CNCDP key terms

Layering independent controls (network, host, application, data, people) so that failure of any single control does not expose the whole environment. Each layer assumes the layer in front of it has already been breached.

A design model that removes implicit trust based on network location and instead verifies every request using identity, device posture, and policy before granting access to a resource.

Dividing a network into zones with enforced traffic boundaries so that compromise in one area cannot spread freely. Controls between zones include firewalls, ACLs, and internal routing policy.

Granular segmentation applied at the workload or host level, where policy follows individual assets rather than physical subnets. It typically relies on software agents or hypervisor-level enforcement.

A buffer network hosting internet-facing services, isolated from the internal network by filtering controls. Compromise of a DMZ host is expected and should not yield direct internal access.

A hardened, heavily monitored host used as the sole administrative entry point into a protected network segment. All administrative sessions are logged and restricted by source and identity.

Granting identities and processes only the permissions needed for their defined function, for only as long as needed. It limits the blast radius of credential theft and misconfiguration.

Controls that vault, broker, rotate, and record privileged credentials and sessions. PAM reduces standing administrative rights and creates attributable audit trails for sensitive actions.

A curated knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform. Defenders use it to map detections, prioritize gaps, and describe behavior consistently.

A linear model of intrusion stages from reconnaissance through actions on objective. It helps defenders identify where an attack is and which control could interrupt it.

Artifact evidence that a system has likely been breached, such as a malicious hash, domain, IP address, or registry key. IOCs are reactive and degrade quickly as attackers change infrastructure.

Evidence of adversary behavior or intent during an intrusion, such as unusual process parentage or credential dumping activity. IOAs are more durable than static artifacts because behavior is harder to change.

A system that ingests, normalizes, deduplicates, and scores threat data from multiple sources, then distributes it to detection and response tools. It manages intelligence lifecycle rather than raw feeds.

High-level analysis of adversary intent, capability, and targeting aimed at decision-makers. It informs risk acceptance and investment rather than feeding technical detections directly.

Analysis of adversary tactics, techniques, and procedures used to shape detection content and defensive posture. It sits between strategic intent analysis and machine-readable technical indicators.

A well-resourced intrusion group, often state-linked, that conducts stealthy, long-dwell campaigns against selected targets. APTs prioritize persistence and objective completion over speed.

Abusing legitimate built-in tools and binaries already present on a host to conduct intrusion activity. It blends with normal administration and defeats hash-based or binary-blocking detection.

A standardized framework for expressing the technical severity of a vulnerability through base, temporal, and environmental metrics. The base score alone does not reflect organizational risk.

Prioritizing remediation by combining technical severity with asset criticality, exposure, and known exploitation rather than by severity score alone. It directs limited remediation effort to the greatest actual risk.

A maintained catalog of vulnerabilities confirmed to be exploited in the wild. Presence on such a list is strong justification for emergency remediation regardless of severity score.

The practical likelihood that a vulnerability can be successfully attacked, considering attack vector, required privileges, weaponized code availability, and deployed mitigations.

An alert or finding that incorrectly reports malicious or vulnerable activity where none exists. High false positive rates erode analyst trust and cause genuine alerts to be ignored.

A missed detection in which real malicious or vulnerable activity is not reported. False negatives are the costlier error because they leave the defender unaware.

A platform that centralizes log collection, correlation, and alerting across the environment. Modern implementations add user behavior analytics and automated response integration.

Endpoint software that continuously records process, file, network, and registry activity, enabling behavioral detection and remote containment. It provides investigation depth that traditional antivirus lacks.

Iteratively adjusting detection logic, thresholds, and suppression rules to reduce false positives while preserving true positive coverage. Tuning is continuous because environments and adversary behavior change.

Parsing heterogeneous log formats into a common schema so events from different sources can be correlated and queried consistently. Without it, cross-source detection is unreliable.

A documented, tested set of roles, procedures, and communication paths guiding the organization's response to a security incident. It defines authority before stress and ambiguity arise.

The response phase that limits an incident's spread and impact, for example by isolating hosts or disabling accounts. It balances stopping damage against preserving evidence and business function.

Removing the root cause and adversary presence, then restoring systems to trusted operation with monitoring. Recovery is incomplete until confidence in integrity is re-established.

A discussion-based simulation in which stakeholders walk through a hypothetical incident to test plans, decision-making, and communication. It reveals gaps without disrupting production.

A documented, unbroken record of who handled evidence, when, and for what purpose, from seizure to disposition. Gaps can render evidence inadmissible or worthless in proceedings.

The principle of collecting the most perishable evidence first, such as memory and network state, before slower-changing disk data. Collection sequence preserves evidence that would otherwise be lost.

Creating a bit-for-bit copy of storage media for analysis while preserving the original. The copy is verified by cryptographic hash to prove it matches the source.

A hardware or software device that prevents any write operation to connected evidence media during acquisition. It protects source integrity from accidental modification.

A proactive, hypothesis-driven search for adversary activity that existing detections have not caught. It relies on telemetry analysis rather than waiting for alerts to fire.

Structuring a hunt around a testable statement about adversary behavior in the environment, then querying telemetry to confirm or refute it. The result improves detections either way.

Decoy assets such as honeypots and fake credentials that generate high-fidelity alerts when touched, since legitimate users have no reason to interact with them.

A structured process identifying assets, threats, and vulnerabilities, then estimating likelihood and impact to determine risk. Outputs drive control selection and acceptance decisions.

Selecting a response to assessed risk: mitigate, transfer, avoid, or accept. Each option carries cost and residual exposure that must be documented and approved.

The risk remaining after controls are applied. It must be explicitly accepted by accountable management, since no control set eliminates risk entirely.

A voluntary framework organizing cybersecurity outcomes into functions such as identify, protect, detect, respond, and recover. Organizations use it to structure and communicate program maturity.

An international standard specifying requirements for establishing, operating, and certifying an information security management system. Certification requires documented risk treatment and audit evidence.