NCCS key terms

A layered security strategy that stacks independent controls across people, process, and technology so that if one safeguard fails, another still blocks or detects the attack.

A person or group with the intent, capability, and opportunity to attack systems, ranging from opportunistic criminals to state-sponsored teams and insider employees.

The total set of points where an unauthorized user could try to enter or extract data from a system, including networks, endpoints, applications, cloud services, and human users.

A weakness in software, configuration, or process that a threat could exploit to gain access, escalate privileges, or disrupt a system. It is not itself an attack.

Code or a technique that takes advantage of a specific vulnerability to achieve an attacker's objective, such as remote code execution or privilege escalation.

A vulnerability that is unknown to the vendor or has no patch available at the time of exploitation, leaving defenders to rely on detection and compensating controls.

Manipulating people into revealing information or taking unsafe actions by exploiting trust, authority, urgency, or fear rather than technical flaws.

A fraudulent message that impersonates a trusted party to trick a recipient into clicking a link, opening an attachment, or disclosing credentials. Variants include spear phishing and smishing.

Malware that encrypts or steals data and demands payment for restoration or to prevent release, often preceded by credential theft and lateral movement inside the network.

Risk posed by an employee, contractor, or partner who misuses legitimate access, whether maliciously, accidentally, or because their account was compromised by an outsider.

Evidence-based information about existing or emerging threats, such as indicators, tactics, and actor profiles, that is collected and analyzed to inform defensive decisions.

A network device or software filter that permits or denies traffic between zones according to a rule set, enforcing segmentation between trusted and untrusted networks.

Dividing a network into isolated zones so that compromise of one area does not automatically grant access to others, limiting lateral movement by attackers.

A monitoring component that inspects traffic or host activity for known attack signatures or anomalous behavior and raises alerts without blocking the traffic.

An inline sensor that detects malicious traffic and actively blocks or drops it, sitting in the traffic path and therefore requiring careful tuning to avoid disrupting legitimate use.

An encrypted tunnel that carries traffic between a remote user or site and a private network over an untrusted medium such as the internet.

A security model that removes implicit trust based on network location and instead verifies every request through identity, device posture, and policy before granting access.

Techniques that absorb or filter distributed denial-of-service traffic, such as rate limiting, scrubbing centers, and anycast distribution, to keep services reachable during an attack.

Agent software on hosts that continuously records process, file, and network behavior, applies analytics to spot malicious patterns, and supports containment actions such as isolating a device.

Software that scans files and memory for known malicious code using signatures and heuristics, forming a baseline layer of host protection but weak against novel malware.

The disciplined process of identifying, testing, deploying, and verifying software updates that close known vulnerabilities before attackers can exploit them.

A documented, approved set of settings for systems and applications, against which actual configurations are compared to detect drift and enforce hardening standards.

Granting users, services, and processes only the access needed to perform their tasks, and no more, to shrink the damage a compromised account can cause.

An access model that assigns permissions to roles rather than individuals, and then assigns users to roles, simplifying administration and supporting separation of duties.

Requiring two or more independent credential types, such as a password plus a hardware token or biometric, so that a stolen password alone is not enough to log in.

A federated authentication arrangement where one login grants access to many applications through a trusted identity provider, reducing password sprawl but concentrating risk.

Controls that vault, rotate, monitor, and approve use of administrative accounts and secrets, limiting how long and where high-impact credentials can be used.

Splitting a sensitive task across different people so no single individual can both initiate and approve a high-risk action, such as creating a vendor and paying it.

Transforming readable data into ciphertext using a key so that only parties holding the correct key can recover the original content.

The lifecycle practices for generating, distributing, storing, rotating, and destroying cryptographic keys, which determines whether encryption actually protects data.

A tamper-resistant appliance that generates and stores cryptographic keys and performs operations inside protected hardware so keys never appear in general-purpose memory.

A protocol that encrypts and authenticates data in transit between clients and servers, using certificates to prove server identity and negotiate session keys.

The policies, certificate authorities, and registration processes that issue, validate, renew, and revoke digital certificates used to bind identities to public keys.

A one-way function that maps data of any size to a fixed-length value, used to verify integrity and to store passwords so the original cannot be recovered directly.

A cryptographic value created with a private key that lets a recipient verify both the origin and the integrity of a message or file.

A platform that centralizes logs from many sources, correlates events against rules and analytics, and alerts analysts to patterns that suggest an incident.

An observable artifact such as a malicious IP address, file hash, or domain that suggests a system has been breached and can be used for detection or hunting.

A documented set of roles, escalation paths, and steps for preparing, detecting, containing, eradicating, recovering from, and learning from a security incident.

Regularly copying data and testing restoration so that systems can be rebuilt after loss, ransomware, or disaster, ideally with offline or immutable copies.

A structured process that identifies assets and threats, estimates likelihood and impact, and ranks risks so resources go to the exposures that matter most.

A living record of identified risks with owners, likelihood and impact ratings, treatment decisions, and status, used to track and report risk over time.

The risk that remains after controls have been applied, which management must formally accept or treat because it cannot usually be eliminated entirely.

An alternative safeguard used when the preferred control is impractical or unavailable, reducing risk to an acceptable level through a different mechanism.

An exercise that identifies critical business functions and the tolerable downtime and data loss for each, driving recovery objectives and continuity planning.

A cloud arrangement that divides security duties between provider and customer, for example the provider secures physical infrastructure while the customer secures data and identities.

A control point between users and cloud services that enforces policy on data movement, blocks unsanctioned applications, and adds visibility into cloud usage.

Labeling information by sensitivity and business value, such as public, internal, confidential, and restricted, so that handling and protection rules match its importance.

Practices that protect containerized workloads, including trusted base images, vulnerability scanning, minimal runtime privileges, and isolation between containers and the host.

The property that systems and data are accessible to authorized users when needed, supported by redundancy, capacity planning, and resilience against disruption.