Glossary

ASD-Approved Cryptographic Algorithm

ASD-Approved Cryptographic Protocol

Australasian Certification Authority

The process of granting or denying requests for access to systems, applications and data. Can also refer to the process of granting or denying requests for access to facilities.

A system permitting access to multiple security domains from a single client device.

The illegal practice of collecting email accounts from information in the public domain or by using software to search for email addresses stored locally on a computer. Account harvesting may be used for spamming.

Accountable material requires the strictest control over its access and movement. Accountable material includes TOP SECRET data, some types of caveated data and any data designated as accountable material by its originator.

Australian Communications Security Instruction

The principle of proactively implementing a spectrum of security measures to strengthen a network or system to make it more robust against attack. Active defence is separate from offensive cyber operations, as well as passive defence or network hardening.

Note that some references to active defence focus on the employment of limited offensive action and counterattacks – commonly referred to as ‘hacking back’. The term active defence is not synonymous with ‘hacking back’, so these terms should not be used interchangeably.

Software that prevents advertisements from appearing with the content the user is intentionally viewing. People block ads for a variety of reasons. For example, many of them find marketing ads annoying and even stressful.

A set of malicious cyber activity with common characteristics, often orchestrated by a person or group targeting specific entities over an extended period. An APT usually targets either private organisations, states or both for business or political motives.

A type of ACSC publication that provides timely information and advice about current security issues, vulnerabilities, and exploits.

A program that displays advertisements that can be installed legitimately as a part of another application or service, or illegitimately without the consent of the system user.

Advanced Encryption Standard

A secondary market of an industry, concerned with the manufacturing, remanufacturing, distribution, retailing, and installation of all parts, equipment, and accessories, after the sale of the device by the original equipment manufacturer to the consumer.

A network security measure designed to ensure that a network is physically isolated from other networks. This intends to make the isolated network secure by ensuring it does not connect to other less secure networks, such as the internet.

An ACSC publication intended to provide timely notification concerning threats or activity with the potential to impact individuals, businesses, organisations, government, devices, peripherals, networks or infrastructure.

Software that is designed to detect, stop and remove viruses and other kinds of malicious software.

Application

A software program or group of software programs designed for end users. Examples of an application include a word processor, a spreadsheet, an accounting application, a web browser, an email client, a media player, a file viewer, an aeronautical flight simulator, a console game or a photo editor. The collective noun application software refers to all applications collectively. This contrasts with system software, which is mainly involved with running the computer.

An approach in which only an explicitly defined set of trusted applications are allowed to execute on systems.

A place where an accumulation of computer files is stored. It could be disk storage, a flash drive, a backup disk drive, an online backup service, an indexing internet page, etc.

The simulation of intelligence processes by machines, especially computer systems. These processes include learning (the acquisition of information and rules for using the information), reasoning (using the rules to reach approximate or definite conclusions), and self-correction. Particular applications of AI include threat identification, expert systems, speech recognition and machine vision.

In the context of technology, an overarching term used to refer to applications, IT equipment, OT equipment, services and data. Such assets may also be referred to as technology assets.

Advanced Technology Attachment

The applications, IT equipment, OT equipment and services used by a system. The greater the attack surface the greater the chances of malicious actors finding an exploitable vulnerability.

The process of assessing the source, perpetrator or sponsor of malicious activity. Statements of attribution often use probabilistic language and indicate the level of confidence in the assessment.

A chronological record of system activities including records of system access and operations performed.

A chronological record that reconstructs the sequence of activities surrounding, or leading to, a specific operation, procedure or event.

Data not to be passed to, or accessed by, foreign nationals.

Data not to be passed to, or accessed by, foreign nationals, with the exception of seconded foreign nationals.

A program that evaluates products in order to protect systems and data against cyber threats. These evaluation activities are certified by the Australian Certification Authority.

A program under which evaluations are performed by impartial bodies against the Common Criteria. The results of these evaluations are then certified by the Australian Certification Authority within the Australian Signals Directorate (ASD).

An Australian Government statutory agency responsible for foreign signals intelligence, cyber warfare and information security.

The Australian Government's lead for cyber security. The ASD's ACSC is part of the Australian Signals Directorate.

Verifying the identity of a user, process or device as a prerequisite to allowing access to resources in a system.

A protocol used in Internet Protocol Security (IPsec) that provides data integrity and data origin authenticity but not confidentiality.

An executive with the authority to formally accept the security risks associated with the operation of a system and to authorise it to operate.

The assurance that systems, applications and data are accessible and useable by authorised entities when required.

A feature or defect of a system, application or service that allows attackers to bypass security measures.

In information technology, a copy of computer data taken and stored elsewhere so that it may be used to restore the original after data loss.

Large amounts of structured and unstructured data that exceeds the ability of commonly used software tools to capture, manage and process. Big data requires techniques and technologies with new forms of integration to reveal insights from datasets that are diverse, complex, and of a massive scale.

Measurable physical characteristics used to identify an individual, such as fingerprints, iris patterns or facial features.

A digital currency and payment system underpinned by blockchain technology. Bitcoins can be used for online purchases, or converted into traditional currency.

A person that hacks for personal gain and/or who engages in illicit and unsanctioned hacking activities. See also 'grey hat' and 'white hat'.

An act of coercion using the threat of revealing or publicising either substantially true or false information about a person or group unless certain demands are met. It is often damaging information and may be revealed to family members or associates rather than to the general public.

A distributed database that maintains a continuously growing list of records, called blocks, secured from tampering and revision. Each block contains a timestamp and a link to a previous block. By design, blockchains are inherently resistant to modification of the data—once recorded, the data in a block cannot be altered retrospectively.

A list of entities that are not considered trustworthy and are blocked or denied access.

A wireless technology standard used for exchanging data between fixed and mobile devices over short distances using short-wavelength UHF radio waves.

A fake request

A program that performs automated tasks. In a cyber security context, a malware-infected computer that carries out tasks set by someone other than the device's legitimate user.

A collection of computers infected by bots and remotely controlled by an actor to conduct malicious activities without the user's knowledge, such as to send spam, spread malware, conduct denial of service activities or steal data.

When data is lost or subjected to unauthorised access, modification, disclosure, or other misuse or interference. Also referred to as a ‘data spill’.

A cyber security incident that results in unauthorised access to data, applications, services, networks and/or devices by bypassing their underlying security mechanisms.

An organisational policy that allows employees to use their own personal devices for work purposes. These devices connect to and utilise the organisation's network, data and resources.

Wide bandwidth data transmission which transports multiple signals and traffic types. In the context of internet access, broadband is used to mean any high speed internet access that is always on.

The distribution of audio or video content to a dispersed audience via any electronic mass communications medium, but typically one using the electromagnetic spectrum.

Software used primarily to access websites and web content.

Occurs when browser settings are changed without the user's knowledge or consent. The browser may persistently redirect to malicious or other unwanted websites.

The list of web pages a user has visited recently — and associated data such as page title and time of visit — which is recorded by web browser software by default.

An exhaustive process to try and determine a cryptographic key, password or other secret credential by systematically trying all candidates or combinations until the correct one is discovered.

A flaw or error in a software program.

A loosely-defined set of planning, preparatory and related activities which are intended to ensure that an organisation's critical business functions will either continue to operate despite serious incidents or disasters that might otherwise have interrupted them, or will be recovered to an operational state within a reasonably short period.

Attacks that are a form of cybercrime which use email fraud to target business, government and non-profit organisations to achieve a specific outcome which negatively impacts the target organisation.

