CENTC key terms

A layered security strategy that places multiple independent controls across people, process, and technology so that a failure in one layer does not expose the whole environment.

A model describing the three core goals of information security: confidentiality, meaning only authorized parties can read data; integrity, meaning data is accurate and unaltered; and availability, meaning systems remain usable when needed.

The principle of granting users and systems only the minimum access rights needed to perform their assigned tasks, reducing the blast radius of a compromised account.

A property ensuring a party cannot credibly deny having performed an action, typically achieved through digital signatures and tamper-evident audit logging.

An architecture model that assumes no implicit trust based on network location and instead verifies every request through continuous authentication, authorization, and least-privilege policy enforcement.

Dividing a network into isolated zones or subnets with controlled inter-zone traffic, limiting lateral movement and constraining the scope of a breach.

A screened network segment that hosts externally facing services, separated from the internal network by filtering controls so that compromise of a public service does not directly expose internal systems.

A network device or software control that inspects and permits or denies traffic between zones according to a configured rule set, often tracking connection state.

A firewall that adds application-aware inspection, user identity awareness, intrusion prevention, and threat intelligence beyond traditional port and address filtering.

A sensor that monitors network or host activity for signs of malicious behavior and generates alerts without necessarily blocking the traffic it observes.

An inline sensor that detects malicious traffic and actively blocks or drops it in real time, preventing the activity from reaching its target.

A detection method that compares activity against known patterns of malicious behavior, effective against known threats but blind to novel variants.

A detection method that establishes a baseline of normal behavior and flags deviations, capable of catching novel threats but prone to false positives.

A documented reference state of expected system or network configuration and behavior, used to detect drift and to support anomaly detection and compliance checks.

A social engineering attack that impersonates a trusted party through email, messaging, or web pages to trick a victim into revealing credentials or executing malicious content.

A targeted phishing attempt crafted for a specific individual or small group using researched details to increase credibility and the likelihood of success.

Manipulating people through deception, urgency, or authority to obtain information or access, exploiting human trust rather than technical flaws.

A social engineering technique in which the attacker invents a plausible scenario or identity to justify a request for information or action.

Malware that encrypts or locks victim data and demands payment for restoration, often combined with data theft and extortion threats.

Any software intentionally designed to harm, disrupt, or gain unauthorized access to systems, including viruses, worms, trojans, and ransomware.

Malicious software that conceals its presence and that of other malware by subverting operating system components, making detection through normal tools unreliable.

The infrastructure and channels an attacker uses to communicate with compromised hosts, issuing instructions and exfiltrating data, often disguised as normal traffic.

An attack in which a third party secretly intercepts and possibly alters communications between two parties who believe they are communicating directly.

Sending forged Address Resolution Protocol replies to associate an attacker's MAC address with a legitimate IP address, enabling traffic interception on a local network.

An attack that exhausts a system's resources or network capacity so that legitimate users cannot access the service; a distributed variant uses many coordinated sources.

Injecting crafted input into an application so that it is interpreted as database commands, potentially exposing or altering stored data.

Injecting script into a web page viewed by other users so that the code executes in their browsers, enabling session theft or credential capture.

Checking and sanitizing data received by an application so that unexpected or malicious content is rejected before it reaches sensitive processing or storage.

A weakness in software, configuration, or process that a threat actor could exploit to compromise confidentiality, integrity, or availability.

A technique, tool, or piece of code that takes advantage of a specific vulnerability to achieve an attacker's objective on a target system.

A structured process for identifying, testing, approving, and deploying software updates that close known vulnerabilities in a timely and controlled manner.

The practice of establishing, documenting, and enforcing approved system settings and tracking changes so that environments stay in a known, secure state.

The likelihood and impact of a threat exploiting a vulnerability against an asset, often expressed qualitatively or quantitatively to guide treatment decisions.

Selecting and applying a response to identified risk, such as mitigating with controls, transferring through insurance, avoiding the activity, or accepting the residual exposure.

The risk that remains after controls have been applied, which must be documented and formally accepted by an accountable owner.

Transforming readable data into ciphertext using a key so that only parties holding the correct key can recover the original content.

A protocol that encrypts and authenticates data in transit between clients and servers, underpinning secure web, email, and API communications.

A cryptographic value computed over data with a private key that others can verify with the corresponding public key, proving origin and detecting tampering.

Requiring two or more independent credential types, such as a password plus a hardware token or biometric, so a single stolen factor is insufficient for access.

Assigning permissions to job roles rather than individuals, so users receive access through role membership and entitlements stay consistent and auditable.

A documented set of roles, procedures, and communication paths guiding an organization's actions during and after a security incident.

The phased process of preparing, detecting and analyzing, containing, eradicating, recovering from, and learning from a security incident.

A step-by-step operational guide for handling a specific incident type, defining decision points, responsibilities, and required evidence handling.

Observable evidence suggesting a system has been breached, such as unusual outbound connections, unexpected accounts, or known malicious file hashes.

Documented, unbroken record of who collected, handled, and stored evidence and when, preserving its integrity for investigation or legal proceedings.

The disciplined collection, preservation, and analysis of digital evidence to reconstruct events and support disciplinary, legal, or remediation actions.

A platform that centralizes log collection, correlation, and alerting across systems, giving analysts a consolidated view for detecting and investigating incidents.

The practice of collecting, retaining, protecting, and reviewing event records from systems and network devices to support detection, troubleshooting, and audit.

Documented arrangements for keeping critical business functions operating during and after disruption, covering alternate processes, staff, and facilities.

Procedures and technical arrangements for restoring systems, data, and services after a major outage, including recovery objectives and tested restoration steps.

Demonstrating adherence to laws, regulations, contractual obligations, and internal policies, typically through documented controls, evidence, and periodic assessment.

A high-level management statement of mandatory expectations and intent that governs how security is conducted and provides the basis for standards and procedures.

A mandatory, specific requirement that supports a policy, such as an approved encryption algorithm or a required password length.

An independent, evidence-based examination of controls and records to determine whether they meet stated requirements and are operating effectively.

A maintained record of hardware, software, data, and services with owners and criticality, forming the foundation for risk assessment and control coverage.