WA Cyber Security Unit (Office of Digital Government)¶
This site contains technical information to support WA Government Cyber Security activities. Please propose updates directly via the edit link on each page or email cybersecurity@dpc.wa.gov.au with any feedback. The site is built with Material for MkDocs (reference) which includes several extensions to markdown for enhanced technical writing.
WA Security Operations Centre (WASOC)¶
- Connecting to the WASOC (Sentinel Guidance)
- Advisories (TLP:CLEAR)
- Incident Reporting User Guide (Jira)
- Threat Hunting (MITRE ATT&CK Tactics and Techniques)
- ACSC Essential Eight Assessment Process Guide
Baselines & Guidelines¶
Baselines are for use as self-assessment checklists, and guidelines are for general implementation guidance.
Baselines
- Security Operations Baseline - aligned with MITRE 11 Strategies of a World-Class Cybersecurity Operations Center and ACSC's Cyber Incident Response Plan Resource.
- Detection Coverage Baseline - telemetry collection and detection analytics aligned to the MITRE ATT&CK Framework.
- Vulnerability Management Baseline - focused on undertaking operational Identify and Protect capabilities.
Critical Infrastructure Entities and Operational Technology
The CISA Cross-Sector Cybersecurity Performance Goals are clear targeted recommendations focusing on most common and impactful threats, including cost, complexity and impact ratings against each recommendation. These are highly relevant targets for entities in scope of SOCI regulatory obligations.
Guidelines
- Supply Chain Risk Management Guideline - Implementation guidance for ACSC Cyber Supply Chain Risk Management.
- Guide to Securing Remote Access Software (CISA) - remote access software overview, including the malicious use of remote access software, detection methods, and recommendations for all organizations.
- #StopRansomware Guide (CISA) - one-stop resource to help organizations reduce the risk of ransomware incidents through best practices to detect, prevent, respond, and recover, including step-by-step approaches to address potential attacks.
- Microsoft Sentinel Guidance - Implementation guidance for using Sentinel for ACSC Guidelines for System Monitoring
- Network Management Guideline - Implementation guidance for ACSC Network gateway hardening.
- Patch Management Guideline - Implementation guidance for ACSC Assessing Security Vulnerabilities and Applying Patches.
Additional documentation¶
The below documents are for general use.
Technical Documentation
Recent Advisories¶
2026 July¶
- Node.js TLS Hostname Handling Vulnerability - 20260702002
- Microsoft SharePoint Known Exploited Vulnerability - 20260702001
2026 June
- Cacti Unauthenticated LFI vulnerability - 20260629006
- FasterXML jackson-databind bypass vulnerability - 20260629005
- ManageEngine AD360 Account Takeover Vulnerability - 20260629004
- Flaw in OpenEXR image library - 20260629003
- libssh2 out of bounds write Vulnerability - 20260629001
- OpenSSL Vulnerability - 20260624001
- Splunk Enterprise Critical Function Vulnerability - 20260619003
- Oracle PeopleSoft Critical Authentication Vulnerability - 20260619002
- Fortinet Exploitation and Compromise Campaign FortiBleed - 20260618002
- Chromium Kernel Critical Vulnerability - 20260618001
- Jenkins Deserialization vulnerability- 20260617001
- Arm CPU Privilege Escalation Vulnerability - 20260611001
- New Critical ICS Vulnerabilities - 20260610003
- Chromium Critical Vulnerabilities - 20260610002
- Microsoft Critical Monthly Updates - 20260610001
- Secure Boot Bypass Vulnerability - 20260608002
- Chrome Multiple Critical Vulnerabilities - 20260608001
- OpenEXR Critical Vulnerabilites - 20260604003
- Rclone Remote Control - 20260604002
- SpringAI Critical Vulnerability - 20260604001
- PaloAlto Authentication Bypass Vulnerability - 20260603004
- FreeRDP Vulnerabilities - 20260603003
- GitPython Critical Vulnerability - 20260603002
- Axios Critical Vulnerabilities - 20260603001
2026 May
- Multiple VLC Vulnerabilities - 20260527001
- Drupal SQL Injection Vulnerability - 20260525001
- F5 NGINX Vulnerability - 20260520001
- Microsoft Critical Monthly Updates - 20260514001
- PHP SOAP Use-After-Free RCE Vulnerability - 20260511001
- Apache HTTP Server Vulnerability - 20260508001
- Palo Alto Networks PAN-OS Critical Vulnerability - 20260506001
WASOC - Recent Threat Activity (June 2026)¶
Based on recent global events, security teams should be focusing on the security controls of their perimeter - Consider your cyber hygiene in light of global events
The WASOC has observed an increase in activity targeting third party libraries and dependencies.
Recent WASOC advisories this month worth staying across include:
WASOC - General Advice¶
The WASOC has observed consistent exploitation delivered via Phishing campaigns and 'Evil Tokens' Device Code exploitation.
- Evil-Token / Device Code Abuse
- For more guidance the ACSC has guidance available here Email Hardening
Security Hardening and Supply Chain Risk remains a focus for all organisations. Please refer to the below guides to ensure all external and internal sign-ins are appropriately monitored.