NISP Level 1 - Security Awareness key terms

The three core goals of information security: keeping data secret from those not entitled to it, keeping data accurate and unaltered, and keeping data and systems usable when needed. Most controls protect at least one of these goals.

A rule that each user, process, or device receives only the access needed to do its job, and no more. Limiting rights shrinks the damage an attacker or a careless user can cause.

The ongoing effort to teach staff how their everyday choices affect organizational risk, so they recognize threats and follow safe habits. It complements technical controls rather than replacing them.

Layering several independent safeguards, such as passwords, training, filtering, and backups, so that failure of one control does not expose everything. Attackers must then defeat multiple barriers in sequence.

Assigning permissions to job roles rather than to individuals, then placing people into roles. It keeps access consistent, easier to audit, and simpler to revoke when someone changes position.

An account with elevated rights, such as an administrator or root account, that can change system settings, install software, or reach sensitive data. These accounts need stronger protection and closer monitoring than ordinary ones.

Logging in with two or more different kinds of proof, such as a password plus a code from a phone or a hardware key. Stealing the password alone then no longer gives an attacker access.

Software that stores credentials in an encrypted vault and fills them in on request, so users can keep long unique passwords without memorizing them. The vault is unlocked by one strong master passphrase.

Using the same password, or small variations of it, on multiple accounts. When one site is breached, attackers replay the stolen credentials against other services, a technique called credential stuffing.

Obtaining someone's username and password or session token through phishing, malware, guessing, or network interception. Stolen credentials let intruders act as a legitimate user and evade many perimeter defenses.

A fraudulent message that impersonates a trusted person or brand to push the recipient into clicking a link, opening an attachment, or revealing information. It usually creates urgency, fear, or curiosity.

Phishing tailored to a specific person or small group using details gathered from public sources or prior messages. Because the content looks plausible and personal, it is harder to spot than bulk phishing.

Manipulating people through trust, authority, or pressure to make them break normal procedures, such as resetting a password or granting access. It targets human judgment rather than technical flaws.

Inventing a believable story or identity, such as posing as an IT technician or auditor, to justify a request for information or access. The invented scenario is the pretext.

Voice-based social engineering carried out by phone or voice message, often using spoofed caller IDs or automated recordings. Attackers may pose as banks, help desks, or government offices to extract data or payments.

An attack in which criminals impersonate an executive, vendor, or colleague to trick staff into transferring money or changing payment details. It often relies on email look-alike domains and no malware at all.

Checking a link's real destination before clicking by hovering over it or reading the address carefully. Small misspellings, unusual domains, or mismatched link text are common warning signs.

Registering a domain that closely resembles a legitimate one, relying on typing errors or hasty reading. Victims land on a look-alike site that harvests passwords or delivers malware.

HTTPS encrypts traffic between browser and site, and the padlock shows a certificate was presented. It does not prove the site is honest, but a browser certificate warning signals a broken or untrusted connection that should not be bypassed.

Using open wireless networks in cafes, hotels, or airports where traffic may be intercepted or the hotspot may be fake. Safer practice is to use a trusted VPN and avoid sensitive transactions on such networks.

A service that encrypts traffic from a device to a trusted gateway, hiding it from local eavesdroppers. It protects data on untrusted networks but does not make a malicious site safe.

Central tools that enroll phones and tablets so an organization can enforce screen locks, encryption, and app rules, and can remotely wipe lost devices. It balances usability with protection of work data on personal or company hardware.

Practices for protecting data when staff work outside the office, including locked screens, trusted networks, patched devices, and careful handling of printed or spoken information. Home routers and shared spaces add risks.

Any software written to harm, spy on, or take control of a system, including viruses, worms, trojans, spyware, and ransomware. It usually arrives through downloads, attachments, malicious ads, or exploited flaws.

Malware that encrypts or steals files and demands payment for their return. Reliable offline backups and prompt isolation of infected machines are the main defenses once an infection starts.

Tracking, testing, and installing software updates that fix known vulnerabilities. Many large breaches begin with an unpatched flaw that had a fix available for months.

Security software and settings on laptops, phones, and servers that detect malicious behavior, block known threats, and limit what programs may run. It is a layer, not a substitute for user caution.

Malware installed simply by visiting a compromised or malicious website, sometimes with no click beyond opening the page. Keeping browsers and plugins updated reduces the risk.

Information about an identifiable person, such as name, contact details, identification numbers, location, or health records. Many laws require that it be collected for stated purposes and protected accordingly.

Labeling information by sensitivity, for example public, internal, confidential, or restricted, so everyone knows how it may be stored, shared, and destroyed. Handling rules follow from the label.

Any incident where protected information is accessed, disclosed, altered, or lost without authorization. Breaches often trigger legal notification duties and require documented response steps.

A rule that papers, notes, and devices holding sensitive information are secured away when a workspace is left unattended. It reduces snooping, theft, and accidental disclosure to visitors or cleaners.

Following an authorized person through a controlled door without presenting separate credentials. Politely challenging unknown visitors and never holding doors for strangers are the basic countermeasures.

A missing laptop, phone, or storage medium that may hold sensitive data. It should be reported at once so accounts can be locked and remote wipe attempted, and so legal duties can be assessed.

Telling the designated security contact quickly when something suspicious happens, such as a strange email, lost device, or odd system behavior. Fast reports let responders contain damage before it spreads.

A documented set of roles and steps for detecting, containing, eradicating, and recovering from a security incident, plus lessons learned afterward. Staff should know how to reach the team and what not to do.

Rules describing how employees may use company systems, networks, and data, including limits on personal use and prohibited content. Violations can carry disciplinary and legal consequences.

Meeting the legal and industry requirements that apply to an organization's data, such as privacy statutes or sector rules. Compliance sets a minimum bar and does not by itself guarantee good security.

Prepared arrangements for keeping essential operations running during a disruption, covering people, facilities, suppliers, and systems. It focuses on continued service rather than only on restoring technology.

The technical portion of continuity planning: how systems and data will be restored after an outage, in what order, and how long it should take. It depends on tested backups and documented recovery steps.

A separate copy of data kept so it can be restored after loss, corruption, or ransomware. Copies should be regular, tested, and at least partly offline or immutable so attackers cannot encrypt them too.