NCCSA key terms

A design rule that gives each user, service, or process only the permissions needed to finish its assigned task, and nothing beyond that, limiting the damage any compromised account can cause.

Layering independent controls across people, networks, hosts, applications, and data so that a single failed or bypassed safeguard does not expose the whole environment to compromise.

The three core security goals: confidentiality keeps data from unauthorized disclosure, integrity keeps it accurate and unaltered, and availability keeps it reachable when legitimate users need it.

Assurance that a party cannot credibly deny having performed an action, typically achieved with digital signatures and tamper-evident audit logs that bind an identity to a transaction.

Dividing a network into isolated zones with enforced traffic boundaries so that a breach in one area, such as a guest or industrial segment, cannot spread freely to critical systems.

A buffer subnet holding internet-facing services such as web and mail servers, separated from the internal network by filtering controls so exposed hosts do not sit beside sensitive internal systems.

A device or software rule engine that permits or blocks network traffic based on attributes such as source, destination, port, protocol, and connection state, enforcing the boundary between trust zones.

An architecture that stops assuming anything inside the perimeter is safe and instead verifies every request continuously using identity, device health, and context before granting access to a resource.

An encrypted tunnel that carries traffic between a remote device or site and a trusted network over an untrusted medium, protecting confidentiality and integrity of data in transit.

Transforming readable data into ciphertext using a key and algorithm so that only holders of the correct key can reverse the process and recover the original content.

A one-way function that maps input of any size to a fixed-length value, used to verify integrity and store passwords, because the original input cannot feasibly be recovered from the output.

A cryptographic value created with a private key that lets a recipient confirm the signer's identity and verify the message was not altered after signing.

Requiring two or more different evidence types, such as a password plus a one-time code or hardware key, so a stolen password alone cannot grant access.

An access model where permissions are bundled into roles and users are assigned roles, simplifying administration and supporting consistent enforcement of least privilege across an organization.

An attack technique that gains higher permissions than originally granted, either by exploiting a flaw in the same account or by moving to a more powerful account.

A social engineering attack that impersonates a trusted party through email, messages, or calls to trick a recipient into revealing credentials, approving payments, or running malicious content.

Manipulating human trust and behavior, rather than technical flaws, to obtain information or access, often through urgency, authority, or familiarity appeals.

Malicious software that encrypts or locks access to data and demands payment for restoration, frequently paired with data theft and threats to publish stolen information.

Any software written to harm, disrupt, or gain unauthorized access to a system, including viruses, worms, trojans, spyware, and ransomware.

Risk arising from a person with legitimate access, whether malicious or careless, who misuses that access or exposes sensitive data and systems.

A weakness in software, configuration, or process that an attacker could exploit to compromise confidentiality, integrity, or availability of a system or its data.

The likelihood and impact of a threat exploiting a vulnerability against an asset, usually expressed qualitatively or quantitatively to guide prioritization of controls and spending.

Choosing how to address an identified risk: mitigate it with controls, transfer it such as through insurance, avoid the activity, or knowingly accept the residual level.

The risk that remains after controls have been applied, which must be documented and formally accepted by an accountable owner rather than assumed to be zero.

A repeatable process for identifying, testing, deploying, and verifying software updates that close known vulnerabilities before attackers can exploit them.

Agent software on hosts that continuously records process, file, and network behavior, detects suspicious patterns, and supports investigation and containment of compromised machines.

A platform that collects and correlates logs from many sources, generates alerts, and supports investigation, providing the central visibility layer for a security operations center.

A documented, tested set of roles and steps for preparing, detecting, containing, eradicating, recovering from, and learning after a security incident.

Prepared procedures and alternate arrangements that keep essential operations running during and after a disruption, including communication, staffing, and manual workarounds.

The technical plan for restoring systems and data after a major outage, defining recovery objectives, backup restoration steps, and the order in which services return.

The policy and practice of keeping audit and system records for a defined period so they remain available for investigations, legal holds, and compliance evidence.

A documented, unbroken record of who handled evidence, when, and where, from collection through storage to presentation, preserving its credibility in an investigation or legal proceeding.

A periodic, documented check that each account still needs its assigned permissions, catching accumulated access from role changes, transfers, and departures.

Labeling information by sensitivity, such as public, internal, confidential, or restricted, so handling, storage, and access rules can be applied consistently.

Controls that inspect content and traffic to detect and block unauthorized movement of sensitive data, such as customer records or credentials, outside approved boundaries.

A management-approved statement of required behavior and expectations for protecting information, forming the basis for standards, procedures, and enforcement decisions.

Exposure created by vendors, suppliers, and service providers whose access to systems or data can introduce vulnerabilities, outages, or compliance failures.

Rules describing how employees may use organizational systems and data, including prohibited activity and monitoring expectations, usually acknowledged at onboarding.