ATSA key terms

A layered security strategy that stacks independent controls - such as network filtering, endpoint hardening, authentication, and monitoring - so that a single failed or bypassed control does not expose the whole environment.

The three core security objectives: confidentiality keeps data from unauthorized disclosure, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed.

The property that a party cannot credibly deny having performed an action, typically achieved with digital signatures, tamper-evident logs, or signed audit trails that bind an identity to an event.

An architecture model that grants no implicit trust based on network location; every request is authenticated, authorized, and continuously evaluated using least privilege and micro-segmentation principles.

The practice of granting each user, service, or process only the permissions strictly required to perform its function, and only for as long as needed, limiting blast radius if compromised.

Splitting a sensitive process across two or more people so no single individual can complete a fraudulent or destructive action alone, such as requiring separate approvers for payments.

A decoy system or service deployed to attract attackers, giving defenders early warning and behavioral intelligence while diverting activity away from real production assets.

A demilitarized zone is a segmented network holding internet-facing services, separated from the internal network by firewalls so a compromised public host cannot directly reach sensitive internal systems.

Dividing a network into isolated zones with controlled inter-zone traffic, which limits lateral movement by an attacker and lets policy be enforced close to the assets it protects.

A fine-grained segmentation approach that enforces allow-list policy per workload or identity rather than per subnet, commonly implemented in virtualized and cloud environments to block east-west movement.

A network device or software filter that permits or denies traffic based on rules covering addresses, ports, protocols, application identity, or user identity, enforcing a boundary between trust zones.

An intrusion detection system alerts on suspicious traffic, while an intrusion prevention system also blocks it inline; both rely on signatures or behavioral baselines to spot malicious patterns.

Security information and event management collects and normalizes logs from many sources, correlates them, and generates alerts, giving analysts a centralized view for detection and investigation.

Security orchestration, automation, and response coordinates tools and runs scripted playbooks to handle repetitive triage and containment steps, reducing analyst workload and response time.

Endpoint detection and response continuously records process, file, and network activity on hosts, enabling behavioral detection, threat hunting, and remote containment of compromised machines.

Observable evidence that a system has been breached, such as malicious file hashes, suspicious domains, unusual registry keys, or known attacker IP addresses used for detection and hunting.

A behavioral signal that malicious activity is underway or imminent, such as unusual privilege escalation attempts or abnormal authentication patterns, focused on intent rather than known artifacts.

A proactive, hypothesis-driven search through telemetry for undetected adversary activity, rather than waiting for automated alerts, often guided by threat intelligence and attacker tactics.

A public knowledge base of adversary tactics, techniques, and procedures observed in real intrusions, used to structure detection coverage, threat hunting, and red team scenarios.

An attacker technique that abuses legitimate built-in tools such as PowerShell, WMI, or certutil to execute actions, blending into normal administration and evading signature-based detection.

A documented, repeatable set of steps for handling a specific incident type, defining roles, decision points, and escalation paths so response is consistent and fast under pressure.

The structured phases of handling a security event: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned, each with defined activities and outputs.

A documented, unbroken record of who handled evidence, when, and how, from collection through storage and analysis, preserving its admissibility and integrity in investigations.

The priority sequence for collecting evidence, starting with the most perishable data such as memory and network connections, before slower-changing disk or archival data is captured.

Creating a bit-for-bit copy of a storage device or memory region using write-blocking, then verifying it with a hash so analysis occurs on a copy and the original stays untouched.

Automated probing of systems and applications against known weakness signatures and configuration checks, producing a prioritized inventory of findings for remediation tracking.

The Common Vulnerability Scoring System rates severity from 0 to 10 using exploitability and impact metrics, helping teams prioritize which vulnerabilities to fix first.

A Common Vulnerabilities and Exposures identifier is a unique public reference number assigned to a specific disclosed vulnerability, enabling consistent cross-tool tracking and lookup.

The disciplined process of identifying, testing, deploying, and verifying software updates that close known vulnerabilities, balancing timely remediation against operational stability risk.

A finding or alert that incorrectly reports a problem where none exists, wasting remediation effort and eroding trust in detection tooling if not tuned out.

An authorized, simulated attack against defined scope and rules of engagement that chains real weaknesses to demonstrate business impact, unlike a broad automated scan.

A goal-oriented adversarial team that emulates realistic threat actors over an extended engagement, testing people, process, and technology together rather than isolated technical flaws.

A structured analysis performed during design that identifies assets, entry points, likely threats, and mitigations, so security requirements are built in before code ships.

A threat classification scheme covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, used to systematically enumerate design threats.

A one-way function that maps data to a fixed-length digest; it verifies integrity because any change to input produces a different output, but it does not provide confidentiality.

A cryptographic value created with a private key over a message hash, letting anyone with the public key verify origin and integrity and supporting non-repudiation.

The policies, certificate authorities, and registration processes that issue, distribute, validate, and revoke digital certificates, binding public keys to verified identities.

Requiring two or more independent credential types - knowledge, possession, or inherence - so a stolen password alone is insufficient to authenticate, with phishing-resistant factors preferred.

An access model where permissions are assigned to roles and users inherit them through role membership, simplifying administration and supporting least privilege at scale.

Federation lets separate organizations trust each other's identity assertions, while single sign-on lets one authentication session reach many applications, reducing credential sprawl and password fatigue.

The likelihood and impact of a threat exploiting a vulnerability, often expressed qualitatively or quantitatively, and the basis for deciding which treatments to fund.

Choosing how to handle assessed risk: mitigate with controls, transfer via insurance or contract, avoid the activity, or accept it with documented management sign-off.

An assessment identifying critical business functions, their dependencies, and tolerable downtime, producing recovery time and recovery point objectives that drive continuity planning.

A controlled process for requesting, reviewing, approving, testing, and recording changes to systems, preventing unplanned outages and preserving an auditable configuration history.

A documented, approved reference state for system settings and software versions, used to detect drift, enforce hardening standards, and support repeatable audits.