CISP-DSG key terms

A model that describes the three core goals of information security: confidentiality (keeping data secret), integrity (keeping data accurate and unaltered), and availability (ensuring data and systems are accessible when needed).

The property that information is not disclosed to unauthorized individuals, processes, or devices. It is achieved through encryption, access controls, and proper handling procedures.

The property that data has not been altered or destroyed in an unauthorized manner. It ensures data is accurate, complete, and trustworthy throughout its lifecycle.

The property that systems and data are accessible and usable by authorized users when required. It is supported by redundancy, backups, and resilience measures.

A security strategy that uses multiple layers of controls (physical, technical, and administrative) so that if one layer fails, others still protect the asset.

The leadership, structures, and processes that ensure IT supports enterprise strategy, objectives, and risk appetite while using resources responsibly.

An organization-wide approach to identifying, assessing, responding to, and monitoring risks that could affect strategic objectives. It aligns risk management with strategy and governance.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, often expressed as qualitative statements or quantitative limits.

The acceptable variation in outcomes around a risk appetite, often expressed as thresholds or limits for specific risk categories.

A governance model separating management (first line), risk and compliance oversight (second line), and independent internal audit (third line).

The tone and structure set by leadership that influences risk awareness, integrity, ethical values, and the effectiveness of internal controls.

Dividing tasks and approvals so no single person can initiate, authorize, record, and review a transaction without detection.

The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.

A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.

An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.

An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.

The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.

The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.

A mechanism that allows a user to log in once and access multiple applications or systems without re-entering credentials, improving usability and centralizing access control.

The process of converting plaintext into ciphertext using an algorithm and a key, so that only authorized parties can read the original information.

An encryption method that uses the same secret key for both encryption and decryption, offering speed but requiring secure key distribution.

Encryption using a suitable public-key scheme and a corresponding private key for decryption. Authenticated key distribution and the specified padding/protocol remain essential; signatures and key agreement are distinct constructions.

A digest construction mapping input to an output under its defined algorithm, with cryptographic versions designed for appropriate resistance properties. Password storage needs a suitable salted password-hashing/KDF scheme rather than a bare fast digest.

An electronic signature that uses asymmetric cryptography to verify the authenticity and integrity of a message or document.

The policies and mechanisms that determine who can access which systems, data, or facilities and under what conditions.

A code injection technique that exploits vulnerabilities in an application's database layer by inserting malicious SQL statements through user input, potentially exposing or altering data.

A vulnerability where an attacker injects malicious scripts into web pages viewed by other users, potentially stealing cookies or session tokens.

Checking supplied data against expected type, size, format and range. It supports robust handling but does not replace parameterization, context-aware output handling or authorization controls.

A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.

A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.