Engineer Information Security key terms

A model describing security goals as confidentiality (data is not disclosed to unauthorized parties), integrity (data is not altered improperly), and availability (systems and data remain accessible to authorized users when needed).

The property that a party cannot credibly deny having performed an action, such as sending a message or approving a transaction, usually achieved through digital signatures and reliable audit logs.

Legal obligations governing the collection, use, storage, and transfer of data identifying individuals, requiring lawful basis, purpose limitation, notice, consent where applicable, and safeguards against breach.

The ongoing practice of applying reasonable safeguards and standards expected of a prudent organization, demonstrating that management actively maintains controls rather than merely assigning responsibility.

The systematic investigation and verification of risks, controls, or third parties before a decision or engagement, such as assessing a vendor's security posture prior to signing a contract.

A management-approved document stating mandatory rules for protecting information, defining scope, roles, and acceptable behavior, and serving as the basis for standards, procedures, and enforcement.

The process of identifying assets and threats, estimating the likelihood and impact of exploitation, and determining risk levels to prioritize treatment decisions.

The risk remaining after existing or newly implemented controls have been applied, which management must formally accept, transfer, or further reduce.

Selecting and applying options to address assessed risk, typically mitigation through controls, transfer such as insurance, avoidance by eliminating the activity, or acceptance with documented approval.

A layered security architecture in which independent controls at network, host, application, and data levels reinforce each other so that failure of one layer does not expose the whole system.

The principle that users, processes, and services receive only the permissions necessary for their function, for the minimum time required, reducing the impact of compromise or error.

Dividing a sensitive task among multiple people so that no single individual can complete a critical transaction alone, preventing fraud and undetected error.

The mechanisms that decide and enforce which subjects may perform which operations on which objects, encompassing identification, authentication, authorization, and accountability logging.

An authorization model granting permissions to roles rather than individuals, with users assigned to roles, simplifying administration and supporting least privilege at scale.

Dividing a network or system into zones with controlled traffic between them, limiting lateral movement after compromise and enabling tailored policy per zone.

A device or software enforcing traffic rules between network zones, permitting or denying connections based on addresses, ports, protocols, or application state.

A monitoring component that inspects traffic or host activity for known attack signatures or anomalous behavior and raises alerts, without necessarily blocking the activity.

A platform that centralizes log collection, correlation, alerting, and retention across many sources, supporting detection and investigation of security incidents.

A structured process of preparation, detection, containment, eradication, recovery, and lessons learned used to manage security incidents and limit damage.

The continuous cycle of discovering assets, identifying weaknesses, prioritizing them by risk, remediating or mitigating them, and verifying that fixes were effective.

The controlled process of testing, deploying, and verifying software updates that correct defects and vulnerabilities, including tracking exceptions where patching is deferred.

A defect where a program writes more data than a fixed-size buffer can hold, corrupting adjacent memory and potentially allowing control-flow hijacking or crash.

Checking that data entering a system conforms to expected type, length, format, and range, rejecting or sanitizing anything else to prevent injection and corruption.

An attack where untrusted input is concatenated into a database query, altering its logic to read, modify, or delete data or to bypass authentication.

A parameterized query in which SQL structure is fixed before values are bound, so user input is treated strictly as data and cannot change query logic.

A web flaw where attacker-supplied script executes in a victim's browser within a trusted site's origin, enabling session theft, data exfiltration, or action forgery.

An HTTP response header that restricts which sources of scripts, styles, and other resources a browser may load, mitigating script injection and data exfiltration.

An attack that causes a logged-in user's browser to submit an unintended state-changing request to a trusted site, exploiting automatically attached session credentials.

The issuance, storage, rotation, and revocation of session identifiers after authentication, including timeouts and binding to context to prevent hijacking and fixation.

Authentication requiring evidence from two or more distinct categories, such as a password plus a hardware token or biometric, so a single stolen factor is insufficient.

A cryptographic value computed over a message with a private key and verified with the corresponding public key, providing integrity, origin authentication, and non-repudiation.

The policies, roles, and systems that issue, distribute, validate, and revoke public-key certificates, binding identities to keys through trusted certificate authorities.

A protocol securing network sessions with negotiated encryption, integrity protection, and server authentication via certificates, forming the basis of HTTPS.

Encryption using one shared secret key for both encrypting and decrypting, offering high speed but requiring secure key distribution and management.

Encryption using a mathematically related key pair, where the public key encrypts or verifies and the private key decrypts or signs, easing key distribution but slower than symmetric methods.

The lifecycle of cryptographic keys, including generation, distribution, storage, rotation, escrow, and destruction, with controls preventing unauthorized disclosure or substitution.

Assigning labels such as public, internal, confidential, or restricted to information so that handling, access, and protection requirements are proportionate and consistent.

An architecture that treats no network location as inherently trusted, requiring explicit verification of identity and device posture and least-privilege access for every request.

The property of software that prevents invalid memory access such as out-of-bounds writes and use-after-free, achieved through safe languages, bounds checks, and runtime protections.