Glossary

The Australian-specific terms first, because those are the ones that carry legal consequences and the ones general glossaries get wrong.

Australian regulatory terms

APP entity: An entity bound by the Australian Privacy Principles under the Privacy Act 1988: Australian Government agencies, and organisations above a turnover threshold, plus specified others regardless of turnover (health service providers, credit reporting bodies, credit providers, TFN recipients, traders in personal information). The threshold has been $3 million since 2001, and the small-business exemption it creates has been under review, so confirm it with the OAIC rather than relying on the figure here.

Eligible data breach: The trigger for notification under the NDB scheme. Unauthorised access to, unauthorised disclosure of, or loss of personal information held by an APP entity, where serious harm to any affected individual is likely. The OAIC’s own guidance on the scheme is here.

Reporting business entity: The trigger for ransomware payment reporting under the Cyber Security Act 2024: an entity carrying on business in Australia above a turnover threshold, currently aligned with the Privacy Act figure. Entities responsible for a critical infrastructure asset are covered irrespective of turnover. Check the current threshold and the reporting timeframe with ASD before relying on either.

Serious harm: Not defined exhaustively in the Act. Includes physical, psychological, emotional, financial and reputational harm. Assessed against the likelihood that a reasonable person would consider the harm serious in the circumstances.

SOCI Act: The Security of Critical Infrastructure Act 2018. Imposes registration, reporting and risk-management obligations on responsible entities for assets in defined critical sectors.

CIRMP: Critical Infrastructure Risk Management Program. The written program certain SOCI-regulated entities must adopt, maintain and annually attest to.

Penalty unit: The indexed unit Commonwealth civil and criminal penalties are expressed in. Because it is indexed, any dollar figure quoted in an article dates quickly. Check the current value before relying on it.

PSPF: Protective Security Policy Framework. Sets the mandatory security requirements for non-corporate Commonwealth entities, including implementing the Essential Eight.

ISM: Information Security Manual. ASD’s detailed control catalogue, far broader than the Essential Eight, used for government system accreditation.

Agencies

ASD: Australian Signals Directorate. The Commonwealth signals intelligence and cyber security agency. Receives ransomware payment reports and SOCI incident reports.

ACSC: Australian Cyber Security Centre, within ASD. The public-facing side: advisories, guidance and the 24/7 hotline on 1300 CYBER1.

OAIC: Office of the Australian Information Commissioner. The privacy regulator. Receives NDB notifications and enforces the Privacy Act.

CISC: Cyber and Infrastructure Security Centre, within Home Affairs. Administers the SOCI Act.

ReportCyber: The online reporting portal at cyber.gov.au/report. Routes reports to ASD and, for criminal matters, to state and territory police.

IDCARE: Australia and New Zealand’s free national identity and cyber support service. Where to send affected individuals after a breach.

Attack and incident terms

Ransomware: Malware that encrypts data and demands payment for decryption. Most current campaigns also exfiltrate data first, so paying for a decryptor does nothing about disclosure.

Double extortion: Encrypting and stealing data, then threatening publication. Why “we restored from backup” is no longer a complete answer to a ransomware incident.

Cyber extortion: The broader category, including data-theft extortion with no encryption at all. The Cyber Security Act 2024 reporting obligation covers extortion payments generally, not only ransomware.

Business email compromise (BEC): Fraud carried out through a compromised or spoofed mailbox, usually redirecting a payment. Consistently among the costliest attack types for Australian businesses by direct loss.

Initial access broker: A criminal who compromises networks and sells that access to others, including ransomware crews. The reason a “minor” credential compromise can become a major incident months later.

Living off the land: Attacker use of tools already present on the system (PowerShell, WMI, legitimate remote admin software) to avoid dropping detectable malware.

Zero-day: A vulnerability exploited before a patch exists. Distinct from the far more common case of a patch existing and not having been applied.

Supply chain compromise: Reaching a target through a supplier, managed service provider, or software dependency rather than attacking it directly.