# Protect against malware, malware.com.au

> The controls that actually stop malware in Australian organisations.

## Avoid malware, and what to do if you click

Plain-English malware guidance for anyone who does not work in IT, at work or at home: the four things that matter, what to do if you clicked, and why reporting fast is the whole game.

Read: https://www.malware.com.au/avoid-malware.md

## The Essential Eight

ASD’s eight baseline mitigation strategies and maturity levels 0-3. Mandatory for non-corporate Commonwealth entities; a de facto baseline elsewhere.

Read: https://www.malware.com.au/essential-eight.md

## Business email compromise explained

How business email compromise and invoice redirection fraud work, why they defeat technical controls, the process controls that stop them, and what to do in the first hour after a payment goes out.

Read: https://www.malware.com.au/business-email-compromise.md

## MFA that actually resists phishing

A ranking of MFA methods by resistance to phishing and session theft (SMS and push are defeated routinely, FIDO2/passkeys are not), plus deployment order and the gaps MFA does not cover.

Read: https://www.malware.com.au/multi-factor-authentication.md

---

Had an incident already? Report it to ASD at https://www.cyber.gov.au/report
or ring 1300 CYBER1, and check your own reporting duties with each regulator
that covers you.

General information only, not legal advice.