NISP Level 2 key terms

The three core security goals: confidentiality keeps data from unauthorized readers, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed.

The set of rules and mechanisms that decide which subjects may perform which operations on which objects, enforced through authentication, authorization, and auditing.

A principle requiring that every user, process, and program receives only the permissions strictly needed for its task, and only for as long as needed.

The assurance that a party cannot credibly deny having performed an action, typically achieved through digital signatures and tamper-evident audit logs.

A management-approved document stating an organization's security objectives, rules of behavior, and responsibilities, forming the basis for standards, procedures, and guidelines.

Layering multiple independent controls across people, process, and technology so that failure of one safeguard does not expose the whole environment.

A segmented network zone holding internet-facing services, separated from the internal network by filtering devices so that compromise of a public host does not directly expose internal systems.

A device or software that inspects and permits or denies network traffic according to configured rule sets, typically at the boundary between security zones.

An intrusion detection system monitors network or host activity for known attack signatures or behavioral anomalies and raises alerts, but normally does not block traffic itself.

An intrusion prevention system inspects traffic inline and can actively drop or reset malicious sessions in addition to alerting, unlike a purely passive detection system.

A virtual LAN logically groups switch ports into separate broadcast domains, letting administrators segment traffic by function or trust level without separate physical hardware.

Dividing a network into isolated zones with controlled inter-zone traffic, limiting lateral movement after a compromise and reducing the scope of impact.

A distributed denial-of-service attack floods a target with traffic from many sources to exhaust bandwidth or resources and make services unavailable to legitimate users.

An attack that gains higher permissions than intended, either vertically to administrator rights or horizontally to another user's resources, often via misconfiguration or unpatched flaws.

The structured process of identifying, testing, deploying, and verifying software updates that close known vulnerabilities across hosts and applications.

Reducing a system's attack surface by disabling unused services and accounts, removing default credentials, applying secure configuration baselines, and restricting access.

Software written to cause harm or unauthorized action, including viruses, worms, trojans, ransomware, spyware, and rootkits, spread through various infection vectors.

Malicious code that encrypts or locks victim data and demands payment for restoration, often combined with data theft and extortion threats.

Malware that conceals its presence and that of other malicious components by subverting operating system functions, making detection with ordinary tools unreliable.

An attack that inserts crafted SQL fragments into application input so the database executes unintended queries, potentially exposing or altering stored data.

Cross-site scripting injects malicious script into pages viewed by other users, letting the attacker act in the victim's browser session or steal sensitive data.

Checking and constraining data received from users or systems against expected format, type, and range before processing, blocking many injection-style attacks.

A widely referenced community list of the most critical web application security risk categories, used to prioritize development and testing efforts.

Encryption using one shared secret key for both encryption and decryption, efficient for bulk data but requiring secure key distribution and management.

Encryption using a mathematically related public and private key pair, where the public key encrypts or verifies and the private key decrypts or signs.

A one-way function mapping input of any length to a fixed-length digest, used for integrity checks and password storage because the original input cannot be feasibly recovered.

A cryptographic value created with a private key over a message digest, letting others verify origin and integrity and supporting non-repudiation.

Random data added to a password before hashing so identical passwords produce different digests, defeating precomputed rainbow tables and slowing guessing attacks.

Authentication requiring two or more independent evidence types, such as a password plus a one-time code or hardware token, so one stolen factor is insufficient.

An arrangement where one identity provider authenticates users and asserts their identity to other trusted services, avoiding separate credentials for each system.

A mechanism letting a user authenticate once and access multiple applications without re-entering credentials, improving usability while concentrating risk on the primary authentication.

Security information and event management collects and correlates logs from many sources, generates alerts, and supports investigation and compliance reporting.

The organized process of preparing for, detecting, containing, eradicating, recovering from, and learning from security incidents, usually defined by a documented plan and team roles.

The disciplined collection, preservation, and analysis of digital evidence using methods that keep it admissible and defensible in disciplinary or legal proceedings.

A documented, unbroken record of who handled evidence, when, and how, proving that digital artifacts were not altered between seizure and analysis.

A weakness in software, configuration, or process that an attacker could exploit to compromise confidentiality, integrity, or availability.

Identifying assets and threats, estimating likelihood and impact of harm, and comparing the result against risk criteria to prioritize treatment decisions.

An authorized, goal-driven simulated attack that exploits real weaknesses to demonstrate business impact, distinct from broad automated vulnerability scanning.

Documented arrangements for keeping or restoring critical operations during and after disruption, covering roles, alternate processes, and recovery priorities.

China's tiered regulatory regime requiring operators of information systems to grade them by importance and apply corresponding security construction and assessment duties.

China's baseline statute on network security, setting duties for network operators on protection, real-name registration, data retention, incident handling, and personal information safeguards.

Legal and organizational duties covering lawful basis, notice and consent, minimal collection, retention limits, and security measures when processing personal data.

Assigning data to sensitivity or criticality levels so that handling, access, retention, and protection controls match the value and legal sensitivity of the information.

A security model that removes implicit trust based on network location, requiring continuous verification of every request and enforcing least privilege per session.

The division of security duties between a cloud provider and its customer, where the provider secures the platform and the customer secures data, identities, and configurations.

The lifecycle of cryptographic keys: generating, distributing, storing, rotating, revoking, and destroying them under controlled procedures and separation of duties.