VCE - Applied Computing - UNIT 2 - SAC 2 - Cybersecurity

Cybersecurity

The practice of protecting systems, networks, programs, devices, and data from digital attacks, unauthorized access, modification, or destruction.

Confidentiality

Ensuring that sensitive information is only accessible to those with proper authorization and is protected from unauthorized disclosure.

Integrity

Ensuring the accuracy, completeness, and reliability of data and systems by preventing unauthorized modification or corruption.

Availability

Ensuring that information, network resources, and systems are reliably accessible to authorized users whenever they are needed.

Threat

Any potential circumstance or event that can exploit a vulnerability to cause harm, disruption, or data loss to a digital system.

Vulnerability

A weakness, flaw, or loophole in a system's design, implementation, or security procedures that can be exploited by a threat.

Risk

The potential likelihood and negative impact of a threat successfully exploiting a system vulnerability.

Deliberate Threat

An intentional malicious action taken against a digital system, such as hacking, malware injection, or phishing attacks.

Accidental Threat

An unintended human error or environmental failure that compromises security, such as sharing passwords or accidentally deleting files.

Phishing

A social engineering attack where fraudulent emails disguised as trustworthy entities trick users into revealing sensitive details or opening malicious attachments.

Malware

Malicious software specifically designed to infiltrate, damage, or disrupt computers, networks, and databases (e.g., viruses, ransomware, spyware).

Ransomware

A type of malicious software that encrypts a victim’s files or locks their system, demanding a financial ransom payment to restore access.

Authentication

The security process of verifying the identity of a user, device, or system before granting access to network resources.

Multi-Factor Authentication (MFA)

An electronic security measure requiring users to provide two or more distinct verification factors (e.g., a password plus an SMS code or biometric scan) to gain access.

Access Controls

Policies, administrative guidelines, and technical restrictions that dictate which users or devices are permitted to access specific data and administrative functions.

Principle of Least Privilege

A procedural security practice ensuring that employees and accounts are only given the bare minimum access rights necessary to perform their specific job roles.

Firewall

A hardware or software security system that monitors and filters incoming and outgoing network traffic based on predefined security rules.

Operating System Updates

Routine software patches released by developers to fix newly discovered bugs, security flaws, and vulnerabilities in operating systems.

Patch Management

The systematic process of acquiring, testing, and installing code updates (patches) to fix software or operating system vulnerabilities.

Firmware

A specialized type of computer software permanently or semi-permanently embedded directly into a hardware device's non-volatile memory to control its low-level functions.

Data Backup

The practice of creating and storing duplicate copies of critical organizational data on separate storage media to ensure recovery following system failures or cyber incidents.

Encryption

The cryptographic process of encoding plaintext data into unreadable ciphertext using an algorithm and a key to protect it from unauthorized interception or access.

Symmetric Encryption

A cryptographic technique where the exact same key is used to both encrypt plaintext and decrypt ciphertext, primarily used to protect data-at-rest.

Asymmetric Encryption

A cryptographic technique utilizing a mathematically related public and private key pair, primarily used to secure data-in-motion.

Public Key

A cryptographic key in asymmetric encryption that can be shared openly and is used to encrypt data or verify digital certificates.

Private Key

A secret cryptographic key in asymmetric encryption that must be strictly safeguarded and is used to decrypt data encrypted by its public key counterpart.

Essential Eight

An Australian Cyber Security Centre (ACSC) framework consisting of eight foundational mitigation strategies designed to protect organizations against a majority of cyber threats.

Information Security Manual (ISM)

The Australian Signals Directorate's (ASD) foundational cybersecurity framework that provides organizations with a comprehensive risk management guide based on five core functions: Govern, Identify, Protect, Detect, and Respond.

Privacy Act 1988

Australian federal legislation that regulates how most Australian Government agencies and large private-sector businesses handle, store, and manage personal information using the Australian Privacy Principles (APPs).

