ECF-GSF Core key terms

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed in measurable terms so that treatment decisions can be judged against a stated threshold.

The process of selecting and applying options to modify risk: avoid the activity, reduce likelihood or impact through controls, transfer it (for example by insurance), or consciously retain it.

The risk that remains after controls have been applied and measured against the risk appetite. It must be documented and accepted by an accountable owner, not assumed to be zero.

The level of risk that exists before any mitigating controls are considered. Comparing it with residual risk shows how much protection the current control set actually delivers.

Layering independent controls across people, process and technology so that a single failure does not lead to compromise. Layers commonly span perimeter, network, host, application, data and monitoring.

A person or group with the intent and capability to exploit a vulnerability, ranging from opportunistic criminals and insiders to state-sponsored groups and hacktivists. Motivation shapes the techniques they favour.

The sum of all exposed points where an unauthorised party could attempt entry or extract data: internet-facing services, endpoints, identities, APIs, supply chain links and physical access.

An architecture principle that removes implicit trust based on network location. Every request is authenticated, authorised and continuously evaluated against policy before access to a resource is granted.

Dividing a network into small zones with tightly scoped allow rules so that lateral movement between workloads is limited. Policies are usually tied to workload identity rather than IP subnets alone.

A demilitarised zone is a segmented network holding services exposed to untrusted networks, isolated from internal systems by filtering devices so that a compromise of a public service does not grant internal access.

A filtering device that tracks connection state, allowing return traffic for sessions it has already permitted. It evaluates packets against a session table rather than judging each packet in isolation.

A proxy or inline device that inspects HTTP traffic and blocks requests matching attack patterns such as injection or cross-site scripting. It complements, but does not replace, secure coding.

Granting an identity or process only the permissions needed for its current task, for the shortest time required. It limits the blast radius of credential theft and accidental error.

An access model where permissions are attached to job roles and users are assigned to roles, simplifying administration. Role explosion and stale assignments are the main risks to manage.

A model that decides access from attributes of the subject, resource, action and environment, evaluated against policy. It supports fine-grained, context-aware rules such as time or device posture.

Elevated permissions granted on request for a limited window and revoked automatically, often with approval and session logging. It reduces standing privilege while keeping operations workable.

Controls for accounts with elevated rights: credential vaulting, session brokering, approval workflows and recording. The goal is to stop administrative credentials from becoming an attacker's shortest path.

Authentication requiring evidence from at least two different categories: something you know, have, or are. Phishing-resistant factors such as hardware security keys resist real-time relay attacks better than codes.

A standard for public-key authentication using authenticators such as security keys or platform biometrics. The private key never leaves the device, and the credential is bound to the origin, defeating relay phishing.

A mechanism where one authentication event grants access to multiple applications, typically via federation protocols. It improves usability but concentrates risk in the primary identity provider.

A signed XML statement from an identity provider about a subject's authentication and attributes, consumed by a service provider. Signature validation and audience restriction checks are essential to prevent forgery and replay.

Assigning labels such as public, internal, confidential or restricted to information so that handling, retention and protection rules follow the label rather than individual judgement.

Tools and policies that detect and block unauthorised movement of sensitive data across email, web, endpoints and cloud. Effective deployment depends on accurate classification and tuned rules.

Collecting and retaining only the personal data necessary for a stated purpose, and deleting it when no longer needed. It reduces both breach impact and regulatory exposure.

A documented rule set defining how long each data category is kept, where it is stored, and how it is destroyed. It balances legal obligations against the risk of holding data too long.

Replacing sensitive values with non-sensitive substitutes mapped back through a protected vault. Unlike encryption, the token itself carries no mathematical relationship to the original value.

Encryption where the same secret key both encrypts and decrypts, using algorithms such as AES. It is fast and suits bulk data, but key distribution and rotation must be solved.

Encryption using a key pair: a public key to encrypt or verify and a private key to decrypt or sign. It solves key distribution and underpins digital signatures and key exchange.

A value produced by hashing a message and encrypting the hash with a private key. Verification with the public key proves integrity and origin, and provides non-repudiation.

A one-way function mapping input of any length to a fixed-length digest. Good cryptographic hashes are collision-resistant and preimage-resistant; they are used for integrity checks and password storage with salting.

A unique random value added to each password before hashing so identical passwords produce different digests. It defeats precomputed rainbow tables and forces attackers to work per account.

The lifecycle controls for cryptographic keys: generation, distribution, storage, rotation, escrow and destruction. Weak key handling usually defeats strong algorithms.

The policies, roles and systems that issue, validate and revoke digital certificates, binding public keys to identities through a trusted certificate authority.

Checking that data entering an application matches expected type, length, format and range, performed server-side. It is the primary defence against injection and malformed-input attacks.

A tool that inventories third-party and open-source components in a build and flags known vulnerabilities and licence issues. It addresses supply chain risk that teams did not write themselves.

Embedding security activities into requirements, design, coding, testing and release: threat modelling, code review, security testing and dependency checks, with defined gates before deployment.

The division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure; the customer secures data, identities, configuration and access.

A control point between users and cloud services that enforces policy on data movement, device posture and application use. It provides visibility and blocking for sanctioned and unsanctioned SaaS.

Agent-based tooling that continuously records endpoint activity, detects suspicious behaviour and supports response actions such as isolation or process termination, with centralised investigation timelines.

Security information and event management: a platform that collects and correlates logs from many sources, generates alerts and supports investigation and compliance reporting.

Observable evidence suggesting a breach, such as a known malicious hash, domain or registry key. Indicators are reactive and short-lived compared with behavioural detection.

Assurance that audit records are complete, time-synchronised and tamper-evident, typically through centralised collection, hashing or write-once storage. Investigations and legal proceedings depend on it.

The documented, unbroken record of who handled evidence, when and why, from collection to presentation. Gaps can render digital evidence inadmissible or worthless in disciplinary and legal processes.

Documented procedures for keeping critical services running during disruption, including alternate sites, staffing and manual workarounds. It focuses on availability rather than restoring IT systems alone.

The technical plan for restoring systems and data after a major failure, defining backups, restore order and infrastructure rebuild steps. It is measured against recovery objectives.

The maximum acceptable duration of service interruption for a process or system. It drives architecture choices such as redundancy and backup frequency.

The maximum acceptable amount of data loss measured in time, setting how often backups or replication must occur. It is independent of how quickly service is restored.

A structured review of a processing activity likely to create high privacy risk, documenting necessity, risks and mitigations before work begins. It is a legal expectation in many privacy regimes.

Building privacy protections into systems and processes from the outset rather than retrofitting them, including default settings that limit collection and exposure.

A request from an individual to see the personal data held about them and related processing details. Organisations must verify identity and respond within statutory deadlines.

The reasonable steps an organisation is expected to take to protect assets and comply with obligations. It is judged against what a prudent peer would do in similar circumstances.

The ongoing investigation and verification of risks, third parties and controls before and during a relationship or decision, feeding evidence into governance and risk decisions.

Structured education that builds staff recognition of threats such as phishing and teaches reporting and safe handling of data. Effectiveness is measured by behaviour, not completion rates.

Sending realistic but harmless lure messages to measure and improve reporting and resistance. Results should drive coaching and process fixes rather than punishment.

A documented set of roles, escalation paths and phases for detecting, containing, eradicating and recovering from security incidents, with lessons-learned review after closure.