# Key Terminology: Unit 4 AOS2 Cybersecurity This glossary defines the essential cybersecurity terminology, legal requirements, and ethical frameworks required for VCE Software Development Unit 4 Area of Study 2 (Cybersecurity: Secure Software Development Practices). --- ## 1. Core Cybersecurity Foundations ### CIA Triad The foundational model of information security consisting of three attributes: * **Confidentiality**: Rules that restrict access to information, ensuring only authorized users can view the data. * **Integrity**: The assurance that data is accurate, complete, and has not been altered or tampered with by unauthorized parties. * **Availability**: The guarantee that authorized users have reliable and timely access to data and resources when needed. ### Vulnerability A weakness, flaw, or loophole in a software application, database, operating system, network design, or physical security that can be exploited by a threat actor. ### Threat Any potential event, action, or force (human or environmental) that has the capacity to exploit a vulnerability and cause harm, data loss, or system damage. ### Risk The probability or likelihood that a threat will exploit a vulnerability, combined with the severity of the resulting impact or damage to the organization. * Mathematically: Risk = Threat x Vulnerability x Impact. ### Attack Surface The sum total of all points, entry channels, and endpoints (ports, forms, APIs, interfaces) where an unauthorized user can attempt to enter data or extract data from an environment. --- ## 2. Types of Vulnerabilities and Risks ### API Vulnerability Flaws in an Application Programming Interface, such as unauthenticated endpoints, exposed credentials, or Insecure Direct Object References (IDOR/BOLA), allowing unauthorized data access or manipulation. ### Malware An umbrella term for malicious software designed to disrupt, damage, or gain unauthorized access to computer systems. Types include: * **Ransomware**: Malware that encrypts data and demands payment for the decryption key. * **Trojan**: Malicious software disguised as a legitimate program. * **Spyware**: Software that secretly monitors user activity (e.g. keyloggers capturing credentials). * **Worm**: Self-replicating malware that spreads across networks without human interaction. ### Unpatched Software Operating systems, libraries, or applications running with known security vulnerabilities for which the vendor has released a security patch, but the organization has failed to install. ### CVE (Common Vulnerabilities and Exposures) A public database of publicly disclosed cybersecurity vulnerabilities, providing a standardized identifier (e.g. CVE-2021-44228) and description for each flaw. ### Poor Identity and Access Management (IAM) Weak security practices regarding credential hygiene, such as reusing passwords, failing to require Multi-Factor Authentication (MFA), or granting users excessive permissions. ### Principle of Least Privilege (PoLP) A security principle stating that users, systems, and processes must only be granted the absolute minimum level of access and permissions required to perform their specific job functions. ### Man-in-the-Middle (MitM) Attack An attack where a threat actor secretly intercepts, relays, and potentially alters communication between two systems (e.g. sniffing cleartext HTTP packets on public Wi-Fi). ### Insider Threat A security risk originating from within the organisation, categorized as: * **Malicious Insider**: An employee or contractor who intentionally abuses access to steal data, commit sabotage, or sell IP. * **Negligent Insider**: A well-meaning employee who accidentally compromises security through human error (e.g. losing a device or committing secrets to git). ### Cyber Security Incident Any single or series of events that compromises the confidentiality, integrity, or availability of an information system, causing disruption, data breaches, or compliance failures. ### Supply Chain Attack (Third-Party Software Risk) A cyber attack that targets an organization by compromising an upstream vendor or open-source software package that the organization trusts and integrates into its systems. ### Ineffective Code Review Failing to audit code commits for security flaws, such as relying on quick superficial checks ("Looks Good To Me" culture) or bypassing pull request approvals altogether. --- ## 3. Secure Development and Security Controls ### Security Controls Mitigations implemented to manage security risks, classified as: * **Physical Controls**: Tangible security measures (e.g. server locks, biometric gates, hardware tokens). * **Software (Technical) Controls**: Digital barriers (e.g. firewalls, encryption, authentication scripts). * **Administrative Controls**: Policy-based constraints (e.g. NDA agreements, patch policies, code checklists). ### Version Control (VCS) Software (like Git) used to track, audit, and manage changes to source code. It ensures code integrity using cryptographic hashing and supports audit histories (non-repudiation). ### Multi-Factor Authentication (MFA) An authentication process requiring a user to present two or more separate categories of evidence (something you know, something you have, something you are) to gain access. ### Role-Based Access Control (RBAC) An authorization model where system permissions are assigned to specific roles (e.g. Intern, Admin) rather than individual accounts. ### Single Sign-On (SSO) A centralized authentication system allowing a user to log in once and gain access to multiple connected applications without re-entering credentials. ### Encryption The cryptographic process of encoding plaintext into ciphertext: * **Symmetric Encryption**: Uses a single key to both encrypt and decrypt data (e.g. AES). * **Asymmetric Encryption**: Uses a linked key pair: a public key to encrypt and a private key to decrypt (e.g. RSA, ECC). * **Encryption in Transit**: Encrypting data as it travels across a network (e.g. HTTPS, TLS). * **Encryption at Rest**: Encrypting data stored on physical disks or databases (e.g. AES-256). ### Password Hashing A one-way cryptographic function (e.g. `bcrypt`, `Argon2`) that converts passwords into a fixed-length string of characters that cannot be reversed. This ensures credentials are not stored in cleartext. ### Code Review The peer-based process of inspecting source code before merging to check for styling, logic bugs, and security vulnerabilities. ### Environment Segregation The architectural practice of isolating Development, Testing (Staging), and Production environments on separate, firewalled networks and hardware. ### Data Sanitisation (Data Masking) The process of stripping, hashing, or randomizing personally identifiable information (PII) from production database backups before importing them into non-production environments for testing. --- ## 4. Legal Requirements (VCE Context) ### Privacy Act 1988 (Cth) Federal Australian legislation regulating how organizations collect, use, store, and secure personal information. It includes the 13 **Australian Privacy Principles (APPs)**. ### Notifiable Data Breaches (NDB) Scheme An amendment to the Privacy Act 1988 that legally mandates organizations to conduct assessments of suspected data breaches and notify the **Office of the Australian Information Commissioner (OAIC)** and affected individuals if a breach is likely to result in serious harm. ### Health Records Act 2001 (Vic) Victorian state legislation establishing guidelines for the collection, handling, and security of health-specific personal data by organizations, reinforcing privacy principles (HPPs). ### Copyright Act 1968 (Cth) Federal legislation protecting intellectual property rights, including software source code, prohibiting unauthorized reproduction, distribution, or piracy of software. --- ## 5. Ethical and Industry Frameworks ### Ethical Considerations Moral responsibilities for software developers beyond legal minimums: * **Transparency**: Actively and honestly notifying clients when a data breach occurs, rather than attempting to conceal the incident. * **Identity Protection**: Implementing robust controls to protect users from identity theft, financial fraud, and loss of privacy. * **Responsible AI Use**: Assessing the ethical implications of using AI code generators (which may introduce hidden vulnerabilities) or AI-based monitoring tools. ### The Essential Eight A prioritized list of cybersecurity mitigation strategies developed by the Australian Signals Directorate (ASD) to help organizations protect their systems against cyber threats. Key strategies include: * Application control * Patch applications * Configure Microsoft Office macro settings * User application hardening * Restrict administrative privileges * Patch operating systems * Multi-factor authentication * Regular backups ### Information Security Manual (ISM) A cybersecurity framework developed by the Australian Cyber Security Centre (ACSC) providing detailed guidelines for securing systems, network traffic (including wireless traffic and network footprinting), encryption standards, and software development practices.