Glossary

48 entries

IR hardening acsc-glossary

3-2-1 backups

Three copies, two media, one off-site. Immutable or offline beats a snapshot the ransomware also encrypted.

crypto concepts hardening

AES

NIST block cipher. 128-bit blocks, keys of 128, 192, or 256 bits. The algorithm is solved. Mode and key handling are the work.

crypto concepts hardening

AES-GCM

AES in Galois/Counter Mode. Confidentiality plus an integrity tag. This is the AES you actually want.

practitioner au-compliance privacy hardening

APP 11 — security of personal information

Privacy Act APP 11. Reasonable steps to protect personal information you hold, and to destroy or de-identify it when it is no longer needed. Technical and organisational measures (APP 11.3 from 11 Dec 2024). OAIC Chapter 11 + Guide to securing personal information.

frameworks au-compliance hardening acsc-glossary

ASD Essentials

ASD's framework series, launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. It covers enterprise IT, cloud and operational technology, and uses principles, actions and domains instead of maturity levels.

practitioner frameworks au-compliance network hardening soci

ASD Essentials for OT

The operational technology chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers OT alongside enterprise IT and cloud; neither reported the OT chapter's specific contents.

practitioner frameworks au-compliance cloud hardening

ASD Essentials for cloud

The cloud chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers cloud alongside enterprise IT and OT; neither reported the cloud chapter's specific contents.

practitioner frameworks au-compliance hardening

ASD Essentials for enterprise IT

The enterprise IT chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. Priority phases set an implementation order, not a rating (iTnews).

identity windows hardening

Active Directory

Microsoft's directory for domain authentication and authorisation. Own the directory and you usually own the estate.

network hardening acsc-glossary

Air gap

Physically isolated. No cable, no Wi-Fi, no 'just this jump host' to the internet. Removable media is still a path if you let it be.

detection hardening acsc-glossary

Antivirus

Software that looks for known-bad and obvious malice, then tries to stop and clean it. Necessary. Not sufficient.

concepts hardening acsc-glossary

Attack surface

Everything a hostile party can reach: apps, IT, OT, services. Bigger surface, more raffle tickets.

IR hardening acsc-glossary

Backup

A copy stored somewhere else so you can restore after loss. If ransomware can reach it with the same credentials, it is not a backup.

network hardening identity

Bastion host

Jump host. The one box allowed to administer the rest. Harden it like it holds the keys.

practitioner hardening supply-chain

Browser extension supply chain

Chrome and Edge auto-update means a bought extension can turn hostile overnight. Inventory, least privilege, and remove what you do not need.

network dns hardening

CAA record

Which certificate authorities may issue for this domain. A DNS policy, not a certificate.

practitioner vulnerability frameworks hardening

CISA KEV

Known Exploited Vulnerabilities catalogue plus BOD 26-04 deadlines. If it is on KEV and you are internet-facing, treat exposure as an incident trigger, not a backlog item.

practitioner IR identity hardening

ClickFix (fake CAPTCHA / Run-dialog paste)

Victim becomes the delivery path: fake Cloudflare/reCAPTCHA verify stages a command on the clipboard, then Win+R → Ctrl+V → Enter. No malicious download needed. Pair with third-party.com placeholder abuse and browser-extension supply chain.

practitioner au-compliance hardening IR

Critical advisory intake

Getting a vendor critical into change control the same day — including record Patch Tuesday bundles. Owner, source list, exploited-first triage, evidence. ASD patching meets the NDB clock.

identity hardening acsc-glossary

DMARC, DKIM, and SPF

Three DNS records. Receivers use them together so your domain is harder to wear.

network dns hardening

DNSSEC

Signatures on DNS data. Authenticity and integrity of answers. Not a VPN. Not HTTPS.

detection hardening

Data loss prevention

DLP. Stop or log sensitive data leaving through the paths you actually instrumented. Policy plus telemetry, not a magic classifier.

identity hardening acsc-glossary

Default passwords

The password the vendor shipped. Fine for unboxing. Malpractice if it is still there at go-live.

hardening concepts acsc-glossary

Defence in depth

Stacked controls so one failure is not game over. Redundancy, not twelve dashboards of the same alert.

frameworks au-compliance hardening

Essential Eight

ASD's baseline of eight mitigation strategies. Maturity 0 to 3. The work is picking a level you can actually hold.

