Protect against malware
The controls that actually stop it, in rough order of what they buy you. Written for people who have to make a decision, not for people who want to be alarmed.
Avoid malware, and what to do if you click
Plain-English malware advice for anyone, at work or at home. What to watch for, what to do if you have clicked something, and who to tell.
The Essential Eight
ASD’s Essential Eight mitigation strategies and the four maturity levels, in plain English, with what each control actually requires in practice.
Business email compromise explained
How BEC and invoice fraud work, why technical controls miss them, and the process changes that actually stop the payment going out.
MFA that actually resists phishing
Why SMS codes and push prompts get defeated, what phishing-resistant MFA means in practice, and which accounts to protect first.
Why this order
The two most common ways in are a stolen credential and an unpatched internet-facing system, and neither involves anybody making a mistake. That is why phishing-resistant MFA and fast patching come before anything aimed at user behaviour: they address most of the problem, and awareness training cannot.
Backups come next, not because they prevent anything, but because they decide how bad the worst case gets. Everything after that is narrowing what a compromise can reach once it has happened.
Had an incident already?
These guides are for reducing risk. If something has already happened, report it to ASD at cyber.gov.au/report or ring 1300 CYBER1, and check your own reporting duties with each regulator that covers you.