NISP Level 1 - Security Operations key terms

A model that describes the three core goals of information security: confidentiality (keeping data secret), integrity (keeping data accurate and unaltered), and availability (ensuring data and systems are accessible when needed).

The property that information is not disclosed to unauthorized individuals, processes, or devices. It is achieved through encryption, access controls, and proper handling procedures.

The property that data has not been altered or destroyed in an unauthorized manner. It ensures data is accurate, complete, and trustworthy throughout its lifecycle.

The property that systems and data are accessible and usable by authorized users when required. It is supported by redundancy, backups, and resilience measures.

A security strategy that uses multiple layers of controls (physical, technical, and administrative) so that if one layer fails, others still protect the asset.

The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.

A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.

An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.

An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.

The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.

The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.

A mechanism that allows a user to log in once and access multiple applications or systems without re-entering credentials, improving usability and centralizing access control.

A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.

A system that monitors network or system activities for malicious actions or policy violations and generates alerts, but does not typically take active blocking measures.

A system that monitors network traffic for malicious activity and can actively block or prevent detected threats, unlike an IDS which only alerts.

The practice of dividing a computer network into smaller subnetworks or segments to improve security, limit lateral movement, and contain breaches.

A technology that creates a secure, encrypted connection over an untrusted network, allowing remote users or sites to communicate as if on a private network.

The process of identifying, acquiring, testing, and installing software updates (patches) to fix vulnerabilities and improve system security.

A security solution that continuously monitors endpoint devices for suspicious activity, provides forensic data, and enables automated response to threats.

A program that detects, prevents, and removes malicious software (malware) from computer systems, often using signature-based and heuristic methods.

The process of securing a system by reducing its attack surface, such as disabling unnecessary services, closing unused ports, and applying secure configurations.

A code injection technique that exploits vulnerabilities in an application's database layer by inserting malicious SQL statements through user input, potentially exposing or altering data.

A vulnerability where an attacker injects malicious scripts into web pages viewed by other users, potentially stealing cookies or session tokens.

The practice of checking and sanitizing user-supplied data to ensure it meets expected format and values, preventing injection attacks and data corruption.

The process of converting plaintext into ciphertext using an algorithm and a key, so that only authorized parties can read the original information.

An encryption method that uses the same secret key for both encryption and decryption, offering speed but requiring secure key distribution.

An encryption method that uses a pair of keys (public and private) where the public key encrypts and the private key decrypts, solving key distribution problems.

A mathematical algorithm that transforms input data into a fixed-size string of characters, used for integrity verification and password storage.

An electronic signature that uses asymmetric cryptography to verify the authenticity and integrity of a message or document.

A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.

A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.

A weakness in a system, application, or process that could be exploited by a threat to cause harm or unauthorized access.

The automated process of identifying and assessing weaknesses in systems and applications, often using tools that compare configurations against known vulnerability databases.

A simulated cyber attack against a system to evaluate its security posture, identify vulnerabilities, and test defenses.

The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.

The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.

A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.

A document that outlines how an organization will continue critical operations during and after a disruption, including strategies for recovery and restoration.

A plan focused on restoring IT infrastructure and operations after a disaster, including backup restoration and recovery time objectives.

The process of copying data to a secondary location or medium to enable recovery in case of data loss or corruption.