VU23217 Recognise the need for cyber security in an organisation

It is worth starting with the honest answer, because the training package answer ("to protect data") is true but thin.

An organisation needs cyber security because it holds three things an attacker can convert into money or leverage: information about other people, the ability to interrupt an operation, and a trusted position in someone else's supply chain. Everything else follows from those three.

Protecting your own identity and personal data

Your online identity is the set of accounts, credentials and records that let a system decide you are you. Personal data is everything attached to that identity: name, address, date of birth, phone number, email, tax file number, Medicare number, driver licence number, passport number, bank and card details, and the trail of behaviour that connects them.

Two reasons to protect it stand out, and they are the two the question bank asks for.

Identity abuse. Someone with enough of your identifiers can open accounts, take out credit, port your mobile number, redirect your mail, lodge a tax return, or pass an identity check at a bank or telco. Recovering from this is slow and largely falls on you, not on whoever lost the data.

Unauthorised financial transactions. Purchases, transfers and subscriptions made in your name. Card fraud is usually recoverable through the chargeback system; bank transfer fraud and cryptocurrency payments frequently are not.

There is a third reason worth adding, because it is where the real damage now sits. Identity data is durable. A stolen password can be changed in a minute; a stolen driver licence number is useful to a criminal for years, and a stolen date of birth is useful forever. That asymmetry is why the Australian Government moved to a credential replacement scheme after the 2022 Optus and Medibank breaches, and it is why the current focus in privacy policy is on stopping organisations collecting identity documents they do not need in the first place.

Definition

Personally identifiable information (PII): information that can be used on its own, or combined with other information, to identify a particular individual. In Australian law the equivalent term is personal information, defined in section 6 of the Privacy Act 1988. Some personal information is also sensitive information, which attracts a higher standard of protection: health, genetic and biometric information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and criminal record.

Protecting the organisation's data

Client data first. An organisation that holds personal information is holding something that belongs, in a meaningful sense, to the people it describes. If it leaks, those people wear the consequences. That is the moral answer; the legal answer is Australian Privacy Principle 11, which requires an APP entity to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. VU23223 covers the privacy law in depth.

Reputation second. Reputation damage is the effect most often cited and least often quantified. The useful way to think about it is that reputation converts into three measurable things: customers who leave, customers who never arrive, and partners who add contractual conditions or walk away.

Then the ones the syllabus tends to skip.

Operational continuity. Modern ransomware does not just encrypt files; it takes the organisation off the air. A dispatch system, a booking system, a patient record system or a payroll run that stops is a business that stops.

Regulatory exposure. Since December 2024, serious or repeated interferences with privacy attract civil penalties up to the greater of 50 million dollars, three times the benefit obtained, or 30 per cent of adjusted turnover in the relevant period. There are now also mid-tier and low-tier penalties for less serious breaches, which makes enforcement more likely rather than less.

Contractual and supply chain exposure. Increasingly the organisation is asked to prove its security posture to win work. Essential Eight maturity levels and ISO/IEC 27001 certification are routinely written into Australian government and enterprise contracts.

Why the organisation needs cyber security professionals

Because none of the above manages itself, and because the specific work splits into distinct roles. The question bank asks for four types of cyber professional with a one-line description; these are the four it expects, with a few extra worth knowing.

Penetration tester, or ethical hacker. Tests the effectiveness of the organisation's defences by attacking them under written authorisation, then reports what worked.

Security administrator. The point person for the security team. Installs, administers and troubleshoots the organisation's security tooling, and writes the security policies and procedure documents that everyone else follows.

Network administrator. Oversees the networks and computer systems and is responsible for their day to day operation.

System administrator. Supports, troubleshoots and maintains servers and the services on them, making sure the organisation's systems function and meet its needs.

Beyond the four, the roles a current job ad will actually name: SOC analyst (tiered, monitors and triages alerts), incident responder, threat hunter, digital forensics analyst, GRC or compliance analyst, security engineer, cloud security engineer, identity and access management specialist, and application security engineer. Two of those did not meaningfully exist when this unit was accredited, and both are now common: cloud security engineer and, more recently, AI security specialist.

Did you know?

The most common route into a SOC role in Australia is not a degree. It is a Certificate IV or diploma plus a home lab, a vendor certification, and demonstrable curiosity. What gets people hired at entry level is being able to explain, out loud and without notes, what happened in a packet capture or a log extract you have looked at yourself. Which is the actual reason for the lab section further down this page.

Awareness practices are performance criterion 1.3, and the question bank wants three ways employees can become more cyber aware. The delivered answer is compulsory training, seminars, and computer login messages. That is fine as far as it goes. What follows is the fuller version, because awareness is the control with the worst reputation and the best return when it is done properly.

Finding out where the organisation is starting from

You cannot improve what you have not measured. Four methods, in rough order of usefulness:

Observation. Walk the floor. Are passwords on sticky notes? Are screens locked when people step away? Are visitors escorted? Is there a bowl of unattended USB sticks?

Simulation. Send a controlled phishing email and measure two numbers: click rate, and report rate. Report rate matters more than click rate, and is the number most organisations forget to track.

Asking questions. Short surveys, or better, informal conversations. People will tell you what they find annoying about security, and what they find annoying is what they route around.

Analysing data. Helpdesk tickets, password reset volumes, blocked email statistics, and prior incident records all describe the actual behaviour of the organisation rather than its self image.

Creating awareness

Training, posters, handouts, demonstrations, role plays, simulations, and sharing real attack stories, including successes. Login banners work as a nudge because they arrive at the moment of use. Short and frequent beats long and annual.

The evidence, such as it is, favours a few things. Make the training specific to the person's actual job rather than generic. Keep individual sessions short. Repeat them. Give people one clear action ("forward it to phishing@ and delete it") rather than a list of warning signs. Above all, make reporting safe: an organisation where people are punished for clicking is an organisation that finds out about its incidents late.

Maintaining awareness

People have short memories for topics they are not interested in. Refresher training as a standing item in team meetings, continued sharing of examples by email, and periodic simulations keep it alive. The goal is to have cyber awareness integrated into daily work habits, not to keep hitting people over the head when they do not comply. This is culture change and change management, not a compliance exercise, and it fails when it is run as one.

A worked example of how it fits together

A model that has been used at Australian institutions, and is a fair pattern to copy:

The login screen tells staff that awareness training is outstanding, and counts down the remaining logins before lockout. Staff click through to a third party online module, answer questions on the content, and a completion certificate is generated and lodged with HR automatically. Six months later, IT services sends a simulated phishing email. Anyone who clicks the link lands on a page that says, in effect, "you have just clicked an insecure link; you could have introduced malware into our systems, and here is the refresher module." The person is retrained at the exact moment the lesson is available to them.

Where the training comes from

Developed in house only if the organisation has the resources, which small and medium enterprises generally do not. More likely, a third party platform charged per user. The market has consolidated around a handful of vendors, and most now bundle simulated phishing with the training content.

Delivery method matters less than fit. Face to face works for small organisations and lets you use the I do, we do, you do pattern where people rehearse the task themselves. Online is the only practical option at scale. Coaching and mentoring do not scale to awareness training but are useful for specialist upskilling.

Measuring whether it worked

Feedback to the employee, so they can see whether their habits have changed, whether they can spot a risk, and whether they need more training. Feedback to the employer, so they can see whether the investment produced a change in behaviour, not just a completion rate. Completion rate is the vanity metric. Report rate, time to report, and repeat clicker rate are the ones that mean something.

Update, current as at September 2026. Two changes to awareness practice have arrived faster than the training market has:

Voice and video are now untrustworthy by default. Synthetic voice and video are cheap enough that "I recognised the CFO's voice on the call" is no longer evidence of anything. Awareness training now has to teach a verification habit, not a detection habit: any request to move money or change payment details is confirmed on a separately initiated channel, using a number the person looked up themselves.

Multi-factor fatigue and prompt bombing. Attackers who already have a password will simply spam push notifications until someone approves one. Staff need to be told explicitly that an unexpected approval prompt is an incident to report, not an annoyance to clear.

What a cyber threat is

Definition

Cyber threat: any circumstance or event with the potential to compromise the security of a system, or to adversely impact organisational operations, assets or individuals, through unauthorised access, destruction, disclosure, modification of information, or denial of service.

Three related words get used loosely and should not be. A threat is the potential event. A vulnerability is the weakness that would let the event happen. A risk is the combination of the two together with the consequence, which is why risk is the only one of the three that can sensibly be described as high or low for a particular organisation.

An unpatched web server is a vulnerability. A ransomware crew that scans for that software is a threat. The chance that the crew reaches your server, multiplied by what happens to the business if they do, is the risk.

Threat actors, threat vectors, threat goals

The question bank asks for a sentence on each. These three are frequently confused, and the distinction is worth being precise about.

