Glossary

Cybersecurity terms, plain English

Clear definitions of Essential Eight strategies, cybersecurity concepts, and Australian compliance terms - no acronym soup, no unnecessary complexity.

A

Application controlEssential Eight
One of the eight strategies. It works by maintaining a list of approved applications and blocking everything else from running - so even if malware lands on a device, it can't execute. At ML1, application control must cover executables, software libraries, scripts, and installers on workstations and internet-facing servers.
Attack surfaceCybersecurity
The total set of entry points an attacker could use to get into a system - every application, user account, network port, and integration. The smaller your attack surface, the fewer opportunities an attacker has. Most Essential Eight strategies are fundamentally about reducing it.
Australian Cyber Security Centre (ACSC)Australian compliance
The Australian government body responsible for improving cybersecurity across the country. It's part of the ASD and publishes guidance, threat intelligence, and the Essential Eight framework that most Australian compliance requirements reference.
Australian Signals Directorate (ASD)Australian compliance
Australia's primary signals intelligence and cybersecurity agency. The ASD publishes the Information Security Manual (ISM) and owns the Essential Eight, and operates the ACSC. When you see 'ASD-recommended' in vendor marketing, they're referring to these frameworks.

B

Backups (regular backups)Essential Eight
One of the eight strategies - and arguably the most underestimated. Not just about having a copy of your data, the Essential Eight requires backups to be stored separately from your main systems (so ransomware can't reach them), tested regularly, and restorable within a defined timeframe.
Baseline configurationCybersecurity
A documented, agreed-upon set of security settings for a system or device. Once a baseline is established, any deviation from it - intentional or otherwise - can be detected and investigated. Many Essential Eight controls are effectively about enforcing a secure baseline.

C

Conditional accessIdentity & access
A policy-based approach to access control that evaluates conditions before granting access - things like the user's location, device compliance status, and sign-in risk level. Microsoft 365 and Google Workspace both support it as part of their zero trust implementation.
Cyber resilienceCybersecurity
The ability to prepare for, respond to, and recover from cyber incidents - not just prevent them. A resilient organisation assumes breaches will happen and focuses on minimising impact and recovery time, not simply keeping threats out.
Cyber Security Act 2024Australian compliance
Australian legislation that introduces mandatory ransomware payment reporting obligations, minimum security standards for smart devices, and strengthened information-sharing between government and industry. It's the most significant cybersecurity law reform Australia has seen in years.

D

Defence in depthCybersecurity
A layered security approach where multiple independent controls protect the same asset - so if one layer fails, others still hold. The Essential Eight is itself a defence-in-depth framework: no single strategy is a silver bullet, and the strategies reinforce each other.

E

EndpointCybersecurity
Any device that connects to a network - laptops, desktops, smartphones, tablets, servers. Endpoints are a primary target for attackers because they're where users work and where data lives. Most Essential Eight strategies are endpoint-focused.
Essential EightEssential Eight
A set of eight prioritised cybersecurity strategies published by the ASD/ACSC, designed to protect Microsoft Windows-based systems against the most common cyber threats. They're not a compliance checkbox - they're a practical risk-reduction framework for Australian organisations of any size, with four maturity levels to guide implementation depth.

I

Identity provider (IdP)Identity & access
A service that creates, stores, and manages user identities. Microsoft Entra ID (formerly Azure AD) and Google Workspace both act as identity providers, handling authentication and single sign-on across connected applications.
Incident responseCybersecurity
The structured process an organisation follows when a cyber incident occurs - from detecting and containing the breach, through to recovery and lessons learned. Having a plan before something goes wrong is the difference between a manageable disruption and a prolonged crisis.
Information Security Manual (ISM)Australian compliance
The ASD's comprehensive cybersecurity framework for Australian government systems. While written for government, many private-sector organisations use it as a reference standard. The Essential Eight derives from ISM controls and is considered the prioritised 'starter pack' for organisations beginning their security journey.

L

Lateral movementCybersecurity
When an attacker who's already inside a network moves from one system to another, searching for higher-value targets or more sensitive data. Restricting administrative privileges and application control both directly limit an attacker's ability to move laterally after an initial compromise.
Least privilegeCybersecurity
The principle that every user and system should have only the minimum access needed to do their job - nothing more. It's the foundation of the Essential Eight's 'restrict administrative privileges' strategy and reduces the blast radius of any compromise.

M

Macro (Office macro)Essential Eight
Small programs embedded in Microsoft Office documents that automate repetitive tasks. They're also a common attack vector - malicious macros in email attachments can execute code as soon as a document is opened. The Essential Eight strategy 'configure Microsoft Office macro settings' addresses this by restricting which macros can run and from where.
Maturity level (ML0–ML3)Essential Eight
The Essential Eight uses four maturity levels to describe how thoroughly each strategy is implemented. ML0 means the strategy isn't implemented at all; ML1 targets opportunistic attackers using automated tools; ML2 targets more capable, targeted adversaries; ML3 targets sophisticated actors prepared to invest significant effort. Most Australian SMBs should target ML1 as a starting point.
Multi-factor authentication (MFA)Essential Eight
One of the Essential Eight strategies. Requires users to prove their identity using more than just a password - typically a second factor like an authenticator app, hardware key, or push notification. At ML1, MFA is required for all remote access and for cloud service administration. Phishing-resistant MFA (passkeys, hardware tokens) is required at higher maturity levels.

N

Notifiable Data Breaches (NDB) schemeAustralian compliance
An Australian Privacy Act requirement that organisations notify both the OAIC and affected individuals when a data breach is likely to cause serious harm. Organisations with annual turnover above $3 million are generally covered, though some smaller businesses are also caught depending on their industry.