A dishonest scheme that aims to get money or something else of value from businesses.

Internet predators who create fake online identities to lure people into emotional or romantic relationships for personal or financial gain.

A marking that indicates that the data has special requirements in addition to those indicated by its classification. This term covers codewords, source codewords, releasability indicators and special-handling caveats.

Content delivery network

Certificates (digital certificates) are electronic documents used in public key cryptography to establish the validity of a public key and establish trust in its owner. Certificates may be self-signed, however, this offers limited trust and should not be used for public services. Trusted Certificate Authorities (CAs) should issue and digitally sign certificates. Protocols use and verify these certificates to secure communications including web browsing, e-commerce, government services, secure messaging and email.

An artefact of Common Criteria evaluations that outlines the outcomes of a product’s evaluation.

The highest-ranking executive in a company, whose primary responsibilities include making major corporate decisions, managing the overall operations and resources of a company, acting as the main point of communication between the board of directors and corporate operations, and being the public face of the company.

A senior executive who is responsible for coordinating communication between security and business functions as well as overseeing the application of controls and associated security risk management processes.

Cyber Hygiene Improvement Program

The categorisation of systems, applications and data according to the expected impact if it was to be compromised.

Data that would cause limited through to exceptionally grave damage to Australia’s national interests, the Australian Government generally or to an individual Commonwealth entity if compromised (i.e. data assessed as OFFICIAL: Sensitive, PROTECTED, SECRET or TOP SECRET).

Groups of low-paid workers whose job is to click on links, surf around targeted websites, perhaps sign up for newsletters in order to exaggerate the popularity of the website. It is very hard for an automated filter to analyse this simulated traffic and detect that is it invalid as it has exactly the same profile as a legitimate visitor.

Using a compromised computer to click ads on a website without the user’s awareness, with the intention of generating revenue for the website or draining resources from the advertiser.

A form of false advertisement which uses links that are designed to attract attention and entice users to follow that link and read, view or listen to the linked content, with a defining characteristic of being deceptive, typically sensationalised or misleading.

A network of remote servers hosted on the internet and used to store, manage, and process data in place of local servers or personal computers.

A service model that enables network access to a shared pool of computing resources such as data storage, servers, software applications and services.

A company that offers some component of cloud computing to other businesses or individuals, typically infrastructure-as-a-service (laaS), platform-as-a-service (PasS) or software-as-a-service (SaaS).

Content Management System

Commercial National Security Algorithm

Program instructions

Making an unsolicited visit or phone call to someone, often in an attempt to sell goods or services.

A set of organisational and technical attributes and processes that employs human, physical and information resources to solve problems and accomplish missions.

A subset of IT equipment which contains cryptographic components.

An international standard for product evaluations.

An international agreement which facilitates the mutual recognition of Common Criteria evaluations by certificate-producing schemes.

The transfer of data and information from one location to another.

The controls applied to protect telecommunications from unauthorised interception and exploitation, as well as ensure the authenticity of such telecommunications.

The disclosure of information to unauthorised persons, or a violation of the security policy of a system in which unauthorised intentional or unintentional disclosure, modification, destruction or loss of an object may have occurred.

A programmable electronic device designed to accept data, perform prescribed mathematical and logical operations at high speed, and display the results of these operations.

Two or more interconnected devices that can exchange data.

A tube, duct or pipe used to protect cables.

The assurance that data is disclosed only to authorised entities.

The use of network address translation to allow a port on a node inside a network to be accessed from outside the network. Alternatively, using a Secure Shell server to forward a Transmission Control Protocol connection to an arbitrary port on the local host.

Specific configuration and usage guidance for products evaluated through the ASD Cryptographic Evaluation Program or the High Assurance Evaluation Program.

A filter that examines content to assess conformance against a security policy.

A computer security standard introduced to prevent cross-site scripting, clickjacking and other code injection attacks resulting from the execution of malicious content in a trusted web page.

A document that describes the plan for the continuous monitoring and assurance in the effectiveness of controls for a system.

The administrative interface that allows for the management and orchestration of a system’s infrastructure and applications.

A small text file that is transmitted by a website and stored in a user's web browser that is then used to identify the user and prepare customised web pages. A cookie can also be used to track a user’s activity while browsing the internet.

The improper or unlawful theft of trade secrets or other knowledge proprietary to a competitor for the purpose of achieving a competitive advantage in the marketplace.

A type of cybercrime that involves stealing a victim's proof of identity. Once credential theft has been successful, the attacker will have the same account privileges as the victim. Stealing credentials is the first stage in a credential-based attack.

Physical facilities, supply chains, information technologies and communication networks which if destroyed, degraded or rendered unavailable for an extended period would significantly impact on the social or economic wellbeing of the nation, or affect a nation’s ability to conduct national defence and ensure national security.

A server that provides critical network or security services. For example, a Microsoft Active Directory Domain Services domain controller or an authentication server.

A system comprising security-enforcing functions tailored to mitigate the specific security risks of accessing or transferring information between security domains. 

A type of digital currency which uses encryption techniques to regulate the generation of units of currency and verify the transfer of funds, operating independently of a central bank. The cryptography is designed for security and anti-counterfeiting measures.

An algorithm used to perform cryptographic functions such as encryption, integrity, authentication, digital signatures or key establishment.

A generic term for Commercial Grade Cryptographic Equipment and High Assurance Cryptographic Equipment.

An algorithm (the hash function) which takes as input a string of any length (the message) and generates a fixed length string (the message digest or fingerprint) as output. The algorithm is designed to make it computationally infeasible to find any input which maps to a given digest, or to find two different messages that map to the same digest.

The set of hardware, software and firmware that implements approved cryptographic functions (including key generation) that are contained within the cryptographic boundary of the module.

An agreed standard for secure communication between two or more entities to provide confidentiality, integrity, authentication and non-repudiation of data.

Software designed to perform cryptographic functions.

A related set of hardware, software and supporting infrastructure used for cryptographic communication, processing or storage and the administrative framework in which it operates.

The practice and study of techniques for securing communications in which plaintext data is converted through a cipher into ciphertext, from which the original data cannot be recovered without the cryptographic key.

A process in which transactions for various forms of cryptocurrency are verified and added to the blockchain digital ledger.

A deliberate act through cyberspace to manipulate, disrupt, deny, degrade or destroy computers or networks, or the information resident on them, with the effect of seriously compromising national security, stability or economic prosperity.

Note: there are multiple global definitions of what constitutes a cyber attack.

A form of bullying or harassment using electronic means. It is when someone bullies or harasses others on the internet and in other digital spaces, particularly on social media sites.

Defensive activity designed to protect information and systems against offensive cyber operations.

Malicious activity designed to covertly collect information from a target's computer systems for intelligence purposes without causing damage to those systems. It can be conducted by state or non-state entities, and can also include theft for commercial advantage.

The CIMA provides Australian governments with guidance on how they will collaborate in response to, and reduce the harm associated with, national cyber incidents.

Offensive and defensive activities designed to achieve effects in or through cyberspace.

The ability to adapt to disruptions caused by cyber security incidents while maintaining continuous business operations. This includes the ability to detect, manage and recover from cyber security incidents.

The safe and responsible use of information and communication technologies.

Measures used to protect the confidentiality, integrity and availability of information technology (IT) and operational technology (OT) systems, applications and data.

An occurrence of a system, service or network state indicating a possible breach of security policy, failure of safeguards or a previously unknown situation that may be relevant to security.

An unwanted or unexpected cyber security event, or a series of such events, that has either compromised business operations or has a significant probability of compromising business operations.