Threat actor. An entity partially or wholly responsible for an incident that impacts, or has the potential to impact, an organisation's security. Also called a malicious actor. It is a who.

Threat vector. The path, method or means by which an attacker gets into a system. Email, a public-facing application, a stolen credential, a compromised supplier, a USB device, an exposed remote access service. It is a how.

Threat goal. What the actor is trying to achieve: steal data, extort money, disrupt operations, gain persistent access for later use, or damage reputation. It is a why.

Useful because the three drive different defences. You cannot change who is attacking you, you can close vectors, and understanding goals tells you which assets to close them around first.

Sources of cyber security attacks

This is the taxonomy the delivered material uses, and it comes originally from the Cisco Cyber Security Essentials chapter 1 material.

Hackers. A broad term, and a contested one. Used here for people seeking access to information, categorised by hat colour: white hat (authorised, works to find and fix), black hat (unauthorised, works for personal or criminal gain), grey hat (somewhere in between, often finds a flaw without permission then discloses it, sometimes for payment).

Script kiddies. Amateurs who run other people's tools and code without much understanding of them. Typically responsible for denial of service, simple defacements and opportunistic scanning. Their significance is that they make the low end of the threat landscape very noisy.

Vulnerability brokers. Grey hats who discover exploits and report them to vendors, often through bug bounty programs. There is also a commercial market in which brokers sell exploits to governments and to vendors of intrusion software, which is a very different activity from bug bounty work and sits in genuinely contested ethical territory.

Hacktivists. Grey hats who attack in support of a political or social cause. Defacement, denial of service and data leaks are the common methods.

Cyber criminals. Black hats, either independent or working for organised crime groups. This is the largest category by volume and by financial damage.

State sponsored actors. Well funded groups working on behalf of a nation state, targeting government and critical infrastructure data, and positioning themselves inside networks for potential future disruption.

Update, current as at September 2026. Two categories the original taxonomy does not capture, and both are now central.

Ransomware-as-a-service operators and their affiliates. The economics of ransomware split years ago into a developer group that builds and maintains the malware, the leak site and the negotiation infrastructure, and affiliates who do the intrusion and take a share of the payment. This matters for defence because it means the tradecraft you see is affiliate tradecraft, and it varies enormously between intrusions using the same ransomware brand.

Initial access brokers. Criminals who specialise in obtaining access, through stolen credentials, exposed remote services or exploited edge devices, and then sell that access to whoever wants it. This is why credential hygiene and edge device patching have moved to the top of the priority list; they are the wholesale market that feeds everything else.

The Australian Signals Directorate's Annual Cyber Threat Report 2024 to 2025, published October 2025, describes both state actors and criminal actors as persistent, and specifically notes continuing activity by China-linked and Russia-linked state actors against Australian government, critical infrastructure and telecommunications networks.

Did you know?

The 2008 compromise of US vice-presidential candidate Sarah Palin's Yahoo email account required no technical skill at all. The attacker reset her password by answering the account's security question, "where did you meet your spouse", which was answerable from a search engine. The relevant lesson for this unit is that a control which relies on secret personal information stops being a control the moment that information stops being secret, which for a public figure is immediately, and for everyone else is roughly as soon as they use social media. Security questions are now regarded as a weakness rather than a control.

Performance criteria 2.2, 2.3 and 2.5 ask for the techniques attackers use, the characteristics and operation of an attack, and the methods used against an organisation's infrastructure. The question bank asks for the six-step description below, which is the classic ethical hacking phase model.

The six steps the question bank expects

Reconnaissance. Gather information about the target. Passive reconnaissance uses public sources: the website, job advertisements, LinkedIn, DNS records, certificate transparency logs, breach data. Active reconnaissance touches the target directly.

Social engineering. Use people to obtain information or access. Pretexting, phishing, vishing, baiting, tailgating.

Scanning. Probe the network to find live hosts, open ports, running services and their versions, and from that, exploitable weaknesses.

Gaining access. Exploit a vulnerability, or more often simply log in with a credential obtained earlier.

Maintaining access. Establish persistence so the access survives a reboot or a password change. A backdoor, a scheduled task, a new account, an OAuth token, a web shell.

Clearing tracks. Remove or alter evidence: clear event logs, delete tooling, timestomp files, disable logging.

Where that model is now wrong, and what to use instead

The six-step model was built to describe a penetration test, and it still describes one accurately. It describes a modern criminal intrusion less well, in three specific ways.

Gaining access is usually not an exploit. It is a valid credential, bought or phished, used against a service that lacks phishing-resistant multi-factor authentication. Phishing featured in roughly 60 per cent of the incidents the ASD responded to in 2024 to 2025.

Maintaining access is often not malware. Attackers increasingly live off the land, using tools already present on the system (PowerShell, WMI, PsExec, remote monitoring and management agents) precisely because those tools do not trigger malware detection. Persistence is frequently just an identity: an extra account, an added authentication method, a service principal in the cloud tenancy.

Clearing tracks has partly become clearing backups. Before encrypting, ransomware affiliates hunt for and destroy backups, snapshots and shadow copies, because intact backups are the single thing that most reliably prevents payment.

And one step the old model omits entirely: lateral movement and privilege escalation, the phase between initial access and objective where the attacker moves from the machine they landed on to the systems that actually matter, usually by way of domain administrator credentials.

flowchart LR
  A[Reconnaissance] --> B[Initial access: phished or purchased credential, or exposed service]
  B --> C[Execution and persistence: often living off the land]
  C --> D[Privilege escalation]
  D --> E[Lateral movement]
  E --> F[Discovery: locate data and backups]
  F --> G[Exfiltration]
  G --> H[Impact: encryption, extortion, or quiet long-term access]
  F --> I[Destroy backups and snapshots]
  I --> H

Attack methods against an organisation's infrastructure

The categories worth being able to name and explain:

Phishing and its variants. Broad phishing, spear phishing (targeted), whaling (executives), smishing (SMS), vishing (voice), and business email compromise, in which the attacker does not deploy malware at all but simply asks, convincingly, for money to be sent somewhere else.

Credential attacks. Password spraying (one common password against many accounts, which evades lockout), brute force, credential stuffing (reusing credentials from other breaches), and multi-factor fatigue.

Exploitation of public-facing applications and edge devices. VPN concentrators, firewalls, file transfer appliances and remote access gateways. These have been the highest-impact vector of the last few years because they are internet facing, they hold credentials, and they are frequently unpatched.

Denial of service and distributed denial of service. Overwhelming a service so legitimate users cannot reach it. The ASD recorded a sharp rise in DDoS incidents in 2024 to 2025.

Supply chain compromise. Attacking a supplier, a managed service provider or a software update mechanism to reach the real target.

Insider threat. Malicious insiders, and the far more common negligent insider.

Man-in-the-middle and man-in-the-browser. Intercepting or altering communications between two parties.

SQL injection and other web application attacks. VU23222 covers these in depth.

Physical. Tailgating, device theft, dropped USB devices, and shoulder surfing. Still effective, still under-tested.

Definition

Zero-day: a vulnerability that is not yet known to the vendor, or for which no patch exists yet, so defenders have had zero days to fix it. Contrast with an n-day, a vulnerability with a patch available that has not been applied. Most successful intrusions use n-days, not zero-days, which is a comforting fact only if you patch.

Performance criterion 2.4 asks that trends be examined, which means this section dates faster than any other on the page. What follows is the picture as at September 2026, with sources and dates so it can be re-checked.

The Australian numbers

From the ASD Annual Cyber Threat Report 2024 to 2025, released 14 October 2025 and covering the financial year to 30 June 2025:

Measure	Figure
Cybercrime reports through ReportCyber	over 84,700
Calls to the Australian Cyber Security Hotline	over 42,500, up 16 per cent
Incidents ASD responded to	over 1,200, up 11 per cent
Proactive notifications of malicious activity	over 1,700, up 83 per cent
Average self-reported cost, small business	56,571 dollars, up 14 per cent
Average self-reported cost, medium business	97,166 dollars, up 55 per cent
Average self-reported cost, large business	202,691 dollars, up 219 per cent
Incidents involving phishing	around 60 per cent
Incidents involving ransomware	around 11 per cent
Denial of service incidents	over 200, an increase of about 280 per cent

Two things to take from that table. The cost per incident is rising much faster than the count of incidents, which suggests attacks are getting more consequential rather than more numerous. And phishing remains the dominant entry method by a wide margin, which is why awareness and phishing-resistant authentication together give more return than almost anything else an organisation can buy.

On the privacy side, the Office of the Australian Information Commissioner reported 532 notifiable data breaches for January to June 2025, published 4 November 2025. Malicious or criminal attack accounted for 59 per cent, and human error rose to 37 per cent from 29 per cent in the prior period. Health service providers were the most-notifying sector at 18 per cent, then finance at 14 per cent and Australian Government at 13 per cent.

