ATP 108 key terms

Anything of value that an organization owns or controls and that supports its mission, including people, facilities, equipment, data, software, and reputation. Assets are identified so they can be protected in proportion to their importance.

Any circumstance or event with the potential to harm an asset through unauthorized access, destruction, disclosure, or modification. Threats may be natural, accidental, or deliberate and exist independently of whether a weakness is present.

A weakness in a system, process, or control that a threat could exploit to cause harm. Vulnerabilities may stem from design flaws, misconfiguration, missing patches, or human behavior.

The likelihood and potential impact of a threat exploiting a vulnerability against an asset. Risk combines probability and consequence and is used to prioritize which protections and resources are warranted.

The property that information is not disclosed to unauthorized individuals, entities, or processes. It is protected through access controls, encryption, and handling rules that limit who can see sensitive data.

The property that data and systems are accurate, complete, and protected from unauthorized modification or destruction. It is supported by change control, hashing, and access restrictions that detect or prevent tampering.

The property that systems and data are accessible to authorized users when needed. It is maintained through redundancy, backups, maintenance, and defenses against disruption such as denial-of-service attacks.

The process of verifying that a user, device, or system is who or what it claims to be. It typically relies on something you know, have, or are, and it precedes authorization decisions.

The process of determining what actions or resources an authenticated identity is permitted to access. It enforces least privilege by granting only the rights needed to perform assigned duties.

The assurance that a party cannot credibly deny having performed an action, such as sending a message or approving a transaction. It is commonly supported by digital signatures and tamper-evident audit logs.

A layered security strategy in which multiple independent controls protect an asset so that failure of one layer does not expose it completely. Layers may span physical, network, host, application, and data safeguards.

A principle holding that users, processes, and systems should receive only the minimum access rights necessary to perform their functions, and only for as long as needed. It limits the damage from accidents and compromised accounts.

A control that divides a sensitive task among multiple people so no single individual can complete it alone. It reduces the risk of fraud and error by requiring collusion to abuse a process.

A security model that assumes no implicit trust based on network location and instead verifies every access request continuously. It emphasizes strong identity, device health checks, and least-privilege access to resources.

A structured process of identifying threats and vulnerabilities, estimating likelihood and impact, and determining risk levels to guide treatment decisions. Results are documented and revisited as conditions change.

The risk that remains after existing or planned controls have been applied. It is compared against the organization's risk tolerance to decide whether further treatment or acceptance is appropriate.

The selection and application of options to address assessed risk, typically by mitigating, transferring, avoiding, or accepting it. The chosen option is documented with an owner and a review date.

A maintained record of an organization's assets, including owners, locations, and criticality. A current inventory is the foundation for scoping protections, patching, and incident response.

A documented, approved set of settings that a system must meet to be considered securely configured. Deviations are detected through monitoring and corrected to return the system to its approved state.

A controlled process for requesting, reviewing, approving, testing, and recording changes to systems and configurations. It reduces the chance that modifications introduce outages or weaken security controls.

The process of identifying, testing, deploying, and verifying software updates that fix vulnerabilities or defects. Timely patching reduces the window in which known weaknesses can be exploited.

An automated technique that probes systems and compares findings against known weakness signatures and misconfigurations. Results are reviewed and prioritized for remediation rather than treated as a complete risk picture.

A documented set of roles, steps, and communications for detecting, containing, eradicating, and recovering from security incidents. It is tested through exercises so the organization can act quickly under pressure.

A plan describing how essential operations will continue during and after a disruption. It addresses alternate processes, staffing, and resources and is exercised periodically to confirm it remains workable.

A network device or software that permits or blocks traffic between zones according to a defined rule set. It enforces boundary policy and is a common control for segmenting networks.

A tool that monitors network or host activity for signs of malicious behavior and generates alerts. Some variants can also block detected activity and are then described as prevention systems.

The transformation of readable data into ciphertext using a key so that only authorized parties can reverse it. It protects data in transit and at rest from unauthorized disclosure.

An authentication approach requiring two or more independent credential types, such as a password plus a one-time code. It reduces the risk of account compromise when a single factor is stolen.

An access model in which permissions are assigned to job roles rather than to individuals, and users are placed into roles. It simplifies administration and supports consistent least-privilege enforcement.

A chronological record of system and user activity, including who did what and when. Logs support detection, investigation, and accountability and must themselves be protected from tampering.

A cryptographic value that binds a message or document to a signer's private key and can be verified by others. It provides evidence of origin and integrity and supports non-repudiation.

The division of a network into separate zones with controlled traffic between them. It limits how far an attacker can move and contains the impact of a compromised host.

The state of meeting obligations imposed by laws, regulations, contracts, or adopted standards. It is demonstrated through evidence such as policies, records, and audit results.

A high-level statement of management intent and mandatory requirements that governs how an organization protects information and systems. Policies are supported by more detailed standards, procedures, and guidelines.

A mandatory rule or specification that translates policy into measurable requirements, such as approved algorithms or configuration settings. Standards provide the basis for consistent implementation and audit.

An independent, systematic examination of controls, records, and practices against defined criteria. Findings are reported to management and tracked to resolution, providing assurance over compliance and effectiveness.

The process of labeling information by sensitivity and criticality so that handling, storage, and access rules can be applied consistently. Labels drive which controls are required for each category of data.

The ongoing obligation to act reasonably and apply appropriate safeguards given the risks and circumstances an organization faces. It reflects sustained effort rather than a one-time action.

The investigation and verification a professional performs before making decisions or recommendations, such as reviewing evidence, validating findings, and confirming facts. It supports defensible, well-founded judgments.

The principles guiding conduct in a security role, including honesty, confidentiality, objectivity, and acting in the public interest. Ethical practice includes disclosing conflicts and avoiding misuse of access.

A situation in which personal, financial, or other interests could improperly influence professional judgment. It is managed by disclosure, recusal, or removal of the conflicting interest.