CSPI key terms

The three core goals of information security: confidentiality keeps data from unauthorized readers, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed.

The possibility that a threat will exploit a vulnerability and cause harm to an organization, usually described as a combination of likelihood and impact.

Any person, event, or circumstance with the potential to damage information or systems, such as an attacker, a natural disaster, or a software flaw being triggered.

A weakness in a system, process, or control that a threat could use to cause harm, such as an unpatched server or a missing approval step.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by leadership and used to decide which risks need treatment.

The risk that remains after safeguards have been applied, which management must consciously accept, reduce further, or transfer to another party.

A quantitative risk figure found by multiplying the expected loss from a single event by how many times that event is expected to occur per year.

A study that identifies critical business functions and estimates how much harm a disruption causes over time, producing recovery priorities and recovery targets.

Giving each user, process, or system only the access needed to do its job and nothing more, which limits the damage from mistakes or compromise.

Splitting a sensitive task among two or more people so that no single person can both commit and conceal an error or fraud.

Layering multiple independent controls so that if one fails, others still protect the asset, rather than relying on a single barrier.

A living record of identified risks with their owners, ratings, treatments, and status, used to track and communicate risk decisions over time.

A high-level management statement of intent that sets mandatory rules and responsibilities for protecting information, answering what must be done and why.

A mandatory, specific requirement that supports a policy, such as an approved encryption algorithm or a minimum password length that everyone must meet.

Step-by-step instructions telling staff exactly how to carry out a task required by policy or standard, so that results stay consistent and repeatable.

Sorting information into labeled categories by sensitivity and value, so that handling, storage, and access rules match the level of protection required.

The senior manager accountable for a specific data set who decides its classification and who may access it, even though others maintain the systems holding it.

Rules describing how employees may use company systems, networks, and data, including prohibited activities and the expectation that usage may be monitored.

The process of assessing, contracting with, and monitoring vendors and partners so that their security weaknesses do not become the organization's weaknesses.

A formal set of professional conduct principles that guides decision-making and defines expected behavior, including honesty, confidentiality, and avoidance of conflicts of interest.

An independent examination that checks whether the organization actually follows its own policies and applicable laws or regulations, producing findings and corrective actions.

Any safeguard or countermeasure, such as a lock, a policy, or a monitoring tool, that reduces risk by preventing, detecting, correcting, or deterring unwanted activity.

An access model where the person who owns a resource decides who else may use it, giving users broad discretion and making centralized oversight harder.

An access model that grants permissions to job roles rather than to individuals, so people receive the rights their role needs and changes are simpler to manage.

A security model that trusts no user or device by default and verifies every request using identity, device health, and context before granting access.

A buffer network segment placed between the internet and the internal network that hosts public-facing services, so a breach of an exposed server does not grant direct internal access.

Encryption that uses one shared secret key to both lock and unlock data, which is fast but requires a secure way to distribute the key.

A one-way function that turns any input into a fixed-length value, used to verify integrity because even a tiny change produces a completely different result.

A cryptographic value created with a sender's private key that lets a recipient verify who signed a message and that its contents were not altered.

A structured exercise that examines a system's design to identify likely attackers, attack paths, and weaknesses before the system is built or changed.

The total set of entry points and exposed services an attacker could try to use, which architects aim to keep as small as practical.

Reducing a system's exposure by removing unneeded software and accounts, closing unused services, and applying secure configuration settings.

A documented set of roles, steps, and contacts for detecting, containing, eradicating, and recovering from a security incident, plus lessons learned afterward.

Observable evidence suggesting a system has been breached, such as unusual outbound traffic, unexpected administrator accounts, or known malicious file hashes.

A documented, unbroken record of who handled evidence, when, and why, needed so that findings remain credible in disciplinary or legal proceedings.

Security information and event management software collects and correlates logs and alerts from many sources, giving analysts a central view for detecting and investigating suspicious activity.

The maximum acceptable time a business function can stay down after a disruption, which drives how recovery capabilities are designed and tested.

A repeating cycle of discovering, prioritizing, remediating, and verifying weaknesses in systems and software before attackers can exploit them.

A controlled process for reviewing, approving, testing, and recording changes to systems so that modifications do not break security or availability.

A predefined, reusable set of response steps for a specific scenario, such as ransomware, that lets teams act quickly and consistently under pressure.