Glossary

All IR acsc-glossary attack-path au-compliance cloud concepts crypto detection dns frameworks hardening identity logging malware network phishing practitioner privacy soci supply-chain threat-intel vulnerability windows

6 entries

practitioner vulnerability frameworks hardening

CISA KEV

Known Exploited Vulnerabilities catalogue plus BOD 26-04 deadlines. If it is on KEV and you are internet-facing, treat exposure as an incident trigger, not a backlog item.

concepts vulnerability practitioner

CVE vs CVSS

CVE names a flaw. CVSS scores a severity model. EPSS estimates exploit likelihood. KEV records known exploitation. Your triage joins all four to exposure and asset value.

vulnerability hardening acsc-glossary

Patch

A vendor fix for a hole or a defect. Installing it is patching. Explaining why you did not is an exception with an expiry date.

vulnerability concepts acsc-glossary

Vulnerability

A weakness in requirements, design, build, or operations that can be tripped or abused and break the security policy.

vulnerability hardening acsc-glossary

Vulnerability management

Find, rank, fix, check. Known-exploited and exposure beat a 400-page scanner PDF.

vulnerability acsc-glossary

Zero-day

A usable flaw the vendor has not disclosed or patched yet. Your window is not a blog post. It is exposure.

Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary