Acronyms and definitions

The process of documenting activity within the software systems used across an organization.

Audit logs record the occurrence of an event, the time at which it occurred, the responsible user or service, and other items.

Authentication is the process of determining whether someone or something is, in fact, who or what it says it is. Authentication technology provides access control for systems by checking to see if a user's credentials match the credentials in a database of authorized users or in a data authentication server.

ATO considers Authentication access controls as a minimum for Client Controlled software.

Multi Factor Authentication (MFA) is a method to authenticate an individual using 2 or more authentication factors to verify their identity, when they log into software.

ATO considers MFA as a minimum for DSP controlled Cloud based software.

A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works.

A brute force lockout event occurs after a specified number of incorrect attempts. ATO standard is 5 incorrect attempts.

Independent certification seeks to provide the ATO with a level of assurance a DSP has robust security practices in place across the organisation. (iRAP or ISO/IEC 27001 standards)

Self-assessment requirement seeks to provide ATO with a level of assurance a DSP will have robust security practices in place across the organisation. (iRAP, ISO/IEC 27001, ISO/IEC 27002, SOC2, OWASP ASVS 3.0 or later, NIST)

Is designed to prevent an attacker from accessing the unencrypted data by ensuring the data is encrypted when on disk.

If an attacker obtains a hard drive with encrypted data but not the encryption keys, the attacker must defeat the encryption to read the data.

Is when the encrypted data is active, moving between devices and networks such as the internet, within a company, or being uploaded in the cloud.

ATO has minimum standards for protocols allowable.

External Vendor Testing Environment.

DSPs build and test services to be able move into production.

Data exfiltration is the theft or unauthorized removal or movement of any data from a device.

This typically involves stealing data from devices through various cyberattack methods.

Represents the amount of time a user can be inactive before the user's session access times out and implements a screen lock. An access event, like SSO would be required to re-open the session.

It is not a session termination, only a screen lock – the session can continue running in the background.

Software transmits indirectly to the ATO, usually by a Gateway or SSP (Sending Service Provider).

Are digital service providers (DSPs), which enable other DSPs to transmit data to the ATO via the ATO SBR ebMS3 messaging standard.

The ISO/IEC 27000 family of standards enables companies and organisations to establish IT security, cybersecurity, and privacy protection.

ISO 27000 outlines the security techniques necessary to properly safeguard customer data.

ISO 27001 is where those principles meet the real world.

Businesses implement the requirements outlined in ISO 27000 standards and verify the effectiveness of their ISMS through an ISO 27001 audit.

ISO 27002 gives guidance on implementing an ISO 27001 ISMS.

ISO/IEC 27017:2015 gives guidelines for information security controls applicable to the provision and use of cloud services.

Different people using the same credential, that is shared. This is not permitted.

If it is the same person logging into multiple devices at the same time, it’s concurrent logins and is acceptable.

After a user login, the user will have access from the same machine to all its data even after the session has expired. This access will be possible until user does a logout.

The ATO’s requirement is to limit this functionality to less than 24 hours (meaning that a users’ access to the system would occur each day).

Seeks to identify entities and their functional roles involved in the transmission of information, operating to and from the system which generates the payload, and the ATO.

This includes providing details of any third-party connections to a DSP product via APIs.

Seeks to identify security controls and policies DSPs need to implement, when partnering with third-party add-on providers and allow connection via an API.

ATO defines and ‘Add-on marketplace’ as an API that is offered by a DSP for use by other third-party software developers to provide additional value-added services to end customers.