NSA Assessment key terms

Layering multiple independent security controls across people, process, and technology so that failure of any single control does not expose the whole environment to compromise.

Granting each user, service, or process only the permissions strictly needed to perform its function, and no more, to limit the blast radius of misuse or compromise.

A segmented network zone that hosts externally reachable services and sits between the untrusted internet and the protected internal network, subject to stricter filtering rules.

A packet filter that tracks connection state and permits return traffic only for sessions it observed being initiated, rather than evaluating each packet in isolation.

An ordered set of permit and deny rules applied to interfaces, packets, or resources; the first matching rule determines the outcome.

Encryption where the same secret key both encrypts and decrypts data, offering high speed but requiring secure key distribution and management between parties.

Encryption using a mathematically related key pair, where the public key encrypts or verifies and the private key decrypts or signs, removing the need to share a secret.

A cryptographic value computed over a message with a private key, letting any holder of the matching public key verify origin integrity and detect tampering.

A one-way algorithm mapping arbitrary input to a fixed-length digest, used for integrity checks and password storage because collisions and preimages are computationally infeasible.

A unique random value stored alongside a password hash and combined with the password before hashing, so identical passwords produce different digests and precomputed tables fail.

The lifecycle of generating, distributing, storing, rotating, revoking, and destroying cryptographic keys under controlled procedures and separation of duties.

Public key infrastructure: the hierarchy of certificate authorities, registration processes, and revocation services that binds public keys to verified identities through signed certificates.

Transport Layer Security: a protocol that negotiates keys and encrypts application traffic in transit, providing confidentiality, integrity, and server authentication via certificates.

A property of key exchange where compromise of a long-term private key does not reveal past session keys, because each session used an ephemeral key pair.

The TCP connection setup exchange of SYN, SYN-ACK, and ACK that synchronizes sequence numbers and confirms both endpoints are reachable before data flows.

A denial-of-service attack that sends many initial connection requests without completing the handshake, exhausting a server's backlog of half-open connections.

An attack that degrades or halts availability by exhausting bandwidth, connection tables, or processing capacity rather than by stealing data or credentials.

Recording raw network frames with timestamps on an interface, producing evidence for protocol analysis, troubleshooting, and incident reconstruction.

Examining summarized connection records, such as source, destination, ports, byte counts, and timing, to spot traffic patterns without inspecting full packet payloads.

A router and switch export format that records metadata about each observed connection, enabling volumetric and behavioral traffic analysis across large networks.

Intrusion detection system: a sensor that inspects traffic or host activity against signatures or behavioral baselines and raises alerts without blocking the activity.

Intrusion prevention system: an inline sensor that detects malicious traffic and actively drops or resets it, adding blocking capability but also risk of disrupting legitimate sessions.

An alert raised for activity that is actually benign, which wastes analyst time and erodes trust in detection tooling when it occurs frequently.

Adjusting detection rules, thresholds, and exclusions over time so alerts reflect the local environment, reducing noise while preserving coverage of real threats.

Security information and event management: a platform that centralizes logs from many sources, correlates events, and supports alerting, dashboards, and investigation workflows.

The policy and storage practice defining how long event records are kept, balancing investigation and compliance needs against cost and privacy obligations.

The phased process of preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned used to manage security incidents consistently.

Short-term actions that stop an incident from spreading, such as isolating a host or blocking a connection, while preserving evidence for later analysis.

Documented, unbroken record of who handled evidence, when, and how, required to show that collected data has not been altered or contaminated.

An observable artifact such as a malicious file hash, domain, or registry key that suggests a system has already been breached and supports scoping an investigation.

Proactively searching telemetry for signs of adversary activity that existing detections missed, driven by hypotheses rather than waiting for alerts to fire.

Gaining permissions beyond those originally granted, whether by exploiting a vulnerability or abusing misconfiguration, to reach higher-value accounts or systems.

Assigning permissions to roles rather than individuals, then mapping users to roles, which simplifies administration and supports consistent enforcement of least privilege.

Requiring two or more independent credential types, such as a password plus a hardware token, so a single stolen secret is insufficient to authenticate.

A ticket-based authentication protocol in which a trusted key distribution center issues time-limited tickets that services accept without handling user passwords directly.

An architecture that treats no network location as inherently trusted and verifies identity and device posture for every request before granting access to resources.

Capping how many requests a client may make in a time window, protecting services from brute force, scraping, and volumetric abuse while preserving availability for legitimate users.