You can view all our publications from this page. Use the filters below to filter by audience type, title and summary and the sort options to sort for the most recently updated or published content.
12 Jul 2021
Hardening Microsoft Windows 10 version 21H1 Workstations
Workstations are often targeted by an adversary using malicious websites, emails or removable media in an attempt to extract sensitive information. Hardening workstations is an important part of reducing this risk. This document provides recommendations on hardening workstations using Enterprise and Education editions of Microsoft Windows 10 version 21H1.
22 Jul 2021
Essential Eight Maturity Model FAQ
The Essential Eight Maturity Model provides advice on how to implement the Essential Eight to mitigate different levels of adversary tradecraft and targeting.
07 Apr 2021
Easy steps to secure your devices and accounts
The Australian Cyber Security Centre (ACSC) has developed an Easy Steps Guide to help Australians reduce their risk of being targeted by cybercriminals.
04 Feb 2021
Security Configuration Guide – Viasat Mobile Dynamic Defense
The ACSC has developed this guidance to assist organisations to understand the risks of deploying and provide specific configuration requirements for the Viasat Mobile Dynamic Defense (MDD) system to handle sensitive or classified data.
18 Feb 2021
Security Configuration Guide – Samsung Galaxy S10, S20 and Note 20 Devices
The ACSC has developed this guide to assist Australian’s to understand the risks when deploying Samsung Galaxy S10 and S20 devices.
Security Configuration Guide – Apple iOS 14 Devices
The ACSC has developed this guide to assist Australian’s to understand the risks of deploying iOS 14 and the security requirements that need to be met to allow iOS 14 to handle sensitive or classified data.
14 Jan 2021
Domain Name System Security for Domain Owners
This publication provides information on Domain Name System (DNS) security for domain owners, as well as mitigation strategies to reduce the risk of misuse of domains and associated resources. Organisations are recommended to implement the mitigation strategies in this publication to improve the security of their DNS infrastructure.
Domain Name System Security for Domain Resolvers
This publication provides information on Domain Name System (DNS) security for recursive resolution servers, as well as mitigation strategies to reduce the risk of DNS resolver subversion or compromise. Organisations should implement the mitigation strategies in this publication to improve the security of their DNS infrastructure.
07 Jan 2021
Identifying Cyber Supply Chain Risks
This guidance has been developed to assist organisations in identifying risks associated with their use of suppliers, manufacturers, distributors and retailers (i.e. businesses that constitute their cyber supply chain).
15 Dec 2020
Cyber Security Research Report
The ACSC commissioned exploratory research to better understand audience awareness of cyber security threats and practices.
Security Tips for Online Gaming
There are many things to think about when it comes to the use of personal devices (e.g. smartphones, tablets, computers and laptops) or gaming devices (e.g. Nintendo, PlayStation and Xbox consoles) for a safe and secure online gaming experience. Following the security tips in this publication can assist you to prevent the compromise of your devices and information, thereby avoiding significant productivity, financial and emotional impacts.
01 Dec 2020
Creating Strong Passphrases
Multi-factor authentication (a combination of something that you know, something that you have or something that you are) is one of the most effective ways to protect against unauthorised access to valuable information and accounts. However, in cases where multi-factor authentication is not available, a strong passphrase can often be the only barrier between adversaries and your valuable information and accounts. Passphrases are most effective when they are long, complex, unpredictable and unique.
24 Nov 2020
Quick Response Codes in a COVID-19 Environment
Quick Response (QR) codes have increased in popularity in the COVID-19 environment, aiding contact tracing and business check-in efforts. This guide provides information for individuals and businesses to help protect against cyber threats when using QR codes.
19 Nov 2020
Marketing and Filtering Email Service Providers
This publication provides high level guidance on how to use email service providers (ESPs) in particular deployment scenarios. The considerations and controls described in that publication also apply to ESPs sending email on your behalf.
23 Oct 2020
Protecting Against Business Email Compromise
Business email compromise is when criminals use email to abuse trust in business processes to scam organisations out of money or goods. Criminals can impersonate business representatives using similar names, domains and/or fraudulent logos as a legitimate organisation or by using compromised email accounts and pretending to be a trusted co-worker.