A cyber security expert with the skills to rapidly address cyber security incidents within an organisation. In the role of a first responder, they use a host of tools to find the root cause of a cyber security incident, limit the damage and significantly reduce the likelihood of it occurring again.

A document that describes the plan for responding to cyber security incidents.

The use of the internet or other electronic means to stalk or harass an individual, group or organisation.

The design, manufacture, delivery, deployment, support and decommissioning of applications, equipment and services that are utilised within an organisation's ICT environment.

Any circumstance or event with the potential to harm systems, applications or data.

The use of computer technology to disrupt the activities of a state or organisation, especially the deliberate disruption, manipulation or destruction of information systems for strategic, political or military purposes.

A computer code that is used, or designed to be used, with the aim of causing physical, functional or mental harm to structures, systems or people.

Cyber weapon is a contentious term among the international policy and legal communities, and there is an absence of agreement surrounding its connotations and implications. Avoid using ‘cyber weapon’ and use more generic terms such as 'destructive tools' or 'exploits' when describing the capabilities used by cyber actors.

Crimes directed at computers, such as illegally modifying electronic data or seeking a ransom to unlock a computer affected by malicious software. It also includes crimes where computers facilitate an existing offence, such as online fraud or online child sex offences.

The environment formed by physical and non-physical components to store, modify, and exchange data using computer networks.

Web sites that are not indexed by search engines and are only accessible through special networks such as The Onion Router (ToR). Often, the dark web is used by website operators who want to remain anonymous. The ‘dark web’ is a subset of the ‘deep web’.

The basic element that can be processed or produced by a computer to convey information.

Data that resides on media or a system.

The unauthorised movement or disclosure of sensitive private or business information.

A large amount of data transferred from one system or location to another.

Data that is being communicated across a communication medium.

Data protection is the process of safeguarding important information from corruption, compromise or loss.

A location in which data is stored, managed and made available to users.

Measures used to protect the confidentiality, integrity and availability of data.

The accidental or deliberate exposure of data into an uncontrolled or unauthorised environment, or to people without a need-to-know.

Database management system

Distributed control system

A process whereby requirements for the protection of data are removed and an administrative decision is made to formally authorise its release into the public domain.

The decoding of encrypted messages.

The part of the internet that is not indexed by search engines. Includes websites that are password-protected and paywalled, as well as encrypted networks, and databases.

Where a device needs a username and/or password to log in, a default password is usually provided that allows the device to be accessed during its initial setup, or after resetting it to factory defaults.

The implementation of multiple layers of controls in a system to provide redundancy in the event a control fails or a vulnerability is exploited.

An electrical device or permanent magnet assembly which generates a magnetic force for the purpose of degaussing magnetic storage devices.

A process for reducing the magnetisation of a magnetic storage device to zero by applying a reverse magnetic force, rendering any previously stored data unreadable.

A small network with one or more servers that is kept separate from the core network, typically on the outside of the firewall or as a separate network protected by the firewall. Demilitarised zones usually provide data to less trusted networks, such as the internet.

When legitimate users are denied access to computer services (or resources), usually by overloading the service with requests.

An attempt by malicious actors to prevent legitimate access to online services (typically a website), for example, by consuming the amount of available bandwidth or the processing capacity of the server hosting the online service.

Software that can be used on a system to restrict access to communications ports. Device access control software can block all access to a communications port or allow access based on device types, manufacturer’s identification or even unique device identifiers.

Diffie-Hellman

Where attackers use ‘password dictionaries’ or long lists of the most commonly-used passwords and character combinations against a password in order to guess it and break into a system.

An electronic document used to identify an individual, a system, a server, a company, or some other entity, and to associate a public key with the entity. A digital certificate is issued by a certification authority and is digitally signed by that authority.

The unique set of traceable activities, actions, contributions and communications that are manifested on the internet or on digital devices.

The coordinated and ongoing set of processes and activities that ensure long-term, error-free storage of digital information, with means for retrieval and interpretation, for the entire time span the information is required.

A cryptographic process that allows the proof of the source (with non-repudiation) and the verification of the integrity of that data.

A device that allows data to flow in only one direction.

A set of policies, tools and procedures to enable the recovery or continuation of vital technology infrastructure and systems following a natural or human-induced disaster. Disaster recovery focuses on the IT or technology systems supporting critical business functions, as opposed to business continuity.

A distributed form of denial-of-service attack.

Direct Memory Access

In the internet, a part of a naming hierarchy which consists of a sequence of names (labels) separated by periods (dots).

Note: There are multiple other technical and communications-related definitions for ‘domain’.

The naming system that translates domain names into IP addresses.

An email authentication protocol designed to give email domain owners the ability to protect their domain from unauthorised use, commonly known as email spoofing.

A system for authenticating emails that works with modern Message Transfer Agent systems. This resource was created to help fight spam, and uses a digital signature to help email recipients determine whether an email is legitimate.

A type of Trojan that downloads other malware onto a computer. The downloader needs to connect to the internet to download the files.

Obtaining and publishing private or personally identifiable information about an individual over the internet. Information can be obtained through a range of methods including network compromise, social engineering, data breaches, or research.

The unintentional download of malicious code to a computer or mobile device that leaves the user open to an attack. The user does not have to click on anything, download or open a malicious email attachment to have their computer or device infected.

Software that interfaces a hardware device with an operating system.

A type of Trojan that installs other malware files onto a computer or device. The other malware is included within the Trojan file, and does not require connection to the internet.

Digital Signature Algorithm

IT equipment that implements Internet Protocol version 4 and Internet Protocol version 6 protocol stacks.

Extensible Authentication Protocol

Extensible Authentication Protocol-Transport Layer Security

Hidden functionality within an application that is activated when an undocumented set of commands and keystrokes are entered. Easter eggs are typically used to display the credits for the development team or a humorous message and are intended to be non-threatening.

Elliptic Curve Diffie-Hellman

Elliptic Curve Digital Signature Algorithm

Electrically erasable programmable read-only memory

An electronic payment system involving electronic funds transfers based on the use of payment cards, such as debit or credit cards, at payment terminals located at the place the sale took place.

Standing for 'electronic mail', a method of exchanging messages between people using electronic devices.

The countermeasures employed to reduce sensitive or classified emanations from a facility and its systems to an acceptable level. Emanations can be in the form of Radio Frequency energy, sound waves or optical signals.

An ACSC program that sets out the requirements for government and organisations to be formally recognised to conduct emanation security practices to national standards.

A protocol used for encryption and authentication in IPsec.

The conversion of plaintext into unreadable ciphertext (typically using cryptographic algorithms and keys) to protect the confidentially of data at rest or in transit.  Ciphertext is returned to plaintext by performing decryption.

When a company ceases support for a product or service. This is typically applied to hardware and software products when a company releases a new version and ends support for certain previous versions.

A personal computer, personal digital assistant, smart phone or removable storage media (e.g. USB flash drive, memory card, external hard drive, writeable CD or DVD) that can store information.

A method of secure communication where only the communicating users can read data transferred from one end-system or device to the other.

A methodology of protecting a network when accessed via remote devices such as laptops or other wireless and mobile devices. Each device with a remote connection to the network creates a potential entry point for security threats.

An approach to work in which employees can do their jobs from anywhere using a variety of devices and applications.

Erasable programmable read-only memory

A person who ensures that when maintenance or repairs are undertaken to ICT equipment, uncleared people are not exposed to information they are not authorised to access.

Those services that are vital to the health and welfare of a population and therefore are essential to maintain even in a disaster.

Evaluation Assurance Level (EAL1 through EAL7)

In the context of system logs, an event constitutes an evident change to the normal behaviour of a network, system or user.

The transmission of information to a centralised computer concerning events that take place on remote computers or servers. In this context, an event is any occurrence that affects a file, program or task. Events are commonly used for troubleshooting applications and drivers.

Used by a security information and event management tool. This tool provides a level of analysis of the contents of an event log to help network administrators determine what is going on within a network.

A file that causes a computer to perform indicated tasks according to encoded instructions.

A piece of code that exploits bugs or vulnerabilities in software or hardware to gain access a system or network.

A markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable.

A physical space where business is performed. For example, a facility can be a building, a floor of a building or a designated space on the floor of a building.

Sending counterfeit email by using a legitimate sender's address without their knowledge.

A trader that is in not legitimate.

Websites that are not legitimate.

A device that allows copies of documents to be sent over a telephone network.

A particularly lightweight thread of execution. Like threads, fibres share address space. However, fibres use cooperative multitasking while threads use pre-emptive multitasking.

Federal Information Processing Standard

A network device that filters incoming and outgoing network data based on a series of rules.

Software embedded in IT equipment or OT equipment.

An intelligence sharing partnership between Australia, Canada, New Zealand, the United Kingdom and the United States of America.

A specific type of electrically erasable programmable read-only memory.

Computer software for using content created with Adobe Flash, including viewing multimedia content, executing rich internet applications, and streaming audio and video.

A defect, fault or imperfection, especially one that is hidden or unknown.

A lead that connects IT equipment to the fixed infrastructure of a facility. For example, the lead that connects a workstation to a network wall socket.

A person who is not an Australian citizen.

A system that is not managed by, or on behalf of, the Australian Government.

Intentional deception to secure unfair or unlawful gain, or to deprive a victim of a legal right.

Fuzzing (or fuzz testing) is a method used to discover errors or potential vulnerabilities in software.

Gateways securely manage data flows between connected networks from different security domains.

A regulation in European Union (EU) law on data protection and privacy in the EU and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA.

A system of satellites combined with receivers on Earth that determines the latitude and longitude of any particular receiver through triangulation.

A software project that is developed from scratch rather than built from an existing program.

A hacker or computer security expert who may sometimes violate laws or typical ethical standards, but may not have the malicious intent typical of a black hat hacker. See also ‘white hat’ and ‘black hat’.

An impartial publication by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) which will help you to identify your options, provide direction and narrow down your choices, and may include instructions relating to specific products. The ASD's ACSC makes every undertaking to ensure the accuracy and quality of the information it provides but is not accountable for any decision made based on it.

The unauthorised exploitation of weaknesses in a computer system or network.

A computer expert that can gain unauthorised access to computer systems. Hacker is an agnostic term and a hacker does not necessarily have malicious intent. See also ‘black hat’, ‘grey hat’, and ‘white hat’.

A hacker whose motivation is political, religious or ideological, as opposed to criminal.

A generic term for IT equipment and OT equipment.

A physical computing device that safeguards cryptographic keys and provides cryptographic processing. A hardware security module is or contains a cryptographic module. Hardware security modules are commonly deployed in public key infrastructure, digital identity solutions and payment systems.

An exploitable weakness in a computer system that enables attacks through remote or physical access to system hardware.

A cryptographic function that can be used to compute Message Authentication Codes using a hash function and a secret key.

Cryptographic equipment that has been authorised by ASD for the protection of SECRET and TOP SECRET data.

The rigorous investigation, analysis, verification and validation of ICT equipment by the Australian Signals Directorate (ASD) against a stringent security standard.

The rigorous investigation, analysis, verification and validation of products by ASD to protect SECRET and TOP SECRET data.

IT equipment that has been designed and authorised for the protection of SECRET and TOP SECRET data.

A server that provides important network services or contains data repositories. For example, a Domain Name System server, database server, email server, file server or web server.

Host-based Intrusion Prevention System

A falsehood deliberately fabricated to masquerade as the truth.

A scam that is distributed in email form that is designed to deceive and defraud email recipients, often for monetary gain.

A computer system designed specifically to attract potential malicious actors in order to inform the development of defensive measures and responses.

An area where wireless internet access is available to the general public.

Hypertext Markup Language

A web security policy mechanism that helps to protect websites against person-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking.

Non-volatile magnetic media that uses a cache to increase read/write speeds and reduce boot times. The cache is normally non-volatile flash memory media.

Hypertext Transfer Protocol is the fundamental protocol used for transferring files on the internet.

While Hypertext Transfer Protocol (HTTP) is the basic framework for transferring data across the web, HTTPS adds a layer of encryption for additional security; with 'S' standing for secure.

The process of analysing the access of individuals or systems to an organisation's IT resources.

The process used in businesses and organisations to grant or deny employees and others authorisation to secure systems.

When a victim’s personal details are stolen and used to perpetrate crime, commonly fraud. Identity theft is a serious crime and can result in long-term and far-reaching negative consequences for victims.

Internet Engineering Task Force

Internet Key Exchange

Emails that attempt to impersonate a trusted individual or company in an attempt to gain access to corporate finances or data.

A scam where a dishonest individual will try to convince you to make a payment or give personal or financial details by claiming to be from a trusted organisation.

Control systems and associated instrumentation used to efficiently operate and/or automate industrial processes. Industrial Control Systems include supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other smaller control system configurations such as programmable logic controllers (PLC).

The protection of information from unauthorised access, use, disclosure, disruption, modification or destruction in order to provide confidentiality, integrity and availability.

An ASD publication outlining a cyber security framework that organisations can apply, using their risk management framework, to protect their systems and data from cyber threats.

Hardware, software and supporting infrastructure used for the processing, storage or communication of data.

An initiative of ASD designed to register suitably qualified individuals to carry out security assessments for systems.

Devices such as mice, keyboards and pointing devices that have an infrared communications capability.

Any person that has, or had, authorised logical or physical access to a system and its resources.

An insider that performs, or attempts to perform, damaging activities (either intentionally or unintentionally) to a system or its resources. Some organisations may choose to exclude unintentional damage to systems and their resources (often referred to as negligent or accidental damage) from their definition of insider threat in order to focus on insiders with malicious intent (often referred to as malicious insiders).

The assurance that data has been created, amended or deleted only by authorised individuals.

The property of your mind or proprietary knowledge. It can be an invention, trade mark, design, brand or the application of your idea.

The back and forth dialog between the user and the computer.

Authentication that involves the interaction of a person with a system.

A specialised agency of the United Nations that is responsible for issues that concern information and communication technologies. It is the oldest global international organisation. Originally called the International Telegraph Union.

The global system of interconnected computer networks that use standardised communication protocols to link devices and provide a variety of information and communication facilities.

The network of physical objects, devices, vehicles, buildings and other items which are embedded with electronics, software, sensors and network connectivity, which enables these objects to connect to the internet and collect and exchange data.

A numerical representation of an address for a particular computer or device on a network or the internet. 

A suite of protocols for secure communications through authentication or encryption of Internet Protocol (IP) packets as well as including protocols for cryptographic key establishment.

The transport of telephone calls over IP networks.

A protocol used for communicating over packet switched networks. Version 6 is the successor to version 4 which is widely used on the internet.

A company that provides subscribers with access to the internet.

An automated system used to identify malicious or unwanted activities. An Intrusion Detection System can be host-based or network-based.

An automated system used to identify malicious or unwanted activities and react in real-time to block or prevent such activities. An Intrusion Prevention System can be host-based or network-based.

Internet Security Association Key Management Protocol

International Organisation for Standardisation

Any device that can process, store or communicate data within IT environments, such as computers, multifunction devices, network devices, smartphones, electronic storage media and smart devices.

A general purpose programming language that is a class-based and object-oriented, and designed to have as few implementation dependencies as possible.

JavaScript Object Notation

A computer which is used to manage important or critical resources in a separate security domain. Also known as a jump host or jump box.

In database management systems, a key is a field that you use to sort data. For example, if you sort records by age, then the age field is a key.

The use and management of cryptographic keys and associated hardware and software. It includes their generation, registration, distribution, installation, usage, protection, storage, access, recovery and destruction.

Cryptographic keys generated or used by cryptographic equipment or software.

Malicious software that records which keys you press. These programs may be used to capture confidential information (such as login or financial details) and send to an attacker. Also known as keystroke logging.

A small portable personal computer, suitable for use while travelling.

An email from a trusted organisation or individual.

In computer science, a library is a collection of non-volatile resources used by computer programs, often for software development.

A software license is a legal instrument governing the use or redistribution of software.

Use of social engineering, such as compelling stories or photos, to persuade large numbers of users to 'like' a social networking page. Many of the stories are fake, and are part of a scam which makes money from the exposure generated by people liking and hence sharing the page.

An HTML object that allows you to jump to a new location when you select it. Links provide a simple means of navigating between pages on the web.

A computer network that interconnects devices within a limited area such as a home, school, laboratory or office building.

A cabinet that is commercially available, of robust construction and is fitted with a commercial lock.

The automatically produced and time-stamped documentation of events relevant to a particular system.

A facility that includes software which generates events and their associated details, the transmission (if necessary) of event logs, and how they are stored.

Measures used to control access to systems and their information.

The act of logging in to a database, mobile device, or computer, especially a multiuser computer or a remote or networked computer system, usually by using a username and password.

Media Access Control

A type of artificial intelligence (AI) that allows software applications to become more accurate in predicting outcomes without being explicitly programmed. The basic premise of machine learning is to build algorithms that can receive input data and use statistical analysis to predict an output value within an acceptable range.

A form of malicious activity where the attacker secretly accesses, relays and possibly alters the communication between two parties who believe they are communicating directly with each other.

An instruction that causes the execution of a predefined sequence of instructions.

Intending or intended to do harm.

Individual or organisations that conduct malicious activities, such as cyber espionage, cyber attacks or cyber-enabled crime.

The use of online advertising to spread malware. It typically involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and web pages.

Any software that attempts to subvert the confidentiality, integrity or availability of a system.

The occurrence of malicious code infecting a system.

An email which has been deliberately crafted to cause problems on the server or on the client. This could be by making the message contain a virus, or crafting the message in such a way as to take advantage of a weakness in the receiving mail client.

A malicious link is created with the purpose of promoting scams, attacks and frauds. By clicking on an infected URL, you can download malware such as a Trojan or virus that can take control of your devices, or you can be persuaded to provide sensitive information on a fake website.

Any software that brings harm to a computer system. Malware can be in the form of worms, viruses, Trojans, spyware, adware and rootkits etc which steal protected data, delete documents or add software not approved by a user.

The use of online advertising to spread malware. Malvertising involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages.

Malicious software used to gain unauthorised access to computers, steal information and disrupt or disable networks. Types of malware include Trojans, viruses and worms.

A company that remotely manages a customer's IT infrastructure and/or end-user systems, typically on a proactive basis and under a subscription model.

Traffic generated by system administrators over a network in order to control workstations and servers. This includes standard management protocols and traffic that contains information relating to the management of the network.

A generic term for hardware, often portable in nature, which is used to store data.

The process of physically damaging media with the intent of making data stored on it inaccessible. To destroy media effectively, only the actual material in which data is stored needs to be destroyed.

The process of relinquishing control of media when it is no longer required.

The process of erasing or overwriting data stored on media so that it cannot be retrieved or reconstructed.

Programming languages that prevent the introduction of vulnerabilities related to memory use. Examples of memory-safe programming languages include C#, Go, Java, Ruby, Rust and Swift. Examples of non-memory-safe programming languages include Assembly and C/C++.

Descriptive data about the content and context used to identify data.

Multiple-input and multiple-output

A transmission and reception station in a fixed location, consisting of one or more receive/transmit antenna, microwave dish and electronic circuitry, used to handle cellular traffic.

A portable computing or communications device. For example, smartphones, tablets and laptop computers.

A wireless handheld device that allows users to make and receive phone calls and to send text messages, among other features.

Authentication using two or more different authentication factors. This may include something users know, something users have or something users are.

IT equipment that combines printing, scanning, copying, faxing or voice messaging functionality in the one device. These devices are often designed to connect to computer and telephone networks simultaneously.

Mini-Serial Advanced Technology Attachment

A program that uses exercises and other readiness activities that target strategic decision-making, operational and technical capabilities, strategic engagement and communications. Through these exercises the program can help broaden your understanding of the roles and responsibilities of key government entities and private sector organisations when responding to a cyber security incident.

The principle of restricting an individual’s access to only the data they require to fulfil the duties of their role.

Two or more computer systems linked together

Security policies used to control access to a network and actions on a network. This can include authentication checks and authorisation controls.

IT equipment designed to facilitate the communication of data. For example, routers, switches and wireless access points.

The infrastructure used to carry data between workstations and servers or other network devices.

Network traffic generated by system administrators over a network in order to control workstations and servers. This includes standard management protocols and other network traffic that contains data relating to the management of the network.

Partitioning a network into smaller networks; compare with network segregation.

Developing and enforcing a rule set for controlling the communications between specific hosts and services; compare with network segmentation.

The linking of computers to allow them to operate interactively.

Network-based Intrusion Detection System

Network-based Intrusion Prevention System

National Institute of Standards and Technology

A contract by which one or more parties agree not to disclose confidential information that they have shared with each other as a necessary part of doing business together.

Authentication between systems or services that does not involve the interaction of a person.

Providing proof that a user performed an action, and in doing so preventing a user from denying that they did so.

A specific type of electrically erasable programmable read-only memory.

A type of media which retains its data when power is removed.

A method of mitigating the possibility of an active handset inadvertently allowing background discussions to be heard by a remote party. This can be achieved through the use of a hold feature, mute feature, push-to-talk handset or equivalent.

Activities in cyberspace that manipulate, deny, disrupt, degrade or destroy targeted computers, information systems, or networks.

Non-classified information identified as requiring basic protection (i.e. information marked as OFFICIAL or OFFICIAL: Sensitive).

An encryption method relying on a pre-shared key which is larger than or equal to the size of the plaintext to create ciphertext. While the OTP is the only scheme to hold certain theoretical security properties, key management renders it impractical for modern use-cases.

Services accessed by users over the internet (also known as internet-facing services).

Data that can be freely used, reused and redistributed by anyone.

An open-source implementation of Pretty Good Privacy, a widely available cryptographic toolkit.

System software that manages hardware and software resources and provides common services for executing various applications on a computer.

Systems that detect or cause a direct change to the physical environment through the monitoring or control of devices, processes and events. Operational technology is predominantly used to describe industrial control systems which include supervisory control and data acquisition systems and distributed control systems.

Open System Interconnect

Any device that can process, store or communicate data or signals within OT environments, such as programmable logic controllers and remote terminal units.

