CNDA key terms

Layering independent security controls across network, host, application, and data tiers so that a single failure or bypass does not expose the whole environment. Each layer assumes the others may be compromised and enforces its own checks.

The three core security goals: confidentiality, keeping data from unauthorized readers; integrity, keeping data unaltered and trustworthy; and availability, keeping systems and data usable when needed. Most control decisions trade off among these three.

A person or group with the intent and capability to attack systems, described by motivation, resources, and skill. Distinguishing commodity criminals from state-sponsored or insider actors shapes which defenses and detection priorities matter most.

The total set of points where an adversary can interact with or influence a system, including exposed services, credentials, APIs, endpoints, and human users. Reducing it shrinks the number of paths an attacker can try.

Granting users, services, and processes only the access needed for their defined tasks, for only as long as needed. It limits the blast radius of a compromised account or exploited service.

A structured process that identifies assets, threats, and vulnerabilities, then estimates likelihood and impact to prioritize controls. Results drive where budget and monitoring effort go rather than treating all risks equally.

Dividing a network into zones with enforced traffic control between them, so hosts in one zone cannot freely reach another. It contains lateral movement and lets policy differ by sensitivity, for example separating user, server, and management networks.

A network segment holding internet-facing services, placed between the untrusted internet and the internal network. Rules restrict traffic so a compromised public server cannot initiate sessions directly into internal systems.

The ordered set of permit and deny rules a firewall evaluates for each packet or connection. Order matters because the first matching rule wins, and shadowed or overly broad rules silently weaken the intended policy.

Firewall behavior that tracks connection state and allows return traffic for sessions initiated from inside, rather than judging each packet in isolation. It reduces rule count but can be evaded by tools that abuse permitted channels.

A posture in which all traffic, access, or execution is blocked unless explicitly permitted by policy. It is the safer baseline because new and unknown services fail closed instead of being silently exposed.

An intermediary that terminates a client connection and opens a separate one to the destination, inspecting and filtering content in between. Because it understands application protocols, it can block categories and log full requests.

Decrypting outbound or inbound encrypted traffic at a controlled point, examining it, then re-encrypting it. It restores visibility for malware and data-loss controls but requires certificate management and attention to privacy and legal constraints.

Applying fine-grained policy between individual workloads or hosts, often inside a data center, rather than only at perimeter chokepoints. It limits east-west movement after an initial compromise.

A documented, repeatable configuration standard that removes unnecessary services, closes default accounts, and sets secure parameters for an operating system or application. Deviations from the baseline become auditable findings.

The cycle of identifying, testing, deploying, and verifying software updates that fix known vulnerabilities. Prioritization should weigh exploitability and exposure, not just severity scores.

Agent software on hosts that continuously records process, file, network, and registry activity, applies behavioral detection, and supports remote investigation and containment. It provides the telemetry and response actions antivirus signatures alone cannot.

Permitting only explicitly approved applications, scripts, or binaries to execute and blocking everything else. It defeats many unknown malware families but requires maintenance as legitimate software changes.

Gaining a higher level of access than originally granted, whether by exploiting a vulnerable service, abusing misconfigured permissions, or stealing administrative credentials. It is often the step that turns a foothold into control.

Using legitimate built-in tools such as PowerShell, WMI, or certutil to perform attacker actions, so activity blends with normal administration. Detection depends on command-line context and parent-child process relationships rather than file signatures.

Automated probing of hosts and services to identify missing patches, weak configurations, and known flaws. Findings require validation and prioritization; a scan report is a starting point, not proof of exploitability.

The raw event data collected from sensors such as logs, network flows, and endpoint agents, forming the evidence base for detection. Coverage, timestamps, and normalization quality determine what questions analysts can later answer.

A platform that centralizes logs from many sources, normalizes and correlates them, and triggers alerts against detection rules. Its value depends on tuned rules and reliable time synchronization across sources.

Observable artifacts suggesting intrusion, such as malicious file hashes, command-and-control domains, or unusual registry keys. They are fast to share but short-lived, since attackers change them easily.

Observable evidence of adversary behavior and intent, such as unusual process chains, credential dumping, or beaconing patterns, rather than fixed artifacts. They survive infrastructure changes better than file hashes or IP addresses.

An alert raised for activity that is actually benign, such as an administrator running an approved script. High false positive rates cause alert fatigue, so tuning must balance noise reduction against missing real events.

Summarized records of connections, including source and destination addresses, ports, byte counts, and timestamps, without payload. Flows reveal scanning, beaconing, and data-transfer patterns even when content is encrypted.

Regular, automated check-ins from implanted malware to attacker infrastructure, often with slight jitter to look normal. Periodic connections of similar size to an uncommon destination are a classic detection pattern.

The channel attackers use to send instructions to compromised hosts and receive results. It may ride common protocols or legitimate cloud services, so blocking must be paired with behavioral detection.

Curated information about adversaries, campaigns, and infrastructure used to inform detection and defense. It is most useful when matched to the organization's sector and technology, and when indicators are fresh.

Assurance that log records are complete, accurately time-stamped, and resistant to tampering or deletion. Centralized, append-only collection and synchronized clocks are prerequisites for trusting any investigation.

Adjusting detection rules, thresholds, and suppressions so alerts reflect real risk rather than environment quirks. It is continuous, because legitimate behavior and attacker techniques both change over time.

A documented set of roles, escalation paths, communication channels, and procedures activated when an incident is confirmed. It should be exercised so decisions are not invented under pressure.

Short-term action to stop an incident from spreading, such as isolating a host or disabling an account, while preserving enough evidence for investigation. Aggressive containment can destroy forensic data if done carelessly.

Removing the root cause of an incident, including malware, attacker accounts, and persistence mechanisms, before restoring normal operations. Skipping it usually leads to re-infection during recovery.

A documented record of who handled evidence, when, and how, from collection through storage and analysis. Gaps or undocumented access can render evidence unreliable or inadmissible.

A structured post-incident review that identifies what worked, what failed, and which controls or procedures should change. Outputs should become tracked improvements, not just a written report.

Unauthorized transfer of data out of an environment, often over permitted channels or to cloud storage. Detection relies on volume anomalies, unusual destinations, and data-loss prevention rules.