CASSPT key terms

A structured method of finding security weaknesses by mapping how data moves through a system, identifying where an attacker could act, and choosing controls before code is written.

The total set of entry points, interfaces, credentials, and services an adversary could use to reach or influence a system, including network, human, and supply chain paths.

A weakness in code, configuration, process, or design that a threat actor could use to cause harm; it becomes a risk only when a credible threat can reach it.

Concrete code, tooling, or technique that takes advantage of a vulnerability to achieve an attacker objective such as code execution, data access, or denial of service.

A published scoring framework that rates vulnerability severity from 0 to 10 using metrics for exploitability, impact, and environmental conditions, helping teams triage remediation order.

A unique public identifier assigned to a specific disclosed vulnerability, enabling vendors, scanners, and advisories to reference the same flaw unambiguously.

A vulnerability for which no vendor fix exists yet, so defenders cannot patch and must rely on compensating controls, detection, and reduced exposure until a remedy ships.

A threat categorization scheme grouping threats into spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, used to prompt systematic threat analysis.

Evidence-based information about adversaries, their tools, and their intent, collected and analyzed to inform defensive prioritization; it ranges from strategic reports to machine-readable indicators.

An observable artifact such as a file hash, domain, IP address, or registry key that suggests malicious activity has occurred and can be used for detection or blocking.

A curated knowledge base of real-world adversary tactics and techniques organized by goal, used to map detections, assess coverage gaps, and describe attacker behavior consistently.

Authorized, goal-driven simulated attack against agreed targets and rules of engagement, intended to demonstrate exploitable weaknesses and validate whether existing controls actually work.

Layering independent preventive, detective, and corrective controls so that failure of any single control does not expose the whole system to compromise.

An architecture principle that grants no implicit trust based on network location; every request is authenticated, authorized, and continuously evaluated using least privilege and explicit policy.

Granting each user, service, or process only the permissions required to perform its function, for only as long as needed, limiting the blast radius of misuse or compromise.

Dividing a network or environment into isolated zones with controlled inter-zone traffic, so a compromised host cannot freely reach sensitive systems or data.

An authorization model that assigns permissions to roles rather than individuals, and grants users roles; simplifies administration and supports consistent least-privilege enforcement.

Controls that secure high-impact accounts through vaulting, session recording, just-in-time elevation, and credential rotation, reducing the risk posed by stolen administrator credentials.

A trusted service that authenticates users and issues assertions or tokens about identity, enabling centralized sign-in, federation, and consistent policy across applications.

An authentication arrangement where one successful login grants access to multiple applications through trust between the identity provider and each relying service, reducing credential sprawl.

Requiring two or more independent evidence types, such as a password plus a hardware key, so a stolen password alone is insufficient to authenticate.

Authentication methods bound to the legitimate service origin, such as FIDO2 hardware keys or passkeys, that do not release usable secrets to lookalike sites.

A repeatable process for inventorying software, assessing updates, testing, deploying fixes on a risk-based timeline, and verifying installation across the estate.

A documented, approved set of settings for a system or platform that serves as the reference for deployment, comparison, and drift detection.

Reducing a system's exposure by disabling unneeded services, removing default accounts, restricting permissions, and applying vendor or benchmark guidance before the system goes live.

Managing servers, networks, and cloud resources through version-controlled definition files so environments are reproducible, reviewable, and consistently configured.

Protecting the automated build and deployment chain through code review, dependency scanning, secret management, artifact signing, and tightly scoped pipeline credentials.

The people, components, and processes that produce and deliver software, including third-party libraries and build systems, all of which can introduce compromise before deployment.

A machine-readable inventory of the components and dependencies in a software product, used to assess exposure when a new vulnerability is announced.

Storing and distributing credentials, keys, and tokens in a dedicated protected store with access control, rotation, and auditing, instead of embedding them in code or configuration files.

Transforming readable data into ciphertext using a key so that only holders of the correct key can recover the original content, protecting confidentiality at rest or in transit.

The lifecycle discipline for cryptographic keys: generation, distribution, storage, rotation, revocation, and destruction, with separation of duties and auditability.

A platform that centralizes logs from many sources, correlates events against rules and analytics, and raises alerts, forming the collection and triage backbone of a security operations center.

The disciplined creation, testing, and maintenance of detection logic mapped to adversary behaviors, with documented intent, known blind spots, and version control.

Adjusting detection thresholds, logic, and suppression so alerts are accurate and actionable, reducing false positives that cause analyst fatigue and missed real incidents.

Proactive, hypothesis-driven searching through telemetry for adversary activity that existing detections did not catch, with findings fed back into detection improvements.

A documented set of roles, communication paths, and phased procedures for preparing, detecting, containing, eradicating, recovering from, and learning from security incidents.

The incident response phase that limits spread and damage, for example by isolating a host, disabling an account, or blocking traffic, while preserving evidence for investigation.

Capturing and handling digital artifacts with documented chain of custody, hashing, and write-blocking so findings remain defensible in investigations or legal proceedings.

The combination of the likelihood that a threat exploits a weakness and the resulting impact, usually expressed qualitatively or quantitatively to prioritize treatment decisions.

A maintained record of identified risks, each with an owner, likelihood and impact rating, chosen treatment, and review date, used to track and report exposure over time.

Selecting how to handle a risk: mitigate with controls, transfer via insurance or contract, avoid the activity, or formally accept the residual exposure with accountable sign-off.

The exposure that remains after controls are applied, which management must knowingly accept or reduce further against the organization's stated tolerance.

The amount and type of risk leadership is willing to pursue or retain in service of objectives, providing the threshold against which treatment decisions are judged.

An alternative safeguard used when a primary control cannot be implemented, such as extra monitoring when a legacy system cannot be patched, documented with its own residual risk.

Assigning labels such as public, internal, confidential, or restricted to information so handling, access, and protection requirements are clear and consistently applied.

Assessing and monitoring the security posture of vendors and partners through due diligence, contractual security terms, and ongoing review, since their weaknesses become your exposure.

Preparing documented strategies and resources so critical operations keep running or are restored within agreed timeframes during disruption, including cyber incidents.