P

Patch applicationsEssential Eight
One of the eight strategies. Keeping third-party applications - browsers, Office suites, PDF readers, media players - up to date with security patches. At ML1, patches rated critical or high must be applied within 48 hours of release; internet-facing services have an even tighter window.
Patch operating systemsEssential Eight
One of the eight strategies, separate from patching applications. Focuses on keeping Windows, macOS, Linux, and mobile operating systems current. ML1 requires critical OS patches within 48 hours and the removal of unsupported or end-of-life operating system versions.
Penetration testingCybersecurity
A simulated cyberattack carried out by security professionals - with permission - to find real vulnerabilities before malicious actors do. It's different from a vulnerability scan: a pen test involves human judgement and typically uncovers issues that automated tools miss, including logic flaws and misconfigurations.
PhishingCybersecurity
Deceptive emails, messages, or websites designed to trick people into handing over credentials, clicking malicious links, or opening infected attachments. It's the most common initial access method in cyber incidents globally. The Essential Eight addresses phishing risk through MFA, application control, and macro settings - multiple layers, because no single control stops all phishing.
Privacy Act 1988Australian compliance
Australian law that governs how organisations collect, store, use, and disclose personal information. It includes the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme. The government has been progressing substantial reforms to the Act - including expanding its coverage to smaller businesses.
Privilege escalationCybersecurity
When an attacker (or malicious software) gains higher-level access than they started with - for example, moving from a standard user account to a local administrator, or from a local administrator to a domain administrator. Restricting administrative privileges and keeping systems patched are the most direct countermeasures.
Privileged accessEssential Eight
Access that goes beyond what a standard user needs - administrator accounts, service accounts, and any account that can change security settings or install software. The Essential Eight strategy 'restrict administrative privileges' is about minimising who holds this access and ensuring privileged accounts aren't used for everyday tasks like browsing the web or reading email.

R

RansomwareCybersecurity
Malicious software that encrypts a victim's data and demands payment for the decryption key. Australian businesses are targeted frequently, and the average cost of an attack (downtime, recovery, reputational damage) far exceeds any ransom demand. The Essential Eight - particularly regular backups, application control, and patching - is specifically designed to reduce both ransomware risk and recovery time.
Risk appetiteCybersecurity
The level of risk an organisation is willing to accept in pursuit of its objectives. Formalising your risk appetite helps prioritise security investment - not every risk needs to be eliminated, but every risk should be a conscious, documented choice rather than an oversight.

S

Single sign-on (SSO)Identity & access
Authentication that lets users access multiple applications with one set of credentials - log in once to your identity provider and you're authenticated across all connected apps. SSO reduces password fatigue, makes MFA easier to enforce consistently, and centralises access revocation when someone leaves.
Social engineeringCybersecurity
Manipulating people into taking actions or revealing information that compromises security. Phishing is one type; social engineering also includes phone-based attacks (vishing), impersonation, and pretexting. Technical controls help, but staff awareness training is the most direct defence.
Supply chain attackCybersecurity
When attackers compromise a trusted supplier or software vendor to gain access to that vendor's customers - rather than targeting each victim directly. The 2020 SolarWinds attack is the most well-known example. Application control and careful vendor vetting reduce exposure.

T

TenantCloud & SaaS
In cloud platforms like Microsoft 365 and Google Workspace, a tenant is a dedicated, isolated instance of the service for a single organisation. All security configuration - MFA policies, conditional access rules, admin roles, data retention - happens at the tenant level. Misconfigurations in your tenant affect every user in your organisation.
Threat actorCybersecurity
Any individual or group that carries out cyberattacks. The Essential Eight maturity levels are calibrated against different threat actor capabilities: ML1 targets opportunistic criminals using commodity tools; ML2 targets capable, adaptive adversaries; ML3 targets sophisticated, well-resourced actors conducting targeted campaigns. Knowing who's most likely to come after your organisation helps calibrate your security investment.
Threat modellingCybersecurity
A structured process to identify what you're protecting, who might attack it, how they'd do it, and where your biggest gaps are - so you can prioritise controls effectively. You don't need a formal methodology to benefit; even a whiteboard session asking 'what's our most valuable asset and how would someone steal it?' is a form of threat modelling.

U

User application hardeningEssential Eight
One of the eight strategies. Disabling features in web browsers and other applications that are rarely needed but frequently exploited - things like Flash, web ads from untrusted sources, and Java in browsers. Reducing what an application can do reduces what an attacker can do with it.

V

VulnerabilityCybersecurity
A weakness in software, hardware, or configuration that could be exploited by an attacker. Vulnerabilities are discovered constantly in applications, operating systems, and devices. The Essential Eight's patching strategies are specifically designed to close them quickly - before attackers can take advantage.

Z

Zero trustIdentity & access
A security model that assumes no user, device, or network connection should be trusted by default - even inside your own network. Every access request is verified based on identity, device health, and context. Conditional access, MFA, and least privilege are all zero trust principles in practice - the Essential Eight aligns well with zero trust thinking.
Zero-dayCybersecurity
A vulnerability that's being actively exploited by attackers before the vendor has released a patch - meaning defenders have 'zero days' to apply a fix. The Essential Eight helps by reducing the number of exposed systems and limiting what attackers can do even when a zero-day is present in your environment.

Ready to put this into practice?

Our step-by-step guides walk you through implementing Essential Eight ML1 in Microsoft 365 or Google Workspace - no prior security experience needed.

View the guides