EXIN Cyber Security Foundation key terms

The three core security goals: information is kept secret from unauthorised parties, is accurate and unaltered, and is reachable when needed. Most controls are justified by one or more of these goals.

Protecting information, in any form, from unauthorised access, change, loss or disclosure. It covers people, processes and technology, not only technical systems.

The assurance that a party cannot credibly deny having sent a message or performed an action. Digital signatures and reliable audit logs are typical ways to achieve it.

Anything of value to an organisation that needs protection, such as data, software, hardware, people, premises or reputation. Identifying assets is the starting point of risk assessment.

A weakness in a system, process or human behaviour that a threat could exploit. Vulnerabilities may be technical, such as unpatched software, or organisational, such as missing procedures.

Any potential cause of an unwanted incident that could harm an asset. Threats can be deliberate, accidental or environmental, and are described by their source and capability.

The combination of the likelihood that a threat exploits a vulnerability and the resulting impact on the organisation. Risk is usually expressed qualitatively or in monetary terms.

Choosing how to deal with an identified risk: reduce it with controls, transfer it (for example by insurance), avoid the activity, or knowingly accept it. The choice is recorded and reviewed.

The risk that remains after controls have been applied. Management formally accepts residual risk, because no control set removes all risk.

Layering several independent controls so that if one fails, others still protect the asset. Examples are firewalls, endpoint protection, access control and staff awareness combined.

Giving users, processes and systems only the access rights they need for their task, and no more. This limits the damage an attacker or a mistake can cause.

The set of rules and mechanisms deciding who may use which resource and in what way. It includes identification, authentication, authorisation and logging of access.

Logging in with two or more different kinds of evidence, such as a password plus a code from a device. It blocks many attacks that rely on stolen passwords alone.

An account with elevated rights, such as administrator or root, able to change systems and data. Such accounts need extra protection because compromise gives an attacker wide control.

A structured process for tracking, testing and installing software updates that fix known vulnerabilities. Unpatched systems are among the most common entry points for attackers.

Dividing a network or system into separate zones with controlled traffic between them. It stops an intruder or malware from spreading freely across the whole environment.

A control that filters network traffic against rules, allowing or blocking connections between zones or hosts. It is a basic perimeter and internal segmentation measure.

A tool that monitors network or host activity and raises alerts on suspicious patterns. A pure IDS detects and reports; an intrusion prevention system can also block traffic.

Converting data into a form that only someone holding the right key can read. It protects confidentiality in transit and at rest, and supports integrity when combined with signatures.

A cryptographic value attached to data that proves who signed it and that the data has not changed. It provides integrity, authentication and non-repudiation.

Recording system and network events and reviewing them for signs of trouble. Good logs support detection, investigation and non-repudiation, but must themselves be protected.

Software written to harm or misuse a system, including viruses, worms, trojans, spyware and ransomware. It often arrives through email attachments, downloads or exploited vulnerabilities.

Malware that encrypts or steals data and demands payment for restoration or non-disclosure. Reliable offline backups and segmentation are key defences.

Deceiving people into revealing credentials, clicking malicious links or transferring money, usually by email or messages that impersonate a trusted party. Variants include spear phishing and smishing.

Manipulating people through trust, authority or urgency to obtain information or access. It targets human behaviour rather than technical flaws, so awareness training is the main countermeasure.

Following an authorised person into a restricted physical area without presenting valid credentials. It exploits politeness and is countered by access badges, turnstiles and staff vigilance.

Overloading a service or network so that legitimate users cannot use it. Distributed attacks use many compromised machines at once, making them harder to block.

A network of compromised devices, called bots, controlled remotely by an attacker. Botnets are rented out for distributed denial-of-service, spam and credential-stuffing campaigns.

An attacker secretly relays or alters communication between two parties who believe they talk directly. Strong encryption and certificate checks make this much harder.

Inserting database commands through unvalidated user input so the application executes them. It can expose or destroy data, and is prevented by parameterised queries and input validation.

A software flaw unknown to the vendor, so no patch exists yet. Attackers exploiting it have an advantage until the vendor responds and defenders apply mitigations.

The person or group behind a threat, such as a criminal, insider, hacktivist or state-sponsored group. Their motivation and resources shape the risk they pose.

Risk from someone with legitimate access, such as an employee or contractor, who misuses it maliciously or accidentally. Access control, monitoring and a healthy culture reduce it.

An event, or series of events, that actually or potentially harms information security. Incidents are handled through a defined response process covering detection, containment, recovery and lessons learned.

Documented roles, steps and contacts for handling a security incident. A tested plan shortens recovery and reduces confusion during a real attack.

Planning and arrangements that keep essential business functions running during and after a disruption. It includes backups, alternate processes and regular testing of recovery arrangements.

Management's written statement of security objectives, rules and responsibilities. It gives direction to controls and is the basis for standards, procedures and awareness activities.

Activities that help staff recognise threats and follow security rules in daily work, such as training, phishing simulations and clear reporting channels. It reduces human-related incidents.

Practices for creating, storing and changing passwords safely, including length over complexity, unique credentials per service and use of a password manager. It reduces credential theft.