CyberStack

Knowledge

AllIRacsc-glossaryau-compliancecloudconceptscryptodetectiondnsframeworkshardeningidentityloggingmalwarenetworkpractitionerprivacythreat-intelvulnerability

145 entries

IR hardening acsc-glossary

3-2-1 backups

Three copies, two media, one off-site. Immutable or offline beats a snapshot the ransomware also encrypted.

network dns

A record

Name to IPv4 address. The record people mean when they say the IP for the site.

network dns

AAAA record

Name to IPv6 address. Four As. Still forgotten in allow-lists that only list v4.

au-compliance frameworks acsc-glossary

ACSC

The Australian Cyber Security Centre, part of ASD. Alerts, advice, assistance. cyber.gov.au and 1300 CYBER1.

crypto concepts hardening

AES

NIST block cipher. 128-bit blocks, keys of 128, 192, or 256 bits. The algorithm is solved. Mode and key handling are the work.

crypto concepts hardening

AES-GCM

AES in Galois/Counter Mode. Confidentiality plus an integrity tag. This is the AES you actually want.

au-compliance acsc-glossary

ASD

Australian Signals Directorate. Foreign signals intelligence and, through the ACSC, national cyber security.

concepts acsc-glossary

Advanced persistent threat (APT)

A campaign with a pattern, not a single file. Often patient, often aimed, sometimes state-linked. The persistence is the point.

malware acsc-glossary

Adware

Software that pushes ads. Sometimes you agreed. Sometimes the installer lied. Either way it is extra code on the box.

network hardening acsc-glossary

Air gap

Physically isolated. No cable, no Wi-Fi, no 'just this jump host' to the internet. Removable media is still a path if you let it be.

detection hardening acsc-glossary

Antivirus

Software that looks for known-bad and obvious malice, then tries to stop and clean it. Necessary. Not sufficient.

concepts hardening acsc-glossary

Attack surface

Everything a hostile party can reach: apps, IT, OT, services. Bigger surface, more raffle tickets.

identity acsc-glossary

Authentication

Prove who is knocking. Users, services, and devices all count. A username is a claim, not a proof.

identity acsc-glossary

Authorisation

What the proven identity is allowed to do. Authn is who. Authz is how far.

network dns concepts

Authoritative vs recursive DNS

One holds the zone. The other hunts for an answer and caches it. Mixing them up is how outages get misread.

concepts acsc-glossary

Availability

Authorised users can actually use the system when the work needs it. Uptime theatre without backups is a bet.

network detection

BGP

Border Gateway Protocol. How networks exchange routes. A hijack shows up as an unexpected origin ASN or RPKI invalid.

IR hardening acsc-glossary

Backup

A copy stored somewhere else so you can restore after loss. If ransomware can reach it with the same credentials, it is not a backup.

network hardening identity

Bastion host

Jump host. The one box allowed to administer the rest. Harden it like it holds the keys.

detection IR network

Beaconing

Regular callbacks from a host that should be quieter. Interval plus jitter, not a perfect metronome.

malware network acsc-glossary

Botnet

A herd of hijacked devices taking orders. Spam, floods, miners, and stuffing logins all rent the same cattle.

identity acsc-glossary

Brute force

Try all the guesses until one works. Rate limits, MFA, and long secrets make this expensive. Shame is free.

identity IR acsc-glossary

Business email compromise

Email fraud aimed at an organisation's money or data. Invoice redirection is the local dialect.

network dns hardening

CAA record

Which certificate authorities may issue for this domain. A DNS policy, not a certificate.

concepts acsc-glossary

CIA triad

Confidentiality, integrity, availability. Lose one and the system is already failing, even if the dashboard is green.

network concepts

CIDR

Classless Inter-Domain Routing. Addresses plus a prefix length. 203.0.113.0/24, not class C.

vulnerability frameworks

CISA KEV

Known Exploited Vulnerabilities catalogue. If it is here, someone is using it. Treat exposure as urgent.

network dns

CNAME

An alias: this name is that name. People sometimes say "C record"; they mean CNAME. There is no DNS type called a C record.

concepts vulnerability

CVE vs CVSS

CVE names a vulnerability. CVSS scores a model of severity. Neither tells you if you are exposed or if it is being used.

crypto concepts network

ChaCha20-Poly1305

The other modern AEAD. A stream cipher plus a tag. First-class in TLS 1.3, especially where AES hardware is missing.

detection IR network

Command and control

C2. How the operator talks to a compromised host after they are in. DNS, HTTPS, and traffic that looks like SaaS are common.

concepts acsc-glossary

Confidentiality

The right eyes only. Encryption, access control, and not leaving copies in the wrong tray.

identity acsc-glossary

Credential stuffing

Reuse leaked username/password pairs on other sites. Your 'unique' login was the same as the breach last year.

network concepts

DHCP

Dynamic Host Configuration Protocol. Addresses and options handed out on the LAN so you do not type them.

identity hardening acsc-glossary

DMARC, DKIM, and SPF

Three DNS records. Receivers use them together so your domain is harder to wear.

network dns concepts

DNS

The internet's name system. Stub asks recursive; recursive walks to authoritative. Analysts live in the query log.

network dns detection

DNS spoofing

A fake DNS answer wins. Cache poisoning is the recursive version. Logging and resolver choice matter.

dns detection network

DNS tunnelling

Data moved through DNS queries and answers. Detection is odd volume, long labels, and unusual types.

network dns hardening

DNSSEC

Signatures on DNS data. Authenticity and integrity of answers. Not a VPN. Not HTTPS.

IR au-compliance acsc-glossary

Data breach

Data lost, peeked, changed, or leaked without authorisation. In Australia the NDB clock may also be running.

detection hardening

Data loss prevention

DLP. Stop or log sensitive data leaving through the paths you actually instrumented. Policy plus telemetry, not a magic classifier.

identity hardening acsc-glossary

Default passwords

The password the vendor shipped. Fine for unboxing. Malpractice if it is still there at go-live.

hardening concepts acsc-glossary

Defence in depth

Stacked controls so one failure is not game over. Redundancy, not twelve dashboards of the same alert.

identity acsc-glossary

Dictionary attack

Guessing with a list of likely passwords instead of every possible string. 'Password1' is in the book. Yours should not be.

network IR acsc-glossary

Distributed denial of service (DDoS)

Many compromised machines, one target, a flood. Availability dies; the data may still be fine. That is not comfort during checkout.

dns detection IR

Domain generation algorithm

Malware derives many domains so blockers lag. Hunt high NXDOMAIN and labels that look generated, not a brand.

malware acsc-glossary

Drive-by download

Hostile code lands because you visited. No attachment required. The click was the URL.

detection IR

EDR

Endpoint detection and response. Behaviour plus the ability to isolate. An agent without an owner is inventory.

cloud concepts acsc-glossary

Encryption

Turn readable data into ciphertext with an algorithm and a key. The keys are the asset. A key taped to the data is theatre.

frameworks au-compliance hardening

Essential Eight

ASD's baseline of eight mitigation strategies. Maturity 0 to 3. The work is picking a level you can actually hold.

practitioner au-compliance hardening frameworks

Essential Eight evidence

How to show you actually did the Essential Eight. Scope, artefact, date, owner. Overall maturity is the weakest strategy, not the average.

detection IR network

Exfiltration

Data leaving. Bulk, slow, or stuffed into a protocol nobody is watching. DLP is a control; logs are how you know.

network dns detection

Fast flux

A hostname whose A or NS answers keep rotating. A resilience trick used by some botnets. Short TTL plus churn.

network hardening acsc-glossary

Firewall

A filter on the way in and out, driven by rules. Default allow is a very expensive switch.

network hardening concepts

HTTP Strict Transport Security

A header that tells the browser: this host is HTTPS only, for a while. Preload is a one-way door.

crypto concepts privacy cloud

Homomorphic encryption

Compute on ciphertext and get an encrypted result. The processor never sees the plaintext. Specialised, not a swap for AES.

detection acsc-glossary

Honeypot

A decoy built to attract hostile attention so you can study it. Not a substitute for patching production.

IR detection

IR playbook

A written path for a class of incident. Roles, decisions, and evidence. Not a novel, and not a blank page at 2 a.m.

practitioner au-compliance frameworks cloud

IRAP

Infosec Registered Assessors Program. ASD-endorsed assessors test systems and cloud against the ISM. The report is evidence. Authorisation stays with you.

frameworks

ISO/IEC 27001

A management system standard. The certificate is proof you run the system, not that you are unbreachable.

identity acsc-glossary

Identity and access management

Join, move, leave. Who you are, how you prove it, what you may do, and how that ends when the job does.

identity acsc-glossary

Identity theft

Someone uses your personal details to commit fraud. The cleanup outlasts the incident ticket.

IR

Incident response

Prepare, detect, contain, recover, learn. The first hour is decisions and evidence, not a slide template.

detection IR threat-intel

Indicator of compromise

An artefact that suggests a compromise: a hash, a name, an address, an email. Useful. Not a strategy.

frameworks au-compliance acsc-glossary

Information Security Manual (ISM)

ASD's control catalogue for Australian government and anyone who wants the same language. Applicability is the work.

identity IR acsc-glossary

Insider threat

Harm from someone who already had the keys — malice, negligence, or a very bad accident. The badge was valid.

concepts acsc-glossary

Integrity

The record is what authorised people made it. Quiet alteration is still a breach.

detection network acsc-glossary

Intrusion detection system (IDS)

Watches for unwanted activity and tells someone. Host or network. Alert without an owner is a screensaver.

detection network acsc-glossary

Intrusion prevention system (IPS)

IDS with a fist. Identifies unwanted traffic and can block it in the moment. Mis-tune it and you become the outage.

malware identity acsc-glossary

Keylogger

Software (or hardware) that records typing. Credentials and payments are the usual prize. This desk does not document how to build one.

detection IR identity

Lateral movement

After the first box, they walk. Credentials, remote admin, and trust you already granted.

identity hardening acsc-glossary

Least privilege

Only the access required, only for as long as required. Standing admin is standing blast radius.

detection IR

Living off the land

Use the admin tools already on the box. PowerShell, WMI, bash, cloud CLIs. No new malware required.

logging detection IR acsc-glossary

Logging

Time-stamped records of what happened. Collect what can answer a question. If it never gets queried, it is storage spend.

identity detection

MFA fatigue

Bombard the user's phone with push prompts until they tap Allow. MFA still on. Judgement off.

detection frameworks

MITRE ATT&CK

A knowledge base of adversary tactics and techniques. Use it to find detection gaps, not to decorate a slide.

network dns

MX record

Where mail for this domain should be handed. A hostname and a preference, not an IP in the MX itself.

malware acsc-glossary

Malvertising

The ad network is the delivery path. A 'legitimate' page, a hostile creative.

malware concepts acsc-glossary

Malware

Software that is there to harm you: steal, lock, spy, or hitch a ride. Virus, worm, Trojan, ransomware — different delivery, same job.

identity acsc-glossary

Multi-factor authentication

Two or more different factor types: know, have, or are. SMS counts. So does intercepting it. Aim for phishing-resistant.

crypto network identity hardening

Mutual TLS (mTLS)

TLS where both sides present a certificate. The server is not the only one who has to prove who they are.

practitioner au-compliance IR

NDB clock

The Notifiable Data Breaches assessment and notify clocks. OAIC, not a breach tray. Thirty days to assess a suspicion; notify as soon as practicable once it is eligible.

frameworks

NIST Cybersecurity Framework

Identify, Protect, Detect, Respond, Recover — plus Govern in 2.0. A common language, not a certification.

network dns

NS record

Which nameservers are authoritative for this zone. Delegation lives here.

