Cybersecurity Foundation key terms

The principle that information is disclosed only to people or systems authorized to see it. It is protected through encryption, access control, and careful handling of sensitive data throughout its lifecycle.

The principle that data and systems remain accurate, complete, and unaltered except through authorized changes. Controls such as hashing, version control, and change management help detect or prevent unauthorized modification.

The principle that systems and data remain accessible to authorized users when needed. Redundancy, backups, capacity planning, and resilience against denial-of-service attacks all support this goal.

A model describing information security as the balance of confidentiality, integrity, and availability. Nearly every control or risk decision can be evaluated by how it affects these three core properties.

The assurance that a party cannot credibly deny having performed an action, such as sending a message or approving a transaction. Digital signatures and reliable audit logs are common mechanisms that provide it.

A weakness in software, configuration, process, or physical environment that an attacker could exploit. Vulnerabilities are identified through scanning, testing, and review, then managed by patching or other mitigation.

Any circumstance or actor with the potential to cause harm to an asset by exploiting a vulnerability. Threats may be malicious people, natural events, or accidental errors, and are assessed separately from likelihood.

The potential for loss or harm, usually expressed as a combination of the likelihood of an event and its impact. Risk is identified, assessed, and then treated by avoiding, reducing, transferring, or accepting it.

A technique, tool, or piece of code that takes advantage of a vulnerability to achieve an attacker's objective. An exploit turns a theoretical weakness into a practical security incident.

A person or group that may carry out an attack, ranging from opportunistic criminals to nation-state groups and insiders. Understanding their motivation and capability helps prioritize defenses.

The path or method an attacker uses to reach and compromise a target, such as phishing email, exposed remote services, or removable media. Reducing available vectors limits an attacker's options.

The total set of points where an attacker could try to enter or influence a system, including network services, applications, users, and third parties. Minimizing it reduces exposure.

A layered approach that places multiple independent controls between an attacker and an asset, so failure of one control does not mean total compromise. Layers may be technical, administrative, and physical.

The practice of granting users, services, and processes only the access needed to perform their tasks, and no more. It limits the damage that a compromised account or faulty program can cause.

Dividing a network or system into isolated zones so that compromise or failure in one area does not spread freely to others. Firewalls, VLANs, and cloud security groups are common implementation tools.

The process of verifying that a user, device, or service is who or what it claims to be. It typically relies on passwords, tokens, biometrics, or certificates, often combined through multi-factor authentication.

The process of deciding what an authenticated identity is permitted to do, such as which files it may read or which actions it may perform. It is enforced through access control rules and roles.

Authentication that requires two or more different factor types, such as something you know plus something you have. It reduces the risk that a stolen password alone grants access.

Transforming readable data into ciphertext using a key so that only holders of the correct key can recover the original. It protects confidentiality in transit and at rest.

Encryption in which the same secret key is used to encrypt and decrypt data. It is fast and suited to bulk data, but the key must be shared securely between parties.

Encryption that uses a mathematically related key pair: a public key to encrypt or verify, and a private key to decrypt or sign. It simplifies key distribution and enables digital signatures.

A one-way function that converts data of any size into a fixed-length value used to verify integrity. A good hash changes completely when input changes and cannot feasibly be reversed.

A cryptographic value created with a private key that lets a recipient verify the signer's identity and confirm the data was not altered. It supports integrity and non-repudiation.

The policies, roles, and systems that issue, distribute, renew, and revoke digital certificates. It lets parties trust public keys by relying on certificate authorities and validation processes.

A social engineering attack that tricks people into revealing credentials, approving payments, or running malicious content, usually through deceptive email or messages. Reporting and user awareness reduce its success.

Manipulating people through trust, urgency, or authority to obtain information or cause them to take unsafe actions. It bypasses technical controls by targeting human behavior instead.

Software intentionally designed to disrupt systems, steal data, or gain unauthorized access, including viruses, worms, trojans, and ransomware. Prevention relies on patching, filtering, and endpoint protection.

Malware that encrypts or steals data and demands payment for restoration or to prevent disclosure. Reliable offline backups and rapid detection are the most dependable recovery measures.

An attack that makes a service unavailable by exhausting its resources, such as bandwidth, connections, or processing capacity. Distributed variants use many sources to amplify the effect.

Risk arising from people within the organization, such as employees or contractors, who misuse legitimate access, whether maliciously or accidentally. Monitoring, least privilege, and offboarding controls reduce it.

A vulnerability that is unknown to the vendor or has no available patch at the time of exploitation. Defenses rely on behavior-based detection, segmentation, and rapid intelligence sharing.

The structured process of identifying, testing, deploying, and verifying software updates that fix vulnerabilities or defects. Consistent patching removes a large share of exploitable weaknesses.

A safeguard or countermeasure that reduces risk, categorized as preventive, detective, or corrective, and as technical, administrative, or physical. Controls are selected based on assessed risk and cost.

A management-approved statement of requirements and expectations that guides how an organization protects information. It sets direction for standards, procedures, and enforcement across the program.

The structures, roles, and decision processes that direct and oversee a security program, including accountability at senior levels. It aligns security activities with business objectives and legal obligations.

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It guides decisions about which risks to treat and how much control investment is justified.

The process of choosing and applying options to address assessed risk: avoid the activity, reduce it with controls, transfer it, or accept it. Residual risk is then monitored and reviewed.

An assessment that identifies critical business functions and estimates the consequences of their disruption over time. Its outputs, such as recovery objectives, drive continuity and recovery planning.

Documented arrangements for keeping essential operations running during and after a disruptive event. It covers roles, alternate processes, communications, and testing of continuity arrangements.

Procedures for restoring technology systems and data after a major outage or disaster, within agreed recovery targets. It is exercised regularly and aligned with continuity and impact analysis results.

The organized process of preparing for, detecting, containing, eradicating, and recovering from security incidents, followed by lessons learned. Clear roles and playbooks shorten attacker dwell time.

A team and facility that continuously monitors, detects, and responds to security events across the organization. It typically combines alert triage, threat intelligence, and incident escalation.

An ongoing program that teaches staff to recognize threats, follow secure practices, and report suspicious activity. It is most effective when reinforced by realistic simulations and clear procedures.

Adherence to laws, regulations, standards, and contractual obligations that apply to the organization. Compliance is verified through audits and evidence, but does not by itself guarantee adequate security.