report you are legally required to make.

detection IR

Living off the land

Use the admin tools already on the box. PowerShell, WMI, bash, cloud CLIs. No new malware required.

logging detection IR acsc-glossary

Logging

Time-stamped records of what happened. Collect what can answer a question. If it never gets queried, it is storage spend.

identity detection

MFA fatigue

Bombard the user's phone with push prompts until they tap Allow. MFA still on. Judgement off.

detection frameworks

MITRE ATT&CK

A knowledge base of adversary tactics and techniques. Use it to find detection gaps, not to decorate a slide.

network dns

MX record

Where mail for this domain should be handed. A hostname and a preference, not an IP in the MX itself.

malware acsc-glossary

Malvertising

The ad network is the delivery path. A 'legitimate' page, a hostile creative.

malware concepts acsc-glossary

Malware

Software that is there to harm you: steal, lock, spy, or hitch a ride. Virus, worm, Trojan, ransomware — different delivery, same job.

identity acsc-glossary

Multi-factor authentication

Two or more different factor types: know, have, or are. SMS counts. So does intercepting it. Aim for phishing-resistant.

crypto network identity hardening

Mutual TLS (mTLS)

TLS where both sides present a certificate. The server is not the only one who has to prove who they are.

practitioner au-compliance IR privacy

My Health Record data breaches: the separate notification duty under section 75

Healthcare providers, repository and portal operators and contracted service providers registered with My Health Record have a breach duty that sits beside the Privacy Act's Notifiable Data Breaches scheme. It starts on suspicion rather than a serious-harm assessment, it goes to both the Australian Digital Health Agency and the OAIC as soon as practicable, and only the Agency may tell patients. Here is what counts, who you tell, what to include and how it differs from an ordinary NDB.

practitioner au-compliance IR

NDB clock

Thirty days to assess a suspicion; notify as soon as practicable once eligible. AGD Privacy Reform Exposure Draft consultation closed 18 Sep 2026 — proposed 72-hour OAIC notify clock is still not law.

practitioner au-compliance IR privacy

NDB serious harm test

The Privacy Act gate for an eligible data breach. Reasonable person, more probable than not, s 26WG factors, then remedial action.

practitioner au-compliance IR privacy

NDB statement contents

What the Privacy Act requires in an eligible-data-breach statement to the OAIC and to individuals — and how to file it on the OAIC online form.

frameworks

NIST Cybersecurity Framework

Identify, Protect, Detect, Respond, Recover — plus Govern in 2.0. A common language, not a certification.

network dns

NS record

Which nameservers are authoritative for this zone. Delegation lives here.

practitioner au-compliance IR

NSW mandatory notification of data breach scheme (MNDB)

Part 6A of the NSW PPIP Act. Contain at once, assess within 30 calendar days from when any staff member suspects, tell the Privacy Commissioner immediately on the approved form, notify people as soon as practicable, and keep a register and a public policy. In force since 28 November 2023.

identity hardening acsc-glossary

Need-to-know

Access only to the data the role actually requires. Broad file shares are a rumour mill with NTFS.

network detection

NetFlow

Who talked to whom, when, how much. Metadata, not payload. Cheap enough to keep.

network concepts

Network address translation

NAT. Rewrite addresses, and usually ports, at a boundary. Many inside, one outside. Not a firewall policy by itself.

detection network IR

Network detection and response

NDR. Watch the wire or the flow for threat behaviour, not just known signatures. Complements EDR. Does not replace it.

network hardening acsc-glossary

Network segmentation

Cut the network into smaller pieces. Segregation is the rule set between them. Flat is a gift.

network concepts

OSI model

Seven layers, Physical to Application. A naming map. The internet you operate is TCP/IP.

identity

OpenID Connect

OIDC. Identity layer on OAuth 2.0. ID tokens for who the user is. Access tokens for APIs.

