ICYB key terms

A person or group that carries out or sponsors attacks, ranging from opportunistic criminals to nation-states. Their motivation, funding, and skill shape the techniques and targets they choose.

The total set of points where an adversary could try to enter or extract data from a system, including exposed services, user accounts, APIs, and supply chain links. Reducing it lowers the number of paths defenders must watch.

Observable artifacts such as malicious file hashes, IP addresses, domains, or registry keys that suggest a system has been breached. They support detection and hunting but age quickly as attackers change infrastructure.

Evidence-based information about existing or emerging threats, gathered from internal telemetry, vendors, and information-sharing groups. It is most useful when tailored to the organization's assets and converted into detection or prioritization decisions.

Malware that encrypts or exfiltrates data and demands payment for recovery or to prevent release. Defenses emphasize offline backups, rapid containment, and tested recovery rather than payment.

Manipulating people into revealing information or taking unsafe actions, often through phishing, pretexting, or impersonation. Controls combine awareness training with technical checks such as email authentication and callback verification.

A deceptive message that impersonates a trusted party to steal credentials, deliver malware, or trigger a fraudulent payment. Variants include spear phishing and business email compromise, which target specific roles with tailored content.

Layering independent controls so that failure of one does not expose the whole environment. Examples include network segmentation, endpoint protection, strong authentication, and monitoring working together against the same threat.

A device or software that permits or blocks traffic based on rules about addresses, ports, and protocols. Next-generation firewalls add application awareness and intrusion prevention to enforce policy beyond simple port filtering.

Dividing a network into zones with controlled traffic between them so that a compromise stays contained. Segmentation limits lateral movement and is often enforced with firewalls, VLANs, or software-defined policy.

A network segment that hosts internet-facing services while isolating them from internal systems. Traffic from the DMZ to the internal network is restricted to specific, necessary flows.

A sensor that monitors network or host activity and alerts on suspicious patterns, either by matching known signatures or by flagging deviations from normal behavior. An intrusion prevention system also blocks the traffic it detects.

An encrypted tunnel that carries traffic between a remote device or site and a trusted network. It protects data in transit but does not by itself verify device health or authorize access to individual applications.

An architecture that assumes no implicit trust based on network location and instead verifies identity, device posture, and context for every request. Access is granted per resource with least privilege and continuous evaluation.

Requiring two or more independent evidence types, such as a password plus a hardware key or authenticator code, to verify identity. It blocks most credential theft and replay attacks, especially when phishing-resistant factors are used.

A mechanism that lets a user authenticate once and access multiple applications through a trusted identity provider. It simplifies access management but concentrates risk, so the central identity system needs strong protection.

An arrangement where separate organizations or systems trust identity assertions from each other using standards such as SAML or OpenID Connect. Users authenticate with their home provider and receive access elsewhere without new credentials.

Controls that secure accounts with elevated rights, including vaulting credentials, just-in-time elevation, session recording, and approval workflows. It reduces the damage a stolen administrator account can cause.

Granting each user, service, and process only the permissions needed for its current task, for only as long as needed. It shrinks the impact of misuse, credential theft, and malware that inherits an account's rights.

An authorization model that assigns permissions to job roles and then assigns people to roles, rather than granting rights individually. It simplifies administration and audits when roles are well defined and reviewed.

Agent software that continuously records endpoint activity such as process, file, and network events, then detects and can automatically contain malicious behavior. It gives analysts investigation data that signature antivirus alone does not.

A repeatable process for identifying, testing, deploying, and verifying software updates that fix vulnerabilities. Prioritizing internet-facing and actively exploited flaws sharply reduces exposure between patch cycles.

A documented, approved set of settings for systems and applications, such as disabled services, password policy, and logging levels. Comparing live systems to the baseline reveals drift and unapproved changes.

A control that permits only explicitly approved programs to run and blocks everything else. It is highly effective against unknown malware but requires ongoing maintenance as legitimate software changes.