Hardening Linux Workstations and Servers
This document has been developed to assist organisations understand how to harden Linux workstations and servers, including by applying the Essential Eight from the Australian Cyber Security Centre (ACSC)’s Strategies to Mitigate Cyber Security Incidents.
19 Oct 2020
Defending Against the Malicious Use of the Tor Network
Blocking traffic from the Tor network will prevent adversaries from using the Tor network to easily conduct anonymous reconnaissance and exploitation of systems and typically has minimal, if any, impact on legitimate users. This publication provides guidance on the prevention and detection of traffic from the Tor network.
02 Oct 2020
Ransomware in Australia
The Australian Signals Directorate’s (ASD) Australian Cyber Security Centre (ACSC) has observed an increase in the number of ransomware incidents affecting Australian organisations and individuals.
10 Sep 2020
ASD Cyber Skills Framework
The ASD Cyber Skills Framework defines the roles, capabilities and skills that are essential to ASD’s cyber missions. The ASD Cyber Skills Framework enables targeted recruitment of cyber specialists, provides a development pathway for current and future cyber staff, and aligns skills, knowledge and attributes with national and international industry standards.
02 Sep 2020
IoT Code of Practice: Guidance for Manufacturers
Internet of Things (IoT) devices need to have effective cyber security provisions to defend against potential threats.
27 Jul 2020
Cloud Security Controls Matrix
The Cloud Security Controls Matrix (CSCM) provides additional context to the Australian Government Information Security Manual (ISM) security controls for cloud computing to assist security assessments.
Cloud Security Assessment Report Template
The Cloud Security Assessment Report Template is used to assess a cloud service provider (CSP) and its cloud services, improving the consistency of the Cloud Security Assessment Reports.
Anatomy of a Cloud Assessment and Authorisation
The Anatomy of a Cloud Assessment and Authorisation is co-designed with industry to support the secure adoption of cloud services across government and industry.
Cloud Assessment and Authorisation – Frequently Asked Questions
This publication provides answers relating to frequently asked questions on the Australian Cyber Security Centre (ACSC)’s new cloud security guidance, future support, government self-assessment and cloud security assessment reports.
22 May 2020
COVID-19 – Remote access to Operational Technology Environments
This cyber security advice is for critical infrastructure providers who are deploying business continuity plans for Operational Technology Environments (OTE)/Industrial Control Systems (ICS) during the COVID-19 pandemic.
01 Jul 2020
Quick Wins for your Website
Small business account for over 95% of all businesses in Australia and 72% of them have a website. However, in a world in which websites are increasingly being targeted by cyber criminals, only 36% check for updates every week. For those small businesses with a website, or that are considering one, these three quick wins will help you protect your money, data and reputation.
01 Jul 2018
Protecting Industrial Control Systems
Industrial control systems are essential to our daily life. They control the water we drink, the electricity we rely on and the transport that moves us all. It is critical that cyber threats to industrial control systems are understood and mitigated appropriately to ensure essential services continue to provide for everyone.
06 Apr 2020
COVID-19 Protecting Your Small Business
This guide has been developed to help small and micro businesses adapt to working during the COVID-19 pandemic. It will help businesses with simple and actionable advice in order to both identify common and emerging cyber threats and develop resilient business practices to protect themselves.
26 Jun 2020
Web Conferencing Security
Web conferencing solutions (also commonly referred to as online collaboration tools) often provide audio/video conferencing, real-time chat, desktop sharing and file transfer capabilities. As we increasingly use web conferencing to keep in touch while working from home, it is important to ensure that this is done securely without introducing unnecessary privacy, security and legal risks. This document provides guidance on both how to select a web conferencing solution and how to use it securely.
Mergers, Acquisitions and Machinery of Government Changes
This publication provides guidance on strategies that organisations can apply during mergers, acquisitions and Machinery of Government changes.
Securing Content Management Systems
Security vulnerabilities within content management systems (CMS) installed on web servers of organisations are often exploited by adversaries. Once a CMS has been compromised, the web server can be used as infrastructure to facilitate targeted intrusion attempts.
Cloud Computing Security for Tenants
This document is designed to assist an organisation’s cyber security team, cloud architects and business representatives to jointly perform a risk assessment and use cloud services securely.