The directions of travel

Extortion has decoupled from encryption. A growing share of ransomware incidents involve data theft and a threat to publish, without any encryption at all. This defeats the traditional answer of "restore from backup", because restoring does not un-publish anything. It also changes the legal position, because a data theft is a notifiable data breach whether or not the systems ever went down.

Artificial intelligence has industrialised social engineering. The visible effect is not novel attacks; it is that the old attacks got cheaper, faster and much better written. The tell-tale signs students were taught to look for, awkward grammar and generic greetings, no longer apply. Synthetic voice and video have made impersonation of a specific named person practical at low cost.

Identity is the new perimeter, and it is under sustained attack. Session token theft, adversary-in-the-middle phishing kits that defeat one-time codes, consent phishing against cloud tenancies, and abuse of legitimate remote access tooling.

Edge devices are the preferred entry point for capable actors. Internet-facing security appliances are attractive precisely because they are trusted, they hold credentials, and they are often outside normal patching cycles.

Living off the land is standard tradecraft. Which pushes detection away from signature-based antivirus and towards behavioural analysis, endpoint detection and response, and log analysis.

Supply chain and third-party risk keeps growing. The OAIC has repeatedly highlighted breaches originating at a supplier or contractor. Vetting, contract clauses and audit rights are now part of the security job, not just the procurement job.

Operational technology and IoT are converging with corporate networks, which extends the attack surface into things that were never designed to be on a network.

Where this genuinely moves. Nobody has a settled view of how much of the current attack volume is AI-assisted; estimates vary widely and the methods used to produce them are not consistent between vendors. Treat any single percentage figure on this with caution, and prefer the direction of travel over the number.

Performance criterion 4.2 asks for botnets, malware, viruses, worms and rootkits to be clarified. The question bank wants a sentence or two on each.

Malware. The umbrella term. Software specifically designed to disrupt, damage or gain unauthorised access to a computer system. Everything below is a kind of malware, or a way of delivering one.

Virus. A program that, when executed, replicates itself by modifying other programs and inserting its own code. The defining characteristic is that it needs a host program and a user action to spread.

Worm. Malware whose primary function is to self-replicate and infect other computers across a network while remaining active on the systems it has infected. The defining characteristic is that it spreads without user action, which is why worms produce the fastest-moving incidents.

Rootkit. A program, or collection of tools, that gives a threat actor remote access to and control over a system while hiding its own presence, usually by subverting the operating system at a low level. Rootkits are the reason "the antivirus says the machine is clean" is not proof that a machine is clean.

Botnet. A network of private computers infected with malicious software and controlled as a group without the owners' knowledge. Botnets are rented out to send spam, run credential stuffing, mine cryptocurrency and, most visibly, deliver distributed denial of service attacks.

Trojan. Malware disguised as something legitimate, which relies on the user installing it. Named for the obvious reason.

Spyware and keyloggers. Software that records activity and sends it elsewhere.

Adware. Software that displays unwanted advertising, often bundled with other software, and often a vector for worse.

Ransomware. Malware that encrypts data and demands payment for the key. Modern variants steal the data first and threaten publication, so payment is demanded twice over.

Update, current as at September 2026. Four terms that are now more useful in practice than several of the classics.

Infostealer. Commodity malware whose entire purpose is to harvest browser-stored passwords, session cookies and cryptocurrency wallets, then exit. Infostealer logs are the raw material of the initial access broker market described earlier, and stolen session cookies are particularly dangerous because they let an attacker bypass multi-factor authentication entirely by resuming an already-authenticated session.

Loader or dropper. Malware whose job is to establish a foothold and then fetch whatever comes next. Sold as a service.

Wiper. Malware that destroys data while presenting itself as ransomware. Associated with state-aligned disruption rather than criminal extortion, because there is no revenue model.

Living off the land binaries. Not malware at all. Legitimate signed system tools used for malicious purposes, which is why "was any malware found" is the wrong first question in an investigation. The better first question is "what ran, and did it make sense for that account, on that machine, at that hour".

Definition

Fileless attack: an intrusion that leaves little or nothing on disk, operating instead in memory and through legitimate system tooling. It defeats detection that depends on scanning files, which is most traditional antivirus, and is one of the main reasons the market moved to endpoint detection and response.

Performance criteria 2.7 and 2.8 ask for examples of IoT devices and an explanation of their security vulnerabilities. The question bank wants five examples and two security issues.

What counts as an IoT device

Anything with an embedded computer and a network connection whose primary purpose is not computing. In a home: a smart speaker or voice assistant controlling lights and alarms; a video doorbell; a smart smoke detector that self-tests and alerts a phone; a connected lighting system; a smart power plug; a robot vacuum; a smart television; a connected thermostat; a fitness tracker or smart watch.

In an organisation, which is where this unit points: networked printers and multifunction devices; IP cameras and access control readers; building management and HVAC controllers; environmental and water sensors; networked medical devices; point of sale terminals; fleet telematics; industrial sensors and programmable logic controllers on the operational technology side.

Why they are a problem

The security issues the question bank asks for are drawn from a short list: malware infection, extra power consumption, ransomware, and remote shutdown. The fuller picture:

Default and shared credentials. Historically the single largest cause. A whole product line shipping with the same username and password, documented publicly.

No patching path, or no patching culture. Many devices have no update mechanism, no way to notify the owner that an update exists, and no defined support period. A device installed in a ceiling in 2019 is very likely still running its 2019 firmware.

Weak or absent encryption, both for the device's own traffic and for the data it stores.

Exposed management interfaces, often on the open internet, frequently discoverable through search engines built for exactly that purpose.

No inventory. Organisations routinely do not know how many IoT devices they have, which makes CIS Control 1 the practical starting point.

Consequence beyond the device. A compromised camera is rarely the objective. It is a foothold on the internal network, a member of a botnet, or a bridge into the operational technology environment.

The Mirai botnet in 2016 is still the clearest demonstration: it compromised hundreds of thousands of cameras and routers using a list of about 60 default credential pairs, and used them to take down a major DNS provider, which in turn made large parts of the internet unreachable in the United States and Europe. No exploit was required. The devices were simply configured as shipped.

Update, current as at September 2026: Australia now regulates this

This is the largest single gap between the unit as written and current practice, and it is worth understanding properly.

The Cyber Security Act 2024 is Australia's first standalone cyber security statute. Among other things, it allows the responsible Minister to mandate security standards for internet-connectable consumer products. The Cyber Security (Security Standards for Smart Devices) Rules 2025 were made under that power, and after a twelve month transition they commenced on 4 March 2026.

The rules impose three requirements on manufacturers and suppliers of relevant smart devices:

No universal default passwords. A password must be unique per device, or set by the user at first use.

A published means of reporting security issues, with acknowledgement and status updates to the reporter.

Published information about the minimum period for which the device will receive security updates.

They apply to most smart devices intended for personal, domestic or household use that are manufactured on or after 4 March 2026. Devices manufactured before that date are not caught. Desktop computers, laptops, smartphones and tablets are excluded, because those are covered by other regimes. Enforcement sits with the Technology Assessment and Regulation Office in the Department of Home Affairs, which can issue compliance notices, stop notices and recall notices, and can publish the fact of non-compliance.

The requirements are deliberately modest, and are aligned with the international baseline (the UK's product security regime and ETSI EN 303 645). The point is not that three requirements will secure the Internet of Things. The point is that they attack the three failures that made Mirai possible: shared credentials, no way to report a flaw, and no idea how long the thing will be supported. For this unit, the relevant observation is that "IoT security is unregulated" was true when the unit was accredited and is no longer true in Australia.

Did you know?

"Extra power usage" appears in the delivered answer list for IoT security issues, and it sounds like padding. It is not. A compromised IoT device recruited to mine cryptocurrency or participate in a botnet runs its processor hard, which shows up as heat, as battery drain on a battery-powered device, and on a fleet of devices, as a measurable change in power draw. On operational technology sites, unexplained power and thermal anomalies are a legitimate detection signal.

Element 3 asks for techniques to protect personal devices, user authentication techniques, and methods and tools to safeguard personal privacy. In the delivered unit these are demonstrated through Cisco labs on strong passwords, backing up to external storage, data ownership, and risky online behaviour.

Protecting the device

Keep the operating system and applications updated, automatically. This is the single highest-value habit, and it is the one people disable because updates are inconvenient.

Run reputable endpoint protection and let it update. On current Windows, the built-in protection is genuinely competent; the important part is that it is enabled and current, not which brand it is.

Back up, and test the restore. Follow the 3-2-1 pattern: three copies of the data, on two different media, with one copy off site. At least one copy should be offline or otherwise immutable, because ransomware deliberately hunts connected backups.

Use strong, unique passwords, held in a password manager. Length beats complexity. A long passphrase of unrelated words is both stronger and more usable than a short string of substituted characters. Uniqueness is the property that actually matters, because it is what stops one breach becoming ten, and uniqueness is impossible at scale without a manager.

