CYBER SECURITY TERMS & GLOSSARY

Without application whitelisting, the organisation is prone to unauthorised applications being executed on devices, leading to malware.

Lack of asset management could result in a lack of asset information, asset failure and ghost assets. Multiple threats including but not limited to asset theft, asset tampering, introducing unauthorised assets etc. must be considered and appropriate controls must be implemented.

If a company is legally or contractually required to be compliant with any data security guidelines or cybersecurity frameworks (e.g. Australian Privacy Principles, Mandatory Data Breach notifications, ISO 27001 framework, PCI DSS etc.) and fails to do so, they will face penalties and may lose customers.

Moreover, not having these compliances in place means that the company is not following cyber security best practices and may result in customers auditing the practices and operations on a periodic basis.

Without appropriate database encryption, an internal or external threat actor, gaining access to a database, would be able to access the data retained which could result in a data breach. If high-value data retained on databases are not encrypted using strong encryption techniques, the data retained, if accessed or copied, can be readable.

Business continuity and disaster recovery plan help organizations prepare for potentially disruptive events. It enhances an organization's ability to continue business operations with little or no disruption and minimizes the risk in the event of a natural or man-made disaster. Additionally, organisations must be incorporate possible cybersecurity incidents as part of the BCP (e,g, ransomware attack) to ensure they are ready in case of such incidents.

A high number of cyberattacks begin with phishing emails. Lack of appropriate email security controls could result in credential theft, fraudulent payment, trojan installation and ransomware delivery. Multiple threats like impersonation attacks, malware delivery, phishing and fraud must be considered and protection controls must be implemented.

Identify and Access Management is a core part of any ICT deployment. If the IAM is not securely deployed, it could impact the key principles of security (accountability, authenticity, confidentiality etc.). Organisations must ensure that privileged and non-privileged access to assets and services are segregated and established with appropriate security controls enforced.

Additionally, solutions like IDAM and PAM could assist organisations with enforcing the protection controls and reduce/minimise any such security violations.

Data is encrypted and decrypted via the use of encryption keys, which means the loss or compromise of the encryption key would invalidate the data security measures put into place.

Lack of proper or weak network protection could lead to harmful spyware accessing workstations, leading to data theft and sabotage. Additionally, ineffective network protection controls will result in unauthorised data leaks from the internal network as part of a data breach.

Lack of periodic penetration testing of the key assets and services would result in organisations not being aware of exposed vulnerabilities that could be targetted by malicious actors. it is very important that organisations do threat modelling to arrive at the correct approach, test vectors and the scope of testing to fit their specific threat landscape based on the technology utilised and implementation architecture.

Attackers often lurk for weeks, or even months, before discovery. Hence, not having threat hunting in place could result in sophisticated threats getting past automated cybersecurity, resulting in breaches, ransomware or persistent attacks in the environment.

Without threat intelligence, the organisation will not be taking a proactive approach towards the threat. Threat intelligence provides organized and analyzed information about past, present, and potential attacks that could be a security threat to an enterprise

Without user behaviour analytics, the organisation will not have visibility over user behaviours and will not be able to leverage data.

Not conducting periodic vulnerability scans will leave your system exposed to vulnerabilities that could be exploited by any external or internal threat actor (opportunistic or targeted attack)

The absence of WAF means that there are no policies in place to monitor malicious traffic on the internet exposed web applications. ie. malicious HTTP/S traffic travelling to the web application is not monitored or blocked, resulting in hacks, brute force attacks, DDoS attacks, cross-site scripting, SQL injection, and zero-day exploits (due to an application-level vulnerability existing)