identity acsc-glossary
Authentication
Prove who is knocking. Users, services, and devices all count. A username is a claim, not a proof.
Short, tagged, searchable.
Terms, frameworks, and concepts used on an Australian defensive desk. No exploit steps.
AllIRacsc-glossaryau-compliancecloudconceptsdetectionframeworkshardeningidentityloggingmalwarenetworkvulnerability
31 entries
identity acsc-glossary
Authorisation
What the proven identity is allowed to do. Authn is who. Authz is how far.
identity acsc-glossary
Brute force
Try all the guesses until one works. Rate limits, MFA, and long secrets make this expensive. Shame is free.
identity IR acsc-glossary
Business email compromise
Email fraud aimed at an organisation's money or data. Invoice redirection is the local dialect.
identity acsc-glossary
Credential stuffing
Reuse leaked username/password pairs on other sites. Your 'unique' login was the same as the breach last year.
identity hardening acsc-glossary
DMARC, DKIM, and SPF
Mail authentication so others cannot cheaply wear your domain. Publish records. Then set a policy that actually rejects.
identity hardening acsc-glossary
Default passwords
The password the vendor shipped. Fine for unboxing. Malpractice if it is still there at go-live.
identity acsc-glossary
Dictionary attack
Guessing with a list of likely passwords instead of every possible string. 'Password1' is in the book. Yours should not be.
identity acsc-glossary
Identity and access management
Join, move, leave. Who you are, how you prove it, what you may do, and how that ends when the job does.
identity acsc-glossary
Identity theft
Someone uses your personal details to commit fraud. The cleanup outlasts the incident ticket.
identity IR acsc-glossary
Insider threat
Harm from someone who already had the keys — malice, negligence, or a very bad accident. The badge was valid.
malware identity acsc-glossary
Keylogger
Software (or hardware) that records typing. Credentials and payments are the usual prize. This desk does not document how to build one.
identity hardening acsc-glossary
Least privilege
Only the access required, only for as long as required. Standing admin is standing blast radius.
identity acsc-glossary
Multi-factor authentication
Two or more different factor types: know, have, or are. SMS counts. So does intercepting it. Aim for phishing-resistant.
identity hardening acsc-glossary
Need-to-know
Access only to the data the role actually requires. Broad file shares are a rumour mill with NTFS.
identity acsc-glossary
Passphrase
A string of words used as a secret. Longer beats clever. Unique beats reused.
identity acsc-glossary
Password
A character string used as a secret. Reuse is how one breach becomes twelve logins.
identity acsc-glossary hardening
Password manager
Generates unique secrets and stores them in a vault. One strong unlock. Not a spreadsheet called passwords_final.
identity acsc-glossary
Password spraying
A few common passwords, a lot of accounts. Misses lockout, hits whoever used SeasonYear!.
identity acsc-glossary
Pharming
Traffic sent to a fake site by tampering, not by a clicked lure. The URL bar can still lie if DNS or the host file does.
identity concepts acsc-glossary
Phishing
A bulk lure: fake message, urgency, a credential or a hostile file. Training helps. Phishing-resistant MFA and mail authentication help more.
identity hardening acsc-glossary
Privileged user
Someone who can change or sidestep security controls. Developers who can bypass a guardrail count.
network identity acsc-glossary
Remote access
Coming in from outside the organisation's network, usually through a gateway. Treat it as privileged even when the user is not.
identity acsc-glossary
Smishing (SMS scam)
Phishing that arrives as a text. Postage, ATO, missed-parcel energy. The link is the problem.
identity concepts acsc-glossary
Social engineering
Manipulate a person, skip the software flaw. Phishing, vishing, BEC, and the helpdesk reset are all this family.
identity acsc-glossary
Spear phishing
Phishing with a name on it. Aimed at a person or a small group, usually with enough context to look like Tuesday.
identity network acsc-glossary
Spoofing
A message or identity dressed as a trusted source. Email, SMS, caller ID, and websites all do this cheaply.
identity acsc-glossary
Two-factor authentication (2FA)
MFA with exactly two proofs. Better than a password. Still not the ceiling.
identity acsc-glossary
Vishing
Social engineering on a phone call. They are not Microsoft, the ATO, or your bank's fraud team.
identity acsc-glossary
Whaling
Spear phishing aimed at senior executives. The invoice looks like their job. The bank details do not.
network identity concepts
Zero trust
Never trust, always verify. A VPN badge is not a day pass. Identity, device, path, and data each get asked again.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary