Principles of Cybersecurity

Privacy, Trust and Freedom of Information

🎯 (EC-11-03, EC-11-07)

📌 Explain privacy, trust and freedom of information with respect to people, systems and data

Three ideas sit underneath everything in cybersecurity: privacy (who controls information about a person), trust (the confidence that people, systems and data will behave as expected) and freedom of information (the public's right to see what governments hold). They support each other, but they also pull against each other, which is why laws and enterprise policies have to balance them.

Privacy

Privacy is a person's ability to decide how information about them is collected, used, shared and kept. It is about control, not secrecy: you are happy for your bank to know your balance, but not for a stranger to. In Australia the Privacy Act 1988 (Cth) protects personal information, defined as information or an opinion about an identified individual, or an individual who is reasonably identifiable. A name is personal information, but so can be a licence number, a photo or a combination of postcode, birth date and job title. Sensitive information, such as health, racial or ethnic origin, religious belief and biometric data, gets stronger protection. The Act binds Australian Government agencies and most organisations with an annual turnover over $3 million, plus some smaller ones such as health service providers. Its 13 Australian Privacy Principles are covered in the next section, and the Office of the Australian Information Commissioner (OAIC) enforces them. NSW public sector agencies, including public schools, are covered by the Privacy and Personal Information Protection Act 1998 (NSW), and health information by the Health Records and Information Privacy Act 2002 (NSW).

Trust

Trust is what makes people hand over data at all. An enterprise earns it by being open about what it collects, protecting it and owning up when something goes wrong. Trust is slow to build and quick to lose: after a breach, customers leave, partners ask hard questions and regulators investigate. Trust also applies to the technology itself. A browser trusts a website because a certificate authority has vouched for it; a bank trusts a login because a second factor confirms it; a manager trusts a report only if the data behind it is accurate and comes from a known source. Modern security designs often assume zero trust: no user or device is trusted just for being inside the network, and every request is checked.

Freedom of information

Freedom of information (FOI) is the right to access documents held by government. It exists so that citizens can hold governments accountable. Under the Freedom of Information Act 1982 (Cth) a person can ask for documents held by Australian Government agencies and ministers. In NSW the Government Information (Public Access) Act 2009 (the GIPA Act) covers state agencies, councils, universities and ministers. The GIPA Act works on a presumption in favour of disclosure and offers four pathways: open access information that agencies must publish, information proactively released, informal release on request, and a formal access application. An agency may refuse or redact information when there is an overriding public interest against disclosure, and an unreasonable impact on someone's privacy is one such consideration. FOI laws do not generally apply to private companies. To see what a company holds about you, you use the access principle in the Privacy Act (APP 12).

People, systems and data

The syllabus asks you to consider all three ideas with respect to people, systems and data. The table pulls this together.

Further reading: OAIC: your privacy rights and OAIC: freedom of information. The NSW Information and Privacy Commission (IPC) regulates GIPA and the NSW privacy laws.

Privacy and Security Principles

🎯 (EC-11-03, EC-11-04)

📌 Describe privacy and security principles associated with access, storage and permissions used by enterprises to collect and interpret data

Enterprises collect data to run services and to interpret it: to spot buying trends, predict demand or personalise offers. Doing this responsibly rests on principles that govern who can access data, how it is stored and what permissions people have given. In Australia, the 13 Australian Privacy Principles (APPs) in the Privacy Act 1988 set the legal baseline, and good security practice adds technical principles on top.

Access principles

Access control answers the question "who can see or change this data?" Four principles guide the answer.

• Least privilege: every user and program gets the minimum access needed for the job, and no more. A front-desk worker can read appointments but not clinical notes.
• Need to know: even a person with a high clearance sees information only when their task needs it.
• Role-based access control (RBAC): permissions are attached to roles (receptionist, doctor, manager) and people are assigned roles, which makes access easier to manage and audit than granting rights person by person.
• Separation of duties and accountability: no single person can complete a sensitive process alone, and audit logs record who accessed what and when. Authentication (proving who you are) comes before authorisation (deciding what you may do).

Notice that no role has every permission. The IT administrator can keep the system running without reading patient records, and a stolen receptionist password cannot expose clinical notes.

Storage principles

Where and how data is kept matters as much as who can open it.

• Data minimisation: collect only what you need. Data you never collected cannot be stolen. APP 3 limits collection to information reasonably necessary for the organisation's functions.
• Encryption: protect data at rest (in databases and on devices) and in transit (across networks), so stolen files are unreadable without the key.
• Retention and secure destruction: keep data only as long as it is needed for the purpose or required by law, then destroy or de-identify it (APP 11.2). Old data that nobody uses is all risk and no benefit.
• Location and third parties: APP 8 makes an organisation accountable when personal information is disclosed to an overseas recipient, such as a cloud provider, so contracts and locations must be checked.
• Classification and backup: label data by sensitivity (public, internal, confidential) so controls match the risk, and keep protected backups so the data survives failure.

Permissions and consent

Permissions cover what people have allowed an enterprise to do with their data. Valid consent is informed, voluntary, current and specific, and cannot be hidden in a huge terms-and-conditions page. Related principles:

• Purpose limitation (APP 6): use or disclose data only for the purpose it was collected for, unless the person consents or another exception applies.
• Notice and transparency (APP 1 and 5): tell people what is collected, why, and who receives it, usually through a collection notice and a privacy policy.
• Choice and control: allow opt-out from direct marketing (APP 7) and let people access and correct their information (APP 12 and 13).
• App permissions: mobile apps and platforms should request only the permissions (location, contacts, camera) that their function needs.

Collecting and interpreting data

Interpreting data raises its own privacy issues. Combining datasets can re-identify people from data that was supposedly anonymous: a "de-identified" record with postcode, birth date and gender might still point to one person. Profiling can also lead to unfair decisions if the data or the algorithm is biased. Sound practice is to analyse aggregated or de-identified data where possible, restrict who can join datasets, and use data only for purposes people would reasonably expect.

Protecting Your Own Data

🎯 (EC-11-03, EC-11-07)

📌 Investigate how an individual can contribute to maintaining the privacy of their own data

Enterprises cannot protect your data alone. Most account takeovers begin with a stolen or reused password, a phishing message or an out-of-date device, and these are things an individual controls. Investigating what a person can do means comparing the actions by how much protection each gives, what it costs in effort, and what it cannot do.

Accounts: passphrases, password managers and MFA

A passphrase is a long secret made of several random words. Length beats complexity: four or more randomly chosen words are easier to remember and much harder to guess than a short password full of symbols such as P@ssw0rd!, which attackers' tools already try. The cyber.gov.au guidance from the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) recommends passphrases, and the key rule is that every account needs a different one. Nobody can remember dozens of unique passphrases, so use a password manager: it generates and stores a unique secret for each site, and only fills it in on the real address, which also helps against fake login pages. Protect the manager itself with a strong passphrase and MFA.

Multi-factor authentication (MFA) asks for something you know (a passphrase) plus something you have (an authenticator app, security key or passkey) or something you are (a fingerprint). Even if a criminal steals your password, they still need the second factor. Authenticator apps, security keys and passkeys resist phishing better than SMS codes, but any MFA is far better than none. Turn it on first for email, because email can reset every other account.

Settings, updates and sharing

• Privacy settings: set social accounts to private, limit who can see posts, tags and location, and switch off location sharing you do not need. Review settings after app updates, because defaults sometimes change.
• App permissions: a torch app that asks for your contacts and microphone is a warning sign. Grant only what the function needs, and remove apps you no longer use.
• Software updates: updates fix known flaws that criminals actively exploit. Turn on automatic updates for your phone, computer and apps.
• Digital footprint: anything posted can be copied, screenshotted and searched, and can be used to guess passwords, security questions or to build a convincing scam. Post as if a stranger and a future employer will read it, because they might.
• Public Wi-Fi: avoid logging in to sensitive accounts on open networks. Use mobile data or a VPN, and see the evil twin animation in the social networking section.
• Backups: keep copies of important photos and files so ransomware or a lost phone does not become a disaster.

Recognising scams

Scammers rely on emotion, not technology: urgency ("your account will be closed today"), fear (fines, police), reward (prizes, refunds) and authority (a bank, the ATO, a parcel courier). Warning signs include unexpected contact, pressure to act immediately, a request for passwords, codes or gift cards, payment by cryptocurrency, and a link that does not match the real organisation's address. Good habits are to stop, verify through a number or app you already trust, never share MFA codes, and report it. Scamwatch lists current scams and how to protect yourself.

If something goes wrong

1. Change the affected password from a clean device and turn on MFA; sign out other sessions.
2. Check where else the same password was used and change those too.
3. Contact your bank straight away if money or card details are involved.
4. Report the incident to ReportCyber (through cyber.gov.au) and to Scamwatch if it was a scam; the eSafety Commissioner helps with image-based abuse and cyberbullying.
5. If identity documents were exposed, contact IDCARE, Australia's not-for-profit identity and cyber support service.
6. Use a breach-notification service such as Have I Been Pwned to learn when your email address appears in a known breach.

Judgement: which actions matter most?

A reasonable judgement is that the biggest gains come from the first two rows: unique passphrases plus MFA on email and banking. They stop the most common route into an account for very little effort. The other actions cover gaps that those two cannot, so together they form a set of layers.

Social Networking Vulnerabilities

🎯 (EC-11-03, EC-11-07)

📌 Explore security vulnerabilities of social networking to both an individual and an enterprise

• account access
• account behaviour
• hosting platform security
• identity theft
• phishing
• evil twins

Social networking platforms hold huge amounts of personal information and connect strangers to each other, which makes them useful to criminals. The weaknesses fall into a few groups: how accounts are accessed, how people behave on them, the security of the platform itself, and the crimes that follow, such as identity theft, phishing and evil twin networks. Each affects both an individual and an enterprise that uses social media for marketing, customer service or recruitment.

Account access

An account is only as safe as the way it is unlocked. Common weaknesses are weak or reused passwords, no MFA, accounts left logged in on shared devices, and recovery routes that are easier to attack than the login, such as a mobile number or an email address that has itself been compromised. Attackers use credential stuffing: they take email and password pairs leaked from one breach and automatically try them on other sites, betting that people reuse passwords. Another route is SIM swapping, where a criminal convinces a mobile provider to move your number to their SIM so they receive your SMS reset codes.

Individual: a takeover lets the attacker read private messages, impersonate you to your friends and lock you out. Enterprise: a hijacked brand account can post scams or offensive content in the company's name, and a shared login with no accountability means nobody knows who did what.

Account behaviour

How people use the account creates risk even when the login is strong. Oversharing gives attackers the raw material for social engineering: a birthday, pet's name, school, workplace, holiday dates and location tags can answer security questions or make a scam convincing. Accepting friend requests from strangers, joining fake competitions and quizzes, clicking links in messages and granting third-party apps broad permissions all widen the attack surface. Fake or cloned profiles copy a real person's photos to trick their contacts into sending money or clicking a link.

Enterprise: employees who post photos of their workplace can accidentally show screens, badges or systems; job titles and org charts on professional networks help an attacker choose whom to impersonate. A social media policy and training address this.

Hosting platform security

Users and companies rely on the platform's own security, over which they have little control. Weaknesses include software flaws, misconfigured settings, scraping of public profile data, over-broad access for third-party apps, and the platform's own staff being tricked. Two well-documented examples: in 2018 it emerged that a third-party quiz app had harvested data on up to 87 million Facebook users (Facebook's estimate) through the platform's permissions, in what became known as the Cambridge Analytica case; and in July 2020 attackers used phone-based social engineering on Twitter employees to gain access to internal tools and take over high-profile accounts to run a cryptocurrency scam. Lessons: the platform is a shared risk, so limit what you put on it and use its security features (MFA, login alerts, app-permission review).

Identity theft

Identity theft is using another person's personal information to commit fraud, such as opening accounts, taking out loans or making purchases in their name. Criminals assemble a profile from many small pieces: name and birth date from a social profile, an address from a delivery photo, an email and password from an old breach. Enough pieces let them pass a bank's identity check or reset another account. Signs include unexpected bills or credit checks, and contact from debt collectors about accounts you never opened. Dealing in another person's identification information with intent to commit an offence is a crime under the Commonwealth Criminal Code (identity crime offences). Response steps are in the earlier section, including contacting IDCARE.

Phishing

Phishing is a message that pretends to come from a trusted source to trick you into revealing information or taking an action. On social networks it arrives as a direct message from a "friend" whose account was taken over, a fake support account, or a post advertising a giveaway. The mechanics are precise:

1. The attacker spoofs a trusted identity, using a look-alike display name, a cloned profile or a compromised real account.
2. The message creates urgency or curiosity ("Is this you in this video?").
3. The link leads to a look-alike domain (for example one letter changed) hosting a copy of the real login page.
4. The victim types their credentials; the page passes them to the attacker, who logs in at once. More advanced kits relay the login to the real site in real time so the victim's MFA code is captured and used too.
5. The attacker then uses the account to send the same message to the victim's contacts, so the scam spreads because people trust friends.

Defences: check the address bar before typing a password, use a password manager (it will not fill on a fake domain), prefer passkeys or security keys, and confirm with the "friend" through another channel.

Evil twins

An evil twin is a rogue Wi-Fi access point set up to look like a legitimate one. Wi-Fi networks are identified by a name, the SSID, and anyone can broadcast any name. Phones remember networks they have joined and reconnect automatically to a known name, and open networks (no password) give the device no way to prove who is running them. So an attacker in a cafe can broadcast "Cafe_Free_WiFi" with a stronger signal, and nearby phones join without asking. All traffic then passes through the attacker's device, a man-in-the-middle position. The attacker can read unencrypted traffic, capture logins entered on a fake "sign in to Wi-Fi" page and redirect users to look-alike sites. HTTPS greatly limits the damage because content is encrypted end to end, but the attacker can still see which sites you visit and can present fake pages.

Defences: turn off auto-join for open networks, confirm the exact network name with staff, use mobile data or a VPN for anything sensitive, and prefer networks that need a password or certificate. The HTTPS handshake that limits the damage is drawn in the hardware and software protection section.

Attributes of a Cybersecurity Breach

🎯 (EC-11-03, EC-11-04)

📌 Describe the attributes of a cybersecurity breach

• confidentiality of information
• integrity of information
• availability of information
• privacy implications

A cybersecurity breach is an incident in which data or systems are accessed, disclosed, changed, destroyed or made unavailable without authorisation. Security professionals describe what has been lost using the CIA triad: confidentiality, integrity and availability. A single incident can damage more than one attribute, and whenever personal information is involved there are also privacy implications for the people it describes.

Confidentiality of information

Confidentiality means only authorised people and systems can view information. It is breached by disclosure: theft of a database, an email sent to the wrong person, a misconfigured cloud storage bucket left open to the internet, or an insider copying files. Example: the Medibank data stolen in 2022 was later published online, an extreme confidentiality failure. Controls: encryption, access control, MFA, data classification and staff training.

Integrity of information

Integrity means data is accurate, complete and has not been changed without authorisation. It is breached by alteration: an attacker editing bank details on an invoice, a user changing records they should only read, malware corrupting files, or a fake update. Integrity failures can be harder to notice than theft, because everything still appears to work. Example: in a payment-diversion scam a criminal changes the account number on a supplier's invoice so the payment lands in their account. Controls: permissions that limit who can edit, hashing and digital signatures to detect changes, audit logs, validation checks and backups to restore a known good copy.

Availability of information

Availability means information and systems are accessible when authorised users need them. It is breached by disruption: ransomware encrypting files, a denial-of-service attack flooding a website, destruction of equipment, or a failure with no backup. Example: a distribution centre whose warehouse system is locked by ransomware cannot dispatch orders, even though no data was stolen. Availability is not only about attacks: hardware failure and human error break it too. Controls: redundancy, backups and disaster recovery, DDoS protection, patching, and monitoring.

Privacy implications

When a breach exposes personal information, the harm falls on real people, and the law treats it differently from a breach of business secrets. Possible harms include identity theft, financial fraud, targeted scams, blackmail or embarrassment (especially with health information), damage to reputation, and even risks to physical safety where an address is exposed. Under the Notifiable Data Breaches scheme, a breach that is likely to result in serious harm to any individual must be reported to the OAIC and the people affected. Some harms cannot be undone: a leaked birth date, medical history or home address stays leaked, and cannot be reset like a password. Privacy implications also include loss of trust, complaints to the OAIC, and possible legal action by those affected.

Confidentiality and privacy are related but not identical. Confidentiality protects any kind of information, such as a secret product design. Privacy is specifically about individuals' control over information about them. A breach of a secret recipe is a confidentiality breach with no privacy issue; a customer list posted online is both. A privacy breach can also happen with no attack at all, such as an employee emailing a spreadsheet of client details to the wrong person.

Threat Actors and Vulnerabilities

🎯 (EC-11-01, EC-11-03)

📌 Investigate vulnerabilities exploited by the threat actor involved in a breach, such as the impact on various elements

• data
• people
• processes
• technology

A threat actor is an individual or group that poses a security threat to an individual or organisation (NESA glossary). A breach happens when a threat actor finds and exploits a vulnerability, a weakness that can be used to cause harm. Weaknesses appear in four elements of any enterprise: its data, its people, its processes and its technology. Investigating a breach means asking which element failed, how the actor exploited it, and what the impact was.

Data

Vulnerabilities: sensitive data stored unencrypted, far more data collected than needed, data kept long after its purpose has ended, cloud storage left publicly readable, and poor classification so nobody knows what is sensitive. Exploit: once inside, the actor finds large, readable stores and copies them. Impact: exposure of personal information, extortion and privacy harm. Fix: minimise, encrypt, classify and delete.

People

Vulnerabilities: staff who click phishing links, reuse passwords, share credentials, fall for phone or message impersonation, or (rarely) act maliciously. Attackers target people because it is often easier than breaking technology. Exploit: social engineering, using authority, urgency or fear. Impact: stolen credentials, malware installed, money transferred. Fix: regular training, phishing simulations, a culture where reporting a mistake is safe, and MFA so one mistake is not enough.

Processes

Vulnerabilities: gaps in how work is done: no patch schedule, accounts not removed when staff leave, one person able to approve and pay an invoice, no check before changing bank details, no tested incident-response or backup-restore plan, and weak supplier checks. Exploit: the actor finds the gap in the procedure, such as a phone call to a service desk that resets a password without verification. Impact: unauthorised access or payments that technology alone would not have stopped. Fix: documented and enforced procedures, separation of duties, verification steps and regular audits.

Technology

Vulnerabilities: unpatched software, default or weak passwords on devices, misconfigured firewalls or cloud services, internet-facing systems with no MFA, exposed application interfaces (APIs) lacking access control, old unsupported systems and no encryption. Exploit: automated scanning finds exposed systems within hours, and known flaws are exploited with ready-made tools. Impact: remote access, malware, data theft or a system outage. Fix: patching, secure configuration, MFA, monitoring and vulnerability scanning.

Threat actors

Motive shapes the target and the damage: a criminal wants data that can be sold or held to ransom; a state actor may quietly sit inside a network for months; a hacktivist wants publicity; and an insider needs no technical skill because they already have access. Hackers are also described by intent: white hat (authorised, testing security with permission), black hat (criminal) and grey hat (unauthorised but without malicious intent, and still often illegal).

How the pieces fit: one breach, four elements

Real breaches usually chain weaknesses from several elements. The OAIC has alleged in its Federal Court proceedings that Medibank's 2022 breach involved credentials belonging to a third-party service-desk worker being stolen, and that a VPN did not require a second factor. These are the regulator's allegations, not settled findings, but they illustrate how a chain forms:

1. People / technology: a staff member's login was captured by malware, and the account had wide access.
2. Technology / process: remote access without MFA let the stolen login be used from anywhere.
3. Data: a large store of customer records, including health claims data, was reachable from that account.
4. Impact: the data was copied, a ransom demand followed and, when it was not paid, information was published on the dark web.

Removing any single link, for example requiring MFA, would have made the chain much harder to complete. That is why defence uses several layers, covered in the next part.

Cybercrime Threats

🎯 (EC-11-01, EC-11-07)

📌 Investigate cybercrime threats to an enterprise

• hacking
• phishing, including smishing
• scamming
• bots and botnets
• employee action causing a vulnerability

Cybercrime is criminal activity carried out using computers and networks, or aimed at them. For an enterprise the main threats are hacking, phishing (including smishing), scams, bots and botnets, and the actions of its own employees. To investigate them, look at how each works, what it damages (confidentiality, integrity or availability), and how likely and costly it is for the kind of enterprise involved.

Hacking

Hacking is gaining unauthorised access to a computer system, network or account. Under the Criminal Code (as inserted by the Cybercrime Act 2001) unauthorised access to or modification of restricted data, and impairment of electronic communication, are offences. Hackers work in stages: they research the target, find a way in, gain higher privileges, move across the network, then steal, change or lock data. Ways in include:

• Password attacks: guessing, dictionary lists, and credential stuffing with leaked passwords.
• Exploiting software flaws: using known vulnerabilities in unpatched systems, or weaknesses in web applications such as SQL injection.
• Misconfiguration: exposed databases, open remote-access ports and default passwords.
• Malware: software installed to do harm, described below.

Phishing, including smishing

Phishing sends messages that impersonate a trusted sender to steal credentials, money or access. It scales cheaply because a criminal only needs a small percentage of recipients to respond. Variants are named after the channel or the target.

Smishing works well because people trust text messages, screens are small so a dodgy link is harder to inspect, and messages can appear in the same conversation thread as genuine ones from that organisation. Enterprise controls include email and SMS filtering, MFA, training with simulated phishing, a simple way for staff to report suspicious messages and clear rules that no one will ever be asked for a password or code by message.

Scamming

A scam is a deception designed to make the victim hand over money or information voluntarily. Enterprises are targeted by business email compromise (BEC) and invoice redirection scams, where a criminal poses as a supplier or executive and asks for a payment to a new bank account; fake tech-support or investment offers; and fake job or supplier enquiries. All exploit human trust: urgency, authority and fear of getting into trouble. Because no malware is needed and the victim authorises the payment, technical controls alone are not enough. Strong processes stop them: call the supplier back on a known number before changing bank details, and require two people to approve large payments. The National Anti-Scam Centre's Scamwatch collects reports and publishes warnings.

Bots and botnets

A bot is an infected device controlled remotely by an attacker; a botnet is a large network of bots. Criminals infect computers, phones, routers and Internet of Things (IoT) devices such as cameras, then command all of them through a command and control (C2) server. Owners often never notice. Uses include:

• Distributed denial of service (DDoS): thousands of bots send requests to one target at once until legitimate users cannot get through, a breach of availability.
• Spam and phishing: sending large volumes of messages from many addresses.
• Credential stuffing: trying stolen passwords across many sites from many addresses to avoid being blocked.
• Proxying and mining: hiding an attacker's traffic or running cryptocurrency mining at the owner's expense.

Defences include DDoS protection services and rate limiting for the target; and for device owners, changing default passwords, updating firmware and keeping IoT devices on a separate network.

Employee action causing a vulnerability

Staff have legitimate access, so their actions can open the door for attackers without any hacking. Most are negligent or accidental: clicking a phishing link, reusing a password, using an unapproved cloud service (shadow IT), plugging in an unknown USB drive, emailing sensitive data to the wrong person, losing an unencrypted laptop, or ignoring updates. A smaller number are malicious insiders, who deliberately steal data, sabotage systems or sell access. Controls include least privilege and logging, clear acceptable-use and social media policies, ongoing training, offboarding that removes access on the last day, and a no-blame reporting culture so mistakes are reported quickly.

Judgement: for most small enterprises, phishing-led account takeover and scams are the most probable threats because they need no technical skill and are cheap to attempt, while ransomware has the highest potential cost. That points to prioritising MFA, staff awareness, payment-verification processes and backups over exotic defences.

Hardware and Software Protection

🎯 (EC-11-03, EC-11-06)

📌 Research hardware and software strategies used to protect data

• isolation
• physical security
• biometrics
• password protection, encryption and permissions
• multi-factor authentication
• back up and disaster recovery
• firewalls
• antivirus and anti-malware

No single control stops every attack, so enterprises use defence in depth: several layers of hardware, software and procedure, so that when one layer fails another still protects the data. Controls are often grouped as preventive (stop it happening), detective (notice it) and recovery (restore after it). The eight strategies below cover all three groups. The Australian Signals Directorate's Essential Eight, a baseline of eight mitigation strategies, overlaps with several of them and is mapped at the end of this section.

Isolation

Isolation limits the damage an attacker can do by keeping systems apart. Network segmentation splits a network into zones (for example with VLANs), with a firewall controlling traffic between them, so that a compromised guest phone cannot reach the finance server. A DMZ (demilitarised zone) holds public-facing servers such as a web server, separate from the internal network. An air gap keeps a system with no network connection at all, used for offline backups and some critical control systems. Sandboxing runs untrusted files or programs in a contained environment, such as a virtual machine, where they cannot touch the real system, so an email attachment can be opened and studied safely. The trade-off is convenience: isolated systems are harder to update and share data with.

Physical security

If an attacker can touch a device, many software protections fail. Physical controls include locks and access cards on server rooms, CCTV, visitor sign-in and escorts, cable locks and lockable racks, secure disposal of drives and paper, and a clean-desk policy. Staff are trained to challenge tailgating, where an unauthorised person follows an employee through a secured door. Portable devices need encryption and remote-wipe in case they are lost. The controls also protect availability from fire, flood and power loss.

Biometrics

Biometrics identify people by body characteristics: fingerprint, face, iris or voice. They are convenient and hard to share or forget, so they suit the "something you are" factor in MFA. Their weaknesses matter as much as their strengths. Systems can wrongly accept an impostor (false acceptance) or wrongly reject the real person (false rejection), and tuning one error rate raises the other. A stolen password can be changed but a fingerprint cannot. Systems should include liveness detection to resist photos and copies, and templates should be stored encrypted, ideally on the device. Biometric information is sensitive information under the Privacy Act, so an enterprise must justify collecting it and protect it carefully.

Password protection, encryption and permissions

Passwords should never be stored as plain text. Systems store a hash (a one-way fingerprint) and add a random salt, so that even if the database leaks, attackers cannot read passwords directly or reuse one precomputed table against all users; slow, purpose-built hashing algorithms make guessing expensive. Organisations should enforce a minimum length, block known breached passwords and support passphrases and MFA.

Encryption turns readable data into cipher text using a key. Symmetric encryption uses one shared key and is fast; asymmetric encryption uses a public and private key pair and solves the problem of sharing keys safely. Data should be encrypted at rest (disk and database encryption) and in transit (HTTPS and VPNs). HTTPS uses both kinds: a certificate proves the site's identity, asymmetric keys deliver a session key, and fast symmetric encryption protects the data.

Permissions apply least privilege: file and database permissions (read, write, delete, execute) are given by role, reviewed regularly and removed when people change jobs, and administrator accounts are separate from everyday accounts.

Multi-factor authentication

MFA requires two or more different types of proof: something you know (password, PIN), something you have (phone, security key, card) and something you are (biometric). Two passwords count as one type, so they are not MFA. Strength varies: SMS codes can be intercepted or obtained through SIM swapping; authenticator-app codes are better; hardware security keys and passkeys are phishing-resistant because they only work with the genuine site. Attackers respond with MFA fatigue attacks (flooding a user with approval requests until they tap "yes") and by relaying codes through fake login pages. Enterprises enable MFA first for remote access, email, administrator accounts and anything holding sensitive data.

Back up and disaster recovery

A backup is a copy of data stored separately so it can be restored after loss, corruption or ransomware. The 3-2-1 rule keeps 3 copies of data, on 2 different types of media, with 1 copy offsite. Modern advice adds that at least one copy should be offline or immutable (cannot be changed or deleted for a set time) so ransomware cannot encrypt it, and that backups must be tested, because an untested backup is only a hope. Disaster recovery (DR) is the plan for restoring systems: it sets a recovery point objective (RPO), how much data loss is acceptable (for example, the last 24 hours), and a recovery time objective (RTO), how long the business can be offline. Recovery sites can be hot (ready immediately), warm or cold (slower and cheaper).

Firewalls

A firewall filters network traffic against rules, allowing or blocking it by source, destination, port and protocol. It can be hardware or software. Packet-filtering firewalls check each packet; stateful firewalls also track the connection; next-generation firewalls inspect applications and can block known threats; a web application firewall protects a website. Good practice is default deny: block everything, then allow only what is needed. A firewall does not stop a user being tricked into approving a connection, or malware already inside, which is why it is one layer among several.

Antivirus and anti-malware

Antivirus and anti-malware software detects, blocks and removes malicious software. Signature-based detection compares files with a database of known malware; heuristic and behaviour-based detection looks for suspicious actions (such as mass file encryption) so it can catch new threats; and endpoint detection and response (EDR) tools monitor devices and let staff investigate and isolate a machine. Suspect files are placed in quarantine. The software needs frequent updates, and it can miss brand-new malware or be switched off by an attacker, so it works together with patching, application control and user training.

Relating the strategies to the Essential Eight

The ACSC's Essential Eight is a set of eight mitigation strategies and a maturity model (levels zero to three) that helps organisations judge how well each is implemented. It is used by Australian Government agencies and widely adopted as a baseline by other organisations. It focuses on technical controls; physical security, biometrics and isolation beyond application control are outside its eight strategies. The table shows how they connect.

Cyber Risk Management

🎯 (EC-11-03, EC-11-09)

📌 Investigate cyber risk management

• implementing a cybersecurity strategy with ongoing training
• identifying and managing vulnerabilities
• assessing the impact of a breach
• controlling damage and loss

Cyber risk management is the continuing process of finding what could go wrong with an enterprise's information and systems, judging how serious it is, deciding what to do about it and checking that it worked. It is a cycle, not a one-off project: identify, analyse, evaluate, treat, monitor, and repeat as the business and the threats change. The Australian and international frameworks, including the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), follow the same logic.

Implementing a cybersecurity strategy with ongoing training

A cybersecurity strategy links security to the organisation's goals. Its parts are:

• Governance: leaders own cyber risk, roles are assigned, and a budget exists. Boards and directors have legal duties to manage risk.
• Policies and procedures: acceptable use, password and MFA rules, data classification, incident response, and supplier security requirements.
• Technical controls: chosen against a baseline such as the Essential Eight and matched to the risks found.
• Ongoing training: one induction session is not enough. Staff need regular short training on phishing, safe data handling and reporting, phishing simulations to test it, extra training for high-risk roles such as finance and administrators, and updates when new scams appear.
• Testing and review: exercises for the incident response plan, restore tests for backups, and regular review of the strategy.

Training matters because people are involved in a large share of breaches. Its effect depends on culture: a workplace where staff can report a clicked link without blame finds problems in minutes, not months.

Identifying and managing vulnerabilities

Vulnerability management is a repeating process:

1. Identify assets: keep an inventory of devices, software, data and suppliers. You cannot protect what you do not know you have.
2. Find weaknesses: vulnerability scans, configuration reviews, penetration tests (authorised simulated attacks), supplier questionnaires and threat information from sources such as the ACSC.
3. Prioritise: rank by how severe the weakness is, whether it is exposed to the internet, whether attackers are already exploiting it and how important the asset is.
4. Treat: patch, reconfigure, add a control or remove the system; record a decision where a weakness is accepted for now.
5. Verify and repeat: re-scan to confirm the fix and schedule the next review.

Managing vulnerabilities covers people and processes as well as technology: an unenforced policy or an untrained user is also a vulnerability.

Assessing the impact of a breach

Before and after an incident, an enterprise assesses the impact to decide priorities. A business impact analysis asks which functions and data matter most and what happens if each is lost. Questions include:

• Which attributes (confidentiality, integrity, availability) are affected, and for which systems?
• What data is involved, how many people are affected, and how sensitive is it?
• What is the financial cost: response, recovery, lost sales, legal advice, penalties?
• What is the operational cost: how long until normal work resumes?
• What are the legal duties, such as notifying the OAIC and individuals?
• What is the reputational effect on customers, partners and staff?

The answers feed the consequence scale in the risk matrix in the next section.

Controlling damage and loss

When a breach occurs, a prepared incident response plan limits the harm. The usual phases are:

1. Prepare: a plan, contacts, roles and tested backups exist before anything happens.
2. Detect and analyse: monitoring or a report reveals the incident, and the team works out what happened and how far it went.
3. Contain: isolate affected devices and accounts, disable stolen credentials and block the attacker, while preserving evidence.
4. Eradicate and recover: remove the cause, restore from clean backups and return to service.
5. Communicate and notify: tell affected people, regulators and (where relevant) police. In Australia, an eligible data breach must be notified under the Notifiable Data Breaches scheme.
6. Review: find out what failed, fix it and update the plan.

Other tools reduce the loss: cyber insurance can transfer some costs, though it does not remove the harm or the legal duties, and a communications plan helps keep customers' trust. The flowchart below shows a simplified decision path for the Notifiable Data Breaches scheme.

The NDB scheme is explained further in the law section, and NSW public sector agencies follow a similar scheme under the Privacy and Personal Information Protection Act 1998 (NSW).

Assessing Risk with a Risk Matrix

🎯 (EC-11-03, EC-11-09)

📌 Assess cyber risk by implementing risk-management strategies using a risk matrix

• internal and external vulnerabilities
• threat landscape
• impact of exposure
• likelihood of exploitation

A risk matrix is a grid that rates a risk from two judgements: how likely it is to happen and how bad the consequence would be. It lets an enterprise compare very different risks on one scale and spend limited time and money on the worst first. The NESA course specifications do not define one, so this section teaches the standard industry form, a 5 by 5 matrix where risk score = likelihood x consequence. Your school or teacher may use a different scale (for example 3 by 3 or 4 by 4); the method is the same.

Internal and external vulnerabilities

The first step is to list weaknesses. Internal vulnerabilities come from inside the enterprise; external vulnerabilities come from outside its direct control.

Threat landscape

The threat landscape is the range of threat actors, methods and trends likely to target an enterprise like this one, drawn from sources such as the ASD's annual cyber threat reports and industry advisories. For a mid-sized logistics business it is mostly financially motivated cybercriminals using ransomware and business email compromise, opportunistic scanning of internet-facing systems, an occasional insider risk, and DDoS by hacktivists or extortionists. A nation-state attack is possible because freight is part of national supply chains, but it is less likely to be aimed at a company of this size. The landscape changes, so it is reviewed regularly, not filed away.

Impact of exposure

Impact (consequence) measures what would happen if the risk occurred, and it should be rated across several measures. A simple scale for Riverina Fresh is:

The dollar bands are examples: each enterprise sets its own, scaled to its size. A $250,000 loss is serious for a business this size but trivial for a national bank.

Likelihood of exploitation

Likelihood is how probable it is that a threat will exploit the vulnerability in a given period (here, the next 12 months). Factors include how exposed the system is, whether tools to exploit the weakness are widely available, the skill needed, how attractive the target is, past incidents and the controls already in place.

Plot, rate and treat

Multiply the two ratings to get a score, then read the band. On this matrix the bands are Low 1 to 4 Medium 5 to 9 High 10 to 16 Extreme 20 to 25. Organisations set their own bands and matching responses (their risk appetite), which is why a 3 by 3 matrix elsewhere may look different. The steps for one risk are:

1. Describe the risk as a sentence: threat, vulnerability and result.
2. Rate the likelihood (1 to 5) using the current controls.
3. Rate the consequence (1 to 5), using the worst credible outcome.
4. Multiply, find the band and compare it with the organisation's appetite.
5. Choose a treatment, then re-rate to find the residual risk that is left.

Reading the register: R2 goes first because it is the only Extreme risk. Notice that R4's treatment (encryption) does not stop laptops being lost, since likelihood stays at 4; it cuts the consequence from 3 to 1 because the data is unreadable. Different treatments change different halves of the equation. R1's residual score stays Medium because people can always be tricked, so training and monitoring continue.

Treatment options

• Avoid: stop the risky activity, for example retire the old tracking portal.
• Reduce (mitigate): add controls that lower likelihood or consequence, such as MFA or encryption.
• Transfer (share): move some of the financial risk through cyber insurance or a managed service. Legal responsibility for personal information stays with the enterprise.
• Accept: knowingly live with a Low risk, with an owner and a review date.

Limits of a risk matrix

A matrix is a communication tool, not a measurement. The ratings are judgements, so two people can score the same risk differently: agree the scales first and have several people rate. Multiplying ordinal ratings (1 to 5) implies more precision than exists. Risks that combine, such as one intrusion causing several harms, may be under-rated when scored one by one. And a low-likelihood but catastrophic risk may deserve attention even when its score looks modest. Use the matrix to start the conversation and to track change over time, not to end it.

Impacts of Cybersecurity Breaches

🎯 (EC-11-01, EC-11-07)

📌 Explain impacts of cybersecurity breaches on the individual, organisation and society

• financial loss
• reputational damage
• operational disruptions
• legal and regulatory ramifications

A breach rarely stays inside the organisation that was attacked. Its effects spread outward: first to the individuals whose data or services are affected, then to the organisation that failed to protect them, and then to society, through lost trust, disrupted services and changes to law and policy. The four impacts named in the syllabus (financial loss, reputational damage, operational disruption and legal and regulatory ramifications) can each be traced at all three levels.

Financial loss

Individuals may lose money to fraud and spend time and money replacing identity documents, changing accounts and monitoring their credit. Organisations face response and recovery costs (investigators, IT, legal advice, customer support), any ransom, lost sales while systems are down, the cost of rebuilding trust, and possible penalties and compensation claims. Society bears the aggregate cost: fraud losses, higher insurance premiums and public spending on response and enforcement.

Reputational damage

Customers who lose trust take their business elsewhere, staff and partners hesitate, and media coverage lasts long after the technical fix. For individuals, published private information such as health details can cause embarrassment, stress and harm to relationships or careers. For society, repeated breaches lower confidence in online services and can make people reluctant to share information, even when it would benefit them.

Operational disruptions

Attacks on availability stop the business working. Organisations cannot take orders, dispatch goods or treat patients; staff fall back on paper processes; recovery may take days or weeks. In 2020 Australian logistics company Toll Group had its systems disrupted by ransomware, affecting freight and parcel services, and in November 2023 a cyber incident at DP World Australia halted operations at container terminals at several ports for days. When the target is essential infrastructure, society feels it directly: the 2021 ransomware attack on the US Colonial Pipeline led its operator to shut down the pipeline and caused fuel shortages, and the 2017 WannaCry ransomware disrupted hospitals in the UK. Individuals lose access to services they depend on.

Legal and regulatory ramifications

Organisations that do not protect personal information can face investigation by the OAIC, court proceedings and civil penalties under the Privacy Act, and must notify eligible breaches. They can also face class actions from affected customers and shareholder claims. Since December 2022 the maximum civil penalty for serious or repeated interferences with privacy has been the greater of $50 million, three times the benefit obtained, or 30 percent of adjusted turnover. Individuals may have rights to complain to the OAIC, and since 2025 to sue for a serious invasion of privacy (see the law section). Society responds with law reform, sanctions on offenders and stronger standards.

Case study: Optus and Medibank, 2022

Only well-documented facts are given here. Both companies were breached in the second half of 2022, and both matters have since been examined by the OAIC.

Both cases prompted public debate, and the Privacy Act's maximum penalties were increased in December 2022; the Cyber Security Act 2024 came later. Court proceedings can take years, so check the OAIC website for the current status. Notice how all four impacts appear together, and how the harm to individuals (identity theft risk, stress, effort) is separate from the harm to the companies.

Cybersecurity Law and Legislation

🎯 (EC-11-07)

📌 Identify laws and legislation associated with cybersecurity

Australia has no single cybersecurity law. Instead, a set of Commonwealth and NSW Acts covers privacy, computer crime, critical infrastructure, unwanted messages and interception. Knowing what each Act does and when it applies is the aim of this dot point. The table summarises them; the details below are kept general where they are technical.

Commonwealth legislation

Penalties can be large. Since December 2022 the maximum civil penalty for a serious or repeated interference with privacy is the greater of $50 million, three times the benefit obtained, or 30 percent of adjusted turnover. Identity crime offences in Part 9.5 of the Criminal Code also cover dealing in identification information with intent to commit an offence.

NSW legislation

Overseas laws can also matter: an Australian business that offers goods or services to people in the European Union may have to follow the GDPR as well.

Which law applies?

Ethical considerations

The syllabus title pairs law with ethics because legal is not always the same as right. Key ethical questions include:

• Authorisation: ethical (white hat) hackers test systems only with written permission. The same technique without permission is a crime.
• Responsible disclosure: a person who finds a flaw should report it to the owner and allow time to fix it, not publish it or exploit it.
• Paying ransoms: paying may recover data but funds criminals and encourages more attacks. Government advice discourages payment, and businesses covered by the Cyber Security Act must report payments.
• Monitoring and surveillance: security monitoring must be proportionate and disclosed to those affected.
• Privacy by design and honesty: collecting only what is needed, being open about breaches, and treating Aboriginal and Torres Strait Islander data with respect for Indigenous data sovereignty.

Primary sources: Privacy Act 1988, Privacy and Other Legislation Amendment Act 2024, Cybercrime Act 2001, Security of Critical Infrastructure Act 2018, Cyber Security Act 2024, Spam Act 2003, Telecommunications (Interception and Access) Act 1979 and Freedom of Information Act 1982. NSW Acts are on the NSW legislation website.

Current and Emerging Cybercrime

🎯 (EC-11-06, EC-11-07)

📌 Explore current and emerging cybercrime threats to an enterprise

Cybercrime evolves as fast as defences do. Criminals adopt new technology, share tools and copy methods that work. The threats below are widely reported as current or emerging. To explore them, ask what is new about each, why it works and how an enterprise can respond. Trends change quickly, so treat this list as a snapshot and check recent ACSC and industry reports.

Ransomware and ransomware-as-a-service

Ransomware encrypts an organisation's files and demands payment for the key. Modern attacks use double extortion: the criminals also steal data first and threaten to publish it, so backups alone do not solve the problem. Ransomware-as-a-service (RaaS) is a business model in which developers rent their ransomware and infrastructure to "affiliates" who carry out the attacks and share the profits. This lowers the skill needed and increases the number of attacks. Defence: patching, MFA, segmentation, tested offline backups, an incident response plan and the reporting obligations in the Cyber Security Act 2024.

AI-enabled phishing and deepfakes

Generative AI lets attackers write fluent, personalised messages in any language, without the spelling mistakes that used to give scams away. Deepfakes are synthetic audio, images or video that imitate real people. Cloned voices have been used in phone scams, and in 2024 a multinational engineering firm was reported to have lost a large sum after an employee joined a video call in which colleagues were faked. Defence: process, not just vigilance. Use a call-back on a known number, a code word or a second approval for payments and sensitive requests, and treat unexpected urgency as a warning. AI can also help defenders, by detecting anomalies and filtering phishing.

Supply-chain attacks

Instead of attacking a well-defended target directly, criminals compromise a supplier, a piece of software or a service that the target trusts. In 2020 attackers inserted malicious code into a software update for the SolarWinds Orion network-management product, and the update reached thousands of customers. Breaches at third-party providers, such as a customer-service platform used by an airline's contact centre, can expose the data of the provider's clients. Defence: assess suppliers, write security and breach-notification duties into contracts, limit the data and access shared, and keep an inventory of dependencies.

IoT botnets

Internet of Things devices such as cameras, routers, smart TVs and sensors often ship with default passwords and rarely receive updates, so they are easy to infect. In 2016 the Mirai malware built a botnet of such devices and used it for a large DDoS attack that disrupted well-known websites through the DNS provider Dyn. The Cyber Security Act 2024 responds by allowing minimum security standards for smart devices, including no universal default passwords. Defence: change default credentials, update firmware, place IoT devices on a separate network and buy devices from suppliers that support updates.

Credential stuffing and infostealers

Billions of leaked username and password pairs are traded and tested automatically against other sites. Infostealer malware quietly copies saved passwords, browser cookies and session tokens from an infected device; stolen session tokens can even bypass MFA. The two feed each other: stealers supply fresh credentials, and stuffing tools test them at scale. Defence: unique passwords, phishing-resistant MFA, device security, session timeouts, and monitoring for logins from unusual places.

Business email compromise

BEC takes over or imitates a business email account to redirect payments or steal data. A typical attack takes over a supplier's mailbox, reads real invoice conversations, then sends a genuine-looking message with changed bank details. It succeeds because the messages are relevant, come from a trusted address and use ordinary business processes, so there is no malware for antivirus to find. Defence: MFA on email, alerts on new mail-forwarding rules, and verifying any change of bank details by phone.

Quantum threats to encryption

A large, reliable quantum computer would be able to break the public-key algorithms (such as RSA and elliptic-curve cryptography) that protect HTTPS, digital signatures and key exchange today, although such computers do not yet exist at that scale. The risk is already real because of harvest now, decrypt later: an actor can copy encrypted data today and decrypt it years later. Symmetric encryption such as AES with long keys is much less affected. Standards bodies have published post-quantum algorithms (NIST released its first standards in 2024), and the ASD's Information Security Manual advises organisations to stop using traditional asymmetric cryptography by the end of 2030. Enterprises should know where they use encryption and plan the transition.

Look across the table for patterns. Several threats work by exploiting trust (suppliers, familiar voices, business email), so verification steps matter as much as software. Several depend on basics not being done (default passwords, no MFA, reused passwords). And attackers scale up cheaply by renting tools. An enterprise that does the fundamentals well removes many of these threats at once, then adds targeted defences for the risks its risk matrix ranks highest.