CC key terms

A model describing information security through three goals: confidentiality keeps data secret from unauthorized people, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users whenever they need it.

The principle that every user, process, or system should receive only the minimum access rights needed to do its job, and only for as long as those duties last.

A layered approach that combines multiple independent safeguards, such as physical, technical, and administrative controls, so that if one layer fails, another still protects the asset.

A safeguard or countermeasure, whether administrative, technical, or physical, that reduces risk by preventing, detecting, or correcting weaknesses and attacks; controls are commonly grouped as preventive, detective, or corrective.

The possibility that a threat will exploit a weakness and cause harm, usually judged by combining how likely an event is with how much damage it would do to the organization.

Any person, group, event, or circumstance with the potential to exploit a weakness and cause harm, such as a malicious attacker, a natural disaster, or a coding error.

A weakness or flaw in a system, process, or control that a threat could take advantage of, such as an unpatched application, a misconfiguration, or an untrained employee.

The assurance that a party cannot credibly deny having performed an action, typically achieved through digital signatures, reliable timestamps, and records that show who did what and when.

A security model that trusts no user or device by default, even inside the corporate network, and instead verifies identity, device health, and context continuously before each access decision.

A high-level management statement that sets the organization's security goals, expectations, and mandatory rules, and provides the framework within which standards, procedures, and guidelines are written.

A mandatory, specific requirement that supports a policy, such as a rule that all laptops use full-disk encryption or that passwords meet a defined length and complexity.

A detailed, step-by-step set of instructions describing how to perform a task or comply with a policy or standard, so staff carry out the activity consistently and correctly.

A document stating the rules for how employees may use organizational systems, networks, and data, including prohibited activities, expected behavior, and consequences for violations.

The process of identifying assets and threats, estimating how likely and how damaging harmful events would be, and judging which risks must be treated first.

A study that identifies critical business functions and the effects of disrupting them over time, used to set recovery priorities and recovery time and recovery point objectives.

A documented set of arrangements that helps an organization keep essential operations running during a disruption and return to normal service afterwards, covering people, processes, and facilities.

The act of a user claiming an identity to a system, for example by entering a username, email address, or ID number, before the system can check whether that claim is true.

The process of verifying that a claimed identity is genuine, typically by checking something the user knows, something the user has, or something the user is.

The process of deciding which resources and actions an authenticated identity may use, based on access rules, roles, or policies set by the organization.

An authentication method requiring two or more independent kinds of evidence, drawn from knowledge, possession, or inherence, so that stealing a single factor is not enough to impersonate someone.

A mechanism that lets a user authenticate once and then reach many applications without logging in again, improving convenience while concentrating the need to protect that primary credential.

An access model that assigns permissions to roles reflecting job duties rather than to individuals, so people receive the rights their role needs and access changes are easier to manage.

The practices and tools used to control, monitor, and record the use of powerful accounts, such as administrator or root accounts, reducing the risk that high-impact access is misused or stolen.

A device or software that inspects network traffic and permits or blocks it according to defined rules, forming a barrier between trusted and untrusted networks or between internal segments.

A separate network segment between an organization's internal network and the internet that hosts systems needing outside access, limiting the damage if those exposed systems are compromised.

An encrypted tunnel carried over an untrusted network that lets remote users or sites communicate as though connected to a private network, protecting data while it travels.

The practice of splitting a network into smaller isolated zones so that a compromise in one area cannot spread freely and traffic between zones can be controlled and monitored.

A monitoring tool that watches network or host activity for suspicious patterns and raises alerts for administrators, without itself blocking the traffic it observes.

A monitoring tool placed in the traffic path that spots suspicious activity and can actively block or drop it, in addition to generating alerts for administrators.

Protecting data while it moves across networks by converting it into ciphertext, commonly with TLS for web traffic, so eavesdroppers cannot read or silently alter it.

A cloud framework that divides security duties between provider and customer: the provider secures the underlying infrastructure, while the customer secures data, configurations, identities, and access choices.

A documented set of roles, steps, and contacts for detecting, containing, eradicating, and recovering from security incidents, and for reviewing lessons afterwards.

A platform that collects and correlates log and event data from many sources, raises alerts about suspicious activity, and supports investigation and compliance reporting.

Software written to cause harm or unwanted behavior, including viruses, worms, ransomware, spyware, and trojans, which may steal data, disrupt systems, or hand control to attackers.

A social engineering attack that sends fraudulent messages appearing to come from a trusted source, tricking recipients into revealing credentials, clicking malicious links, or opening harmful attachments.

Manipulating people through deception and psychological pressure, by phone, email, or in person, to make them disclose information or take actions that weaken security.

An automated process that probes systems and applications for known weaknesses, misconfigurations, and missing updates, producing findings used to prioritize remediation work.

A repeatable process for identifying, testing, deploying, and verifying software updates that fix security flaws, so known weaknesses are closed before attackers can exploit them.

A documented record of who collected, handled, and stored evidence and when, so its integrity can be demonstrated and it remains usable in legal or disciplinary proceedings.