ECSS key terms

A layered security strategy that stacks independent controls across people, process, and technology so that a failure in one control does not expose the whole environment.

The three core security goals: confidentiality keeps data from unauthorized readers, integrity keeps it accurate and unaltered, and availability keeps it reachable when legitimate users need it.

Granting each user, service, or process only the access rights needed for its current task, and no more, to shrink the damage any single compromised account can cause.

Dividing a network into isolated zones with controlled traffic between them, so a breach in one zone cannot spread freely to sensitive systems in another.

A buffer subnet that hosts internet-facing services such as web and mail servers, keeping them separated from the internal network even if they are compromised.

A device or software filter that inspects packets or connections and permits or blocks traffic according to a configured rule set, often placed at network boundaries and between segments.

A monitoring tool that watches network or host activity for known attack signatures or suspicious behavior and raises alerts, but does not itself block the traffic it detects.

An inline sensor that detects malicious traffic and actively drops or resets it, sitting in the traffic path so that detected attacks never reach the protected host.

A decoy system or service deployed to attract attackers, collect intelligence about their tools and techniques, and divert attention from real production assets.

The process of identifying assets and threats, estimating likelihood and impact, and ranking risks so that limited security budget and effort go to the most significant exposures first.

A weakness in software, configuration, or process that an attacker could exploit to gain access, escalate rights, or disrupt service; it becomes a risk when a threat can reach it.

A disciplined cycle of inventorying software, testing vendor fixes, deploying them on a schedule, and verifying installation so known vulnerabilities are closed before attackers use them.

Ongoing education that teaches staff to recognize phishing, handle data correctly, report incidents, and follow policy, reducing the human errors attackers most often exploit.

A documented, rehearsed sequence of preparation, detection, containment, eradication, recovery, and lessons learned that guides an organization through a security incident.

The information-gathering phase of an attack in which an adversary maps targets, technologies, employees, and exposed services, often using only public sources before touching the target directly.

Open-source intelligence: collecting and correlating publicly available information such as websites, DNS records, social media, and job postings to build a picture of a target.

Probing target hosts to discover live systems, open ports, running services, and operating system details, typically with tools such as Nmap to build an attack surface map.

Actively querying discovered services to extract detailed information such as user accounts, shares, SNMP data, or directory entries, which feeds later exploitation and credential attacks.

A technique, script, or tool that takes advantage of a specific vulnerability to execute code, bypass controls, or otherwise compromise a target system.

The code or action an attacker delivers after an exploit succeeds, such as a reverse shell, a downloader, or a ransomware binary that performs the actual objective.

A hidden access method planted on a compromised system, such as a rogue account or remote-access tool, that lets an attacker return without repeating the original intrusion.

Gaining higher rights than initially granted, either by exploiting a local flaw to move from user to administrator or by stealing credentials of a more powerful account.

Recovering or guessing credentials offline from captured hashes using dictionary, rule-based, or brute-force methods, or online by trying logins against exposed services.

Automated login attempts that replay username and password pairs leaked from one breach against other services, exploiting the fact that many people reuse passwords.

Deceiving a target into revealing credentials or running malicious content through a convincing message that impersonates a trusted sender, brand, or colleague.

Manipulating people through trust, urgency, or authority to obtain information or access, bypassing technical controls by targeting human judgment instead.

Inserting crafted SQL syntax into an input field so the application executes attacker-controlled queries, potentially dumping, altering, or deleting database contents.

Injecting script into a page that other users view, so the code runs in their browsers, steals session cookies, or performs actions as the victim.

Taking over an authenticated session by stealing or predicting its token or cookie, letting an attacker act as the legitimate user without knowing their password.

An attacker secretly relays or alters traffic between two parties who believe they are communicating directly, enabling eavesdropping and credential theft on unencrypted links.

Sending forged Address Resolution Protocol replies to bind an attacker's MAC address to a legitimate IP, redirecting local network traffic through the attacker for interception or modification.

A layer-2 attack that lets traffic cross VLAN boundaries, typically through switch port tagging abuse or double-tagged frames, defeating segmentation that was meant to isolate systems.

The disciplined application of investigation methods to digital devices and media to reconstruct events, attribute activity, and present findings that hold up in a legal or disciplinary proceeding.

A documented, unbroken record of who handled evidence, when, and how, from seizure through storage and analysis, proving the material was not altered or substituted.

Creating a bit-for-bit duplicate of storage media, including slack and unallocated space, using a write blocker so the original evidence stays untouched while analysis proceeds on the copy.

A hardware or software device that permits read access to evidence media while preventing any write operation, preserving the original state for later verification.

Computing a cryptographic digest such as SHA-256 of evidence before and after handling; matching values demonstrate that the image or file has not changed.

Information that disappears when a system loses power, such as RAM contents, running processes, network connections, and logged-in sessions, which must be captured first at a scene.

The rule that evidence should be collected from the most perishable sources first, moving from memory and network state to disk, then to archival backups and printouts.

Capturing memory or disk data from a running system, preserving volatile evidence that a shutdown would destroy, while accepting that the act of collection may alter the system slightly.

Recovering files from unallocated space or damaged media by scanning raw bytes for known headers and footers rather than relying on intact file system metadata.

Ordering file system, log, and artifact timestamps chronologically to reconstruct what happened, when, and in what sequence during an incident.