Encrypt the device. BitLocker on Windows, FileVault on macOS, on by default on current mobile platforms. This is what makes a lost laptop an inconvenience rather than a data breach.

Lock the screen, and use a real device passcode.

Be wary of phishing, in email, SMS and voice.

Be careful on public wireless networks, and prefer a mobile hotspot for anything sensitive.

Authentication

The question bank asks for the advantages of two-factor authentication. The standard answer is that even a strong password can be compromised, and adding a second factor makes the login sequence stronger and more controlled.

That answer is correct and incomplete. The current framing is worth learning properly, because the difference between forms of multi-factor authentication is now larger than the difference between having it and not having it.

The three classic factors: something you know (password, PIN), something you have (a phone, a token, a smart card), something you are (fingerprint, face, iris). Multi-factor authentication requires two or more from different categories. A password plus a security question is not multi-factor; both are things you know.

Ranked by how well each survives a real attack, worst to best:

SMS one-time codes. Better than nothing. Defeated by SIM swapping and by real-time phishing, where a fake site relays the code to the real site while you type it.

Authenticator app codes (TOTP). Better. Not vulnerable to SIM swapping. Still defeated by real-time relay phishing.

Push approvals. Convenient. Vulnerable to fatigue attacks unless number matching is enforced.

Phishing-resistant methods: FIDO2 security keys and passkeys. These bind the credential to the legitimate site's domain, so a relay attack simply does not work; the key will not sign for the wrong origin. There is no code for a person to read out or type, so there is nothing to phish.

Update, current as at September 2026. Passkeys are now supported across the major operating systems, browsers and large consumer platforms, and they are the direction of travel for both consumer and enterprise authentication. The ASD's Essential Eight guidance has moved in the same direction: the November 2023 revision of the maturity model brought multi-factor authentication requirements forward to Maturity Level One for online access to sensitive data, and pushed phishing-resistant methods up the maturity levels. Adoption is uneven and account recovery remains the weak point in most passkey deployments, so this is a moving picture rather than a settled one.

Related and worth knowing: single sign-on reduces the number of credentials a person has, which reduces reuse but concentrates risk on one identity provider. Conditional access applies rules based on device state, location and risk signals. Zero standing privilege and just-in-time administration grant administrative rights only for the window they are needed.

Safeguarding personal privacy

The four the question bank expects: be wary of what you share online; adjust search engine and browser settings to limit tracking; use a VPN when browsing; use strong passwords.

Worth adding, and worth some honesty about the VPN answer.

A commercial VPN moves your traffic's exit point and hides it from the local network and your internet provider. It does not make you anonymous, it does not stop tracking by the sites you log into, and it transfers your trust from your internet provider to the VPN provider. It is genuinely useful on untrusted networks and for hiding traffic from a local observer. It is oversold as a privacy product.

More effective in practice: a browser that blocks third-party trackers by default, or a content blocker; reviewing app permissions, particularly location, contacts, camera and microphone; turning off ad personalisation and advertising identifiers; using aliased email addresses so a breach at one service does not link to your identity everywhere else; checking which accounts you actually still use and closing the rest; enabling multi-factor authentication on email first, because email is the recovery channel for everything else; and checking your own exposure at Have I Been Pwned.

And the structural one, which sits outside individual control: exercising the rights the Privacy Act gives you. APP 12 gives you a right of access to personal information an organisation holds about you, and APP 13 a right to have it corrected. Since June 2025 there is also a statutory tort of serious invasion of privacy, which for the first time gives individuals a direct cause of action in Australia rather than depending entirely on regulator action.

Performance criterion 4.1 asks for the common infrastructure, equipment and software used to protect an organisation. The question bank puts a network diagram in front of you and asks for a sentence on each element: a router visible to the internet in the public zone, a firewall, a server in the demilitarised zone, and workstations in the private zone.

The classic zoned network

Router. The device that forwards traffic between networks. The edge router is the organisation's connection to the internet and is visible from it, which makes it both the first line of defence and the first thing scanned.

Firewall. Enforces a policy about which traffic may pass between zones, based on source, destination, port, protocol and, in a next-generation firewall, application and user identity. The firewall is what creates the zones; without it, "zone" is just a diagram.

Demilitarised zone (DMZ). A network segment that sits between the internet and the internal network, holding the services that must be reachable from outside: web servers, mail gateways, reverse proxies, public DNS. The point of the DMZ is that a compromise of a public-facing server does not put the attacker on the internal network, because the firewall policy between DMZ and private zone is restrictive.

Server in the DMZ. A host offering a service to the internet, hardened, minimally privileged, and permitted to talk to the internal network only on the specific ports it genuinely needs.

Workstations in the private zone. Staff machines on the internal network, which should not be directly reachable from the internet at all.

flowchart LR
  I[Internet] --- R[Edge router]
  R --- FW[Firewall]
  FW --- DMZ[DMZ: web, mail and DNS servers reachable from the internet]
  FW --- PRIV[Private zone: workstations, file and application servers, directory services]
  DMZ -. tightly restricted, specific ports only .-> PRIV
  I -. no direct path .-> PRIV

The rest of the toolkit

Intrusion detection and intrusion prevention systems (IDS and IPS). Detection watches and alerts; prevention sits inline and blocks.

Proxy and web filtering. Controls and inspects outbound web traffic, and blocks known bad destinations.

Email security gateway. Filters spam, phishing and malicious attachments, and enforces sender authentication (SPF, DKIM and DMARC), which is the technical control that makes it harder to spoof the organisation's own domain.

Endpoint protection, and endpoint detection and response (EDR). Antivirus stops known bad files. EDR records what processes actually did and lets an analyst hunt, investigate and isolate a host remotely. XDR extends the same idea across email, identity, cloud and network telemetry.

Security information and event management (SIEM). Central collection, correlation and alerting across logs from everything above. Without centralised logging, incident response is archaeology.

Security orchestration, automation and response (SOAR). Automates the repeatable parts of triage and response so analysts spend their time on the parts that need judgement.

Virtual private network and remote access gateway. Encrypted access for remote staff. Also, as noted earlier, a prime target.

Network access control (NAC). Decides what a device is allowed to do when it plugs into the network, based on its identity and health.

Data loss prevention (DLP). Detects and blocks sensitive data leaving by unapproved channels.

Backup infrastructure, with at least one immutable or offline copy.

Identity and access management, including privileged access management and directory services.

Vulnerability scanning and patch management tooling.

Update, current as at September 2026. The zoned model above is still how most Australian organisations are physically built, and it is still the right mental model for the assessment. It is no longer a sufficient security model, for a simple reason: there is no longer a meaningful inside. Staff work from home on their own networks, applications live in someone else's data centre, and data moves between software-as-a-service tenancies that the organisation does not run.

Zero trust is the response. The principle is never trust, always verify: no request is trusted because of where it came from. Every request is authenticated and authorised on its own merits, using the identity of the user, the health of the device, and the sensitivity of the resource, and access granted is the least required for the task and time-limited. In practice this means strong identity, device compliance checks, per-application access rather than full network access, and micro-segmentation instead of one flat internal network.

The practical consequence for a technician: the firewall rule set is no longer the centre of the security posture. The identity provider is.

Performance criterion 4.4 asks for these to be investigated. The question bank uses the business.gov.au cyber security guidance as its frame, and asks for a sentence on each of the following.

Security and incident response policies. Policies let the organisation plan, prepare and budget. They state what counts as an incident, who is responsible, what people are allowed to do, and what happens when something goes wrong. Without them, every decision is made under pressure by whoever happens to be in the room.

Educate users. Every employee needs to be on board with good practice. Covered above.

Maintain security patches and updates. Necessary, and progressively harder as the organisation grows and the asset list stops fitting in one person's head.

Implement patch management procedures. Not the same as the previous point. Patching needs a documented process: an asset inventory, a source of vulnerability information, a risk-based priority order, a test path, a deployment window, and a way to verify that the patch actually landed. Ad hoc patching leaves the long tail unpatched, and the long tail is where intrusions start.

Secure devices and the network. Current routers, firewalls and security appliances, configured deliberately rather than left at defaults, and kept patched themselves.

Monitor the use of equipment and systems. Choose monitoring that integrates with the rest of the stack, so alerts arrive with context rather than as isolated events.

Implement sound access strategies. Multi-factor authentication, least privilege, and authentication, authorisation and accounting (AAA) so that access is verified, limited and recorded.

Worth adding to that list, because a current audit will ask for them: an asset register; a documented backup and restore standard with tested restores; a supplier and third-party risk process; an access review cycle that actually removes access when people change roles or leave; a data retention and destruction schedule, which is the control that limits the size of a future breach; and a business continuity and disaster recovery plan that has been rehearsed rather than filed.

Definition

AAA: authentication (proving who you are), authorisation (deciding what you may do), accounting (recording what you did). The third one is the one organisations skip, and it is the one that decides whether an incident can be investigated afterwards.

Performance criterion 4.5 asks for a behaviour based approach to be investigated. The question bank wants two techniques.

Honeypots. A decoy system, account or file placed where an attacker would find it, valuable-looking and never legitimately used. It lures the attacker by appealing to predictable behaviour, then captures, logs and analyses what they do. Two benefits: the alert has almost no false positive rate, because nothing legitimate should ever touch a honeypot; and the administrator learns the attacker's actual tradecraft and can build better defences from it. Honeytokens are the lightweight version: a fake credential in a password vault, a fake customer record, a fake document with a beacon in it.

Monitoring employee activity, or baselining. A profile of normal activity is built over time for a user or a system: the places they connect to, the volume of data they move, the servers they touch, the hours they work. When behaviour departs from the baseline, a flag is raised for investigation. The 3am login from a new country to an account that has only ever been used from one office, on a machine that has never enrolled before, is the classic example.

The reason behaviour based detection matters is the point made earlier about living off the land. If an attacker uses only legitimate tools with valid credentials, there is no signature to match. What is left is the behaviour: this account does not normally do this, at this time, on this host, at this volume.

Update, current as at September 2026. The commercial expression of baselining is user and entity behaviour analytics (UEBA), now generally built into SIEM and identity platforms rather than sold separately. Two cautions worth carrying:

Baselines drift, and they encode whatever was normal when they were built, including things that were quietly wrong at the time.

Monitoring employees is a privacy question as well as a security one. In Australia, workplace surveillance is regulated at state and territory level and is not uniform; notice requirements and permitted purposes differ. The security answer and the lawful answer are not automatically the same, and the security team is not the right body to decide alone. VU23223 covers the legal side.

What threat intelligence is

Threat intelligence is data that has been collected, processed and analysed to understand a threat actor's motives, targets and behaviours. Its purpose is to let a security team make faster, better-informed decisions, and to shift a security operations centre from reacting to attacks towards anticipating them.

It is conventionally described at three levels. Strategic intelligence is about who is likely to target this sector and why, and is written for executives. Operational intelligence is about specific campaigns and actor tradecraft, and is written for defenders planning detections. Tactical intelligence is the machine-readable detail: indicators of compromise such as file hashes, domains and IP addresses, feeding straight into tooling.

Indicators of compromise age quickly, because an attacker can change a domain in seconds. Behaviours age slowly, because changing tradecraft is expensive. That observation is the reason MITRE ATT&CK exists, and the reason it is more useful than an indicator feed.

Sources worth knowing. In Australia, ASD and the ACSC publish advisories, alerts and the annual threat report at cyber.gov.au, and the ASD Cyber Security Partnership Program provides sector-specific intelligence to member organisations. Internationally, the CISA Known Exploited Vulnerabilities catalogue is the single most practically useful free feed for prioritising patching, because it lists vulnerabilities known to be exploited in the wild rather than merely known to exist. Commercial annual threat reports from the major vendors are useful for the direction of travel, with the caveat that each vendor sees the slice of the world its own products are deployed in, and each report is also marketing.

The Lockheed Martin Cyber Kill Chain

The Cyber Kill Chain was the first serious attempt to describe the structure and lifecycle of a cyber attack, published in 2011. It breaks an intrusion into seven stages.

Reconnaissance. Learning as much as possible about the target, through open sources and active investigation.

Weaponisation. Building the means of exploiting a discovered weakness: custom malware, a crafted document, a phishing email.

Delivery. Getting the weapon to the target. Sending the email, planting the file, compromising the website.

Exploitation. Taking advantage of the weakness to gain execution: a server vulnerability, a user enabling macros.

Installation. Establishing a foothold by installing and running malware on the target system.

Command and control. Establishing a channel back to the attacker so the implant can receive instructions and send data.

Actions on objectives. Everything the attacker does once they have access, to reach whatever they actually came for.

The value of the model is defensive: an intrusion has to complete every stage to succeed, and the defender only has to break one. Breaking it early is cheaper.

Its limitation, and it is a real one, is that the model was written to describe malware-delivered intrusions from outside. It handles an attacker who logs in with a valid credential poorly, it handles insider threat poorly, and it compresses the entire interesting middle of a modern intrusion, privilege escalation and lateral movement, into a single stage.

MITRE ATT&CK

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as the foundation for threat models and methodologies in industry, government and the security product community.

Its structure. Tactics are the adversary's objectives, the why of an action: reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defence evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, impact. Techniques and sub-techniques are the how: the specific ways each tactic is achieved, each with a stable identifier such as T1566 for phishing. Groups and software entries record which named actors and tools have been observed using which techniques.

Why it is more useful than the Kill Chain in daily work. The Kill Chain gives you a narrative shape. ATT&CK gives you a checklist you can measure yourself against. A security team can map its detections to techniques and see, concretely, which techniques it would currently miss. That exercise, sometimes run through the free ATT&CK Navigator, turns "are we secure" into a set of answerable questions.

ATT&CK is updated roughly twice a year and now covers Enterprise, Mobile and ICS matrices, with cloud, container and identity coverage expanded considerably since the version this unit was written against. Any reference to a specific technique count will be out of date almost immediately; check the current matrix rather than quoting a number.

The Diamond Model, briefly

Not in the unit, but useful and quick. The Diamond Model of Intrusion Analysis says every intrusion event has four connected features: an adversary uses a capability over an infrastructure against a victim. Its practical value is pivoting: if you know one vertex you can often discover the others, so a single malicious domain leads to other victims, other tooling and eventually to attribution.

Performance criterion 4.6 asks that incident response policies, processes and systems be reviewed. The question bank asks for the role of an incident response policy, and for the four stages of the NIST incident response process.

The role of an incident response policy

The policy is the precursor to the plan. It defines what counts as a security incident, who is responsible, what the roles are, what must be documented, and what must be reported to whom. It gives the incident response function its authority; without it, a responder in the middle of an intrusion has no mandate to take a production server off the network.

Sitting under the policy: the plan, which sets out the organisational framework, the team, the tools and the communications approach; and the playbooks, which are the step-by-step procedures for specific incident types such as ransomware, business email compromise, or a lost device.

NIST's guidance is emphatic on one point that small organisations tend to skip. Establish a formal incident response capability even if the organisation is small. A virtual team of part-time staff with defined authority and responsibility responds far better than a group of competent people with no defined roles.

The four stage life cycle, as taught

This is the model in NIST SP 800-61 Revision 2, published August 2012, and it is what the question bank asks for.

Preparation. Building the capability before anything happens: the team, the policy, the plan, the tooling, the training, the contact lists, and the preventive controls that reduce the number of incidents in the first place.

Detection and analysis. Identifying that something has happened, working out what it is, how far it has spread and what it affects, and prioritising it. This is the hardest phase and the one where most of the skill sits.

Containment, eradication and recovery. Stopping the spread, removing the attacker and their tooling, and restoring systems to normal operation with confidence that the way in has been closed.

Post-incident activity. The lessons learned review: what happened, what worked, what did not, and what changes to make.

flowchart LR
  P[Preparation] --> D[Detection and analysis]
  D --> C[Containment, eradication and recovery]
  C --> PI[Post-incident activity]
  PI --> P
  C --> D

Update, current as at April 2025: SP 800-61 has been rewritten

NIST SP 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, was published in April 2025 and supersedes Revision 2.

The change is structural, not cosmetic. Revision 3 abandons the four discrete sequential phases and reorganises incident response around the six functions of the NIST Cybersecurity Framework 2.0. Its model has three layers:

Preparation sits in Govern, Identify and Protect, which are the ongoing activities that reduce incidents and get the organisation ready for them.

Active response sits in Detect, Respond and Recover.

Continuous improvement sits in the Identify: Improvement category, and runs throughout rather than waiting until the end.

NIST's reasoning is that incidents are now frequent enough and damaging enough that treating response as a separate set of activities, bolted on beside the security program, no longer works. Response has to be integrated into how the organisation governs and manages risk generally, and lessons have to feed back continuously rather than at the end of a phase.

The mapping between the two, so both answers can be given:

SP 800-61r2 phase	SP 800-61r3 CSF 2.0 functions
Preparation	Govern, Identify, Protect
Detection and analysis	Detect, and Identify: Improvement
Containment, eradication and recovery	Respond, Recover, and Identify: Improvement
Post-incident activity	Identify: Improvement

For assessment purposes the four stages are still the expected answer. For work, r3 is the current document, and the four stages remain a perfectly good way to describe what happens on the day.

The Australian reporting obligations that sit on top

This is the part the delivered material does not cover, and it is the part that turns incident response from a technical exercise into a legal one. Depending on the organisation and the incident, several clocks start at once.

Notifiable Data Breaches scheme, Privacy Act 1988. If an eligible data breach occurs, meaning unauthorised access to or disclosure or loss of personal information that is likely to result in serious harm, the entity must notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. Where a breach is suspected rather than confirmed, the entity must complete an assessment expeditiously, and the OAIC expects that within 30 days.

Ransomware and cyber extortion payment reporting, Cyber Security Act 2024. Since the reporting provisions commenced, a business with annual turnover above three million dollars, or a responsible entity for critical infrastructure, that makes or benefits from a ransomware or extortion payment must report it to the Department of Home Affairs within 72 hours of making the payment or becoming aware of it. The obligation is on the payment, not on the incident. There is a civil penalty for failing to report.

Critical infrastructure obligations, Security of Critical Infrastructure Act 2018. Responsible entities for critical infrastructure assets must report cyber security incidents to ASD: within 12 hours for an incident with a significant impact, and within 72 hours for one with a relevant impact.

Sector-specific obligations. APRA-regulated entities must notify APRA within 72 hours of a material information security incident under Prudential Standard CPS 234, and within 10 business days of identifying a material information security control weakness. Other sectors have their own.

ASD and ReportCyber. Voluntary for most organisations, and worth doing. The limited use obligation introduced by the Cyber Security Act 2024 restricts how information voluntarily given to ASD during an incident may be used and shared, which is designed to make organisations more willing to ask for help early.

The practical consequence is that an incident response plan for an Australian organisation needs a legal and reporting workstream running in parallel with the technical one, with the clocks written into the playbook and the decision-makers named. Working out who reports what, to whom, and by when, in the third hour of a ransomware incident, is not a plan.

Did you know?

The Cyber Security Act 2024 also established a Cyber Incident Review Board, an independent body that conducts no-fault, post-incident reviews of significant cyber incidents and publishes lessons for the wider economy. It is modelled loosely on transport safety investigation practice, where the point of the inquiry is to prevent recurrence rather than to assign blame. It has compulsory information-gathering powers where voluntary cooperation is not forthcoming.

Performance criterion 5.1 asks for the fundamentals of the NIST CSF to be examined and explained. The delivered material predates the current version, and the question bank's Q18 actually asks for the NIST incident response stages rather than the framework's functions, so it is worth separating the two documents clearly. The Cybersecurity Framework is a risk management framework. SP 800-61 is incident response guidance. They are related but they are not the same thing.

What it is

The NIST Cybersecurity Framework is a voluntary framework of cyber security outcomes, first published in 2014 in response to a US Presidential executive order, and adopted well beyond the United States. It is deliberately not a control list and not a compliance standard. It describes what an organisation should achieve, and leaves how to the organisation and to more specific standards such as ISO/IEC 27001, NIST SP 800-53 or the CIS Controls.

CSF 2.0 was published on 26 February 2024 and is the current version. Two changes matter most: it added a sixth function, Govern, and it dropped the earlier framing that limited it to critical infrastructure, so it is now explicitly written for organisations of every size and sector.

The six functions

Function	What it covers
Govern (GV)	The organisation's cyber security risk management strategy, expectations and policy are established, communicated and monitored. Roles, responsibilities, risk appetite, supply chain risk management, and oversight.
Identify (ID)	The organisation's current cyber security risks are understood. Asset inventory, business context, risk assessment, and improvement.
Protect (PR)	Safeguards to manage those risks are used. Identity and access management, awareness and training, data security, platform security, and resilience of technology infrastructure.
Detect (DE)	Possible attacks and compromises are found and analysed. Continuous monitoring and adverse event analysis.
Respond (RS)	Actions regarding a detected incident are taken. Incident management, analysis, reporting and communication, and mitigation.
Recover (RC)	Assets and operations affected by an incident are restored. Recovery plan execution and recovery communication.

Govern is the significant addition. Its inclusion is an acknowledgement that the recurring cause of failure is not missing technology; it is that nobody owns the risk, the risk appetite has never been stated, and the board is not receiving anything it can act on. Govern sits in the centre of the framework's wheel diagram because it informs all five of the others.

Tiers and Profiles

Tiers describe how rigorous and how well integrated an organisation's cyber security risk governance and management practices are: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, Tier 4 Adaptive. Tiers are not a maturity score to be maximised. They describe how the organisation approaches risk, and the appropriate tier depends on the organisation.

Profiles are the practical instrument. A Current Profile describes the outcomes the organisation is achieving now. A Target Profile describes the outcomes it needs. The gap between them, prioritised by risk and cost, is the improvement plan. NIST also publishes Community Profiles for particular sectors or problems, and SP 800-61r3 is exactly that: a community profile for incident response.

flowchart TD
  GV[Govern: strategy, roles, policy, oversight, supply chain]
  GV --> ID[Identify: assets, risks, improvement]
  GV --> PR[Protect: access, training, data, resilience]
  GV --> DE[Detect: monitoring and analysis]
  GV --> RS[Respond: manage, analyse, report, mitigate]
  GV --> RC[Recover: restore and communicate]
  ID --> PR --> DE --> RS --> RC
  RC --> ID

Performance criterion 5.2 asks for the ACSC Essential Eight strategies to be identified. The question bank asks for the eight, and for a sentence on the difference between the maturity levels.

What it is

The Australian Signals Directorate publishes Strategies to Mitigate Cyber Security Incidents, a prioritised list of mitigations. The Essential Eight is the baseline subset of that list: the eight strategies ASD considers the most effective starting point for Windows-based, internet-connected corporate networks. It was first published in 2017 and is the de facto security baseline in Australian government and, increasingly, in contracts with government.

The eight strategies

They fall into three groups by intent.

Preventing malware delivery and execution

Strategy	What it does
Application control	Only approved executables, scripts, installers and libraries may run. Stops unapproved code, including most malware, from executing at all.
Patch applications	Apply patches to applications, prioritising internet-facing services and the applications that handle untrusted content such as browsers, email clients and PDF readers.
Configure Microsoft Office macro settings	Block macros from the internet, and allow only vetted macros in trusted locations or with a trusted certificate.
User application hardening	Disable or restrict risky features in browsers and productivity applications, such as Flash, ads, Java, and Office child processes and OLE.

Limiting the extent of incidents

Strategy	What it does
Restrict administrative privileges	Grant administrative access only where needed, validate and revalidate requests, keep privileged accounts off the internet and email, and separate privileged from unprivileged use.
Patch operating systems	Apply operating system patches, prioritising internet-facing systems, and remove operating systems that are no longer supported.
Multi-factor authentication	Require more than one factor, particularly for remote access, for privileged actions and for access to sensitive data repositories.

Recovering data and system availability

Strategy	What it does
Regular backups	Back up data, software and configuration settings; retain them in line with business continuity requirements; test restoration; and prevent unprivileged accounts from modifying or deleting backups.

The eighth item is where ransomware is actually defeated, and the one most often implemented badly. A backup an attacker's stolen domain administrator account can delete is not a backup.

The maturity levels

The Essential Eight Maturity Model defines four levels. The key to understanding them, and the thing the question bank is testing, is that each level is defined by the capability of the adversary it is intended to stop, not by how much effort the organisation has put in.

Maturity Level Zero. There are weaknesses in the organisation's overall posture. When exploited, they could compromise the confidentiality, integrity or availability of its data and systems.

Maturity Level One. Aimed at adversaries who use widely available, publicly known exploits against unpatched systems, and commodity social engineering to trick users. They are opportunistic, taking whoever is available rather than choosing a target.

Maturity Level Two. Aimed at adversaries willing to invest more time in a target and more effort in evading controls. Better-crafted phishing, more capable and better-maintained tooling, and active attempts to bypass the security measures that are in place.

Maturity Level Three. Aimed at adversaries who are adaptive, less reliant on public tooling, and focused on a particular target. They will invest effort in finding weaknesses in older or unsupported software, in exploiting gaps in configuration, and in evading detection and consolidating access once inside.

Two rules that get missed. Maturity is assessed per strategy, and the organisation's overall level is the lowest of the eight, so a single laggard drags the whole rating down. And ASD directs that all eight should be implemented to a level together, rather than one strategy being taken to Level Three while others sit at Level One.

Update: what has changed since the delivered material

The delivered material in the vault folder is written against the October 2021 publication. The model was substantially revised in November 2023, and the changes are worth knowing because they reflect where the threat went.

Patching of internet-facing services tightened. Critical vulnerabilities in internet-facing services must be patched within 48 hours, and this now applies whether or not a working exploit is known to exist, rather than only where an exploit is available.

Multi-factor authentication moved forward and up. Requirements were brought forward so that multi-factor authentication for online access to the organisation's sensitive data appears at Maturity Level One, and phishing-resistant methods carry greater weight at higher levels. This is the change that most affects how the earlier authentication section should be read.

Privileged access controls tightened, with validation and periodic revalidation of privileged access requests, restrictions on privileged accounts reaching the internet and email, and requirements around break-glass accounts.

Some requirements were removed, including macro execution event logging and patching obligations for lower-priority devices, which is a reasonable indication that the model is being pruned as well as extended.

Update, current as at September 2026: the Essentials series

This one is live and unresolved, and it should be watched.

On 15 June 2026 ASD opened a consultation on evolving the Essential Eight into a broader Essentials series, grounded in the Information Security Manual and offering, in ASD's words, prioritised and threat-informed mitigations for contemporary technology environments. The first chapter is Essentials for enterprise IT; further chapters covering operational technology and cloud are foreshadowed. Consultation closed on 12 July 2026.

The reasoning given is that the 2017 model was designed for on-premises Windows environments and does not translate cleanly to cloud services, shared responsibility models or software-as-a-service. The new approach is intended to be less prescriptive and more principles-based, and to explain the adversary techniques behind each mitigation rather than only stating the mitigation.

What is settled and what is not. Settled: the consultation happened, the Essential Eight remains published and current, and ASD has said organisations already using it can expect strong alignment with their existing controls and investments. Not settled: the retirement date. An ACSC representative has publicly indicated an approximate path of running both documents in parallel, beginning to deprecate the Essential Eight around twelve months from the close of consultation and retiring it around twenty-four months, but ASD has published no schedule and that is an indicative expectation rather than a commitment.

The sensible reading for anyone studying this now: learn the Essential Eight, because it is current, it is what contracts and audits reference, and its underlying controls are durable. But treat the framework name as less permanent than the controls it contains, and if you are writing a contract, reference ASD's current baseline guidance rather than naming the Essential Eight specifically.

Performance criterion 5.3 asks for the CIS controls to be examined. The question bank asks for all 18 to be stated.

What they are

The CIS Critical Security Controls are a prioritised set of safeguards published by the Center for Internet Security, developed from analysis of how attacks actually succeed. Where the NIST CSF describes outcomes and the Essential Eight gives eight high-value mitigations, the CIS Controls sit in between: 18 controls containing 153 individual safeguards, ordered so that the earliest controls give the greatest risk reduction.

The version taught in the delivered material is v8, released May 2021. The current version is v8.1, released 25 June 2024.

The 18 controls

Control	Title
CIS 1	Inventory and Control of Enterprise Assets
CIS 2	Inventory and Control of Software Assets
CIS 3	Data Protection
CIS 4	Secure Configuration of Enterprise Assets and Software
CIS 5	Account Management
CIS 6	Access Control Management
CIS 7	Continuous Vulnerability Management
CIS 8	Audit Log Management
CIS 9	Email and Web Browser Protections
CIS 10	Malware Defences
CIS 11	Data Recovery
CIS 12	Network Infrastructure Management
CIS 13	Network Monitoring and Defence
CIS 14	Security Awareness and Skills Training
CIS 15	Service Provider Management
CIS 16	Application Software Security
CIS 17	Incident Response Management
CIS 18	Penetration Testing

The ordering is the argument. Controls 1 and 2 come first because you cannot defend an asset you do not know you have, and because unknown assets and unapproved software are where intrusions begin. Everything after that depends on them.

Implementation Groups

Not every organisation should attempt all 153 safeguards, and CIS says so explicitly through three Implementation Groups.

IG1 is the subset CIS calls essential cyber hygiene: 56 safeguards intended for a small or medium organisation with limited expertise, whose main concern is keeping the business running and protecting the data it holds. IG1 is a defensible destination in its own right, not a stepping stone that must be left behind.

IG2 adds safeguards for an organisation with people dedicated to managing and protecting IT infrastructure, often handling sensitive client or business data and subject to regulatory requirements.

IG3 adds the remainder, for organisations with security expertise across specialist functions, where a successful attack could cause significant harm to the public.

Each group includes the ones below it.

What changed in v8.1

v8.1 is an iterative update rather than a rewrite. Existing v8 work carries over. The changes:

A new Governance security function was added, alongside the existing identify, protect, detect, respond and recover functions, so the controls can express the policies, procedures and processes that support how an organisation protects its assets, and produce the evidence auditors ask for.

Mappings to the NIST CSF were realigned to CSF 2.0, which is what put Governance there in the first place.

Asset classes were revised and remapped to safeguards, so it is clearer which safeguard applies to which kind of thing.

Glossary entries were expanded and ambiguous safeguard descriptions clarified.

The pattern across all three frameworks in the same eighteen-month window is the same: governance moved from the background to the foreground. NIST added Govern in February 2024, CIS added Governance in June 2024, and ASD's stated reason for the Essentials series is that the prescriptive-controls-only approach does not fit contemporary environments.

Students, reasonably, ask which one to use. They answer different questions, and in practice an Australian organisation uses more than one.

Framework	What it is	Best used for
NIST CSF 2.0	Outcome-based risk management framework, six functions	Structuring the whole program; communicating posture to a board; gap analysis through Current and Target Profiles
Essential Eight	Eight prioritised mitigations with four maturity levels	An Australian baseline, particularly where government contracts or expectations apply; a clear, measurable target for a small security team
CIS Controls v8.1	18 controls, 153 safeguards, three implementation groups	A concrete, ordered work list; deciding what to actually do next Monday
ISO/IEC 27001	Certifiable information security management system standard	Where a certificate is needed to satisfy customers or regulators
ASD Information Security Manual	Detailed control catalogue for Australian government systems	Where the organisation must meet Commonwealth requirements, including IRAP assessment

A workable pattern for a mid-sized Australian organisation: use the CSF to structure and report, use the Essential Eight as the baseline and the measurable target, and use the CIS Controls to sequence the actual work. They map to one another; CIS publishes mappings to the CSF, and ASD publishes a mapping from the Essential Eight to the Information Security Manual.

The delivered unit builds a small virtual network so attacks and defences can be observed rather than described. The concepts are worth holding separately from the specific software versions, because the concepts last and the versions do not.

Virtualisation and hypervisors

Virtualisation creates the illusion of a complete machine in software. A hypervisor creates and manages that environment, allocating processor, memory, storage and network resources to each guest, and presenting each guest with what looks to it like real hardware.

Type 1, or bare metal. The hypervisor runs directly on the hardware with no host operating system beneath it. VMware ESXi, Microsoft Hyper-V, KVM, Proxmox, Citrix Hypervisor. Used in data centres.

Type 2, or hosted. The hypervisor runs as an application on top of an ordinary operating system. Oracle VirtualBox, VMware Workstation and Fusion, Parallels. Used on a laptop, which is what a study lab is.

When a hypervisor creates networks it also creates virtual network adapters on the host. Running ipconfig on Windows or ip addr on Linux will show them alongside the physical interfaces, and being able to tell which adapter belongs to which virtual network is the first troubleshooting skill in lab work.

Networking modes are where lab exercises most often go wrong, so it is worth being precise.

NAT. Guests share the host's IP address to reach the outside world. Guests can reach the internet; the outside cannot initiate connections to them.

Bridged. Guests appear as separate machines on the physical network with their own addresses. Convenient, and a poor choice for a lab containing deliberately vulnerable machines.

Host-only, or internal. Guests can talk to each other, and in host-only mode to the host, but not to the wider network. This is the correct mode for a lab with vulnerable targets in it.

The classic lab build

The lab in the delivered material puts five machines on a single subnet, 192.168.1.0/24: Kali Linux as the attacking machine, Metasploitable 2 as a deliberately vulnerable Linux target, and Windows XP, Windows 7 and Windows 10 as targets, either as five physical machines or, more sensibly, as five virtual machines on one host.

Kali Linux is a Debian-based distribution built for penetration testing and security auditing, carrying several hundred security tools. kali.org

Metasploitable 2 is an intentionally vulnerable Ubuntu image built for practising against, compatible with the common hypervisors.

Update, current as at September 2026. Three things about that build have aged.

The Windows XP and unpatched Windows 7 targets are historical curiosities. They are still useful for demonstrating exactly why unsupported operating systems are a problem, and for practising against MS08-067 and MS17-010 (EternalBlue), which is genuinely instructive because both were used in real, consequential worms. They are not representative of anything you will meet in current work.

Kali 2018.4 is long superseded. Use a current Kali release, and note that Kali is now developed and maintained by OffSec rather than under the older Offensive Security branding.

Isolation discipline matters more than it used to. A deliberately vulnerable virtual machine must never be reachable from the internet or from the home network. Host-only or internal networking, snapshots taken before each exercise, and no shared folders or clipboard with the host.

Alternatives worth knowing about for self-study, since a five-machine lab is a lot of laptop. TryHackMe and Hack The Box provide hosted, legal targets with guided material. Metasploitable 3 and the OWASP Juice Shop are current deliberately vulnerable targets. DetectionLab and Microsoft's free trial tenancies let you practise the defensive side, which is the side that actually gets hired at entry level, and which almost no home lab covers.