An agreement in which one company hires another company to be responsible for a planned or existing activity that is or could be done internally, and sometimes involves transferring employees and assets from one firm to another.

Open Web Application Security Project

Peer-to-peer

A multinational Pacific cyber security network which the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) is a member of. PaCSON promotes closer sharing of cyber security threat information, tools, techniques and ideas between Pacific nations.

Security measures that are applied within a network and require limited human interaction. Passive defence includes logging and monitoring mechanisms, and implementation of tools and processes to harden networks including firewalls, application hardening, patching procedures and antivirus software.

A sequence of words used for authentication.

A sequence of characters used for authentication.

The use of different character sets, such as lower-case alphabetical characters (a-z), upper-case alphabetical characters (A-Z), numeric characters (0-9) and special characters.

A type of software that offers greater security through the capability to generate unique, strong, easily-changed passwords for all online accounts and the secure encrypted storage of those passwords either through a local or cloud-based vault.

An attack that attempts to access a large number of accounts with some commonly-used passwords.

Authentication that does not involve the use of something users know. Passwordless authentication may be single-factor or multi-factor, with the later often referred to as passwordless multi-factor authentication.

Multi-factor authentication using something users have that is unlocked by something users know or are. Note, while a memorised secret may be used as part of passwordless multi-factor authentication (e.g. to unlock access to a cryptographic private key stored on a device) it is not the primary authentication factor, hence the use of the passwordless terminology.

A piece of software designed to remedy vulnerabilities or improve the usability or performance of software, IT equipment or OT equipment.

A metallic (copper) or fibre-optic cable used for routing signals between two components in an enclosed container or rack.

A group of sockets or connectors that allow manual configuration changes, generally by means of connecting patch cables.

The action of updating, fixing, or improving a computer program.

Part of digitally transmitted data that is the fundamental purpose of the transmission. In the cyber-security context, normally the part of a malware program that performs a malicious action.

A decentralised file sharing system. Files are stored on and served by the personal computers of the users.

A penetration test is designed to exercise real-world scenarios in an attempt to achieve a specific goal, such as compromising critical systems, applications or data.

Additional security for security associations ensuring that if one security association is compromised subsequent security associations will not be compromised.

A device used to share a set of peripherals between multiple computers. For example, a keyboard, video monitor and mouse.

Any information relating to an identified or identifiable natural person.

A number allocated to an individual and used to validate electronic transactions.

Information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not.

Information that can be used on its own or with other information to identify, contact or locate a single person, or to identify an individual in context.

A way of harvesting personal information, where a hacker puts a malicious code on your computer that redirects you to a fake site.

Untargeted, mass emails sent to many people asking for sensitive information (such as bank details), encouraging them to open a malicious attachment, or visit a fake website that will ask the user to provide sensitive information or download malicious content.

See also 'spear phishing' and 'whaling'.

A document that describes vulnerabilities in a system and the plans for their rectification.

Programmable logic controllers

Pairwise Master Key

Malware that can change parts of its code in order to avoid detection by security software.

A small window which suddenly appears (pops-up) in the foreground of the normal screen.

Any device that can easily be carried. It is a small form factor computing device that is designed to be held and used in the hand.

A file format that has captured all the elements as of a printed document as an electronic image that you can view, navigate, print or forward to someone else.

A position that involves duties that require a higher level of assurance than that provided by normal employment screening. In some cases, additional screening may be required. Positions of trust can include, but are not limited to, Chief Information Security Officers and their delegates, system administrators and privileged users.

Applications that may appear to serve a useful purpose but often perform actions that may adversely affect a computer’s performance. Also known as potentially unwanted applications.

The shell framework developed by Microsoft for administrative tasks such as configuration management and automation of repetitive jobs.

The ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively.

Settings which control how a user's data is shared with other people or systems. Privacy settings apply to web browsers and social networking services.

Provides a dedicated operating system for sensitive tasks and is protected from internet attacks and threat vectors.

Privileged accounts include privileged user accounts and privileged service accounts.

Privileged operating environments are those used for activities that require a degree of privileged access, such as system administration activities.

A user who can alter or circumvent a system’s security measures. This can also apply to users who could have only limited privileges, such as software developers, who can still bypass security measures.

A privileged user can have the capability to modify system configurations, account privileges, audit logs, data files or applications.

A user account that has the capability to modify system configurations, account privileges, event logs and security configurations for applications. This also applies to users who may only have limited privileges but still have the ability to bypass some of a system’s controls.

A generic term used to describe software or hardware.

A document that stipulates the security functionality that must be included in a Common Criteria evaluation to meet a range of defined threats.

Protection Profiles also define the activities to be taken to assess the security function of an evaluated product.

An administrative label assigned to data that not only shows the value of the data but also defines the level of protection to be provided.

Protective Security Circular

The Australian Government's Protective Security Policy Framework

A computer available in public areas. Some places where public computers may be available are libraries, schools or government facilities.

Data that has been formally authorised for release into the public domain.

Information that has been formally authorised for release into the public domain.

A set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption.

Network infrastructure that an organisation has no control over, such as the internet.

Public network infrastructure used for voice communications.

Any Wi-Fi service established and owned by a contributing group that is provided for use by its customers on a wireless device.

Public Wi-Fi may be unsecured, password protected or have other secure authentication protocols established and managed by such contributing group.

See also unsecured networks.

Handsets that have a button which is pressed by the user before audio can be communicated, thus providing off-hook audio protection.

The ability to provide different priorities to different applications, users or data flows, or to guarantee a certain level of performance to a data flow.

The transmission of signals by modulation of electromagnetic waves with frequencies below those of visible light.

A device designed to transmit electromagnetic radiation as part of a radio communication system.

Remote Access Dial-In User Service

Random-access memory

Malicious software that makes data or systems unusable until the victim makes a payment.

An administrative decision to change the controls used to protect data based on a reassessment of the potential impact of its unauthorised disclosure. The lowering of the controls for media containing sensitive or classified data often requires sanitisation or destruction processes to be undertaken prior to a formal decision to lower the controls protecting the data.

A plan that outlines an organisation's recovery strategy for how they are going to respond to a cyber security incident.

Most commonly refers to the removal of information from a document to ensure that information remains private or secret from a wide audience. It can also refer to a form of editing in which multiple sources of texts are combined and altered slightly to make a single document.

Data not to be passed to, or accessed by, foreign nationals beyond those belonging to specific nations which the data has been authorised for release to.

Access to a system that originates from outside an organisation’s network and enters the network through a gateway, including over the internet.

When a scammer pretends to be affiliated with a tech or computer company, such as Apple, Telstra or their technical support division. The scammer usually tries to convince you that you have a computer or internet problem and you need to buy or install new software to fix the problem.

A software administration tool or program that can be used by a hacker to remotely gain access and control of an infected machine.

A proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection.

Storage media that can be easily removed from a system and is designed for removal, such as Universal Serial Bus flash drives and optical media.

The capacity to recover quickly from difficulties.

Radio frequency

Request for Comments

A public key cryptosystem based on the practical difficulty of factoring the product of two large prime numbers.

A type of scam involving feigning romantic intentions towards a victim, gaining their affection, and then using that goodwill to commit fraud. This may involve access to the victim's money, bank accounts, credit cards, passports, email accounts, or national identification numbers or forcing the victims to commit financial fraud on their behalf. Often called dating and romance scams.

A tool or set of tools used by an attacker in order to compromise a system, gain the highest level of privilege, and then hide their activity.

A networking device that forwards data packets between computer networks.

