CSIS key terms

A model describing three core goals of information security: confidentiality keeps data secret, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed.

A formal document that states management's rules for protecting information and systems, defining acceptable use, responsibilities, and consequences so staff know what is required.

Layering multiple independent security controls-such as firewalls, authentication, encryption, and monitoring-so that if one control fails, others still protect the asset.

Granting each user, process, or system only the minimum access rights needed to perform its assigned tasks, reducing the damage that a mistake or compromised account can cause.

An access control approach where permissions are assigned to job roles rather than individuals, and users receive permissions by being placed into the appropriate role.

Authentication that requires two or more different evidence types-such as a password plus a one-time code or fingerprint-so a stolen password alone is not enough to log in.

A mechanism letting a user authenticate once and then access multiple applications without logging in again, improving convenience but making the initial credential a high-value target.

Tools and processes that control, monitor, and record the use of powerful administrative accounts, such as restricting when they can be used and vaulting their credentials.

Encryption that uses the same secret key to both encrypt and decrypt data, which is fast and efficient but requires a secure way to share the key.

Encryption using a pair of related keys: a public key anyone can use to encrypt, and a private key kept secret to decrypt. It solves key distribution but is slower than symmetric.

A one-way mathematical function that turns any input into a fixed-length value; even a tiny change to the input produces a very different output, making it useful for integrity checks.

A cryptographic value created with a sender's private key that lets a recipient verify the message's origin and integrity, and detect tampering, without needing the private key.

The policies, roles, and systems-including certificate authorities-that issue, distribute, and revoke digital certificates, enabling trusted use of public keys and digital signatures.

Regularly replacing cryptographic keys with new ones and retiring old keys, which limits the amount of data exposed if a key is eventually compromised.

A network security device or software that inspects traffic and allows or blocks it based on rules, forming a barrier between trusted internal networks and untrusted external networks.

A separate network segment that hosts internet-facing services, isolating them from the internal network so a compromise of a public server does not directly expose internal systems.

An encrypted tunnel between a user's device or a remote site and a private network, protecting traffic as it travels over untrusted networks such as the internet.

A monitoring tool that inspects network or host activity for known attack patterns or suspicious behavior and raises alerts, but does not itself block the traffic.

Dividing a network into smaller zones with controlled traffic between them, which limits how far an attacker can move and reduces the blast radius of a compromise.

A security model that assumes no user or device is automatically trusted based on location, requiring continuous verification of identity and least-privilege access for every request.

A structured process for identifying potential threats and weaknesses in a system early in design, so controls can be planned before code is built or deployed.

The total set of entry points, interfaces, and exposed services that an attacker could try to exploit; reducing it shrinks the opportunities available to adversaries.

A documented, approved configuration standard for systems-such as required patches and disabled services-against which deployed systems are measured and hardened.

The process of identifying assets, threats, and vulnerabilities, then estimating the likelihood and impact of harm to decide which risks need treatment.

The risk that remains after security controls have been applied and management has decided whether to accept, transfer, or further reduce it.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, which guides decisions about how much security investment is justified.

A study that identifies critical business processes and estimates the operational and financial impact of disruption, helping set recovery priorities and acceptable downtime.

A documented record of who handled digital evidence, when, and for what purpose, preserving its integrity so it can be trusted in investigations or legal proceedings.

The ongoing effort to investigate and verify that reasonable security practices are in place, showing an organization did not act negligently in protecting information.

The handling of personal information in ways that respect legal and ethical expectations, including limiting collection, controlling use, and protecting it from unauthorized disclosure.

A legal or contractual obligation to inform affected individuals, regulators, or partners within a set time after discovering a security incident involving protected data.

A documented set of roles, steps, and communication paths for detecting, containing, eradicating, and recovering from security incidents, including lessons learned afterward.

A platform that collects and correlates logs and alerts from many sources, helping analysts detect patterns and investigate incidents across the environment.

A continuous, repeating cycle of discovering, prioritizing, remediating, and verifying security weaknesses in systems and software before attackers can exploit them.

A discussion-based rehearsal in which participants walk through a simulated incident scenario to test plans, clarify roles, and find gaps without disrupting real operations.

Checking and sanitizing data received from users or other systems so that malformed or malicious input cannot cause errors or be interpreted as commands.

An attack where malicious SQL statements are inserted through unvalidated input fields to read, modify, or delete database contents or bypass authentication.

Building security activities-such as threat modeling, code review, and testing-into each phase of the software development lifecycle rather than adding security only at the end.

Assigning labels such as public, internal, confidential, or restricted to information so that handling, access, and protection requirements match its sensitivity.

Tools and policies that monitor and block sensitive data from leaving approved boundaries, whether through email, web uploads, or removable media.