ISACA CSX Fundamentals key terms

The three core security objectives: confidentiality keeps data from unauthorized disclosure, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed.

The assurance that a party cannot credibly deny having performed an action, such as sending a message or approving a transaction, typically supported by digital signatures and reliable audit logs.

Any circumstance or actor with the potential to exploit a vulnerability and cause harm to an asset, such as a malicious insider, malware, or a natural disaster.

A weakness in a system, process, or control that a threat could exploit, such as an unpatched application, a misconfiguration, or a missing policy.

The likelihood that a threat will exploit a vulnerability and the resulting business impact, usually assessed as a combination of probability and consequence.

The process of identifying assets and threats, estimating likelihood and impact, and prioritizing risks so that limited security resources are directed where they reduce exposure most.

Selecting and applying a response to an assessed risk: mitigate it with controls, transfer it (for example via insurance), avoid the activity, or knowingly accept the residual risk.

The risk that remains after controls have been implemented, which management must formally accept because no control set eliminates all exposure.

A layered control strategy in which preventive, detective, and corrective safeguards are stacked so that failure of any single control does not lead to full compromise.

The principle that users, processes, and services receive only the access rights required to perform their assigned tasks, and no more, for no longer than necessary.

Dividing sensitive tasks among different people so that no single individual can both initiate and approve a critical action, reducing fraud and error risk.

The process of verifying that a claimed identity is genuine, commonly through something the user knows, has, or is, or through a combination of these factors.

The process of determining what an authenticated subject is permitted to do, enforced through access control models, roles, and policy rules.

Authentication that requires two or more independent credential types, such as a password plus a one-time code, so that a stolen password alone is insufficient for access.

An access control model that grants permissions to roles rather than individuals, and assigns users to roles based on their job responsibilities.

The mathematical transformation of readable data into ciphertext using a key, so that only parties holding the correct key can recover the original information.

Encryption in which the same secret key is used to encrypt and decrypt data, offering speed suitable for bulk data but requiring secure key distribution.

Encryption using a mathematically related key pair, where the public key encrypts or verifies and the private key decrypts or signs, solving key distribution problems.

A one-way function that converts input of any length into a fixed-length digest, used to verify integrity because any change to the input produces a different digest.

A cryptographic value created with a sender's private key that lets a recipient verify the signer's identity and confirm the data has not been altered.

The policies, processes, and certificate authorities that issue, distribute, validate, and revoke digital certificates binding public keys to verified identities.

A network security device or software that inspects traffic against a rule set and permits or blocks packets to segment networks and enforce access policy.

A monitoring tool that inspects network or host activity for known attack signatures or anomalies and raises alerts, but does not itself block the traffic.

An inline monitoring tool that detects malicious traffic and actively blocks or drops it in real time, unlike a purely alerting detection system.

A platform that collects and correlates logs and events from many sources, generates alerts, and supports investigation and compliance reporting.

Dividing a network into isolated zones with controlled traffic between them, limiting how far an attacker can move after compromising a single host.

Software written to cause harm or unauthorized action, including viruses, worms, trojans, ransomware, and spyware, often delivered through phishing or malicious downloads.

Malicious software that encrypts or steals data and demands payment for restoration or non-disclosure, a leading cause of disruptive organizational outages.

A social engineering attack that impersonates a trusted party through email, messages, or calls to trick recipients into revealing credentials or running malicious content.

Manipulating people through deception, urgency, or authority to obtain information or access, exploiting human trust rather than technical flaws.

An attack that exhausts a system's resources or floods its network so that legitimate users cannot access the service, threatening availability.

The disciplined process of identifying, testing, and deploying software updates to close known vulnerabilities before attackers can exploit them.

Automated inspection of systems and applications for known weaknesses, missing patches, and misconfigurations, producing findings that feed remediation prioritization.

Authorized, goal-directed simulated attacks that exploit vulnerabilities to demonstrate real business impact, going beyond the detection focus of scanning.

The structured process of preparing for, detecting, containing, eradicating, and recovering from security incidents, followed by lessons learned to improve future readiness.

Documented arrangements for keeping critical business functions running during and after disruption, covering alternate sites, manual workarounds, and recovery priorities.

A plan focused on restoring IT infrastructure, data, and applications after a major outage, including recovery objectives and backup restoration procedures.

A copy of data stored separately from the original so it can be restored after loss, corruption, or ransomware, ideally following the 3-2-1 rule and tested regularly.

A management-approved statement of mandatory rules and expectations for protecting information, forming the basis from which standards, procedures, and guidelines are derived.