Cambridge SC key terms

A person or group that carries out or sponsors attacks, described by motivation, capability and resources, such as opportunistic criminals, state-backed groups or insiders.

The total set of points where an attacker could try to enter or influence a system, including network services, user interfaces, APIs, supply chain components and people.

A weakness in software, configuration, process or physical setup that a threat could exploit to cause harm. It is distinct from the threat itself and from the resulting risk.

Code or a technique that takes advantage of a specific vulnerability to achieve an effect such as code execution, privilege escalation or data disclosure.

A vulnerability that is unknown to the vendor or has no available fix at the time of exploitation, leaving defenders without a patch-based mitigation.

Malicious software that encrypts or steals data and demands payment for restoration or non-disclosure. Modern variants often also exfiltrate data for double extortion.

A social engineering attack that impersonates a trusted party through email, messaging or calls to trick a person into revealing credentials, approving payments or running malicious content.

Observable evidence suggesting a system has been breached, such as unusual outbound traffic, unexpected account creation, known malicious file hashes or anomalous login locations.

Layering independent controls across people, process and technology so that failure of one control does not by itself expose the asset.

Granting each user, service or process only the access needed to perform its task, for no longer than necessary, to limit the impact of error or compromise.

An access model where permissions are assigned to roles and users gain permissions by being placed in roles, simplifying administration and supporting separation of duties.

An access model that evaluates policies against attributes of the subject, resource, action and environment, enabling fine-grained and context-aware decisions.

Authentication that requires two or more independent factor types, such as something you know plus something you have, so a stolen password alone is insufficient.

A phishing-resistant credential, often a hardware key or platform passkey, that binds authentication to the legitimate origin using public-key cryptography.

Controls that secure accounts with elevated rights, including vaulting credentials, just-in-time elevation, session recording and approval workflows for administrative actions.

Dividing a sensitive task among different people so no single person can complete a high-risk action alone, reducing fraud and undetected error.

Encryption where the same secret key both encrypts and decrypts data, offering high speed but requiring secure key distribution and management.

Encryption using a key pair, where the public key encrypts or verifies and the private key decrypts or signs, solving key distribution without a shared secret.

The policies, roles and systems that issue, distribute, validate and revoke digital certificates, binding public keys to verified identities.

A cryptographic value created with a private key over a message digest, letting a recipient verify integrity and origin and supporting non-repudiation.

A one-way function that maps data of any size to a fixed-length digest. It detects alteration but provides no confidentiality and is not encryption.

Adding unique random data to each password before hashing so identical passwords produce different digests, defeating precomputed tables and reducing the value of bulk cracking.

The lifecycle of cryptographic keys: generation, distribution, storage, rotation, revocation and destruction, with controls that protect keys from disclosure.

Dividing a network into zones with controlled traffic between them, so a compromise in one zone cannot spread freely to others.

A control that permits or blocks network traffic based on rules such as addresses, ports, application or state, enforcing a boundary between zones.

A security model that grants no implicit trust based on network location and instead verifies identity and device posture for every request before allowing access.

A protocol that encrypts and authenticates traffic between client and server, protecting confidentiality and integrity of data in transit.

Integrating security activities such as threat modelling, secure coding, code review and security testing into each phase of software development rather than adding them at the end.

A structured review of a system design to identify assets, entry points, likely threats and mitigations before code is written.

A repeatable process for identifying, testing, deploying and verifying software fixes so known vulnerabilities are closed within an agreed timeframe.

A documented set of roles, escalation paths and steps for preparing for, detecting, containing, eradicating, recovering from and learning from security incidents.

A platform that collects and correlates logs from many sources to detect suspicious patterns, generate alerts and support investigation.

Documented, unbroken record of who handled digital evidence, when and how, so its integrity can be defended in disciplinary or legal proceedings.

Creating a verified bit-for-bit copy of storage or memory for investigation, allowing analysis on the copy while preserving the original as evidence.

Identifying assets, threats and vulnerabilities, then estimating likelihood and impact to prioritise treatment through mitigation, transfer, avoidance or acceptance.

Management-approved statements defining required security behaviour and controls, forming the basis for standards, procedures and audit evidence.

A structured analysis of a processing activity likely to create high privacy risk, documenting necessity, safeguards and residual risks before processing begins.

Collecting and keeping only personal data that is adequate, relevant and necessary for the stated purpose, reducing exposure and compliance burden.

A request by an individual to obtain confirmation of, and a copy of, personal data held about them, along with related information the law requires.