ECF Cybersecurity (Core) key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in measurable terms. It guides how much security investment is justified and when risk must be reduced, transferred, or avoided.

The risk that remains after controls and mitigations have been applied. It is compared against risk appetite to decide whether further treatment is required or the exposure can be formally accepted.

The level of risk that exists before any controls are applied. Comparing inherent and residual risk shows how much protection a control set actually provides and helps justify security spending.

A living record listing identified risks with owners, likelihood, impact, current controls, treatment plans, and review dates. It is the operational tool used to track and report risk decisions over time.

The process of choosing how to respond to an identified risk: mitigate it with controls, transfer it (for example via insurance), avoid the activity, or accept it. Each option carries cost and ownership implications.

Layering multiple independent controls across people, process, and technology so that failure of one layer does not expose the whole environment. Attackers must then defeat several different barriers rather than a single point.

Granting each user, service, or process only the permissions needed to perform its function, and no more. It limits the blast radius of a compromised account and simplifies access review.

Splitting a sensitive task across two or more people so no single individual can complete a high-risk action alone, such as both creating a vendor and approving its payment. It reduces fraud and error risk.

An access model where permissions are assigned to roles and users receive access by being placed in roles. It scales better than per-user permissions and makes entitlement reviews easier to audit.

An access model that evaluates attributes of the user, resource, action, and environment (such as department, data classification, time, or device health) to make context-aware authorization decisions. It supports finer granularity than static roles.

Controls that secure accounts with elevated rights, including vaulting credentials, session recording, just-in-time elevation, and approval workflows. These accounts are high-value targets because compromise yields broad control.

Authentication requiring two or more different factor types, such as something you know plus something you have. It blocks most credential-only attacks but is weaker against real-time phishing unless phishing-resistant factors are used.

Authentication methods bound to the legitimate site's origin, such as FIDO2 security keys or passkeys, so credentials cannot be replayed on a lookalike page. These resist adversary-in-the-middle phishing that defeats OTP codes.

Trusting an external identity provider to authenticate users so they can access services using one set of credentials. Standards such as SAML and OpenID Connect carry identity assertions across organizational boundaries.

A session mechanism letting a user authenticate once and reach multiple applications without re-entering credentials. It improves usability but concentrates risk, so the identity provider needs strong protection and monitoring.

A security model that treats no network location as inherently trusted and verifies every request based on identity, device posture, and context. It replaces perimeter assumptions with continuous, explicit authorization.

Dividing a network into zones with enforced traffic controls between them, so compromise in one area cannot spread freely. It limits lateral movement and protects sensitive systems such as payment or health data stores.

A device or software that permits or denies network traffic according to rules based on addresses, ports, protocols, or application identity. Next-generation firewalls add application awareness and intrusion prevention capabilities.

A monitoring system that inspects traffic or host activity and raises alerts on suspicious patterns. A network IDS watches traffic at a tap point, while a host IDS watches processes and files on a single machine.

Blocking or redirecting resolution of domains associated with malware, phishing, or policy violations. It stops many attacks early because malicious tooling frequently depends on resolving command-and-control or payload domains.

Agent software that continuously records endpoint process, file, and network activity, detects malicious behavior, and supports response actions such as isolating a host or killing a process. It provides investigation telemetry beyond antivirus signatures.

The process of identifying, testing, deploying, and verifying software updates that fix vulnerabilities. Prioritizing by exploitability and exposure, with defined remediation windows, reduces the window attackers can exploit known flaws.

A control permitting only approved executables or scripts to run, blocking everything else by default. It defeats many malware families that rely on unapproved binaries, though it requires ongoing maintenance of the approved list.

A documented, approved set of settings for systems such as operating systems or databases, derived from hardening standards. Deviations are detected through configuration monitoring so drift does not silently weaken security.

Protecting stored data, such as databases, disks, or backups, by converting it to ciphertext with a key. It defends against physical theft and unauthorized storage access but not against misuse by an authorized application.

Protecting data while it moves between systems using protocols such as TLS, so interception on the network does not reveal content. It also provides integrity checks that reveal tampering in transit.

The lifecycle practices for cryptographic keys: generation, distribution, storage, rotation, and destruction, often using a hardware security module. Weak key handling undermines encryption even when strong algorithms are chosen.

A cryptographic value created with a private key that lets anyone verify the signer's identity and confirm the data was not altered. It provides authenticity and integrity, and supports non-repudiation when keys are properly controlled.

Producing a fixed-length value from data so any change to the input yields a different output. Hashes verify integrity and store password verifiers, but are not encryption because the process is not meant to be reversed.

Storing passwords as slow hashes with a unique random salt per user, using algorithms designed for the purpose. Salts prevent precomputed table attacks and per-user uniqueness stops identical passwords from hashing alike.

A platform that centralizes logs from many sources, correlates events against detection rules, and alerts analysts. Modern deployments increasingly add user and entity behavior analytics to spot anomalies beyond static rules.

A documented approach defining roles, severity levels, communication paths, and steps for preparation, detection, containment, eradication, recovery, and lessons learned. It is exercised through tabletop and simulation drills.

The incident response phase that stops the spread of an intrusion, for example by isolating hosts, disabling accounts, or blocking network paths. It balances limiting damage against preserving evidence for investigation.

Documentation recording who collected, handled, and stored evidence, and when, so its integrity can be shown in legal or disciplinary proceedings. Gaps or undocumented access can render evidence unusable.

Observable artifacts suggesting a system may be compromised, such as malicious file hashes, command-and-control domains, or unusual registry keys. They are easy to share but age quickly as attackers change infrastructure.

Evidence of adversary behavior and intent, such as unusual privilege escalation or lateral movement patterns, rather than static artifacts. They are harder to evade than indicators of compromise because they describe techniques.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, organized by goal. Defenders use it to map detections, identify coverage gaps, and prioritize threat-informed improvements.

Information about threat actors, their capabilities, and campaigns, processed into context that supports decisions. Strategic intelligence informs leadership, while tactical feeds support detection and blocking at machine speed.

A continuous cycle of discovering assets, scanning for weaknesses, prioritizing by risk and exploitability, remediating, and verifying. Prioritization matters because most environments cannot patch everything at once.

Code or a technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining code execution or reading protected data. A working exploit raises the practical urgency of a vulnerability.

Assigning labels such as public, internal, confidential, or restricted to information based on sensitivity and legal obligations. Labels drive which handling, access, and encryption controls apply to each dataset.

Defined periods for keeping records, after which they are securely destroyed unless a legal hold applies. Keeping data longer than needed increases breach impact and can breach privacy commitments.

A structured review of how a project or system collects, uses, shares, and protects personal data, identifying privacy risks and required mitigations before launch. It documents accountability and supports regulatory obligations.

Assessing and monitoring the security posture of vendors and suppliers who access data or systems, using questionnaires, contractual security clauses, and periodic review. It addresses risk that enters through the supply chain.