The rule that matters more than any of this: testing, probing or scanning any system you do not own or have written permission to test is a criminal offence in Australia under Part 10.7 of the Criminal Code Act 1995. Written permission, with scope and dates. VU23223 covers the legal detail.

Wireshark is the standard protocol analyser, used in security operations for traffic analysis, for malware analysis (identifying command and control channels and beaconing patterns), and for finding weaknesses in how applications actually talk on the wire.

The distinction that trips people up: a capture filter decides what gets recorded and uses BPF syntax; a display filter decides what you are shown from an existing capture and uses Wireshark's own syntax. The filters below are display filters.

Purpose	Filter
One host, either direction	ip.addr == 192.0.2.10
An address range	ip.addr >= 192.0.2.1 and ip.addr <= 192.0.2.50
A port	tcp.port == 80 or udp.port == 53
Packets over a size	frame.len > 1000
A MAC address	eth.src == 00:11:22:33:44:55
HTTP status code	http.response.code == 404
HTTP method	http.request.method == "GET"
A URI substring	http.request.uri contains "login"
A cookie	http.cookie contains "sessionid"
TCP flags, for example SYN	tcp.flags.syn == 1
DNS queries for a domain	dns.qry.name contains "example.com"
TLS ClientHello	tls.handshake.type == 1

Two additions that earn their place in an investigation. tls.handshake.extensions_server_name shows the hostname a client asked for even though the rest of the session is encrypted, which is often the only visible clue about where traffic is going. And http.request.method == "POST" and frame.len > 5000 is a crude but effective first pass for large outbound uploads.

Two habits worth forming early. Encrypted traffic is now the default, so most investigation is about metadata (who talked to whom, when, how often, how much) rather than content; regular, evenly spaced connections to one destination are the signature of beaconing malware regardless of whether you can read the payload. And full packet capture is expensive to store, so in real environments flow records and proxy or DNS logs usually do the work Wireshark does in a lab.

The performance evidence for this unit requires threats, risks and vulnerabilities to be identified for two scenarios, with suitable protective methodologies recommended. The scenario used in the delivered assessment is a good one to think through, because it is the shape of most Australian small businesses.

The organisation

Top End Tours is a five-year-old adventure tour company with three people: the owner, a driver who handles catering and logistics, and an administrator who covers marketing and publicity four days a week. They hold a database of over 1,500 people containing names, addresses, email addresses and phone numbers, and financial records for some returning customers, in MySQL on a PC acting as a server at the owner's home, where the small office is. A consumer wireless router connects the server, a printer and a laptop, and connects to the internet over a base-level NBN service. Nobody is an IT expert. The owner set the system up and calls a local IT firm when stuck, which has happened twice in two years. Physical assets are the office, the server, a boat and trailer, and two vehicles.

The threats, risks and vulnerabilities

Working through it the way the assessment expects, but with the reasoning made explicit.

The data is the crown jewel, and it is a regulated asset. Over 1,500 individuals' personal information, including financial records. This is the thing that would cause the most harm if it left, and it is what makes the business subject to obligations under the Privacy Act's Notifiable Data Breaches scheme. Small businesses with turnover under three million dollars are currently exempt from most of the Privacy Act, which is a live policy question rather than a permanent state of affairs, and which does not remove either the reputational consequence or the customer's expectation.

Phishing, by email, phone and text. Three people, no security team, no filtering beyond whatever the mail provider does by default. The most likely entry point by a wide margin.

Ransomware. The consequence would be total; a single server holding the only copy of the customer database and the booking information.

No regular, tested backup. The single largest vulnerability in the scenario. Everything else is recoverable if this is fixed, and almost nothing is if it is not.

Weak or reused passwords, and no multi-factor authentication. Especially on the email account, which is the recovery channel for everything else, and on the database.

Unpatched operating systems and software, on a machine nobody is responsible for.

A consumer wireless router, quite likely still on default administrative credentials, possibly with remote management exposed, and unlikely to have received a firmware update. This is both a vulnerability and, if compromised, a position from which everything on the flat internal network is visible.

A flat network with no segmentation. The server, the printer, the laptop and, presumably, personal and family devices share one network in a residence. The printer alone is a plausible entry point.

Physical and environmental risk. The server is in a house. Fire, theft, flood, a burst pipe and a power event all destroy it, and any of them destroys the business if the backup is a second drive sitting beside it.

Single point of knowledge. One person set it up and understands it. Nothing is documented. This is a business continuity risk that has nothing to do with attackers.

Third-party dependency. The IT firm has administrative access and is contacted rarely. Who holds credentials, what they can reach, and what happens if they are compromised are all unanswered.

Insider and departure risk. Casual staff, shared logins, no offboarding process.

The mitigations, in the order they should be done

Sequenced by risk reduction per dollar, which for an organisation this size is the only sensible ordering.

Fix backups first. Automated daily backup of the database and business files, following 3-2-1: three copies, two media, one off site. At least one copy immutable or offline so ransomware cannot reach it. Then, and this is the step everyone skips, restore from it and confirm the restored database opens. An untested backup is a hypothesis.

Turn on multi-factor authentication, starting with email, then the accounting and banking platforms, then any remote access. Use an authenticator app or a passkey rather than SMS.

A password manager and unique passwords for every account. Three people, so this is a small job, and it eliminates credential stuffing entirely.

Turn on automatic updates for operating systems, applications and the router firmware, and replace the router if it no longer receives updates.

Change the router's administrative password, disable remote management and universal plug and play, and put guest, personal and family devices on a separate network from the business server.

Phishing awareness for three people. Not a training platform; a conversation and a written rule. The rule that matters: any request to change bank details or send money is verified by calling a known number, never a number from the message. Teach the pressure techniques rather than a list of signs, because those are what actually generalise: authority, urgency, emotion, scarcity, and reference to a current event.

Reduce what is held. The business almost certainly does not need to store card details, and should not. Move recurring payments to a payment provider that tokenises the card, so the data is off the premises entirely. Delete customer records that are past any retention need. Data that is not held cannot be breached, and this is the cheapest control in the list.

Encrypt the server's disk and any laptop, so a theft is a hardware loss rather than a data breach.

Write down the two things that matter: a one-page incident plan (who to call, what to turn off, who must be told, in what order) and a one-page inventory of systems, accounts and who has access. This is what turns a two-week crisis into a two-day one.

Formalise the IT provider relationship. Named contact, defined access, a clause about security and breach notification, and a periodic review of what access still exists.

Mapped back to the Essential Eight, that list is patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges and regular backups, which is five of the eight achieved with no capital expenditure. Application control, macro configuration and user application hardening are the three that need tooling and expertise, and for a three-person business they can reasonably wait. Mapped to CIS, it is close to Implementation Group 1.

ASD publishes a Small Business Cyber Security Guide and a small business checklist that cover this same ground, and are the right thing to hand to a business like Top End Tours.

Did you know?

The most common serious failure in small business incidents is not the absence of a backup. It is a backup that has been running successfully for years and has never been restored from. Backup software reports on whether the job completed, not on whether the data in it is usable. The only test that means anything is a restore.

The unit scope, elements, performance criteria, performance and knowledge evidence, assessment conditions and the delivered assessment structure are transcribed from the CDU TAFE VU23217 Assessor Guide v4 and the VU23217 assessment requirements document held in this unit's folder in the vault, together with the delivered topic decks for cyber security awareness, threat intelligence models, the laboratory environment, the NIST incident response guide, the Essential Eight maturity model and the CIS critical security controls, all dated between July 2022 and July 2023. Nominal hours are from the 22603VIC accredited course document. The Wireshark filter list is adapted from the Wireshark filters note in the same folder, checked against current Wireshark display filter syntax.

Current Australian material: the ASD Annual Cyber Threat Report 2024 to 2025 and the Essential Eight Maturity Model and its November 2023 change summary, all at cyber.gov.au; the ASD consultation notice on the evolution of the Essential Eight, published 15 June 2026, with consultation closing 12 July 2026; the Cyber Security Act 2024 and the Cyber Security (Security Standards for Smart Devices) Rules 2025 on the Federal Register of Legislation, with the Department of Home Affairs smart device security standards guidance; and the Office of the Australian Information Commissioner notifiable data breaches statistics for January to June 2025, published 4 November 2025. All read 2 September 2026.

Framework material: the NIST Cybersecurity Framework 2.0 (NIST CSWP 29, published 26 February 2024); NIST SP 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, published April 2025, and its predecessor Revision 2 of August 2012; the CIS Critical Security Controls v8.1 pages and the Center for Internet Security release announcement of 25 June 2024; MITRE ATT&CK at attack.mitre.org; and the Lockheed Martin Cyber Kill Chain page. Business-facing guidance is from business.gov.au and the ASD small business guidance. The indicative Essential Eight retirement timeline attributed to an ACSC representative is reported commentary on the June 2026 consultation rather than published ASD policy, and is described that way in the text above.