practitioner au-compliance frameworks hardening

PSPF Policy 14 — Cyber Security Strategies

PSPF Release 2025 Policy 14 is the Commonwealth cyber floor (Essential Eight to ML2 for NCEs). Direction 002-2026 adds a hard legacy-tech stocktake deadline of 31 March 2027 — and SoGS measures by 31 December 2026.

network dns

PTR record

Reverse DNS. Address back to a name, under in-addr.arpa or ip6.arpa.

network detection IR

Packet capture

The packets, on disk. Ground truth for a window of time. Heavy, precise, and easy to collect too late.

dns detection threat-intel

Passive DNS

Historical DNS answers observed by sensors. Pivot on an IOC. Not a replacement for a live lookup.

identity acsc-glossary

Passphrase

A string of words used as a secret. Longer beats clever. Unique beats reused.

identity acsc-glossary

Password

A character string used as a secret. Reuse is how one breach becomes twelve logins.

identity acsc-glossary hardening

Password manager

Generates unique secrets and stores them in a vault. One strong unlock. Not a spreadsheet called passwords_final.

identity acsc-glossary

Password spraying

A few common passwords, a lot of accounts. Misses lockout, hits whoever used SeasonYear!.

vulnerability hardening acsc-glossary

Patch

A vendor fix for a hole or a defect. Installing it is patching. Explaining why you did not is an exception with an expiry date.

detection IR

Persistence

Still there after reboot, password change, or the first cleanup. Scheduled tasks, tokens, and legitimate-looking remote access.

identity acsc-glossary

Pharming

Traffic sent to a fake site by tampering, not by a clicked lure. The URL bar can still lie if DNS or the host file does.

identity concepts acsc-glossary

Phishing

A bulk lure: fake message, urgency, a credential or a hostile file. Training helps. Phishing-resistant MFA and mail authentication help more.

practitioner au-compliance IR

Privacy Act and OAIC

Privacy Act 1988, APPs, and the OAIC. Who is an APP entity, the NDB three-limb test, what the notice must say, and which desk pages hold the clocks.

practitioner au-compliance IR privacy

Privacy Act penalties after a breach: civil penalties, infringement notices and compliance notices

The OAIC now has three levels of enforcement for Privacy Act failures: court-ordered civil penalties for serious or repeated interferences, on-the-spot infringement notices for specific procedural breaches, and compliance notices that tell you what to fix. What triggers each one, what it can cost, and what to check before the OAIC does.

identity hardening

Privileged access management

PAM the program: vault the admin passwords, broker the sessions, record them. Not the same as Linux PAM, the Unix login modules. People say both.

identity hardening acsc-glossary

Privileged user

Someone who can change or sidestep security controls. Developers who can bypass a guardrail count.

practitioner ai hardening frameworks

Prompt injection

Instructions and data share one channel. ASD and NCSC: no fully reliable model-level fix. Put the controls in the harness.

practitioner au-compliance frameworks

Protective Security Policy Framework

AGD protective security policy for NCEs. Four domains, PSPF Release 2025 Policy 14 cyber floor, Essential Eight to Maturity Level 2 since July 2022.

practitioner au-compliance IR

Queensland mandatory data breach scheme (MNDB)

Chapter 3A of Queensland's Information Privacy Act 2009. Contain straight away, assess within 30 days, notify the Information Commissioner and people as soon as practicable, and keep a register and a published policy. Councils have been in since 1 July 2026.

IR malware acsc-glossary

Ransomware

Hostile software that locks your data or systems and bills you to get them back. Often also steals a copy first. Restore beats negotiation as a control.

practitioner au-compliance IR

Ransomware payment reporting

Cyber Security Act 2024 Part 3. Pay (or learn someone paid for you) and the clock is 72 hours to ASD's form. Home Affairs watches compliance; the report has use limits.

network identity acsc-glossary

Remote access

Coming in from outside the organisation's network, usually through a gateway. Treat it as privileged even when the user is not.

malware acsc-glossary

Rootkit

Tooling that grabs high privilege and then hides. If you only look where it wants you to look, you will miss it.

identity

SAML

Security Assertion Markup Language. XML assertions from an identity provider so a service can skip local passwords.

practitioner hardening supply-chain

SBOM and build-pipeline checklist

Software bill of materials plus the CI controls that make it useful. Inventory what you ship, who can publish, and how fast you can patch a dependency.

detection logging

SIEM

Security information and event management: collect, normalise, correlate, alert. Useless if nobody owns the queue.

network dns

SOA record

Start of authority. One per zone. Serial, timers, and who is supposed to be in charge.

detection IR

SOAR

Orchestration and response. Automate the boring. Keep a person on steps that isolate a host or disable an account.

practitioner au-compliance frameworks

SOCI Act obligations

Security of Critical Infrastructure Act 2018, mapped for practitioners. Eleven sectors, three positive security obligations, extra duties for Systems of National Significance, the 2024 ERP Act changes, and a protected-information offence that catches responsible entities too.

practitioner au-compliance IR

SOCI cyber incident clock

Part 2B of the SOCI Act. Significant impact on availability: 12 hours. Other cyber incidents with a relevant impact: 72 hours. The clock starts when the responsible entity becomes aware, not when root cause is finished.

network dns

SRV record

Service location: this protocol on this domain lives at that host and port.

hardening detection acsc-glossary

Sandbox

A paddock for untrusted code. If it explodes, the paddock takes it. Production is not a paddock.

practitioner hardening network au-compliance

Securing edge devices: ASD's seven mitigation strategies for firewalls, VPNs and routers

Firewalls, VPN gateways and edge routers face the internet, are hard to monitor and can reach your internal network, so they are a favourite first foothold. ASD's practitioner guidance gives seven vendor-neutral strategies. In short: know what sits at the edge, buy secure products, patch fast but check for compromise first, use strong authentication, switch off what you don't use, keep management interfaces off the internet, and get logs off the box.

detection IR

Security operations centre

People, detections, and a queue. A room full of screens is optional. Ownership of after-hours is not.

practitioner au-compliance hardening

Smart device security standard: what makers and sellers must do

Since 4 March 2026, most internet-connected consumer devices made for the Australian market must ship without guessable shared passwords, with a published way to report security bugs, and with a stated end date for security updates. Suppliers must also hand over a statement of compliance. Here is who is caught, what the three rules mean in practice, and what to check before you stock or buy a device.

identity acsc-glossary

Smishing (SMS scam)

Phishing that arrives as a text. Postage, ATO, missed-parcel energy. The link is the problem.

identity concepts acsc-glossary

Social engineering

Manipulate a person, skip the software flaw. Phishing, vishing, BEC, and the helpdesk reset are all this family.

concepts acsc-glossary

Spam

Unsolicited bulk messages, usually ads. Not all spam is phishing. Plenty of phishing rides in the same tray.

identity acsc-glossary

Spear phishing

Phishing with a name on it. Aimed at a person or a small group, usually with enough context to look like Tuesday.

identity network acsc-glossary

Spoofing

A message or identity dressed as a trusted source. Email, SMS, caller ID, and websites all do this cheaply.

malware acsc-glossary

Spyware

Software that watches what you do without a real yes. Sometimes bundled. Sometimes smuggled.

practitioner au-compliance soci

Systems of National Significance (SoNS)

A privately declared subset of critical infrastructure assets. SoNS can attract Enhanced Cyber Security Obligations on top of the ordinary SOCI duties.

network dns concepts

TTL

Time to live. How long a resolver may cache this answer. Seconds, not a promise the world forgets on cue.

network dns

TXT record

Free-form text on a name. SPF, DKIM, and DMARC live here. So does a lot of vendor noise.

detection IR threat-intel

Tactics, techniques, and procedures

How they work, not just which IP they used today. ATT&CK is the common catalogue.

practitioner au-compliance privacy

The statutory privacy tort (Privacy Act Schedule 2): what security and incident teams need to know

