This is a concept website · Enquire about this domain

cloudvps.com.au

# you hold the admin login, so you hold the work

Cloud VPS: when you run the server, the security is yours

If you run your own virtual server, you hold its operating system and its admin login, and the security work comes with them. Where that server is supplied as Infrastructure-as-a-Service, ASD’s patching guidance puts it plainly: organisations “are still responsible for patching their applications and operating systems when using Infrastructure-as-a-Service”. This guide, published by Dotto, sets out the five jobs that follow, drawn from the Australian Signals Directorate (ASD) on cyber.gov.au, with every source listed at the foot of each page.

General information, not technical advice for your server. The official place to check is ASD at cyber.gov.au; for personal information a server holds, the Office of the Australian Information Commissioner (OAIC).

A ring of old metal keys lying on a wooden table, in black and white.
Photo by weinstock on Pixabay

jobs: 5Five jobs that come with the admin login

Each job has its own guide. The line beneath it is ASD’s own measure, from the page that guide rests on.

  1. 01

    Patching the operating system

    For the operating systems of internet-facing servers, ASD’s recommended timeframe is “Within two weeks, or within 48 hours if identified as critical by vendors or working exploits exist.”

    Scanning those servers for missing patches: “At least daily.”

  2. 02

    Admin access and MFA

    Admin access goes only to the people who need it, through separate administrator accounts, and ASD says organisations should use phishing-resistant multi-factor authentication “for all systems and services”.

    Administrator accounts: “Review administrator accounts regularly”.

  3. 03

    Logging and watching

    ASD’s small business handbook says to “focus on high-value events such as logins, administrator changes, remote access and security alerts”.

    Keeping them: “retain logs for several months or longer where possible”.

  4. 04

    Backups you have tested

    The ISM, September 2026, adds a control at revision 0: “Backups are stored using a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period.”

    Testing them: by restoring from them, as part of disaster recovery exercises.

  5. 05

    Reporting a cyber incident

    ASD asks organisations to “Report incidents as early as possible, even if the threat is only suspected.” ASD says: “Some sectors also have mandatory reporting requirements. Information voluntarily shared with us by Australian organisations is protected by law.”

    ASD’s hotline, 1300 CYBER1 (1300 292 371), is open 24 hours a day, 7 days a week.

whyWhy the work is the operator’s

ASD’s logging guidance makes the same point about logs: Infrastructure-as-a-Service, it says, “would include a significant amount of logging responsibility on the tenant”.

ASD’s small business handbook asks businesses to review the services they expose to the internet, naming remote administration tools among them, and to limit access and secure or switch off whatever is not needed. It calls websites “a common target for cyber attacks”.

Running your own server is a choice with weight on it. ASD’s small business handbook suggests talking security measures and set-up through with an IT professional, so that a network and its external services are protected.

sources: 3 depthsWhere the advice comes from

ASD writes at three depths, and these guides draw on all three.

  1. The Small business cyber security handbook. Its readers, in ASD’s words: “small business owners, managers and employees seeking clear, actionable cyber security guidance”.
  2. The practitioner publications. The patching guidance, for one, is aimed at “IT professionals, cyber security teams, system administrators and managers who are responsible for keeping systems secure and up to date”.
  3. The Information security manual (ISM). In ASD’s words, “a cyber security framework that organisations can apply to protect their systems and data from cyber threats”. These guides cite the edition marked September 2026.

Many of the same practices sit in the Essential Eight, which ASD calls the most effective of its Strategies to mitigate cyber security incidents.

Each guide names the publication it rests on, so you can tell the plain small business line from the practitioner’s.