Protecting stored data with cryptography so that stolen disks, backups, or database files are unreadable without keys. It complements access controls but does not stop an attacker who has both data and keys.

Protecting data as it moves between systems using protocols such as TLS, so eavesdroppers on the path cannot read or alter it. It requires correct certificate validation and current protocol versions to be effective.

A cryptographic protocol that authenticates a server, sometimes a client, and encrypts the connection between them. Weak configurations, expired certificates, or ignored validation errors undermine its protections.

The policies, roles, and systems that issue, distribute, renew, and revoke digital certificates. It lets parties validate each other's identity through trusted certificate authorities.

The lifecycle practices for generating, storing, rotating, restricting, and destroying cryptographic keys. Poor key handling defeats encryption entirely, so keys are often protected in hardware security modules.

Labeling information by sensitivity and business value so that handling, access, and protection rules are consistent. Labels drive decisions about encryption, retention, sharing, and monitoring.

Tools and policies that detect and block sensitive data leaving approved boundaries, such as through email, uploads, or removable media. Effective programs depend on accurate classification and tuned rules to limit false positives.

A platform that collects and correlates logs from many sources to detect incidents and support investigations. Its value depends on complete log coverage, relevant detection rules, and analysts who triage alerts.

A documented set of roles, steps, and communication paths for detecting, containing, eradicating, and recovering from security incidents. It is validated through exercises rather than assumed to work.

A documented record of who handled evidence, when, and how, from collection through storage and analysis. Gaps can make evidence inadmissible or unusable in legal and disciplinary proceedings.

Creating a verified, bit-for-bit copy of a storage device or memory so analysis occurs without altering the original. Hashes prove the copy matches the source and support later evidentiary use.

Identifying assets and threats, then estimating likelihood and impact to rank risks against defined criteria. Results guide which treatments to fund and which to accept, transfer, or avoid.

Choosing how to respond to an assessed risk: mitigate with controls, transfer through insurance or contracts, avoid the activity, or accept it with documented approval. Each choice has cost and residual risk.

An exercise that identifies critical business functions and the harm caused by their disruption over time. Its output sets recovery objectives that shape backup and continuity investments.

The maximum acceptable amount of data loss measured in time, which determines backup frequency. It is set from business impact analysis, not from what backup tools happen to provide.

A management-approved statement of required behavior and control expectations for the organization. Supporting standards and procedures translate it into specific, auditable requirements.

A controlled process for reviewing, approving, testing, and recording changes to systems and configurations. It prevents outages and preserves an audit trail linking changes to incidents.

Embedding security activities such as threat modeling, code review, and security testing into each phase of software development. Finding flaws during design and build is far cheaper than after release.

A structured review of a design that enumerates assets, entry points, likely attackers, and mitigations before code is written. It surfaces architectural weaknesses that testing alone often misses.

Storing API keys, passwords, and certificates in a controlled vault with access control, rotation, and audit instead of embedding them in code or configuration files. It limits exposure from leaked repositories and builds.

The division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure, while the customer secures data, identities, and configuration of the services they use.

Insecure settings in cloud services, such as public storage buckets, overly broad roles, or exposed management ports. It is a leading cause of cloud breaches because defaults and rapid change invite mistakes.

A continuous cycle of discovering, prioritizing, remediating, and verifying weaknesses across assets. Prioritization weighs exploitability, exposure, and business criticality rather than raw severity scores alone.

Copies of data kept separately so it can be restored after loss, corruption, or ransomware. Reliable programs keep at least one copy offline or immutable and test restores regularly.

Rules defining how long each data type is kept and when it is securely destroyed. Retention limits legal exposure and reduces the volume of sensitive data an attacker can steal.

An email authentication policy that tells receiving servers how to handle messages failing SPF or DKIM checks and reports results to the domain owner. It reduces domain spoofing when enforced.