practitioner au-compliance hardening frameworks

Essential Eight evidence

How to show you actually did the Essential Eight. Scope, artefact, date, owner. Overall maturity is the weakest strategy, not the average.

network hardening acsc-glossary

Firewall

A filter on the way in and out, driven by rules. Default allow is a very expensive switch.

network hardening concepts

HTTP Strict Transport Security

A header that tells the browser: this host is HTTPS only, for a while. Preload is a one-way door.

identity hardening acsc-glossary

Least privilege

Only the access required, only for as long as required. Standing admin is standing blast radius.

crypto network identity hardening

Mutual TLS (mTLS)

TLS where both sides present a certificate. The server is not the only one who has to prove who they are.

identity hardening acsc-glossary

Need-to-know

Access only to the data the role actually requires. Broad file shares are a rumour mill with NTFS.

network hardening acsc-glossary

Network segmentation

Cut the network into smaller pieces. Segregation is the rule set between them. Flat is a gift.

practitioner au-compliance frameworks hardening

PSPF Policy 14 — Cyber Security Strategies

PSPF Release 2025 Policy 14 is the Commonwealth cyber floor (Essential Eight to ML2 for NCEs). Direction 002-2026 adds a hard legacy-tech stocktake deadline of 31 March 2027 — and SoGS measures by 31 December 2026.

identity acsc-glossary hardening

Password manager

Generates unique secrets and stores them in a vault. One strong unlock. Not a spreadsheet called passwords_final.

vulnerability hardening acsc-glossary

Patch

A vendor fix for a hole or a defect. Installing it is patching. Explaining why you did not is an exception with an expiry date.

identity hardening

Privileged access management

PAM the program: vault the admin passwords, broker the sessions, record them. Not the same as Linux PAM, the Unix login modules. People say both.

identity hardening acsc-glossary

Privileged user

Someone who can change or sidestep security controls. Developers who can bypass a guardrail count.

practitioner ai hardening frameworks

Prompt injection

Instructions and data share one channel. ASD and NCSC: no fully reliable model-level fix. Put the controls in the harness.

practitioner hardening supply-chain

SBOM and build-pipeline checklist

Software bill of materials plus the CI controls that make it useful. Inventory what you ship, who can publish, and how fast you can patch a dependency.

hardening detection acsc-glossary

Sandbox

A paddock for untrusted code. If it explodes, the paddock takes it. Production is not a paddock.

practitioner hardening network au-compliance

Securing edge devices: ASD's seven mitigation strategies for firewalls, VPNs and routers

Firewalls, VPN gateways and edge routers face the internet, are hard to monitor and can reach your internal network, so they are a favourite first foothold. ASD's practitioner guidance gives seven vendor-neutral strategies. In short: know what sits at the edge, buy secure products, patch fast but check for compromise first, use strong authentication, switch off what you don't use, keep management interfaces off the internet, and get logs off the box.

practitioner au-compliance hardening

Smart device security standard: what makers and sellers must do

Since 4 March 2026, most internet-connected consumer devices made for the Australian market must ship without guessable shared passwords, with a published way to report security bugs, and with a stated end date for security updates. Suppliers must also hand over a statement of compliance. Here is who is caught, what the three rules mean in practice, and what to check before you stock or buy a device.

practitioner au-compliance hardening

Third-party and supply chain

You can outsource the work. You cannot outsource the risk. Cloud shared responsibility, IRAP evidence, ISM procurement — and the vendor update channel that pushes your next plugin build.

practitioner frameworks au-compliance hardening

Transitioning from the Essential Eight to ASD Essentials

What iTnews and techpartner.news report about moving from the Essential Eight to ASD Essentials: existing work remains relevant, every strategy maps to at least one principle, but maturity ratings do not automatically convert.

identity hardening

User Account Control (UAC)

Windows consent prompt before a process takes a full admin token. A speed bump, not a wall.

vulnerability hardening acsc-glossary

Vulnerability management

Find, rank, fix, check. Known-exploited and exposure beat a 400-page scanner PDF.

network hardening detection

Web application firewall

WAF. A reverse proxy that tries to stop common web attacks before the app. Rules, not a rewrite of the application.

practitioner network crypto hardening supply-chain IR

When a certificate authority is distrusted: trust-store response runbook

What to do when a certificate authority's keys are compromised or a root program stops trusting it. Browsers fix themselves within hours; the long tail is everything else that carries its own copy of the trust store, plus any of your own certificates that chain to the distrusted CA.

Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary