SC key terms

The amount of risk an organization is willing to accept in pursuit of its objectives, set by senior leadership and used to decide which risks need treatment and which can be tolerated.

The process of choosing and applying options to modify risk, such as mitigating, transferring, avoiding, or accepting it, then documenting the decision and its owner.

The risk that remains after controls or other treatments have been applied, which must be compared against the organization's tolerance before being formally accepted.

Ranking risks using descriptive scales such as high, medium, and low based on judgment and experience, useful when reliable numeric data is unavailable or speed matters more than precision.

Expressing risk in monetary and numeric terms, typically combining asset value, exposure factor, and annualized rate of occurrence to produce expected yearly loss figures.

The expected yearly financial loss from a threat, calculated as single loss expectancy multiplied by annualized rate of occurrence, used to justify control spending.

The reasonable steps an organization takes to protect assets and meet its obligations, showing that it acted responsibly rather than negligently.

The ongoing investigation and verification of risks, controls, and third parties so that decisions and due care efforts are based on accurate, current information.

A high-level management statement of intent and mandatory rules that directs how an organization protects information and sets the authority for supporting standards and procedures.

A mandatory, specific requirement that supports a policy, such as a required encryption algorithm or password length, leaving little room for local discretion.

Step-by-step instructions describing how to perform a task consistently so that standards and policies are carried out the same way each time.

Assigning labels such as public, internal, confidential, or restricted to information so that handling, access, and protection requirements match its sensitivity and value.

The senior person accountable for a specific data set who decides its classification, approves access rules, and accepts the risk associated with its use.

The role that implements and maintains the technical and procedural safeguards protecting data, following the rules and classifications set by the data owner.

Traces of data that remain on storage media after deletion or formatting, which must be addressed through overwriting, degaussing, or destruction before reuse or disposal.

The process of removing data from media so it cannot be recovered, using methods such as overwriting, cryptographic erase, degaussing, or physical destruction appropriate to the media type.

Layering multiple independent controls across people, process, and technology so that failure of one safeguard does not expose the whole environment.

The set of hardware, firmware, and software components that must be correct for a system's security policy to hold, so it is kept as small and simple as practical.

An abstract component that mediates every access request between subjects and objects, is always invoked, and is small enough to be verified, forming the basis of secure kernels.

An international framework for specifying and evaluating IT security product assurance, using protection profiles and evaluation assurance levels to compare products against defined claims.

A one-way function that maps input of any length to a fixed-length digest, where small input changes alter the output and finding collisions is infeasible, supporting integrity checks.

A value created by encrypting a hash of a message with a sender's private key, letting recipients verify origin and integrity and supporting nonrepudiation.

The policies, roles, and systems that issue, distribute, validate, and revoke digital certificates so parties can trust public keys bound to identities.

Random data added to a password before hashing so identical passwords produce different hashes, defeating precomputed lookup tables and slowing large-scale guessing.

A seven-layer reference model describing how network communication is organized from physical signaling up through applications, used to reason about where controls belong.

The practical four-layer protocol stack used on most networks, covering link, internet, transport, and application functions with protocols such as IP, TCP, UDP, and HTTP.

Dividing a network into isolated zones with controlled traffic between them, limiting how far an attacker can move and reducing the scope of a compromise.

A buffer network segment holding systems reachable from the internet while shielding the internal network, typically bounded by firewalls applying different rules on each side.

A protocol that encrypts and authenticates traffic between clients and servers using certificates and negotiated session keys, protecting confidentiality and integrity in transit.

Granting each user, process, or service only the access needed to perform its current task, and no more, to limit the damage from error or compromise.

Splitting a sensitive task among two or more people so no single person can complete a fraudulent or damaging action alone.

Assigning permissions to job roles rather than individuals, so users gain access through role membership and changes follow organizational responsibilities.

Making access decisions from policies that evaluate attributes of the subject, resource, action, and environment, enabling fine-grained and context-aware authorization.

An arrangement where separate organizations trust a common identity provider, letting users authenticate once and access resources across domains without duplicate credentials.

A mechanism letting a user authenticate once and reach multiple systems without re-entering credentials, reducing password fatigue while concentrating risk in the initial authentication.

An automated check that compares systems against known weakness signatures and configuration baselines, producing findings that must be validated and prioritized.

An authorized, goal-driven simulated attack that chains weaknesses to demonstrate real business impact, typically after vulnerabilities have been identified and remediated.

A test result that reports a problem where none exists, wasting remediation effort and eroding trust in the testing process if not triaged.

A platform that centralizes logs from many sources, correlates events against rules, and raises alerts so analysts can detect and investigate suspicious activity.

Documented roles, steps, and communication paths for detecting, containing, eradicating, and recovering from security incidents, plus lessons learned afterward.

Plans and arrangements that keep critical operations running during disruption, focusing on availability of people, processes, and technology over time.

Focused procedures and technical arrangements for restoring systems and data after a major disruption, guided by recovery point and recovery time objectives.

Documentation tracking who handled evidence, when, and how, from collection through presentation, so its integrity can be defended in legal or disciplinary proceedings.

Integrating security activities such as threat modeling, code review, and testing into each phase of software development rather than adding checks only at the end.

Structured analysis of a system's components, data flows, and trust boundaries to identify likely threats and choose controls before code is written.

Examining source or binary code without running it to find insecure patterns such as injection flaws or hardcoded secrets, often automated in build pipelines.

Testing a running application from the outside to find exploitable behavior such as input handling flaws and misconfigurations, complementing code-level review.

Identifying third-party libraries and components in an application and checking them against vulnerability and license data to manage supply chain risk.