Quick links

The references and tools we actually use.

Australian guidance, the frameworks we work to, and the free tools we reach for every week. All external, all free to use, and checked to make sure they still go where they should.

Australian guidance and reporting

ASD Essential EightThe Australian baseline mitigation strategies and maturity model.
ASD Information Security ManualThe full Australian control set the Essential Eight sits inside.
ReportCyberReport cybercrime and cyber security incidents in Australia.
OAIC — Notifiable Data BreachesWhen a breach must be reported, and how.
ScamwatchCurrent scam alerts, and where to report one.

Frameworks and standards

NIST Cybersecurity FrameworkA risk-based framework for organising a security programme.
CIS Critical Security ControlsA prioritised set of controls, grouped by implementation level.
OWASP Top 10The most common web application security risks.
OWASP ASVSA testable standard for verifying application security.
MITRE ATT&CKAdversary tactics and techniques, drawn from real intrusions.

Vulnerability intelligence

CISA Known Exploited VulnerabilitiesCVEs confirmed as exploited in the wild. Patch these first.
National Vulnerability DatabaseThe reference database of CVEs and their scores.
FIRST EPSSThe probability a CVE will be exploited in the next 30 days.

Check a site, domain or file

Qualys SSL LabsA thorough public test of a server’s TLS configuration.
Mozilla HTTP ObservatoryGrades a site’s security headers and related settings.
MXToolboxDNS, mail server, SPF, DKIM and blocklist lookups.
dmarcian DMARC InspectorChecks a domain’s DMARC record and what it will do.
VirusTotalScan a file, URL or hash against dozens of engines.
urlscan.ioSee what a website actually loads and where it connects.
ShodanFind what an organisation exposes to the internet.
Have I Been PwnedCheck whether an email address appears in a known breach.

Testing tools

ZAPA free, open-source web application testing proxy.
Burp SuiteThe standard toolkit for web application and API testing.
NmapNetwork discovery and port scanning.
WiresharkPacket capture and protocol analysis.

Cloud and incident response

AWS Well-Architected — Security PillarAWS’s own security design principles and best practices.
Microsoft cloud security benchmarkMicrosoft’s control baseline for Azure, formerly the Azure Security Benchmark.
Google Cloud enterprise foundations blueprintGoogle’s reference design for a secure Google Cloud estate.
CISA incident response playbooksStep-by-step incident and vulnerability response procedures.

We aren't paid to list any of these. If a link has moved, tell us at connect@summitcybergroup.com.au.