CNCC(C) key terms

A layered approach that stacks independent security controls across network, host, application, and data tiers so a single failure does not expose critical assets. Each layer assumes the others may be breached.

Dividing a network into smaller zones with enforced boundaries between them, so traffic crossing zones passes through filtering controls. Limits lateral movement after a compromise and reduces the blast radius of an incident.

A buffer subnet that hosts externally reachable services while shielding the internal network. Traffic between the internet and internal systems must traverse the DMZ, where stricter filtering and monitoring apply.

A firewall that inspects traffic beyond addresses and ports, applying application awareness, user identity, and threat signatures. It can block specific applications or content inline rather than only permitting or denying connections.

A design principle that removes implicit trust based on network location. Every request is authenticated, authorized, and continuously evaluated using identity, device posture, and context before access is granted.

A tunnel that encrypts traffic between a client or site and a trusted gateway over an untrusted network. It provides confidentiality and integrity for remote access or site-to-site links.

A protocol that encrypts and authenticates data in transit between clients and servers using certificates and negotiated ciphers. It underpins HTTPS and many other secure application protocols.

Granting each user, service, or process only the access needed to perform its function, for only as long as needed. Reduces both accidental damage and the impact of compromised accounts.

The set of processes and technologies that create identities, authenticate them, and authorize their access to resources. Includes provisioning, single sign-on, and lifecycle deprovisioning.

An authorization model that assigns permissions to roles rather than individuals, and then assigns users to roles. Simplifies administration and supports consistent enforcement of least privilege.

Requiring two or more independent credential types, such as a password plus a hardware token, before granting access. Blocks most credential-stuffing and password-replay attacks because a stolen password alone is insufficient.

The policies, roles, and systems that issue, distribute, and revoke digital certificates. It binds public keys to verified identities so parties can authenticate each other and establish encrypted sessions.

The framework of direction and oversight that aligns security activities with business objectives and legal duties. It defines decision rights, accountability, and reporting lines for managing security risk.

A management-approved statement of mandatory requirements that directs how an organization protects information and systems. Policies are supported by standards, procedures, and guidelines that add detail.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, stated by leadership. It guides prioritization and sets thresholds for treatment decisions.

Meeting obligations imposed by laws, regulations, and industry rules that apply to the organization. Compliance is a baseline, not a substitute for managing risk to an acceptable level.

Laws that govern how personal data is collected, used, stored, and transferred, and that grant rights to individuals. They typically impose breach notification, consent, and cross-border transfer requirements.

Assigning information to categories such as public, internal, confidential, or restricted based on sensitivity and impact if disclosed. Classification determines handling, retention, and protection requirements.

A documented record of who handled evidence, when, and for what purpose, from collection through disposal. Gaps or breaks can render digital evidence inadmissible or unreliable in legal proceedings.

A structured process that identifies assets and threats, estimates likelihood and impact, and determines resulting risk levels. Its output prioritizes which risks need treatment and which can be accepted.

Choosing and applying a response to assessed risk, such as mitigating with controls, transferring through insurance, avoiding the activity, or accepting the residual. Each option is weighed against cost and business need.

The risk that remains after controls or other treatments have been applied. It must be compared with the organization's risk appetite and formally accepted by an accountable owner.

A living record of identified risks with owners, ratings, treatment plans, and review dates. It provides traceability and supports reporting to management and auditors.

An independent, evidence-based examination of controls against defined criteria such as policies, standards, or regulations. Findings are documented and tracked to remediation.

A systematic scan and review of systems to identify known weaknesses, missing patches, and misconfigurations. It produces a prioritized inventory but does not by itself prove exploitability.

An authorized, scoped attempt to exploit weaknesses in order to demonstrate real business impact. Results validate controls and inform remediation priorities beyond a scan's output.

A written agreement defining the scope, timing, methods, contacts, and limits of an authorized security test. It protects both the tester and the client and sets escalation paths for unexpected findings.

The lifecycle of identifying, testing, deploying, and verifying software updates that fix known vulnerabilities. Timely patching reduces exposure windows that attackers routinely exploit.

Agent software on hosts that continuously records process, file, and network behavior, detects malicious patterns, and supports containment actions. It gives analysts visibility beyond signature-based antivirus.

Controls that inspect data in motion, at rest, and in use to detect and block unauthorized disclosure. Rules are typically tuned using data classification labels and regulatory patterns.

Protecting stored data with cryptography so that lost disks, stolen backups, or improper access do not expose readable content. Key management and access control remain essential to its effectiveness.

The generation, distribution, rotation, storage, and destruction of cryptographic keys throughout their lifecycle. Weak key handling undermines even strong encryption algorithms.

A platform that centralizes logs from many sources, correlates events, and generates alerts for analyst review. It supports detection, investigation, and evidence retention for compliance.

A team and facility that monitors, detects, and responds to security events around the clock. It follows defined playbooks and escalates incidents according to severity.

A documented set of roles, phases, and communications for detecting, containing, eradicating, and recovering from security incidents. It is tested through exercises and revised after each real event.

The disciplined collection, preservation, and analysis of digital evidence to reconstruct events. Investigators follow documented procedures so findings remain defensible and reproducible.

A social-engineering attack that impersonates a trusted party to trick recipients into revealing credentials, approving payments, or running malicious content. It remains a leading initial access vector.

Recurring education that helps staff recognize threats such as phishing and follow secure practices. Effective programs measure behavior change and are reinforced by policy and reporting channels.

A contractual document that defines deliverables, scope, schedule, assumptions, and acceptance criteria for a consulting engagement. It anchors expectations and reduces scope disputes.

Translating technical findings into business impact, likelihood, and recommended actions that decision-makers can act on. Effective communication aligns security work with client priorities and budget realities.