LPI Security Essentials key terms

The three core goals of information security: keeping data readable only by authorized parties, keeping data accurate and unaltered, and keeping systems and data reachable when needed. Most controls are justified by one or more of these goals.

A threat is anything that could cause harm, a vulnerability is a weakness that a threat could exploit, and risk is the likelihood and impact of that combination actually occurring. Distinguishing the three prevents misdirected spending on controls.

The process of identifying assets, listing the threats and vulnerabilities affecting them, and estimating likelihood and impact so controls can be prioritized. Results are usually recorded in a risk register with an owner and a treatment decision.

Layering independent controls so that failure of one does not expose the whole system, for example firewalls plus host hardening plus encryption plus monitoring. Attackers must then defeat several different mechanisms instead of a single barrier.

Granting each user, process, or service only the permissions needed for its task and no more. This limits the damage from mistakes, compromised accounts, and malicious insiders, and simplifies auditing of who can do what.

The sum of all points where an attacker could try to interact with a system: open ports, exposed services, user accounts, APIs, and installed software. Reducing it by removing unneeded components is a fundamental hardening step.

Manipulating people into revealing information or performing unsafe actions, often by impersonation, urgency, or authority. Technical controls help only partly, so awareness training and verification procedures are the main defenses.

A fraudulent message that impersonates a trusted party to trick the recipient into clicking a link, opening an attachment, or handing over credentials. Variants include spear phishing aimed at specific people and smishing sent by SMS.

Categories of hostile software such as viruses that infect files, worms that spread over networks, trojans disguised as useful programs, ransomware that encrypts data for extortion, and spyware that quietly collects information. Classification guides detection and response.

Malware that encrypts or steals data and demands payment for restoration or non-disclosure. Reliable offline backups, patching, and segmentation are the practical defenses, since paying does not guarantee recovery.

Software that hides an attacker's presence by modifying the kernel, bootloader, or system libraries so that normal tools no longer report its files and processes. Detection often requires offline scanning or reinstalling the system.

Encryption where the same secret key both encrypts and decrypts data. It is fast and suits bulk data, but the key must be shared securely in advance, which is why it is often combined with asymmetric methods.

Encryption using a key pair: a public key that anyone may know and a private key kept secret. It solves key distribution and enables digital signatures, but is much slower than symmetric ciphers, so it usually protects keys rather than bulk data.

The Advanced Encryption Standard, a symmetric block cipher with 128-bit blocks and key sizes of 128, 192, or 256 bits. It is the default choice for file, disk, and network encryption in modern Linux tooling.

A scheme for applying a block cipher to data longer than one block. Modes such as CBC need a random initialization vector, while authenticated modes like GCM also detect tampering, so they are preferred for new designs.

A one-way function that maps any input to a fixed-length digest, where small input changes produce very different outputs. Good cryptographic hashes resist finding two inputs with the same digest and are used for integrity checks and password storage.

A unique random value added to each password before hashing so identical passwords produce different stored values. Salting defeats precomputed lookup tables and hides when several accounts share the same password.

Storing only a slow, salted hash of a password instead of the password itself, using a deliberately expensive algorithm. The cost factor makes large-scale guessing impractical even if the stored hashes leak.

A value computed with a private key over a message or its hash, which anyone can verify with the matching public key. It provides integrity and proof of origin, and underpins package signing and certificate validation.

The system of certificate authorities, registration procedures, and revocation mechanisms that lets parties trust public keys they have not met before. Browsers and package managers rely on it to validate identities.

Transport Layer Security negotiates keys and encrypts traffic between a client and server, typically for HTTPS and mail submission. It authenticates the server with a certificate and, optionally, the client, and modern versions forbid weak legacy ciphers.

Restricting an application to accept only a specific expected certificate or public key rather than any certificate from a trusted authority. It narrows the impact of a mis-issued certificate but complicates rotation.

Encrypting an entire storage device so its contents are unreadable without the key, protecting data if a machine is lost or stolen. The key must be supplied at boot, for example by a passphrase or a TPM.

A hardware chip that stores keys and measurements securely and can seal data so it is released only when the boot state matches expectations. It supports disk encryption unlocking and hardware-backed key storage.

A firmware feature that verifies the signature of each boot component against trusted keys before executing it, blocking unauthorized bootloaders and some rootkits. Key management must be handled carefully to avoid locking out legitimate systems.

The classic Unix permission bits that grant read, write, and execute rights separately to the file owner, its group, and everyone else. They are the first line of access control on files and directories.

A per-process mask that removes permission bits from newly created files and directories, so defaults are less permissive than the maximum. A typical value of 022 yields files writable only by their owner.

A program that lets permitted users run specific commands as another user, usually root, after authenticating. Rules in its configuration file support fine-grained delegation, logging, and password-free operation for automation.

Making regular copies of data and periodically proving they can actually be restored. Untested backups often fail when needed, so restore drills, retention rules, and at least one offline copy are essential.

A filter that permits or blocks network traffic according to rules about addresses, ports, and protocol state. Host firewalls protect a single machine, while network firewalls guard segments and are usually default-deny.

Dividing a network into zones with controlled traffic between them, so a compromise in one area cannot spread freely. It limits lateral movement and is often implemented with VLANs, subnets, and firewall rules.

Configuring a network service to expose only what is required: disabling unused features, running as an unprivileged user, restricting access, and keeping it patched. It reduces the attack surface of every listening daemon.

Reaching a system over an untrusted network using an encrypted, authenticated channel such as SSH with keys instead of passwords. Disabling direct root login and limiting source addresses further reduce exposure.

A public and private key used for passwordless, cryptographically strong SSH authentication. The public half is placed on the server, and the private half stays protected on the client, ideally with a passphrase.

Systems that monitor traffic or host activity for signs of attack and either alert or actively block it. Signature-based detection catches known patterns, while anomaly-based detection flags deviations from normal behavior.

Collecting events from systems and services and reviewing them for failures, anomalies, and policy violations. Centralized, time-synchronized logs with retention rules make investigations and compliance reporting feasible.

The three access-control functions: proving who a subject is, deciding what it may do, and recording what it did. Keeping them distinct clarifies where failures occur and what evidence exists afterward.

Requiring two or more different evidence types, such as a password plus a one-time code or hardware token. It blocks most credential theft, though push fatigue and code interception mean some methods are weaker than others.

Assigning permissions to roles rather than to individuals, then placing users in the roles their duties require. This keeps access reviews manageable and supports least privilege as staff change positions.

Collecting and keeping only the personal data actually needed for a stated purpose, and retaining it no longer than necessary. It reduces breach impact and supports legal obligations such as consent and access requests.

Pseudonymization replaces identifiers with substitutes so data can still be linked, while anonymization aims to make re-identification impossible. Pseudonymized data remains personal data, so privacy duties usually still apply.