NCJOSI key terms

A model describing three core goals of information security: confidentiality, meaning only authorized parties can read data; integrity, meaning data stays accurate and unaltered; and availability, meaning systems and data remain accessible when needed.

A layered security strategy that stacks multiple independent controls, such as firewalls, endpoint protection, authentication, and monitoring, so that failure of one control does not expose the whole environment.

A network segment that sits between an untrusted network such as the internet and the internal trusted network, hosting externally reachable services while limiting direct exposure of internal systems.

Dividing a network into smaller isolated zones with controlled traffic paths between them, which limits lateral movement by attackers and reduces the scope of a compromise.

A device or software that inspects network traffic and permits or blocks it according to configured rules, typically based on addresses, ports, protocols, or application behavior.

A monitoring tool that inspects network or host activity for known attack signatures or suspicious behavior and raises alerts, without necessarily blocking the traffic it observes.

A monitoring tool placed inline with traffic that detects malicious activity and actively blocks or drops it, in addition to generating alerts for analysts.

A social engineering attack that sends fraudulent messages, usually email, designed to trick recipients into revealing credentials, clicking malicious links, or opening harmful attachments.

Manipulating people through deception, urgency, or authority to obtain information or access, targeting human trust rather than technical weaknesses in systems.

A social engineering technique in which the attacker invents a believable scenario or persona, such as an IT technician or auditor, to justify requests for sensitive information.

Malware that encrypts or locks access to files and systems, then demands payment for restoration, often coupled with data theft and threats to publish stolen information.

An attack that floods a service with traffic from many compromised hosts or devices, exhausting bandwidth or resources so legitimate users cannot access the service.

A network of compromised machines or internet-connected devices controlled remotely by an attacker, commonly used to send spam, spread malware, or launch distributed denial-of-service attacks.

The infrastructure and communication channels an attacker uses to send instructions to compromised systems and receive data back, often disguised as normal network traffic.

An attack that inserts malicious database commands into input fields so an application executes unintended queries, potentially exposing, altering, or deleting stored data.

An attack that injects malicious scripts into web pages viewed by other users, allowing the attacker to steal session data, redirect victims, or act as the victim in the browser.

Checking and sanitizing data submitted by users before processing it, which prevents malformed or malicious content from reaching databases, interpreters, or other downstream components.

Techniques an attacker uses after initial access to move from one compromised system to others inside a network, escalating reach toward higher-value targets and credentials.

Gaining a higher level of access than originally granted, such as moving from a standard user to administrator rights, either by exploiting flaws or by abusing misconfiguration.

Observable artifacts such as unusual file hashes, IP addresses, domains, or registry changes that suggest a system may have been breached and guide investigation.

A team and facility responsible for continuously monitoring, detecting, analyzing, and responding to security events across an organization's environment.

A platform that collects logs and event data from many sources, correlates them, and generates alerts so analysts can detect and investigate suspicious activity in one place.

The practice of storing system and security logs for a defined period to support investigations, audits, and compliance obligations, balanced against storage cost and privacy concerns.

A documented set of roles, steps, and communication paths an organization follows to detect, contain, eradicate, and recover from a security incident, including lessons learned afterward.

The incident response phase focused on limiting the spread and impact of a compromise, for example by isolating hosts, disabling accounts, or blocking malicious traffic.

The incident response phase in which the root cause and malicious artifacts are removed, such as deleting malware, closing the exploited vulnerability, and resetting compromised credentials.

The incident response phase of restoring affected systems and services to normal operation, verifying their integrity, and monitoring closely for signs of renewed compromise.

A documented, unbroken record of who collected, handled, and stored evidence and when, used to demonstrate that evidence has not been altered or tampered with.

Creating a bit-for-bit copy of a storage device or memory for investigation, so analysis can proceed on the copy while the original evidence remains preserved and unmodified.

A prioritization principle in evidence collection stating that the most perishable data, such as memory and network connections, should be captured before more persistent data like disk contents.

Automated probing of systems and applications to identify known weaknesses, missing patches, and misconfigurations, producing findings that feed into remediation prioritization.

A standardized framework that assigns a numerical severity score to a vulnerability based on factors such as exploitability and impact, helping teams rank remediation work.

The potential for loss or harm, commonly expressed as the combination of the likelihood that a threat exploits a weakness and the resulting impact on the organization.

The process of tracking, testing, and applying software updates that fix security flaws, reducing the window during which known vulnerabilities can be exploited.

Protecting stored data, such as files or database records, by converting it into ciphertext so that anyone without the proper key cannot read it if storage is lost or stolen.

Protecting data while it travels across networks by encrypting the communication channel, so intercepted traffic cannot be read or altered by eavesdroppers.

A method where the same secret key is used to encrypt and decrypt data, offering speed and efficiency but requiring a secure way to share the key.

A method using a public key to encrypt and a mathematically related private key to decrypt, which simplifies key distribution and also supports digital signatures.

A cryptographic value created with a private key that lets recipients verify a message's origin and confirm it has not been altered, providing authenticity and integrity.

Applying a one-way mathematical function to data to produce a fixed-length value used to verify integrity, since any change to the input yields a different output.

A protocol that encrypts and authenticates communications between clients and servers, commonly protecting web traffic and other network sessions from interception.

Requiring two or more independent forms of proof, such as a password plus a one-time code or hardware token, so a stolen password alone is insufficient to log in.

Granting each user, process, or system only the access rights required to perform its tasks, minimizing the damage possible if credentials are misused or compromised.

An access model where permissions are assigned to roles rather than individuals, and users obtain permissions by being placed in the appropriate roles.

A periodic examination in which managers or system owners confirm that users still need their assigned access, removing accounts and permissions that are no longer justified.

A controlled process for requesting, reviewing, approving, and documenting modifications to systems, intended to prevent outages and unapproved security-impacting changes.

A document defining how employees may use organizational systems, networks, and data, including prohibited activities and consequences for violations.

Education that teaches staff to recognize common threats such as phishing and to follow safe practices, reducing the likelihood of successful social engineering attacks.

A plan describing how essential business functions will keep operating during and after a disruption, covering alternate processes, resources, and communication for critical activities.

A plan focused on restoring IT systems and data after a major disruption, defining recovery priorities, backup restoration steps, and target timeframes for resuming services.

Categorizing information by sensitivity, such as public, internal, confidential, or restricted, so that handling, storage, and access controls match the value and risk of the data.