ACIA Capstone key terms

A statement describing the security outcome an organization intends to achieve, written so that auditors can later test whether the outcome is actually met by implemented safeguards.

The practice of linking each internal safeguard to the external standards or regulations it satisfies, so overlapping requirements are consolidated and gaps become visible in a single traceable matrix.

The exposure that remains after existing controls have been applied, which management formally accepts or treats rather than the raw exposure measured before safeguards existed.

A living record of identified risks, each with owner, likelihood, impact, treatment decision, and status, used to prioritize spending and demonstrate oversight to leadership and auditors.

The amount and type of risk an organization is willing to pursue or retain in service of its goals, expressed quantitatively or qualitatively and used to judge whether a given exposure is acceptable.

Splitting a sensitive process across different people so no single individual can both initiate and approve a privileged action, reducing the chance of fraud or undetected error.

Granting each identity only the permissions required for its current task, for only as long as needed, so a compromised account exposes the smallest possible blast radius.

An access model where permissions are bundled into roles and users receive rights by being assigned to roles, simplifying administration and audit compared with per-user entitlement grants.

An access model that evaluates attributes of the user, resource, action, and environment against policy at request time, enabling fine-grained and context-aware authorization decisions.

An arrangement where a trusted identity provider authenticates a user and asserts that identity to a separate service provider, so credentials are never shared directly with the relying application.

A signed XML statement issued by an identity provider that conveys authentication and attribute claims about a subject to a service provider during a federation exchange.

A capability letting a user authenticate once and reach multiple applications without re-entering credentials, which improves usability but concentrates risk in the primary identity provider.

Tools and processes that vault, broker, record, and time-limit administrative credentials, preventing standing high-privilege accounts from becoming easy lateral-movement targets for attackers.

A design philosophy that treats every request as untrusted until verified, enforcing identity and device checks per transaction instead of relying on network location as proof of trust.

Dividing a network into small zones with tightly scoped allow rules so workloads communicate only with approved peers, limiting how far an intruder can move after initial compromise.

Partitioning infrastructure into distinct subnetworks with controlled interconnections, used to contain breaches, separate trust levels, and satisfy regulatory scoping requirements for sensitive systems.

A buffer network segment hosting externally reachable services, isolated from the internal network by filtering controls so internet-facing compromise does not directly expose core systems.

A packet filter that tracks connection state and permits return traffic for established sessions, enforcing policy more precisely than rules that inspect each packet in isolation.

The division of security duties between a cloud provider and its customer, where the provider secures the underlying platform and the customer secures data, identities, and configuration they control.

A documented, approved set of settings for a system or image, against which actual configurations are compared so drift and insecure defaults are detected and corrected.

Software that creates and runs virtual machines, isolating guest operating systems from each other and from hardware; its compromise undermines every workload it hosts.

An exploit in which code running inside a container breaks isolation to reach the host kernel or neighboring workloads, often through excessive privileges or misconfigured mounts.

Assigning labels such as public, internal, confidential, or restricted to information so handling, retention, and protection requirements are applied consistently and proportionately.

Controls that inspect traffic and storage for sensitive content and block or alert on unauthorized movement, using classification labels and pattern matching to enforce handling policy.

Replacing sensitive values with meaningless substitutes that map back through a protected vault, reducing the scope of systems that must store regulated data directly.

Encrypting data with a data key that is itself encrypted by a longer-lived key-encryption key, so rotating the master key does not require re-encrypting all stored content.

A managed system that generates, stores, rotates, and audits cryptographic keys and restricts their use through policy, keeping key material out of application code and configuration files.

A tamper-resistant appliance that performs cryptographic operations and protects keys inside dedicated hardware, providing stronger assurance than software-only key storage.

Observable evidence such as a malicious hash, domain, or registry key that suggests a system has already been breached, useful for scoping incidents and hunting across the estate.

A behavioral sign of adversary activity in progress, such as unusual privilege escalation or command patterns, which can reveal an intrusion before known compromise artifacts appear.

A platform that centralizes logs, correlates events across sources, and triggers alerts, giving analysts a single investigative view instead of many disconnected device consoles.

A predefined, versioned sequence of steps responders follow for a given incident type, encoding decision points and escalation paths so response is consistent under pressure.

A discussion-based rehearsal in which stakeholders walk through a simulated incident to test roles, communication, and decision-making without disrupting production systems.

The maximum acceptable amount of data loss measured in time, which determines backup frequency and replication design for each business process.

The maximum acceptable elapsed time to restore a service after disruption, driving architecture choices such as redundancy and failover automation.

Proactively searching environments for hidden adversary activity using hypotheses rather than waiting for alerts, often guided by indicators of attack and knowledge of likely techniques.

An open framework producing a numeric severity score from exploitability and impact metrics, used to compare vulnerabilities while recognizing that environmental context still governs actual priority.

The practical likelihood that a given weakness can be successfully abused in a specific environment, shaped by exposure, available exploit code, and required preconditions.

The total set of entry points and exposed resources an adversary could attempt to use, which shrinking through removal and hardening reduces opportunities for exploitation.

The lifecycle of identifying, testing, deploying, and verifying software fixes on a risk-based schedule, with exceptions documented and compensating controls applied where patching is delayed.

Automated analysis of declarative deployment templates before they are applied, catching insecure defaults such as public storage or overly broad permissions prior to production exposure.

Layering independent controls so that failure or bypass of any single safeguard does not alone result in compromise, forcing an adversary to defeat multiple dissimilar barriers.

A structured exercise that enumerates assets, adversaries, and abuse paths for a design, then records mitigations before code is written rather than after deployment.

A study identifying critical processes and quantifying the operational and financial consequences of their disruption, which sets recovery objectives and prioritizes resilience investment.

Uncontrolled growth of virtual instances, including forgotten or unpatched copies, which expands the attack surface and complicates inventory, licensing, and vulnerability coverage.