WA Cyber Security Unit (Office of Digital Government)¶

This site contains technical information to support WA Government Cyber Security activities. Please propose updates directly via the edit link on each page or email cybersecurity@dpc.wa.gov.au with any feedback. The site is built with Material for MkDocs (reference) which includes several extensions to markdown for enhanced technical writing.

RSS Feeds

If you would like to subscribe to updates for this site please use the RSS or ATOM feeds.

WA Security Operations Centre (WA SOC)¶

Baselines & Guidelines¶

Baselines are for use as self-assessment checklists, and guidelines are for general implementation guidance.

Baselines

Security Operations Baseline - aligned with MITRE 11 Strategies of a World-Class Cybersecurity Operations Center and ACSC's Cyber Incident Response Plan Resource.
Detection Coverage Baseline - telemetry collection and detection analytics aligned to the MITRE ATT&CK Framework.
Vulnerability Management Baseline - focused on undertaking operational Identify and Protect capabilities.

Critical Infrastructure Entities and Operational Technology

The CISA Cross-Sector Cybersecurity Performance Goals are clear targeted recommendations focusing on most common and impactful threats, including cost, complexity and impact ratings against each recommendation. These are highly relevant targets for entities in scope of SOCI regulatory obligations.

Guidelines

Supply Chain Risk Management Guideline - Implementation guidance for ACSC Cyber Supply Chain Risk Management.
Guide to Securing Remote Access Software (CISA) - remote access software overview, including the malicious use of remote access software, detection methods, and recommendations for all organizations.
#StopRansomware Guide (CISA) - one-stop resource to help organizations reduce the risk of ransomware incidents through best practices to detect, prevent, respond, and recover, including step-by-step approaches to address potential attacks.
Microsoft Sentinel Guidance - Implementation guidance for using Sentinel for ACSC Guidelines for System Monitoring
Network Management Guideline - Implementation guidance for ACSC Network gateway hardening.
Patch Management Guideline - Implementation guidance for ACSC Assessing Security Vulnerabilities and Applying Patches.

Additional documentation¶

The below documents are for general use.

Technical Documentation

Recent Advisories¶

2024 September¶

2024 August

2024 July

WA SOC - Recent Threat Activity (August 2024)¶

Based on recent high impact incidents seen by the WA SOC, security teams should be focusing on the below areas of improvement:

WASOC Guidance targeted on recent escalation of state-based actor threat activity

The ACSC has released a coordinated advisory about the newly realised APT40.
CISA has released a joint Cybersecurity Advisory titled "North Korea State-Sponsored Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs".
The ACSC has observed activity of Threat Actors impersonating the ACSC Email scammers impersonating the ASD's ACSC

Recent WA SOC advisories this month worth staying across include:

Agencies should review the latest WA Government Cyber Security Policy

WASOC - General Advice¶

Security Hardening remains a focus for all organisations. Please refer to the below guides to ensure all external and internal sign-ins are appropriately monitored.

ASD Blueprint for Restricting Admin Privileges