CES-WE key terms

Any circumstance, actor, or event with the potential to exploit a weakness and cause harm to an organization's systems, data, or operations. Threats exist independently of whether a specific weakness is actually present.

A weakness in software, hardware, configuration, or procedure that a threat could exploit. A vulnerability by itself causes no harm; it becomes dangerous only when a capable threat can reach it.

The likelihood that a threat will exploit a vulnerability together with the resulting business impact. Risk combines probability and consequence, so it falls when either the chance of occurrence or the severity of harm drops.

A safeguard or countermeasure put in place to reduce risk. Controls may be preventive, detective, or corrective, and are often grouped as administrative, technical, or physical.

The principle that each user, process, or device should receive only the access rights needed for its assigned task, and only for as long as needed. It limits damage when an account or component is compromised.

A layered strategy that places multiple independent safeguards between an attacker and a protected asset, so that failure of any single control does not by itself result in compromise.

The process of verifying that an entity, whether a person, device, or service, is who or what it claims to be. It normally relies on something the entity knows, has, or is.

The process of deciding which resources and actions an already-authenticated entity is permitted to use. Authorization answers what you may do, while authentication answers who you are.

The collection and retention of records showing what entities did, when, and from where. Good accounting supports incident investigation, non-repudiation, and detection of policy violations.

A framework that bundles authentication, authorization, and accounting into a single service model, letting a central server decide who may connect and record what each session does.

An encryption method in which the same secret key both encrypts and decrypts data. It is fast and well suited to bulk traffic, but every pair of parties must share the key securely in advance.

An encryption method that uses a mathematically related key pair: a public key anyone may see and a private key the owner keeps secret. It eases key distribution but is slower than symmetric algorithms.

A one-way function that maps input of any length to a fixed-length digest. Changing even one input bit should alter the output completely, and recovering the original input from the digest must be impractical.

A value produced with a sender's private key that a recipient can verify using the matching public key, proving the data's origin and confirming it was not altered in transit.

The policies, roles, hardware, and software that let an organization issue, distribute, validate, renew, and revoke public-key certificates, usually anchored in one or more trusted certificate authorities.

A signed data structure that binds a public key to an identity and states the purposes and validity period for which the binding is asserted. Recipients rely on it only if they trust the issuing authority.

A protocol that secures connections between clients and servers by negotiating cryptographic parameters, authenticating the server and optionally the client, then encrypting the data that follows to protect it in transit.

An access model that treats no network location as inherently trusted and requires every request to be authenticated, authorized, and continuously evaluated using identity, device health, and context.

A secret value configured on both a client and an access point before they communicate, used to derive session keys. Because every device holding the same key is indistinguishable, it suits small networks better than large enterprises.

The key-establishment handshake introduced with WPA3 that replaces the older pre-shared key exchange. It resists offline guessing of recorded handshakes and provides forward secrecy even if a password is later disclosed.

A port-based access control standard that keeps a network port or wireless association blocked until the connecting device completes an authentication exchange with a backend server.

An authentication framework, not a single method, that carries many credential types between a supplicant and an authentication server. Specific methods such as EAP-TLS or PEAP define how credentials are actually proved.

A widely used protocol for carrying authentication, authorization, and accounting information between a network access device and a central server, letting one identity store serve many access points.

The human-readable name that identifies a wireless network. It is broadcast in management frames for convenience but is not a security boundary, since anyone nearby can observe it and copy it.

An unauthorized wireless access point attached to or placed near an organization's network. Even when added innocently, it can bypass perimeter controls and offer attackers an unmonitored path inward.

A fraudulent access point that imitates a legitimate network name to lure nearby devices into connecting, so the operator can capture credentials or relay and alter the victim's traffic.

A denial-of-service technique that sends forged management frames telling clients they have been disconnected, forcing repeated reconnection attempts that can be captured or used to push victims toward a malicious network.

Wireless intrusion detection and prevention systems monitor radio traffic for known attack patterns and policy violations, alerting administrators and, in prevention mode, actively blocking or containing suspicious devices.

A relative measure of the power at which a wireless receiver hears a signal, usually expressed in decibel-milliwatts. Values are comparative rather than absolute and vary between hardware vendors.

The difference between the strength of the wanted signal and the level of background noise at a receiver, expressed in decibels. Higher values support faster, more reliable links and more complex modulation.

Signal overlap caused by two or more access points using the same channel in the same area, forcing devices to contend for airtime and reducing throughput even when signal strength appears adequate.

A deliberate assignment of radio channels to access points so that neighboring cells do not share a channel and non-overlapping channels are reused only at a safe distance.

A radio technique that uses multiple transmit and receive antennas to send several data streams at once or to improve reliability through spatial diversity, raising throughput without using extra spectrum.

A startup process in which each stage verifies a cryptographic signature on the next stage before running it, so tampered firmware or bootloaders are detected and refused.

An over-the-air or manual update package that carries a digital signature the device checks before installation, preventing attackers from installing modified code on deployed equipment.

A web page that intercepts a client's first requests and requires an action, such as accepting terms or entering credentials, before normal network access is granted. It is a convenience control, not strong authentication.

A logical subdivision of a physical network that keeps traffic from different groups separate at layer two. Correct tagging and trunk configuration matter, because a misconfigured trunk can merge segments.

A structured measurement of radio coverage and interference in a planned or existing deployment, used to choose access point placement, channel assignments, and antenna settings before and after installation.