Privacy and Data Protection Act 2014

Victorian state legislation that governs how Victorian public sector organizations, local councils, and state departments handle personal information using Information Privacy Principles (IPPs).

Health Records Act 2001

Victorian legislation that establishes specific rules and Health Privacy Principles (HPPs) for the handling and security of confidential health information.

APP 2: Anonymity and Pseudonymity

The requirement under the Privacy Act that organizations must give individuals the option of interacting anonymously or using a pseudonym, unless required by law or impracticable.

APP 6: Use or Disclosure

The privacy rule stating that personal information collected for a primary purpose cannot be used or disclosed for a secondary purpose unless specific exceptions like consent or reasonable expectation apply.

APP 11: Security of Personal Information

The mandatory obligation for organizations to take active, reasonable steps to protect personal information from misuse, loss, and unauthorized access, and to destroy or de-identify it when no longer needed.

Intranet

A private, internal computer network restricted to an organization's authorized users, utilizing internet technologies for secure communication and resource sharing.

Internet

A massive, globally interconnected network of computers and public networks operating via the TCP/IP protocol suite that is accessible to anyone.

Virtual Private Network (VPN)

A secure technology that creates an encrypted connection (tunnel) over the public internet, allowing remote users or branch offices to safely access a private corporate network.

Transmission Control Protocol/Internet Protocol (TCP/IP)

The fundamental communication protocol suite of the internet, where TCP breaks data into packets and reassembles them, while IP handles addressing and routing.

IP Address

A unique numeric label (such as IPv4) assigned to every device connected to a computer network, allowing it to communicate with other systems.

Packet Switching

The networking method where data is broken down into small blocks (packets) sent independently across the most efficient route and reassembled at the destination.

Hypertext Transfer Protocol Secure (HTTPS)

An encrypted protocol used for secure communication over a computer network, combining HTTP with SSL/TLS security protocols.

Secure Sockets Layer (SSL)

A legacy cryptographic security protocol designed to provide secure communications over the internet via digital certificates and handshakes.

Transport Layer Security (TLS)

The modern successor to SSL, a cryptographic protocol that provides secure, encrypted communications over computer networks and the internet.

Domain Name System (DNS)

The hierarchical decentralized naming system on the internet that translates human-readable domain names (e.g., website addresses) into machine-readable IP addresses.

Local Area Network (LAN)

A computer network that connects digital devices within a limited, confined geographical area such as a single home, school, or office building.

Wide Area Network (WAN)

A computer network that spans a large geographical area, often connecting multiple smaller LANs across cities or countries using third-party transmission media.

Wireless Personal Area Network (WPAN)

A network used for connecting an individual's personal devices over a very short range using standards like Bluetooth or infrared.

Ethernet

A wired networking technology protocol used to connect devices within a Local Area Network (LAN) using twisted-pair or fiber-optic cables.

Network Switch

A networking hardware device that connects devices together on a computer network and uses packet switching to forward data directly to the intended destination device.

Router

A networking device that forwards data packets between different computer networks, such as connecting a local home or school network to the internet.

Wi-Fi

A wireless networking technology that allows devices to connect to a local area network or the internet using radio waves.

Bluetooth

A short-range wireless communication technology standard used for exchanging data between fixed and mobile devices over short distances.

Near-Field Communication (NFC)

A short-range wireless connectivity technology that enables secure two-way communication between electronic devices when they are placed within a few centimeters of each other.

Fiber-Optic Cable

A high-speed wired transmission medium made of glass or plastic fibers that transmits data over long distances using pulses of light.

Ethics in Software Development

The moral principles, codes of conduct, and professional standards that guide software developers to ensure their systems are safe, unbiased, secure, and respectful of privacy.

Algorithmic Bias

An ethical issue where an automated algorithm or AI system produces systematically prejudiced or unfair outputs due to erroneous assumptions or biased training data.

Intellectual Property (IP)

Creations of the mind protected by law (such as software code, patents, and trademarks) that grant creators exclusive rights to use and commercialize their work