SCYM key terms

The structured process of identifying what could go wrong, estimating how likely and how damaging each event would be, and deciding which risks to treat first.

Any person, group, or circumstance with the potential to exploit a weakness and cause harm to systems, data, or operations.

A weakness in a system, process, or configuration that a threat could exploit to gain unauthorized access, disrupt service, or damage data.

A safeguard or countermeasure, whether technical, administrative, or physical, put in place to reduce risk to a level the organization accepts.

The risk that remains after controls have been applied; it must be compared with the organization's risk tolerance and formally accepted by an accountable owner.

Sorting information into labeled tiers, such as public, internal, confidential, and restricted, so that handling and protection requirements match its sensitivity.

A written management statement of required behavior and rules that defines what the organization expects and provides the basis for enforcement and audit.

The state of meeting obligations set by laws, regulations, contracts, or internal standards, usually evidenced through documented controls and independent review.

A study that identifies critical business functions and estimates the harm caused by their outage, producing the recovery targets used in continuity planning.

Exposure created by vendors, software components, and service providers whose weaknesses or failures can damage the organization's own security or operations.

A maintained log listing identified risks with their owners, ratings, chosen treatments, and review dates so that tracking stays visible and accountable.

The three core security goals: confidentiality, meaning only authorized parties see data; integrity, meaning data is accurate and unaltered; and availability, meaning systems are usable when needed.

Layering independent controls so that if one fails, others still block or detect the attack; no single safeguard is trusted on its own.

Giving each user, service, and process only the access needed to do its job, and no more, for only as long as it is needed.

Dividing a network into separate zones with controlled traffic between them so that a compromise in one area cannot spread freely to others.

A device or software filter that permits or blocks network traffic based on rules about addresses, ports, and protocols.

A design approach that never assumes trust from network location; every request is authenticated, authorized, and checked each time it is made.

Reducing a system's attack surface by removing unused services, changing default settings, applying secure configuration, and keeping software current.

An authorized, goal-driven attempt to breach systems using attacker techniques, performed to prove which weaknesses are actually exploitable in practice.

Proving that a user, device, or service is who it claims to be, typically using something known, something held, or something inherent to the subject.

Deciding what an already authenticated identity is permitted to do, based on policy, role, or attributes, and enforcing those limits at every access point.

Requiring two or more independent credential types drawn from different categories, so that a stolen password alone is not enough to sign in.

Assigning permissions to job roles rather than to individuals, so users inherit the rights their role requires and changes are easier to review and audit.

Transforming readable data into ciphertext using a mathematical algorithm and a key, so that only holders of the correct key can reverse the process.

A one-way function that turns data into a fixed-length fingerprint; the same input always yields the same value, but the input cannot be recovered from it.

A signed electronic document binding a public key to an identity, issued by a trusted authority and used by others to verify that identity.

The policies, roles, and systems that issue, distribute, renew, and revoke digital certificates so that public key trust can operate at scale.

The full lifecycle handling of cryptographic keys, covering generation, storage, distribution, rotation, and destruction, and protecting them from loss or exposure.

A cryptographic value created with a private key that lets a recipient confirm who sent a message and whether its contents were altered in transit.

The organized process of preparing for, detecting, containing, eradicating, and recovering from a security incident, followed by a structured review.

A platform that collects logs and events from many sources, correlates them against detection rules, and raises alerts for analysts to investigate.

A staffed function that monitors alerts and telemetry, triages suspicious activity, and coordinates the first response to detected events around the clock.

A time-ordered, tamper-resistant record of who did what, when, and from where, used for investigation, troubleshooting, and compliance evidence.

A repeatable cycle of identifying, testing, deploying, and verifying software fixes so that known flaws are closed before attackers exploit them.

A copy of data or systems kept separately so it can be restored after loss, corruption, or ransomware; it must be tested rather than assumed to work.

The maximum amount of data, measured in time, that can be lost in a disruption; it sets how frequently backups or replication must run.

The target deadline for restoring a business function after a disruption; it drives which recovery strategies and spending levels are justified.

A deceptive message that impersonates a trusted party to push a recipient into revealing credentials, sending payment, or opening malicious content.

A discussion-based rehearsal in which participants talk through a simulated incident, testing plans, roles, and decisions without touching live systems.

A structured review after an incident or exercise that records what worked, what failed, and which corrective changes are now owned and tracked.