EXIN Information Security Essentials key terms

Data that has been given meaning by interpretation or context, so it can inform decisions. In security terms it is the asset being protected, whether stored, processed or transmitted.

The property that information is not disclosed to people, systems or processes that are not authorised to access it. Breaches of confidentiality include leaks, eavesdropping and misdirected email.

The property that information and systems remain accurate, complete and protected against unauthorised modification. Integrity failures include tampering, silent corruption and unauthorised edits.

The property that information and systems are accessible and usable by authorised users when needed. Loss of availability comes from outages, denial-of-service attacks, ransomware or physical damage.

The ability to prove that a specific action, such as sending a message or approving a transaction, was performed by a particular party, so that party cannot credibly deny it.

Anything of value to an organisation that needs protection, including information, hardware, software, services, people and premises. Asset identification is the starting point of risk assessment.

Assigning information to labelled categories, such as public, internal, confidential and secret, according to sensitivity and value. The label then dictates how the information must be handled and protected.

Any potential cause of an unwanted incident that could harm an asset. Threats may be deliberate, such as hackers, or accidental, such as fire, flooding or employee mistakes.

A weakness in an asset or control that a threat could exploit. Examples include unpatched software, weak passwords, poor physical access restrictions and untrained staff.

The combination of the likelihood that a threat exploits a vulnerability and the resulting impact or harm to the organisation. Risk is usually expressed qualitatively or in financial terms.

A structured process of identifying assets, threats and vulnerabilities, then estimating likelihood and impact to determine which risks need treatment. It produces a prioritised picture of exposure.

Choosing how to respond to an assessed risk: reduce it with controls, transfer it such as through insurance, avoid the activity, or accept it with management approval.

The risk that remains after controls have been applied and the treatment plan is in place. Management formally accepts residual risk, since no control set removes all risk.

Software written to cause harm, including viruses, worms, trojans, spyware and ransomware. It typically spreads through email attachments, downloads, malicious websites or infected media.

Malicious software that encrypts files or locks systems and demands payment for restoration. It often spreads through phishing or exposed remote access, and reliable backups are the main defence.

Manipulating people into revealing information or performing actions that weaken security, by exploiting trust, authority or urgency rather than technical flaws. Phishing and pretexting are common forms.

A social engineering attack that sends fraudulent messages, usually email, that appear to come from a trusted source to trick recipients into clicking links, opening attachments or disclosing credentials.

A high-level management statement of the organisation's security objectives, principles and mandatory rules. It provides the authority for detailed standards, procedures and guidelines that follow it.

A mandatory, specific requirement that supports the information security policy, such as a password length or an encryption algorithm. Standards are measurable and can be audited.

Documented step-by-step instructions for carrying out a security-related task consistently, for example how to request access or how to report an incident.

Rules that describe how employees may use organisational IT resources, such as email, internet and devices. It typically covers permitted activities, prohibitions and consequences of misuse.

Any measure, technical or organisational, that modifies or reduces risk. Controls may prevent, detect, correct or compensate, and their effectiveness is verified through audits and testing.

The principle of granting users and systems only the access rights they need to perform their tasks, and no more. It limits the damage possible if an account is compromised or misused.

A rule that access to specific information is granted only to people whose work genuinely requires it, regardless of their general clearance level or seniority.

Dividing a sensitive task among different people so that no single person can complete a critical process alone, such as both requesting and approving a payment. It reduces fraud and error.

Structured programmes that teach employees about security risks, policies and expected behaviour, so they recognise attacks and handle information correctly. It is a core human security control.

The mechanisms that decide who or what may access a resource and what they may do with it, covering identification, authentication, authorisation and logging of access.

Verifying that a user, device or system is who or what it claims to be, typically through something you know, have or are, alone or combined in multi-factor authentication.

Requiring two or more independent types of evidence before granting access, such as a password plus a code on a registered phone. It blocks many attacks that rely on stolen passwords.

Transforming readable data into ciphertext that can only be turned back into plaintext with the correct key. It protects confidentiality in storage and in transit.

Applying a one-way mathematical function to data to produce a fixed-length value used to verify integrity. Any change to the input produces a different hash value.

A cryptographic value created with a private key that lets a recipient verify the sender's identity and confirm the data was not altered, supporting integrity and non-repudiation.

The process of tracking, testing and installing software updates that fix known vulnerabilities. Delayed patching is one of the most frequently exploited weaknesses.

Measures that restrict who can physically enter rooms, buildings or areas holding sensitive systems, using locks, badges, reception checks, turnstiles and visitor escorts.

A rule requiring that sensitive papers be locked away and screens locked when a workstation is left unattended, reducing exposure to visitors, cleaners and shoulder surfing.

An event, or series of events, that has actually or potentially compromised information security and requires a response. Examples include malware infection, data leak or lost device.

The documented process for detecting, reporting, assessing, responding to and learning from security incidents, with defined roles, escalation paths and communication lines.

Documented arrangements that let critical business functions keep operating, or resume quickly, during and after a disruption. It covers people, processes, facilities and technology.

Copies of data kept separately so it can be restored after loss, corruption or ransomware. Effective backup requires regular testing of restoration, not only copying.

Conforming to laws, regulations, contracts and internal policies that apply to the organisation. Non-compliance can bring fines, legal action and reputational damage.

An independent, systematic examination of controls, records and practices against defined criteria, producing evidence of conformity or gaps that management must address.