CCST Cybersecurity key terms

A model describing three core goals of information security: keeping data secret from unauthorized parties, keeping it accurate and unaltered, and keeping it reachable when legitimate users need it.

The practice of granting each user, service, and device only the minimum access needed to do its job, so a compromised account or runaway process can do limited damage.

Layering several independent safeguards across people, processes, and technology so that when one control fails or is bypassed, another still stands between the attacker and the asset.

The act of verifying that a person, device, or service is genuinely who or what it claims to be, using evidence such as a password, token, certificate, or fingerprint.

The step after identity is proven in which the system decides which files, applications, and actions that identity may use, based on permissions, roles, or policy.

Requiring two or more different kinds of proof, such as a password plus a code from an authenticator app, before allowing sign-in, so one stolen secret is not enough.

A social engineering attack that sends fake email, text, or chat messages designed to make the recipient reveal credentials, approve a payment, or open a malicious attachment.

Transforming readable data into an unreadable form with a mathematical algorithm and a key, so that only someone holding the correct key can turn it back into plaintext.

Running data through a one-way function that produces a fixed-length fingerprint; changing even one character changes the result, which makes it useful for verifying integrity.

A cryptographic value created with a sender's private key that a recipient can check to confirm the message truly came from that sender and was not modified.

A hardware or software control that examines network traffic against configured rules and permits or blocks each connection, separating trusted networks from untrusted ones.

A monitoring tool that inspects network or host activity, compares it with signatures or learned baselines, and raises alerts about suspicious behavior without stopping the traffic.

A sensor positioned in the traffic path that detects malicious or policy-breaking activity and actively drops or blocks it, rather than only notifying an administrator.

A separate network segment that hosts internet-facing services such as web and mail servers, sitting between the outside internet and the protected internal network behind firewalls.

An encrypted tunnel that carries traffic between a remote user or branch site and a private network over an untrusted medium such as the public internet.

Dividing a network into smaller zones, with traffic between zones controlled by firewalls or access rules, so a breach in one area does not expose everything else.

An ordered list of rules applied to routers, switches, firewalls, or files that permits or denies traffic or access based on attributes such as address, port, or user.

The newest Wi-Fi security standard, offering stronger handshakes and encryption than earlier versions so wireless traffic resists eavesdropping and offline password-guessing attacks.

Software installed on endpoints that scans files, memory, and downloads for known malicious code or suspicious behavior, then blocks, quarantines, or removes whatever it finds.

An endpoint agent that continuously records process, file, and network behavior, uses analytics to spot attacks, and lets responders investigate, isolate, and remediate the affected host.

A scheduled process for finding, testing, approving, and installing vendor updates that close known software flaws, shrinking the time attackers have to exploit them.

A control that lets only software on an approved list execute on a system and blocks everything else by default, which stops many unapproved tools and malware.

Encrypting all data on a drive so the contents are unreadable without the correct key or passphrase, protecting information when a laptop or disk is lost or stolen.

Software running on a single endpoint that filters that machine's inbound and outbound connections using local rules, adding protection beyond the network perimeter.

Malware that hides itself and other malicious tools by tampering with the operating system, often at kernel level, making it difficult to detect from inside the infected machine.

A weakness in software, configuration, or procedure that an attacker could use to gain access, disrupt service, or otherwise damage confidentiality, integrity, or availability.

Any person, group, event, or condition with the potential to exploit a weakness and cause harm to an organization's systems or data.

The combination of how likely a threat is to exploit a weakness and how much harm would result, used to decide which issues get fixed first.

A piece of code, tool, or sequence of actions that abuses a specific weakness to gain unauthorized access or cause a system to behave unexpectedly.

An automated assessment that checks hosts and applications against databases of known flaws and weak settings, producing a report of possible issues that still need validation.

An authorized attack simulation by skilled testers who try to chain weaknesses together and reach specific goals, showing how much damage a real intruder could cause.

A published scoring method that rates a vulnerability from 0 to 10 based on how easily it can be exploited and how severe the resulting impact would be.

The work of fixing a discovered weakness, such as installing a patch, correcting a setting, or isolating a system that cannot be updated in time.

A confirmed or suspected event that harms, or could harm, the confidentiality, integrity, or availability of systems and data, or that breaks security policy.

A written guide naming roles, communication paths, and step-by-step actions an organization follows to detect, contain, remove, and recover from a security incident.

The response step that stops an intrusion from spreading further, for example by disconnecting a host, disabling an account, or blocking malicious traffic at the firewall.

The response step that removes the attacker's foothold, deleting malware, closing the vulnerability that was used, and resetting compromised credentials, before systems return to service.

A written, unbroken record showing who collected evidence, where it has been, and who handled it, so it remains trustworthy in a legal or disciplinary proceeding.

An observable sign that a system may be compromised, such as a malicious file hash, an unusual outbound connection, or a strange registry key, used to detect and scope an intrusion.

A review held after an incident closes that records what happened, what helped, and what should change in tools, procedures, or training.