Glossary

A software development principle whereby products and services are configured for maximum security by default.

When a customer requests that their suppliers provide evidence of their commitment to security and transparency for their products and services.

A software development principle whereby security is designed into every stage of a product or service’s development.

A path for transferring data between two entities that ensures confidentiality and integrity, as well as mutual authentication, between the two entities.

A network protocol that can be used to securely log into, execute commands on, and transfer files between remote workstations and servers.

A networking protocol designed for securing connections between web clients and web servers over an insecure network, such as the internet.

A protocol which allows the encryption and signing of email messages.

An area certified to the physical security requirements for a Security Zone Two to Security Zone Five area, as defined in the Department of Home Affairs’ Protective Security Policy Framework.

An activity designed to provide assurance in the security posture of a system and its operating environment. Security assessments can include security control assessments, vulnerability scanning, vulnerability assessments and penetration tests.

A document that describes the agreed scope, type and extent of assessment activities as part of a security control assessment.