Originally RDF Site Summary; later, two competing approaches emerged, which used the backronyms Rich Site Summary and Really Simple Syndication respectively.

Real-time Traffic Protocol

A virtual space in which new, untrusted or untested software or coding can be run safely without risking harm to the hosting computer.

A fraudulent scheme performed by a dishonest or deceitful individual, group or company in an attempt to obtain money or something else of value.

An email that intentionally deceives for personal gain or to damage another individual.

A person who commits fraud or participates in a dishonest scheme.

A type of malware written using a scripting language. Common forms of scripting language include JavaScript, HTML, Visual Basic Script, PowerShell, Perl, Python and Shell Scripting.

The process of increasing website traffic by increasing the visibility or ranking of a website or a web page to users of a search engine.

The people who are the second most likely to purchase products and services, and are thus targeted for marketing purposes.

A representative of a foreign government on exchange or long-term posting.

A hardened workstation, or virtualised privileged operating environment, used specifically in the performance of administrative activities.

A network protocol that can be used to securely log into, execute commands on, and transfer files between remote workstations and servers.

A networking protocol designed for securing connections between web clients and web servers over an insecure network, such as the internet.

A software development principle whereby products and services are configured for maximum security by default.

A software development principle whereby security is designed into every stage of a product or service’s development.

A protocol which allows the encryption and signing of email messages.

An area certified to the physical security requirements for a Security Zone Two to Security Zone Five area, as defined in the Department of Home Affairs’ Protective Security Policy Framework, Entity facilities policy, to allow for the processing or storage of classified data.

An activity undertaken to assess controls for a system and its environment to determine if they have been implemented correctly and are operating as intended.

A document that describes the outcomes of a security assessment and contributes to the development of a plan of action and milestones.

A collection of connection-specific parameters used for IPsec connections.

The duration a security association is valid for.

An act that leads to damage of a system or unauthorised access to the system.

An Australian Government interdepartmental committee responsible for the evaluation and endorsement of security equipment and services. The committee is chaired by the Australian Security Intelligence Organisation.

An organisation’s cyber security strategy; system-specific security documentation; and any supporting diagrams, plans, policies, processes, procedures and registers.

A system or collection of systems operating under a consistent security policy that defines the classification, releasability and special handling caveats for data processed within the domain.

A weakness in a system that gives a threat agent the opportunity to mount an attack.

The level of security risk to which a system is exposed. A system with a strong security posture is exposed to a low level of security risk while a system with a weak security posture is exposed to a high level of security risk.

Any event that could result in the compromise, loss of integrity or unavailability of data or resources, or deliberate harm to people measured in terms of its likelihood and consequences.

Statements that communicate the expectations of an organisation’s senior management about their security risk tolerance. These criteria help an organisation identify security risks, prepare appropriate treatments and provide a benchmark against which the success of mitigations can be measured.

The process of identifying, assessing and taking steps to reduce security risks to an acceptable level.

An artefact of Common Criteria evaluations that specifies conformance claims, threats and assumptions, security objectives, and security requirements for an evaluated product.

Updates to the security on your system.

Security Equipment Guide

Any device or system that has the ability to perceive that it is not operating correctly and to make the necessary adjustments to restore itself to normal operation.

An email authentication method designed to detect forged sender addresses during the delivery of email.

Data that would cause damage to an organisation or an individual if compromised.

A computer that provides services to users or other systems. For example, a file server, email server or database server.

User accounts that are used to perform automated tasks without manual intervention, such as machine to machine communications. Service accounts will typically be configured to disallow interactive logins.

A company which allows its subscribers access to the internet.

The name given to identify a particular Wi-Fi network. The SSID is broadcast by the wireless access point (wireless router) and can be detected by other wireless-enabled devices in range of the wireless access point (WAP). In some cases, SSIDs are hidden, making them invisible to Wi-Fi clients.

A form of blackmail in which sexual information or images are used to extort money or sexual favours from the victim in return for not releasing the information or images publicly.

Secure Hashing Algorithm 1

Secure Hashing Algorithm 2

A framework that describes the management and operational responsibilities between different parties for a system. Where responsibilities relating to specific controls are shared between multiple parties, enough detail is documented to provide clear demarcation between the parties.

The program that gives your commands to your computer's operating system.

A text messaging service component of most telephone, internet and mobile device systems. It uses standardised communication protocols to enable mobile devices to exchange short text messages.

A distinct pattern in network traffic that can be identified to a specific tool or exploit. Signatures are used by security software to determine if a file has been previously determined to be malicious or not.

Session Initiation Protocol

The theft of credit card information using card readers, or skimmers, to record and store victims' data.

Stateless Address Autoconfiguration

A legally independent company with less than a certain number of employees or financial turnover. The Australian Taxation Office defines Australian SMEs as having less than $250 million turnover.

Appliances that are able to connect to the internet via Wi-Fi or another protocol such as the Zigbee specification and can be accessed and controlled remotely from any internet-connected computer or mobile device.

An electronic device, generally connected to other devices or networks via different wireless protocols such as Bluetooth, Zigbee, NFC, Wi-Fi, LiFi, 3G, etc, that can operate to some extent interactively and autonomously.

Vehicles equipped with system driven forms of artificial intelligence.

A handheld electronic device that provides connection to a cellular network. Smartphones allow people to make phone calls, send text messages and access the internet.

A fraudulent text message sent by a deceitful or dishonest person in order to obtain money or something else of value.

Simple Network Management Protocol

The methods used to manipulate people into carrying out specific actions, or divulging information.

Websites and applications that enable users to create and share content or to participate in social networking.

An act of deception and fraud committed through social media websites or applications.

An application that allows a workstation to act as a phone using a built-in or externally-connected microphone and speaker.

An element of a system including, but not limited to, an application or operating system.

A download for an application, operating system or software suite that provides fixes for features that aren't working as intended or adds minor software enhancements and compatibility.

Non-volatile media that uses non-volatile flash memory media to retain its data when power is removed and, unlike non-volatile magnetic media, contains no moving parts.

Special Publication

Unsolicited electronic messages, especially containing advertising, indiscriminately transmitted to a large number of people.

A form of phishing that targets a specific person or group.

Functionality that allows personnel to access public network infrastructure and a Virtual Private Network connection at the same time, such as an organisation’s system and the internet.

A type of attack where a message is made to look like it comes from a trusted source. For example, an email that looks like it comes from a legitimate business, but is actually trying to spread malware.

A program that collects information on the user’s activities without their consent. Spyware may be installed on a system illegitimately, or as a part of other software without the user’s knowledge.

Exploitation of a vulnerability in a database application that does not properly validate or encode user input, allowing the manipulation, exfiltration or deletion of data.

A standardised build of an operating system and associated software that can be used for servers, workstations and mobile devices.

A user who can, with their normal privileges, make only limited changes to a system and generally cannot bypass security measures.

A private actor that conducts activity on behalf of a state, for example, a contracted hacker or company.

A special-purpose programming language designed for managing data held in a relational database management system.

An individual or a business that signs a contract to perform part or all of the obligations of another's contract.

A person who is an authority in a particular area or topic. In computer science, also called a domain expert.

A cable laid on the sea bed between land-based stations to carry telecommunication signals across stretches of sea and ocean.

A control system architecture comprising computers, networked data communications and graphical user interfaces for high-level process supervisory management. It also comprises other peripheral devices like programmable logic controllers and discrete proportional-integral-derivative controllers used to interface with process plant or machinery.

