NCCSI key terms

A design rule that gives each user, process, or service only the permissions needed to finish its task, and no more, for only as long as needed. It limits the damage caused by mistakes, stolen credentials, or compromised software.

Splitting a sensitive task across two or more people so no single person can complete it alone. For example, the person who requests a payment is not the person who approves it, which reduces fraud and undetected error.

Layering independent controls across people, process, and technology so that if one safeguard fails, others still reduce risk. Layers commonly include physical security, network filtering, endpoint protection, identity checks, and monitoring.

A security model that treats no network location as inherently trusted. Every request is authenticated, authorized, and evaluated against policy before access is granted, and trust is continuously reassessed rather than assumed once at login.

Assigning labels such as public, internal, confidential, or restricted to information based on its sensitivity and the harm from disclosure. The label then drives handling, storage, sharing, and retention rules.

An access model where permissions are attached to job roles rather than to individuals. People are assigned to roles, so access changes cleanly when someone moves between positions, and administration stays manageable at scale.

Requiring two or more different evidence types to prove identity, such as a password plus a hardware key or push approval. Because a stolen password alone is insufficient, it blocks most credential-based account takeover.

A setup where one authenticated session grants access to many applications without repeated logins. It improves usability and centralizes policy enforcement, but makes the primary identity provider a high-value target that must be strongly protected.

Trust arrangements that let an identity verified by one organization or provider be accepted by another, often using standards such as SAML or OpenID Connect. Users keep one set of credentials while partners avoid storing passwords.

Tools and processes that control, vault, and record the use of powerful accounts such as domain administrators or root. Typical features include just-in-time elevation, session recording, and automatic credential rotation.

An attack or misconfiguration that gives a user or process more rights than intended, either by exploiting a flaw in the same account or by moving to a higher-privileged account. It is often a step toward full system compromise.

Automated attempts to log in using username and password pairs stolen from other breaches, betting that people reuse passwords. It is defeated by unique passwords, breach monitoring, rate limiting, and multi-factor authentication.

Dividing a network into zones with controlled traffic between them, so a compromise in one area cannot spread freely. Segmentation is enforced with firewalls, virtual local area networks, or access control lists.

Fine-grained segmentation that applies policy to individual workloads or hosts rather than broad network ranges. Rules typically follow workload identity, allowing very narrow allow-lists and strong containment of lateral movement.

A device or software filter that permits or blocks network traffic according to rules about addresses, ports, and protocols. Stateful firewalls track connection state, while next-generation models add application awareness and intrusion inspection.

A monitoring tool that inspects network or host activity for signs of attack and raises alerts. A detection-only system reports; an intrusion prevention system can also block the traffic inline.

An encrypted tunnel that carries traffic between a remote device and a trusted network or gateway. It protects data on untrusted links, but does not by itself verify device health or stop a compromised endpoint.

A set of cryptographic signatures added to DNS records so resolvers can verify that answers came from the legitimate zone and were not altered in transit. It protects integrity of name resolution, not confidentiality.

Supplying forged domain name responses so a victim is directed to an attacker-controlled address. It enables redirection to phishing sites or interception of traffic, and is mitigated by DNSSEC, encrypted DNS, and hardened resolvers.

Agent software that continuously records endpoint behavior such as process creation, file changes, and network connections, then detects and can contain malicious activity. It supports investigation with historical telemetry rather than signatures alone.

A repeatable process for identifying, testing, deploying, and verifying software updates that fix vulnerabilities. Prioritizing internet-facing and actively exploited flaws shortens the window attackers can use known weaknesses.

A control that permits only explicitly approved programs to run and blocks everything else. Because unknown malware cannot execute even if it lands on disk, allowlisting strongly resists ransomware and unapproved tooling.

Malicious software that encrypts or steals data and demands payment to restore access or prevent release. Reliable recovery depends on tested offline backups, segmentation, and rapid detection rather than on paying.

Protecting stored data, such as disks, databases, or backups, with cryptography so it is unreadable without the right key. It defends against stolen media and unauthorized storage access, and complements but does not replace access control.

Protecting data while it moves across networks using protocols such as TLS or IPsec, so eavesdroppers cannot read or silently alter it. It is essential for remote access, web traffic, and connections to cloud services.

The lifecycle practices for generating, storing, distributing, rotating, and destroying cryptographic keys, plus controlling who can use them. Weak key handling defeats strong algorithms, so keys are often the real point of failure.

The policies, roles, and systems that issue, validate, and revoke digital certificates so parties can trust each other's public keys. Certificate authorities sign certificates, and revocation handles keys that are compromised or retired.

A cryptographic value created with a private key that lets anyone verify the signer's identity and confirm the data was not changed. It provides authenticity and integrity, but not confidentiality.

Storing passwords only as one-way hashes computed with a slow algorithm and a unique random salt per password. Salting prevents precomputed lookup attacks and identical passwords producing identical stored values.

A tamper-resistant device that generates and stores cryptographic keys and performs operations inside its boundary, so keys never leave in plaintext. It is commonly used for certificate authorities, payment systems, and cloud key custody.

A platform that collects logs from many sources, correlates them, and alerts on suspicious patterns. It gives analysts a central timeline for detection and investigation, and often drives automated response playbooks.

A documented set of roles, steps, and contacts for detecting, containing, eradicating, and recovering from a security incident. It is validated through exercises so the organization responds consistently under pressure.

A documented record of who handled evidence, when, and how, from collection through storage to presentation. Gaps or undocumented transfers can make digital evidence unreliable or inadmissible in legal or disciplinary proceedings.

Creating a verified bit-for-bit copy of a storage device or memory so analysis happens on the copy while the original stays preserved. A hash of the image proves it matches the source.

Deceptive messages that impersonate a trusted party to trick recipients into revealing credentials, approving payments, or running malicious files. Variants include targeted spear phishing and voice or text-based lures.

Authentication methods that bind the login to the real service origin, such as hardware security keys or passkeys using FIDO standards. Unlike codes or push prompts, they do not surrender a reusable secret to a fake site.

Identifying assets and threats, then estimating likelihood and impact to rank risks. Results guide where to spend controls, accept residual risk, or transfer it through insurance or contracts.

Choosing how to respond to an identified risk: mitigate it with controls, avoid the activity, transfer it to another party, or formally accept it. Each choice should be documented with an owner and review date.

A continuous cycle of discovering, prioritizing, remediating, and verifying weaknesses in software and configuration. Prioritization weighs exploitability, exposure, and business value rather than raw severity scores alone.

The exposure created when vendors, suppliers, or partners can access systems or data. Managing it involves due diligence, contractual security terms, ongoing monitoring, and knowing which critical services depend on outsiders.

Regularly restoring data and systems from backups to prove they are complete, current, and usable within required timeframes. Untested backups frequently fail when needed, especially after ransomware.

The division of security duties between a cloud provider and its customer. Providers secure the underlying infrastructure, while customers secure their data, identities, and configurations, and the split varies by service type.

Insecure settings in cloud services, such as public storage buckets, overly broad permissions, or disabled logging. These errors are a leading cause of cloud data exposure because they are easy to introduce and hard to see.

Controls that limit what a container can reach, since containers share the host kernel and are not as separated as virtual machines. Hardened images, dropped capabilities, and runtime monitoring reduce breakout and lateral movement.