identity hardening acsc-glossary

Need-to-know

Access only to the data the role actually requires. Broad file shares are a rumour mill with NTFS.

network detection

NetFlow

Who talked to whom, when, how much. Metadata, not payload. Cheap enough to keep.

network concepts

Network address translation

NAT. Rewrite addresses, and usually ports, at a boundary. Many inside, one outside. Not a firewall policy by itself.

detection network IR

Network detection and response

NDR. Watch the wire or the flow for threat behaviour, not just known signatures. Complements EDR. Does not replace it.

network hardening acsc-glossary

Network segmentation

Cut the network into smaller pieces. Segregation is the rule set between them. Flat is a gift.

identity

OpenID Connect

OIDC. Identity layer on OAuth 2.0. ID tokens for who the user is. Access tokens for APIs.

network dns

PTR record

Reverse DNS. Address back to a name, under in-addr.arpa or ip6.arpa.

network detection IR

Packet capture

The packets, on disk. Ground truth for a window of time. Heavy, precise, and easy to collect too late.

dns detection threat-intel

Passive DNS

Historical DNS answers observed by sensors. Pivot on an IOC. Not a replacement for a live lookup.

identity acsc-glossary

Passphrase

A string of words used as a secret. Longer beats clever. Unique beats reused.

identity acsc-glossary

Password

A character string used as a secret. Reuse is how one breach becomes twelve logins.

identity acsc-glossary hardening

Password manager

Generates unique secrets and stores them in a vault. One strong unlock. Not a spreadsheet called passwords_final.

identity acsc-glossary

Password spraying

A few common passwords, a lot of accounts. Misses lockout, hits whoever used SeasonYear!.

vulnerability hardening acsc-glossary

Patch

A vendor fix for a hole or a defect. Installing it is patching. Explaining why you did not is an exception with an expiry date.

detection IR

Persistence

Still there after reboot, password change, or the first cleanup. Scheduled tasks, tokens, and legitimate-looking remote access.

identity acsc-glossary

Pharming

Traffic sent to a fake site by tampering, not by a clicked lure. The URL bar can still lie if DNS or the host file does.

identity concepts acsc-glossary

Phishing

A bulk lure: fake message, urgency, a credential or a hostile file. Training helps. Phishing-resistant MFA and mail authentication help more.

au-compliance IR

Privacy Act and OAIC

Australian privacy law and the regulator. Eligible data breaches must be assessed and, if they meet the test, notified.

identity hardening

Privileged access management

PAM the program: vault the admin passwords, broker the sessions, record them. Not the same as Linux PAM, the Unix login modules. People say both.

identity hardening acsc-glossary

Privileged user

Someone who can change or sidestep security controls. Developers who can bypass a guardrail count.

practitioner au-compliance frameworks

Protective Security Policy Framework

The Australian Government protective security policy for non-corporate Commonwealth entities. Governance, information, personnel, physical — and a cyber floor that points at Essential Eight.

IR malware acsc-glossary

Ransomware

Hostile software that locks your data or systems and bills you to get them back. Often also steals a copy first. Restore beats negotiation as a control.

practitioner au-compliance IR

Ransomware payment reporting

Cyber Security Act 2024 Part 3. If you pay, or someone pays for you, the clock is 72 hours. ASD takes the form; Home Affairs watches compliance.

network identity acsc-glossary

Remote access

Coming in from outside the organisation's network, usually through a gateway. Treat it as privileged even when the user is not.

malware acsc-glossary

Rootkit

Tooling that grabs high privilege and then hides. If you only look where it wants you to look, you will miss it.

identity

SAML

Security Assertion Markup Language. XML assertions from an identity provider so a service can skip local passwords.

detection logging

SIEM

Security information and event management: collect, normalise, correlate, alert. Useless if nobody owns the queue.

network dns

SOA record

Start of authority. One per zone. Serial, timers, and who is supposed to be in charge.

detection IR

SOAR

Orchestration and response. Automate the boring. Keep a person on steps that isolate a host or disable an account.

practitioner au-compliance frameworks

SOCI Act obligations

Security of Critical Infrastructure Act 2018, high level. Positive security obligations, cyber incident reporting, and extra duties if you are a System of National Significance.

network dns

SRV record

Service location: this protocol on this domain lives at that host and port.

hardening detection acsc-glossary

Sandbox

A paddock for untrusted code. If it explodes, the paddock takes it. Production is not a paddock.

detection IR

Security operations centre

People, detections, and a queue. A room full of screens is optional. Ownership of after-hours is not.

identity acsc-glossary

Smishing (SMS scam)

Phishing that arrives as a text. Postage, ATO, missed-parcel energy. The link is the problem.

identity concepts acsc-glossary

Social engineering

Manipulate a person, skip the software flaw. Phishing, vishing, BEC, and the helpdesk reset are all this family.

concepts acsc-glossary

Spam

Unsolicited bulk messages, usually ads. Not all spam is phishing. Plenty of phishing rides in the same tray.

identity acsc-glossary

Spear phishing

Phishing with a name on it. Aimed at a person or a small group, usually with enough context to look like Tuesday.

identity network acsc-glossary

Spoofing

A message or identity dressed as a trusted source. Email, SMS, caller ID, and websites all do this cheaply.

malware acsc-glossary

Spyware

Software that watches what you do without a real yes. Sometimes bundled. Sometimes smuggled.

network dns concepts

TTL

Time to live. How long a resolver may cache this answer. Seconds, not a promise the world forgets on cue.

network dns

TXT record

Free-form text on a name. SPF, DKIM, and DMARC live here. So does a lot of vendor noise.

practitioner au-compliance hardening

Third-party and supply chain

You can outsource the work. You cannot outsource the risk. Cloud shared responsibility, IRAP evidence, and ISM procurement sit on the same desk as the incident.

detection IR threat-intel

Threat hunting

Assume they are already in. Ask a question of your logs. Not a dashboard tour.

detection concepts

Threat intelligence

Context that changes a decision. IoCs expire. TTPs last. A feed you never action is a newsletter.

network concepts crypto acsc-glossary

Transport Layer Security (TLS)

The S in HTTPS. Stops eavesdropping, tampering, and forgery on the wire. TLS 1.3 is the current protocol.

malware acsc-glossary

Trojan

Hostile software dressed as something you meant to run. The gift is the rest of the program.

network concepts

VLAN

Virtual LAN. A broadcast domain with a tag. Segmentation only if the rest of the design agrees.

network acsc-glossary

Virtual private network (VPN)

A tunnel plus some discipline. Encryption is common. A full-trust badge on the far side is optional and usually a mistake.

malware acsc-glossary

Virus

Hostile software that hitchhikes: it attaches to other programs or copies itself across systems. Needs a host. Still not a metaphor for every pop-up.

identity acsc-glossary

Vishing

Social engineering on a phone call. They are not Microsoft, the ATO, or your bank's fraud team.

vulnerability concepts acsc-glossary

Vulnerability

A weakness in requirements, design, build, or operations that can be tripped or abused and break the security policy.

vulnerability hardening acsc-glossary

Vulnerability management

Find, rank, fix, check. Known-exploited and exposure beat a 400-page scanner PDF.

malware concepts acsc-glossary

Watering hole

Poison a site your targets already visit. The prey comes to the water. Patching and isolation still apply.

network hardening detection

Web application firewall

WAF. A reverse proxy that tries to stop common web attacks before the app. Rules, not a rewrite of the application.

identity acsc-glossary

Whaling

Spear phishing aimed at senior executives. The invoice looks like their job. The bank details do not.

malware acsc-glossary

Worm

Self-copying hostile software that uses the network as a tram. Often no click required once it is inside.

network identity concepts

Zero trust

Never trust, always verify. A VPN badge is not a day pass. Identity, device, path, and data each get asked again.

vulnerability acsc-glossary

Zero-day

A usable flaw the vendor has not disclosed or patched yet. Your window is not a blog post. It is exposure.

Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary