Glossary

A computer security standard introduced to prevent cross-site scripting, clickjacking and other code injection attacks resulting from the execution of malicious content in a trusted web page.

A document describing the plan for continuous monitoring and assurance in a system’s security control effectiveness.

The administrative interface that allows for the management and orchestration of a system’s infrastructure and applications.

A small text file that is transmitted by a website and stored in a user's web browser that is then used to identify the user and prepare customised web pages. A cookie can also be used to track a user’s activity while browsing the internet.

The improper or unlawful theft of trade secrets or other knowledge proprietary to a competitor for the purpose of achieving a competitive advantage in the marketplace.

The enrolment, issuance, use, protection, change and revocation of credentials and other authentication artefacts.

A type of cybercrime that involves stealing a victim's proof of identity. Once credential theft has been successful, the attacker will have the same account privileges as the victim. Stealing credentials is the first stage in a credential-based attack.

Physical or virtual systems and assets so vital to Australia that their incapacity or destruction would have a debilitating impact on security, national economic security, national public health or safety, or any combination of these.

Core processes and services that are essential to delivering primary organisational outcomes or contributing to personnel health and safety.

A server that provides critical network or security services. For example, Microsoft Active Directory Domain Services domain controllers, Microsoft Active Directory Certificate Services Certification Authority servers, Microsoft Active Directory Federation Services servers and Microsoft Entra Connect servers.