Security+ key terms

A model describing three core goals of information security: confidentiality keeps data secret from unauthorized people, integrity keeps it accurate and unaltered, and availability keeps it reachable by authorized users when needed.

The assurance that someone cannot credibly deny having performed an action, such as sending a message or approving a transaction, because strong evidence links that action to their identity.

The practice of giving each user, process, or device only the minimum access rights needed to do its assigned work, which limits the damage a single compromised account can cause.

A security model that treats no user or device as inherently trusted, even inside the corporate network, so every access request is continuously verified using identity, device health, and context.

Three linked access-control functions: authentication proves who a subject is, authorization decides what that subject may do, and accounting records what it actually did for later review.

A one-way mathematical process that turns any input into a fixed-length digest; the same input always yields the same digest, but the original data cannot practically be recovered from it.

A cryptographic value produced with a sender's private key that lets a recipient confirm the message truly came from that sender and was not changed in transit.

The combination of policies, roles, hardware, and software used to issue, distribute, renew, and revoke digital certificates and the public keys those certificates bind to identities.

A social engineering attack that sends fraudulent messages, usually email, designed to trick recipients into revealing credentials, clicking malicious links, or opening harmful attachments.

Malicious software that encrypts or locks a victim's files and systems, then demands payment for the decryption key or for restoring access to the data.

Manipulating people through deception, urgency, or claimed authority so they break normal procedures and disclose information or perform unsafe actions that bypass technical controls.

An attack that compromises a trusted vendor, software component, or service provider so malicious code or unauthorized access reaches the target through that trusted relationship.

An attack that inserts crafted database commands into application input fields so the server executes them, potentially exposing, altering, or deleting stored data.

An attack that injects malicious scripts into web pages viewed by other users, letting the attacker steal cookies, hijack sessions, or change what victims see.

A person or group that carries out attacks, ranging from lone criminals and malicious insiders to organized crime and state-sponsored teams, each with different skills and motives.

A weakness in software, hardware, configuration, or procedure that an attacker could exploit to gain unauthorized access, disrupt operations, or cause other harm.

An insecure setup of a system or service, such as default passwords, openly readable storage, or unnecessary services left enabled, that creates an exploitable weakness.

Layering multiple independent controls across people, networks, endpoints, applications, and data so that a failure or bypass of one layer does not expose everything.

Reducing a system's attack surface by removing unneeded software and services, applying secure settings and patches, and restricting access to only what the role requires.

A network segment placed between the internet and the internal network that hosts internet-facing services, so a compromise there does not directly expose internal systems.

Dividing a network into very small zones and permitting only specifically defined traffic between them, which limits how far an intruder can move after compromising one host.

Designing systems with redundancy, clustering, and failover so services keep running with minimal downtime when a component fails or during planned maintenance.

The ability of an organization and its systems to keep delivering essential services during disruption and to recover quickly afterward, using redundancy, backups, and tested plans.

A logically separate network segment built on shared switching equipment, used to group devices by function or trust level and to contain broadcast traffic and attacks.

A platform that collects and correlates logs and event data from many sources, raises alerts on suspicious patterns, and supports investigation and compliance reporting.

A tool that automates routine security operations, such as enriching alerts and running response playbooks, so analysts handle incidents faster and more consistently.

Endpoint software that continuously records process and file activity on hosts, detects malicious behavior, and can isolate or remediate an infected device.

A documented set of roles, steps, and communication paths that guides an organization through preparing for, detecting, containing, eradicating, and recovering from a security incident.

A documented record of who handled evidence, when, and for what purpose, from collection through storage and analysis, so it stays trustworthy and admissible.

An automated check that compares systems against known weakness signatures and configuration baselines to produce a prioritized list of findings to remediate.

An authorized, goal-driven attack simulation by skilled testers who try to exploit weaknesses and chain them together to demonstrate real business impact.

A living record of identified risks, each with its likelihood, impact, owner, and chosen treatment, used to track and prioritize risk decisions over time.

The amount and type of risk an organization is willing to accept while pursuing its objectives, which guides how much control and spending is justified.

A study that identifies critical business functions and calculates how much disruption each can tolerate, producing recovery priorities and time objectives that shape continuity planning.

The maximum acceptable time a system or process may stay unavailable after a disruption before the organization suffers consequences it considers unacceptable.

The exposure created by relying on vendors, partners, and service providers, managed through due diligence, contractual security requirements, and ongoing monitoring of their controls.

Labeling information by sensitivity and value, such as public, internal, confidential, or restricted, so handling, storage, and access rules can be applied consistently.

Ongoing education that teaches employees to recognize threats such as phishing, follow policy, and report suspicious activity, reducing the chance human error causes a breach.