CCIS key terms

Layering multiple independent security controls so that failure of any single control does not expose the whole system. Layers typically include physical, network, endpoint, identity, and data protections.

Granting each user, service, or process only the permissions needed to perform its defined task, and no more. Limits the damage from compromised accounts or flawed software.

Splitting a sensitive task across two or more people so no single individual can complete a high-risk action alone. Common in change management, payments, and administrative approval workflows.

A management-approved statement of mandatory rules and expectations for protecting information and systems. Policies are high-level and durable; standards, procedures, and guidelines implement them.

A specific, mandatory requirement that supports a policy, such as a password length, encryption algorithm list, or logging retention period. Standards are measurable and auditable.

Rules describing how employees may use organizational systems, networks, and data, including prohibitions and monitoring notice. Users typically acknowledge it during onboarding and periodically thereafter.

Ongoing education that teaches staff to recognize threats such as phishing, handle data correctly, and report incidents. Effectiveness is often measured with simulated attacks and completion tracking.

Assigning labels such as public, internal, confidential, or restricted to information so handling and protection requirements match its sensitivity and legal obligations.

The accountable role that decides classification, access rules, and permitted uses for a data set. Owners delegate technical implementation to custodians but retain responsibility for protection decisions.

The role that operates and maintains systems holding data, applying the backups, access controls, and encryption that the data owner requires. Custodians implement controls rather than set policy.

A controlled process for requesting, reviewing, testing, approving, and recording changes to production systems. Reduces outages and provides an audit trail linking changes to incidents.

A security model that treats no network location as inherently trusted. Every request is authenticated, authorized, and continuously evaluated using identity, device health, and context signals.

Dividing a network into small zones with tightly scoped allow rules so workloads communicate only with approved peers. Limits lateral movement after a host is compromised.

A device or software that permits or blocks traffic based on rules about addresses, ports, protocols, or application content. Stateful firewalls track connection state; next-generation models add application awareness.

A sensor that inspects traffic or host activity for known attack signatures or anomalous behavior and raises alerts. It detects and reports but does not block traffic.

An inline sensor that detects malicious traffic and actively drops or resets it. Because it sits in the traffic path, false positives can disrupt legitimate business activity.

An encrypted tunnel that carries traffic between a remote device or site and a trusted network over an untrusted medium. Provides confidentiality and often authenticates endpoints before access.

Cryptographic signing of DNS records that lets resolvers verify a response truly came from the zone owner and was not forged or altered in transit.

Injecting forged DNS responses so a victim resolves a legitimate name to an attacker-controlled address. Often enables credential theft through lookalike login pages.

Requiring two or more independent evidence types, such as a password plus a hardware key or push approval, before granting access. Blocks most credential-replay attacks.

Methods bound to the legitimate site's origin, such as FIDO2 security keys or passkeys, so a proxy phishing page cannot capture or replay the credential. Contrasts with codes a user can type into any page.

A central identity provider authenticates a user once and issues assertions or tokens that many applications accept. Improves usability but concentrates risk in the identity provider.

Trust between separate organizations' identity systems that lets a user authenticated in one realm access resources in another, typically using standards such as SAML or OpenID Connect.

Assigning permissions to job roles rather than individuals, then placing users into roles. Simplifies administration and review as people change positions.

Tools and processes that vault, broker, record, and time-limit administrative credentials. Reduces standing administrator rights and creates accountability for privileged sessions.

Granting elevated permissions only for a defined window when a task requires them, then automatically revoking them. Shrinks the exposure window compared with permanent admin rights.

A periodic, documented check in which managers or resource owners confirm that each account's entitlements are still needed. Findings drive removal of stale or excessive permissions.

Agent software that continuously records process, file, and network telemetry on hosts, detects suspicious behavior, and supports investigation and remote containment actions.

A documented, hardened reference state for systems, covering settings such as services, permissions, and patch levels. Compliance checks compare live hosts against it.

The gradual divergence of a system's actual settings from its approved baseline through manual changes, updates, or unmanaged software installs. Increases attack surface and troubleshooting effort.

The cycle of identifying, testing, deploying, and verifying software fixes for known vulnerabilities. Prioritization weighs exploitability, exposure, and business impact.

Protecting stored data, such as disks, databases, or backups, with encryption so media theft or unauthorized file access does not reveal plaintext. Keys must be protected separately from the data.

Protecting data while it moves between systems using protocols such as TLS or IPsec, preventing eavesdropping and tampering on the network path.

Transport Layer Security, the protocol that encrypts and authenticates connections such as HTTPS. Uses certificates to prove server identity and negotiates session keys.

The policies, certificate authorities, and processes that issue, validate, renew, and revoke digital certificates. Underpins trust for TLS, code signing, and many authentication schemes.

The lifecycle practices for cryptographic keys: generation, distribution, storage, rotation, use, and destruction. Weak key handling defeats even strong algorithms.

A one-way function that maps data of any size to a fixed-length value used to verify integrity or store password verifiers. Not reversible, unlike encryption.

Unique random data added to a password before hashing so identical passwords produce different stored values. Defeats precomputed rainbow tables and forces per-account cracking effort.

A cryptographic value created with a private key that lets anyone verify the signer's identity and confirm the content was not altered. Provides integrity, authenticity, and non-repudiation.

Deceptive messages that impersonate a trusted party to trick recipients into revealing credentials, approving payments, or running malicious files. Variants include spear phishing and business email compromise.

A platform that centralizes logs from many sources, correlates events against detection rules, and alerts analysts. Often paired with automation for enrichment and response.

A platform that fuses endpoint, network, identity, and cloud telemetry into correlated detections and guided response. Reduces tool sprawl compared with separate consoles per layer.

Documented roles, escalation paths, and steps for detecting, containing, eradicating, recovering from, and learning from security incidents. Tested through tabletop and live exercises.

The incident response phase that limits spread and damage, for example by isolating a host, disabling an account, or blocking a domain. Chosen to balance business disruption against attacker movement.

A structured, blameless examination after an incident closes that identifies root causes and assigns tracked improvements to controls, detection, or process.

A method such as the five whys or fault tree analysis used to find the underlying reason an incident or failure occurred, rather than stopping at the immediate trigger.

Automated probing of systems to inventory software and identify known weaknesses or missing patches. Produces findings that require validation and prioritized remediation.

Code or a technique that abuses a specific weakness to gain unauthorized behavior on a system. Availability of a working exploit strongly raises a vulnerability's priority.

Identifying assets and threats, estimating likelihood and impact, and comparing the result with the organization's risk tolerance to choose treatments: mitigate, transfer, avoid, or accept.

A maintained record of identified risks with owners, ratings, treatment decisions, and review dates. Used to track acceptance decisions and demonstrate governance over time.

The division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure; the customer secures its data, identities, and configuration.

Insecure settings in cloud services, such as public storage buckets, overly broad identity policies, or exposed management interfaces. A leading cause of cloud data exposure.

Controls that inspect content and context to detect or block sensitive data leaving approved boundaries, such as through email, uploads, or removable media.