IBM Cybersecurity Analyst key terms

The three core security goals: confidentiality keeps data from unauthorized disclosure, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed.

A principle stating that users, processes, and services receive only the minimum access rights required to perform their tasks, limiting the damage from mistakes or compromised accounts.

A layered security strategy that stacks independent controls across people, networks, hosts, applications, and data so that failure of one layer does not expose the whole environment.

A security model that removes implicit trust based on network location and instead verifies every user, device, and request continuously before granting access to resources.

A person or group with the intent and capability to attack systems, such as nation-states, organized crime, hacktivists, insiders, or script kiddies, each with different motives and resources.

A well-resourced attacker, often state-sponsored, that maintains covert access to a target network over a long period to steal data or disrupt operations rather than seeking quick profit.

The total set of points where an attacker could try to enter or extract data from a system, including exposed services, applications, user accounts, and physical access paths.

Observable artifacts such as malicious file hashes, IP addresses, domain names, or registry keys that suggest a system has been breached and support detection and hunting.

A social engineering attack that tricks recipients into revealing credentials or running malware by impersonating a trusted party through email, messages, or fake login pages.

A targeted phishing message crafted for a specific person or team using researched details, making it far more convincing than bulk phishing and harder for filters to catch.

Manipulating people through deception, urgency, or authority to obtain information or actions, exploiting human trust rather than technical flaws in systems.

Malware that encrypts or steals data and demands payment for restoration or non-disclosure, often spreading laterally and disrupting backups to increase pressure on victims.

Any software written to harm or gain unauthorized access to a system, including viruses, worms, trojans, spyware, and ransomware, each with distinct propagation and payload behavior.

A network device or software filter that permits or blocks traffic between zones based on rules covering addresses, ports, protocols, and sometimes application content.

A monitoring tool that inspects network or host activity for known attack signatures or suspicious behavior and raises alerts, but typically does not block traffic itself.

An inline security control that inspects traffic and actively blocks or drops activity matching attack patterns, sitting in the traffic path so it can stop threats in real time.

Dividing a network into isolated zones with controlled inter-zone traffic, which limits lateral movement by attackers and reduces the blast radius of a compromise.

A buffer network zone holding internet-facing services such as web servers, separated from the internal network so that compromising a public host does not grant direct internal access.

A virtual private network creates an encrypted tunnel over an untrusted network, letting remote users or sites reach private resources while protecting traffic from interception.

Requiring two or more independent evidence types, such as a password plus a hardware token or biometric, so a stolen password alone cannot grant access.

An access model that assigns permissions to job roles rather than individuals, so users inherit rights through role membership, simplifying administration and audit.

An attack or misconfiguration that gives a user or process more rights than intended, either by exploiting a flaw or by abusing excessive permissions already granted.

The process of tracking, testing, and deploying software updates that fix known flaws, reducing the window in which attackers can exploit publicly disclosed vulnerabilities.

A weakness in software, configuration, or process that an attacker could exploit to compromise confidentiality, integrity, or availability of a system or its data.

The Common Vulnerability Scoring System provides a standardized 0 to 10 severity score reflecting exploitability and impact, helping teams prioritize remediation across many findings.

An automated assessment that probes systems and compares findings against known vulnerability databases, producing a list of weaknesses to validate and remediate.

An authorized, goal-driven simulated attack that exploits weaknesses to demonstrate real business impact, going beyond a scan by chaining findings and validating exploitability.

A written agreement defining scope, timing, allowed techniques, contacts, and escalation paths for a security test, protecting both the tester and the target organization.

A documented set of roles, steps, and communications for detecting, containing, eradicating, and recovering from security incidents, prepared before an event occurs.

The incident response phase that stops an attack from spreading, for example by isolating a host, disabling an account, or blocking a malicious address.

A documented, unbroken record of who handled evidence, when, and how, required to show that digital evidence was not altered and remains admissible.

Creating a bit-for-bit verified copy of a storage device so investigators can analyze the duplicate while preserving the original as untampered evidence.

A forensic guideline for collecting the most perishable evidence first, such as memory and network connections, before more persistent data like disk contents.

Security information and event management software collects logs from many sources, correlates them, and generates alerts, giving analysts a centralized view of activity.

Policies and storage that keep system and security logs for a defined period, supporting investigations, compliance obligations, and detection of slow, long-running intrusions.

Agent software on hosts that continuously records process, file, and network behavior, detects malicious patterns, and enables remote investigation and containment.

Reducing a system's exposure by removing unnecessary services and accounts, applying secure configuration baselines, and tightening permissions before deployment.

Protecting stored data by converting it into unreadable form with a key, so stolen disks, backups, or database files cannot be read without decryption.

Protecting data moving across networks using protocols such as TLS, preventing eavesdroppers from reading or silently altering traffic between systems.

Labeling information by sensitivity and business value, such as public, internal, confidential, or restricted, which then determines handling, access, and protection requirements.

A cloud principle dividing security duties between provider and customer, with the provider securing the underlying infrastructure and the customer securing data, identities, and configurations.

A widely referenced list of the most critical web application security risks, used to guide secure coding, testing, and awareness training for developers.

The assurance that a party cannot credibly deny having performed an action, typically supported by digital signatures and tamper-evident audit logs.