Cloud Computing Security for Cloud Service Providers
This document is designed to assist assessors validating the security posture of a cloud service in order to provide organisations with independent assurance of security claims made by Cloud Service Providers (CSPs). This document can also assist CSPs to offer secure cloud services.
Malicious Email Mitigation Strategies
Socially engineered emails containing malicious attachments and embedded links are routinely used in targeted cyber intrusions against organisations. This document has been developed to provide mitigation strategies for the security risks posed by these malicious emails.
31 Oct 2019
Quick Wins for your End of Support
Every software product has a lifecycle. Knowing key dates in a program’s lifecycle can help you make informed decisions about the products your small business relies on every day. This guide helps small businesses understand what end of support is, why it is important to be prepared and when to update, upgrade or make other changes.
03 Dec 2020
Implementing Certificates, TLS, HTTPS and Opportunistic TLS
Transport Layer Security (TLS) is a widely used encryption protocol which enables parties to communicate securely over the internet. Through the use of certificates and Public Key Infrastructure (PKI), parties can identify each other through a trusted intermediary and establish encrypted tunnels for the secure transfer of information.
Small Business Cyber Security Guide
This guide has been developed to help small businesses protect themselves from the most common cyber security incidents.
09 Oct 2019
Quick Wins for your Portable Devices
Mobile technology is an essential part of modern business. While these devices may be small, the cyber threats when transporting them outside of the office are huge. This guide helps small businesses understand what is a portable device, why it is important to manage their use and how to keep the data on portable devices secure.
Step-by-Step Guide – Turning on Automatic Updates (For iMac & MacBook, and iPhone & iPad)
This step-by-step guide shows you how to turn on automatic updates if you use an iMac, MacBook, iPhone or iPad.
Step-by-Step Guide – Turning on Automatic Updates (For Windows 10)
This step-by-step guide shows you how to turn on automatic updates if you use Microsoft Windows 10.
How to Combat Fake Emails
Organisations can reduce the likelihood of their domains being used to support fake emails by implementing Sender Policy Framework (SPF) and Domain-based Message Authentication, Reporting and Conformance (DMARC) records in their Domain Name System (DNS) configuration. Using DMARC with DomainKeys Identified Mail (DKIM) to sign emails provides further safety against fake emails. Likewise, organisations can better protect their users against fake emails by ensuring their email systems use and apply SPF, DKIM and DMARC policies on inbound email.
16 Jul 2021
Essential Eight Maturity Model
Travelling Overseas with Electronic Devices
This publication provides guidance on strategies that individuals can take to secure the use of electronic devices when travelling overseas.
What Executives Should Know About Cyber Security
This publication discusses high-level topics that executives should know about cyber security within their organisations.
Cyber Security for Contractors
This document has been developed to assist contractors with appropriately securing Australian Government information on their systems.
Securing PowerShell in the Enterprise
This document describes a maturity framework for PowerShell in a way that balances the security and business requirements of organisations. This maturity framework will enable organisations to take incremental steps towards securing PowerShell across their environment.
An Examination of the Redaction Functionality of Adobe Acrobat Pro DC 2017
This document provides guidance on the efficacy of redaction facilities within Adobe Acrobat Pro DC 2017 and is intended for information technology and information security professionals within organisations looking to redact sensitive or personal information from PDF documents before releasing them into the public domain or to other third parties.
03 Aug 2021
Questions to ask Managed Service Providers
This document provides simple yet practical questions to ask managed service providers regarding the cyber security of their systems and the services they provide.
Windows Event Logging and Forwarding
A common theme identified by the Australian Cyber Security Centre (ACSC) while performing investigations is that organisations have insufficient visibility of activity occurring on their workstations and servers. Good visibility of what is happening in an organisation’s environment is essential for conducting an effective investigation. It also aids incident response efforts by providing critical insights into the events relating to a cyber security incident and reduces the overall cost of responding to them.
Data Spill Management Guide
A data spill is the accidental or deliberate exposure of information into an uncontrolled or unauthorised environment, or to persons without a need-to-know. A data spill is sometimes referred to as information disclosure or a data leak. Data spills are considered cyber security incidents and should be reported to the Australian Cyber Security Centre (ACSC).
