NISP L1 PT key terms

The three core security goals: keeping data readable only by authorized parties, keeping data accurate and unaltered, and keeping systems and data usable when needed. Most controls are justified by which of the three they protect.

The likelihood that a threat will exploit a weakness and cause harm, combined with the impact of that harm. Risk is assessed so that limited security resources can be directed where they reduce the most exposure.

Any actor, event, or circumstance with the potential to damage an asset, such as a criminal group, malware, a flood, or an careless employee. A threat only causes loss when a vulnerability exists that it can use.

A weakness in a system, process, or configuration that a threat can exploit, such as an unpatched service, a weak password policy, or an unlocked server room. Vulnerabilities are found by scans, audits, and testing.

Layering independent controls so that failure of one does not expose the whole environment, for example firewalls, endpoint protection, access control, and monitoring together. Attackers must then defeat several different barriers instead of a single one.

Manipulating people into breaking normal security procedures, for example by impersonating support staff, creating urgency, or offering a pretext. It targets human trust rather than technical flaws, so awareness training and verification routines are the main defenses.

A fraudulent message, usually email, that impersonates a trusted party to trick the recipient into revealing credentials, opening malware, or transferring money. Variants include spear phishing aimed at specific people and smishing sent by text message.

A recurring program that teaches staff to recognize attacks, follow policy, and report suspicious events. Effective programs use short realistic exercises and measure behavior, not just completion of a slide deck.

A seven-layer reference model describing how data moves from an application on one host to an application on another: physical, data link, network, transport, session, presentation, and application. It gives a shared vocabulary for locating faults and controls.

The practical protocol suite of the Internet, organized into link, internet, transport, and application layers. IP handles addressing and routing of packets, while TCP adds reliable, ordered delivery and UDP offers fast connectionless delivery.

A numbered endpoint that lets one host run many network services on a single IP address. Well-known examples are 22 for SSH, 80 for HTTP, 443 for HTTPS, and 3389 for remote desktop; firewall rules commonly filter on them.

A device or software filter that permits or blocks traffic according to rules about addresses, ports, and protocols. Stateful firewalls track connections, while next-generation firewalls also inspect application content and user identity.

A network segment that sits between the untrusted Internet and the internal network and hosts services that external users must reach, such as web or mail servers. If a DMZ host is compromised, internal systems remain behind another filtering boundary.

Dividing a network into zones with controlled traffic between them, for example separating finance, engineering, and guest networks. Segmentation limits how far an intruder or worm can spread and reduces the scope of monitoring and compliance.

A tunnel that carries traffic securely over an untrusted network, typically using encryption and authentication. Remote-access VPNs connect individual users to the corporate network, while site-to-site VPNs link branch offices.

The process of tracking, testing, and installing vendor updates for operating systems and applications on a defined schedule. It closes known vulnerabilities, so unpatched internet-facing software is a leading cause of breaches.

Agent software on workstations and servers that continuously records process, file, and network behavior, detects suspicious patterns, and lets analysts investigate or isolate a host. It complements antivirus signatures by catching novel attacker techniques.

Software written to harm or covertly control a system, including viruses, worms, trojans, ransomware, and spyware. Delivery is often by phishing or malicious downloads, and impact ranges from data theft to encrypted files and extortion.

Malware that encrypts or steals data and demands payment for its return or for not publishing it. Reliable offline backups, prompt patching, and segmentation are the main defenses; paying does not guarantee recovery.

Giving each user, service, and process only the access needed for its task and no more. It shrinks the damage from a compromised account or bug and simplifies review of who can reach sensitive data.

Assigning permissions to job roles rather than to individuals, then placing users in the appropriate roles. This makes access consistent, auditable, and easier to revoke when someone changes position or leaves.

Requiring two or more different kinds of evidence to log in, such as a password plus a code from an app or a hardware key. It blocks most credential theft and password-guessing attacks, though push-notification fatigue is a known weakness.

A scheme where one authenticated session grants access to many applications through a trusted identity provider. It reduces password sprawl and help-desk load, but the primary account becomes a high-value target that must be strongly protected.

The service that authenticates users and issues assertions or tokens about their identity to other applications. It centralizes account lifecycle, MFA policy, and access logging for connected systems.

Transforming readable data into ciphertext using a key so that only holders of the right key can reverse it. It protects data in transit and at rest, but it does not replace access control or integrity checks.

Encryption where the same secret key both encrypts and decrypts, as in AES. It is fast and suits bulk data, but the key must be shared securely in advance, which is why hybrid schemes use asymmetric methods to exchange it.

Encryption using a key pair: a public key anyone may hold and a private key kept secret. It solves key distribution and enables digital signatures, but it is slower than symmetric ciphers, so it usually protects only a session key.

A one-way calculation that turns any input into a fixed-length value, such as SHA-256. The same input always gives the same output, small changes alter it completely, and it is used for integrity checks and password storage.

A value created with a sender's private key over a hash of a message, which a recipient verifies with the public key. It proves the message came from the key holder and was not altered in transit.

A signed electronic document that binds a public key to an identity, issued by a certificate authority and valid for a stated period and purpose. Browsers and systems check the chain of trust and revocation before trusting the key.

The policies, roles, and systems that issue, distribute, renew, and revoke digital certificates, including certificate authorities and registration authorities. It provides the trust framework that makes TLS and signed code trustworthy.

The protocol that encrypts and authenticates connections such as HTTPS, using certificates to prove the server's identity and to negotiate session keys. Weak versions and misconfigurations are common findings in security assessments.

A platform that collects logs from many sources, correlates events, and raises alerts against detection rules. Analysts use it as the central console for triage, investigation, and retention of evidence.

A chronological record of events such as logins, file access, and network connections, produced by systems and applications. Logs are the raw material for detection, investigation, and proving compliance, so they must be protected and retained.

A documented set of roles, steps, and contacts for handling a security incident across preparation, detection, containment, eradication, recovery, and lessons learned. Exercising it in advance prevents ad hoc decisions under pressure.

The arrangements that keep essential business functions running during a disruption, including alternate sites, manual workarounds, and staffing. It is broader than disaster recovery, which focuses specifically on restoring IT systems and data.

Information relating to an identified or identifiable living person, such as name, contact details, location, or identifiers. Privacy laws impose duties on how it is collected, used, secured, and shared.

The European Union law governing processing of personal data, with principles such as lawfulness, purpose limitation, and minimization, plus rights for individuals. It applies to organizations outside the EU that offer goods or monitor people in the EU.

The legal duty to inform regulators, and sometimes affected individuals, within defined deadlines after personal data is lost or exposed. Timelines and thresholds vary by jurisdiction, so incident response must include a legal assessment.

An international standard for establishing, operating, and certifying an information security management system. It requires risk-based controls, documented policies, and continual improvement, and organizations can be independently audited against it.

Labeling information by sensitivity, such as public, internal, confidential, and restricted, so that handling rules match its value. It drives encryption, access, retention, and sharing decisions throughout the organization.