SSCP key terms

The core security model stating that information must be kept secret from unauthorized users (confidentiality), protected from improper modification (integrity), and available to authorized users when needed (availability).

A layered security strategy that uses multiple independent controls-such as firewalls, access controls, encryption, and monitoring-so that if one safeguard fails, others still protect the asset.

The principle of granting users and processes only the minimum access rights they need to perform their assigned tasks, reducing the damage that can result from accidents, errors, or compromised accounts.

A control that divides a sensitive task among two or more people so that no single individual can complete a fraudulent or risky action alone, such as both requesting and approving a payment.

An access restriction that limits information to individuals whose job duties specifically require it, regardless of their general clearance level or role in the organization.

The likelihood that a threat will exploit a vulnerability and cause harm to an asset, often expressed as a combination of probability and potential impact.

Any potential cause of an unwanted incident that could harm an asset, such as a malicious actor, natural disaster, software flaw, or accidental human error.

A weakness or gap in a system's design, implementation, configuration, or operation that a threat could exploit to compromise confidentiality, integrity, or availability.

The risk that remains after existing controls have been applied and accepted by management, reflecting the gap between total risk and the risk that has been mitigated.

The systematic process of identifying assets, threats, and vulnerabilities, then estimating the likelihood and impact of harm so that controls can be prioritized and justified.

The estimated monetary cost of a single incident involving a specific asset, calculated by multiplying the asset's value by its exposure factor (the percentage lost in the event).

A structured study that identifies critical business functions and determines how disruptions affect them, establishing recovery priorities, recovery time objectives, and recovery point objectives.

The maximum acceptable amount of time a business process can be unavailable after a disruption before the impact becomes unacceptable to the organization.

The maximum acceptable amount of data loss measured in time, indicating how far back the organization must be able to restore data after an outage.

A documented set of procedures describing how an organization detects, contains, eradicates, and recovers from security incidents, including roles, communication paths, and escalation steps.

A documented, unbroken record of who handled digital evidence, when, and for what purpose, used to prove that the evidence was not altered from collection through presentation.

The practice of reviewing system, network, and application records to detect anomalies, policy violations, or indicators of compromise that may reveal a security incident.

Security information and event management software that collects logs from many sources, correlates events in real time, and alerts analysts to patterns that suggest attacks or policy violations.

A monitoring tool that inspects network or host activity for known attack signatures or suspicious behavior and raises alerts, but does not itself block the traffic it detects.

A device or software that inspects traffic and actively blocks or drops activity matching malicious patterns, sitting inline so it can stop attacks rather than only alert.

A cryptographic method in which the same secret key is used to both encrypt and decrypt data, offering speed and efficiency but requiring secure key distribution and management.

A cryptographic method using a pair of mathematically related keys, where the public key encrypts and the private key decrypts, solving the key distribution problem but running slower than symmetric methods.

A one-way mathematical algorithm that converts input data into a fixed-length value, used to verify integrity because any change to the input produces a different output.

A cryptographic value created by hashing a message and encrypting the hash with the sender's private key, providing authentication, integrity, and nonrepudiation to the recipient.

The framework of policies, roles, and technologies-including certificate authorities, registration authorities, and digital certificates-that manages public key distribution and trust in an organization.

A trusted entity that issues and revokes digital certificates, binding a public key to an identity after verifying the requester, and serving as the root of trust in PKI.

A cryptographic protocol that protects data in transit between clients and servers by providing encryption, integrity checks, and authentication through digital certificates.

A virtual private network creates an encrypted tunnel over an untrusted network such as the internet, allowing remote users or sites to communicate as if on a private internal network.

A network security device or software that examines packets against a rule set and permits or denies traffic between network segments based on addresses, ports, protocols, or application state.

The practice of dividing a network into smaller, isolated zones with controlled traffic between them, limiting the spread of attacks and supporting compliance and performance requirements.

A list attached to a resource or network interface that specifies which users, groups, or addresses are permitted or denied access and what operations they may perform.

An access model that assigns permissions to job roles rather than to individuals, so users receive rights by being placed in the appropriate role, simplifying administration and supporting least privilege.

A strict access model in which the system enforces access decisions based on security labels assigned to objects and clearances assigned to subjects, and users cannot change those labels.

An access model in which the owner of a resource decides who may access it and with what rights, typically implemented through access control lists.

An authentication method requiring two or more independent credential types from categories such as something you know, something you have, or something you are, making unauthorized access significantly harder.

The process of verifying that a user, device, or system is who or what it claims to be, typically through passwords, tokens, certificates, or biometric traits.

The process of determining which resources and operations an authenticated identity is permitted to use, enforced through access control models and policies.

A defensive coding practice that checks and sanitizes data entering an application to ensure it meets expected format, length, and type, preventing injection and other manipulation attacks.

The ongoing process of identifying, testing, deploying, and verifying software updates that fix vulnerabilities, helping keep systems current and reducing exploitable exposure.

Integrating security activities-such as threat modeling, code review, and testing-into every phase of software development so that flaws are found and fixed before deployment.