Organisations, such as application developers, IT equipment manufacturers, OT equipment manufacturers, service providers and data brokers, that provide products and services. Suppliers can also include other organisations involved in distribution channels.

The act of browsing the internet by going from one web page to another web page using hyperlinks in a web browser.

An email that is potentially malicious.

A message that is potentially malicious.

A video that is potentially malicious.

Symmetric encryption algorithms are algorithms for cryptography that use the same cryptographic keys for both the encryption of plaintext and the decryption of ciphertext data. Symmetric encryption algorithms may operate in various modes which apply either stream or block ciphers.

A related set of hardware, software and supporting infrastructure used for the processing, storage or communication of data and the governance framework in which it operates.

System administration refers to the management of one or more hardware and software systems. Also referred to as 'sys admin'.

A system (or application) administration role performed by a privileged user that hold a position of trust.

The classification of a system is the highest classification of data which the system is authorised to store, process or communicate.

Critical infrastructure or essential service

The executive responsible for a system.

A document that describes a system and its associated controls.

A system’s system security plan, cyber security incident response plan, continuous monitoring plan, security assessment report, and plan of action and milestones.

A portable computer that uses a touch screen as its primary input device. Most tablets are slightly smaller and lighter than the average laptop.

When an individual or business willfully and intentionally falsifies information on a tax return to limit their tax liability.

The transfer of signals over distances.

The automatic measurement and transmission of data collected from remote sources. Such data is often used within systems to measure the use, performance and health of one or more functions or devices that make up the system.

A device that is used for point-to-point communication over a distance. This includes digital and IP telephony.

A system designed primarily for the transmission of voice communications.

A short name referring to investigations and studies of compromising emanations.

IT equipment that has been specifically designed to minimise TEMPEST emanations.

An individual or organisation that conducts malicious activity, such as cyber espionage, cyber attacks or cyber-enabled crime.

Traffic Light Protocol

Recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction.

A device that has been configured to automatically filter and control the flow of data.

The Traffic Light Protocol is a set of Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) designations used to ensure that information is shared with the correct audience.

A system that facilitates the transfer of data, in one or multiple directions (low to high or high to low), between different security domains.

Transport layer security is a widely adopted security protocol designed to facilitate privacy and data security for communications over the internet.

An IPsec mode that provides a secure connection between two endpoints by encapsulating an IP payload.

A type of malware or virus disguised as legitimate software, which is used to hack into the victim's computer.

A person or system formally identified as being capable of reliably producing data meeting certain defined parameters, such as a maximum data classification and reliably reviewing data produced by others to confirm compliance with certain defined parameters.

An IPsec mode that provides a secure connection between two endpoints by encapsulating an entire IP packet.

A form of multi-factor authentication (see definition) to confirm a user's claimed identity by combining two different pieces of evidence.

The technical term for the web address (location) of an internet resource such as a website or an image within a website.

Computer code with known security weaknesses.

Unprivileged accounts include unprivileged user accounts and unprivileged service accounts.

Unprivileged operating environments are those used for activities that do not require privileged access, such as reading emails and browsing the web.

Most often refers to a free Wi-Fi network, like at a café or shop.

An area not certified to the physical security requirements for a Security Zone Two to Security Zone Five area, as defined in the Department of Home Affairs’ Protective Security Policy Framework, Entity facilities policy, to allow for the processing or storage of classified data.

Any IT equipment that an organisation does not trust. For example, unknown IT equipment (which might belong to malicious actors), or an uncontrolled personal mobile device of an employee.

An act of updating something or someone or an updated version of something.

Universal Serial Bus

A small piece of hardware that stores data, sometimes called a jump drive, thumb drive or flash drive.

An individual that works for an organisation and is authorised to access a system.

User accounts include privileged user accounts and unprivileged user accounts.

The overall experience of a person using a product such as a website or computer application, especially in terms of how easy or pleasing it is to use.

The means by which the user and a computer system interact, in particular the use of input devices and software.

Confirmation (through the provision of strong, sound, objective evidence) that requirements for a specific intended use or application have been fulfilled.

An access method for cyber operations.

Confirmation, through the provision of objective evidence, that specified requirements have been fulfilled.

Network devices and other IT equipment grouped logically based on resources, security or business requirements instead of their physical location.

A network that maintains privacy through a tunnelling protocol and security procedures. Virtual Private Networks may use encryption to protect network traffic.

Simulation of a hardware platform, operating system, application, storage device or network resource.

A type of malware. Viruses spread on their own by attaching code to other programs, or copying themselves across systems and networks.

A type of media, such as random-access memory, which gradually loses its data when power is removed.

A weakness in a system’s security requirements, design, implementation or operation that could be accidentally triggered or intentionally exploited and result in a violation of the system’s security policy.

A vulnerability assessment can consist of a documentation-based review of a system’s design, an in-depth hands-on assessment or automated scanning with software tools. In each case, the goal is to identify as many vulnerabilities as possible.

The process of identifying, prioritising and responding to vulnerabilities.

Wide Area Network

Setting up a fake website (or compromising a real one) in order to infect and exploit visiting users.

Web Content Management

A technique used in non-volatile flash memory media to prolong the life of the media. As data can be written to and erased from memory blocks a finite number of times, wear-levelling helps to distribute writes evenly across each memory block, thereby decreasing wear and increasing its lifetime.

AKA wearables

A reference to a web resource that specifies its location on a computer network and a mechanism for retrieving it. Formally a Uniform Resource Locator (URL).

In computing, a client-server computer program that the client runs in a web browser.

A video camera connected to a computer, allowing its images to be seen by internet users.

Illegitimate changes made to the appearance and content of a website. Often likened to graffiti or online vandalism.

Wired Equivalent Privacy

A highly-targeted form of spearphishing that is aimed at senior executives within an organisation.

An ethical computer hacker, or a computer security expert, who specialises in penetration testing and in other testing methodologies to legally and legitimately ensure the security of an organisation's information systems. See also ‘black hat’ and ‘grey hat’.

A set of wireless communication protocols that can transmit traffic to Wi-Fi enabled devices within a local area. A Wi-Fi enabled device such as a laptop or mobile device can connect to the internet when within range of a wireless network connected to the internet. An area covered by one or more Wi-Fi access points is commonly called a hotspot.

A protocol designed for communicating data over wireless networks.

A protocol designed to replace the Wi-Fi Protected Access protocol for communicating data over wireless networks.

A protocol designed to replace the WPA2 protocol for communicating data over wireless networks.

A telecommunications network or computer network that extends over a large geographical distance.

A crime in which a person concocts a scheme to defraud or obtain money based on false representation or promises.

Telecommunication involving signals transmitted by radio waves rather than over wires, also: the technology used in radio telecommunication.

A device which enables communications between wireless clients. It is typically also the device which connects wired and wireless networks.

The transmission of data over a communications path using electromagnetic waves rather than a wired medium.

A wireless distribution method for two or more devices that use radio communications and often includes an access point to the internet.

A network based on the 802.11 standards.

An organisation that supports women in their science, technology, engineering or maths (STEM) careers. They help women by educating high school girls about the opportunities in STEM, as well as providing networking and education for professionals.

A stand-alone or networked single-user computer.

Self-replicating malware that uses a network to distribute copies of itself to other computer devices, often without user intervention. Worms need not attach themselves to existing programs.

X11, also known as the X Window System, is a basic method of video display used in a variety of operating systems. X11 forwarding allows the video display from one device to be shown on another device.

An exploitable software vulnerability that hasn’t been disclosed or patched by the software vendor yet.