Since 10 June 2025, individuals in Australia can sue for a serious invasion of privacy under Schedule 2 of the Privacy Act 1988. The five elements, why insider snooping and covert recording are the security cases that matter, the exemptions for reporting to police and ASD, the time limits and damages cap, and what to change in your logging and incident playbooks.

practitioner au-compliance hardening

Third-party and supply chain

You can outsource the work. You cannot outsource the risk. Cloud shared responsibility, IRAP evidence, ISM procurement — and the vendor update channel that pushes your next plugin build.

detection IR threat-intel

Threat hunting

Assume they are already in. Ask a question of your logs. Not a dashboard tour.

detection concepts

Threat intelligence

Context that changes a decision. IoCs expire. TTPs last. A feed you never action is a newsletter.

practitioner frameworks au-compliance hardening

Transitioning from the Essential Eight to ASD Essentials

What iTnews and techpartner.news report about moving from the Essential Eight to ASD Essentials: existing work remains relevant, every strategy maps to at least one principle, but maturity ratings do not automatically convert.

network concepts crypto acsc-glossary

Transport Layer Security (TLS)

The S in HTTPS. Stops eavesdropping, tampering, and forgery on the wire. TLS 1.3 is the current protocol.

malware acsc-glossary

Trojan

Hostile software dressed as something you meant to run. The gift is the rest of the program.

identity acsc-glossary

Two-factor authentication (2FA)

MFA with exactly two proofs. Better than a password. Still not the ceiling.

identity hardening

User Account Control (UAC)

Windows consent prompt before a process takes a full admin token. A speed bump, not a wall.

network concepts

VLAN

Virtual LAN. A broadcast domain with a tag. Segmentation only if the rest of the design agrees.

network acsc-glossary

Virtual private network (VPN)

A tunnel plus some discipline. Encryption is common. A full-trust badge on the far side is optional and usually a mistake.

malware acsc-glossary

Virus

Hostile software that hitchhikes: it attaches to other programs or copies itself across systems. Needs a host. Still not a metaphor for every pop-up.

identity acsc-glossary

Vishing

Social engineering on a phone call. They are not Microsoft, the ATO, or your bank's fraud team.

vulnerability concepts acsc-glossary

Vulnerability

A weakness in requirements, design, build, or operations that can be tripped or abused and break the security policy.

vulnerability hardening acsc-glossary

Vulnerability management

Find, rank, fix, check. Known-exploited and exposure beat a 400-page scanner PDF.

practitioner au-compliance IR

WA notifiable information breach scheme (PRIS Act Part 2 Division 6): starts 1 January 2027

Western Australia's public-sector breach scheme under the Privacy and Responsible Information Sharing Act 2024. From 1 January 2027: contain immediately, assess and write a report within 30 days of forming a reasonable suspicion, then tell the Information Commissioner and affected people as soon as practicable. Policy, register and annual-report duties come with it.

malware concepts acsc-glossary

Watering hole

Poison a site your targets already visit. The prey comes to the water. Patching and isolation still apply.

network hardening detection

Web application firewall

WAF. A reverse proxy that tries to stop common web attacks before the app. Rules, not a rewrite of the application.

identity acsc-glossary

Whaling

Spear phishing aimed at senior executives. The invoice looks like their job. The bank details do not.

practitioner network crypto hardening supply-chain IR

When a certificate authority is distrusted: trust-store response runbook

What to do when a certificate authority's keys are compromised or a root program stops trusting it. Browsers fix themselves within hours; the long tail is everything else that carries its own copy of the trust store, plus any of your own certificates that chain to the distrusted CA.

practitioner identity cloud supply-chain IR

When a platform holding your secrets is breached: secrets rotation runbook

Hosting platforms, CI/CD services and AI gateways keep your API keys, database passwords and registry tokens. When one of them reports a breach, assume every secret it held is exposed, and remember that a secret is only dead once the service that issued it has revoked it.

malware acsc-glossary