ISC Engineer key terms

A strategy that layers multiple independent security controls across people, process, and technology so that failure of any single control does not expose the whole environment to compromise.

The practice of granting each user, service, or process only the permissions strictly required to perform its function, and no more, limiting the blast radius of misuse or compromise.

A control that divides a sensitive task among two or more people so no single individual can complete a high-risk action alone, reducing fraud and error.

An authorization model where permissions are attached to job roles rather than individuals, and users receive access by being assigned to the appropriate role.

An authorization model that grants or denies access by evaluating attributes of the subject, resource, action, and environment against policy rules, enabling fine-grained and context-aware decisions.

A trust arrangement in which separate organizations or systems accept each other's authentication assertions, letting a user sign in once and access resources across domains.

An authentication mechanism that lets a user log in once and gain access to multiple applications or systems without re-entering credentials for each one.

Authentication that requires two or more independent evidence types, such as something you know plus something you have, so a stolen password alone is insufficient to gain access.

An attack or flaw in which a user or process gains permissions beyond those originally granted, often moving from standard user to administrator or from one account to another.

Tools and processes that vault, rotate, monitor, and approve use of high-power accounts such as administrators and service accounts to reduce abuse of standing privileges.

A security model that assumes no implicit trust based on network location and requires continuous verification of identity, device health, and context before granting each request.

Dividing a network into isolated zones with controlled traffic paths between them, so a compromise in one zone cannot move freely to others.

A network segment that hosts externally reachable services and is separated from the internal network by filtering controls, limiting exposure if a public-facing host is compromised.

An ordered list of permit and deny conditions evaluated against network traffic, typically matching on addresses, ports, and protocols to enforce the intended traffic policy.

An encrypted tunnel that carries traffic between a client or site and a trusted network over an untrusted medium, protecting confidentiality and integrity in transit.

A suite of protocols that authenticates and encrypts IP packets at the network layer, commonly used to build site-to-site and remote-access virtual private networks.

A protocol that establishes an encrypted, integrity-protected channel between two endpoints, authenticating the server with certificates and optionally the client.

The policies, processes, and systems that issue, distribute, validate, and revoke digital certificates, binding public keys to verified identities through trusted certificate authorities.

A signed list published by a certificate authority naming certificates that are no longer valid before their expiry, which relying parties check during validation.

A method for querying a certificate authority in real time about whether a specific certificate has been revoked, offering more current status than a periodically published list.

Encryption that uses the same secret key for both encryption and decryption, offering high speed and efficiency but requiring secure key distribution between parties.

Encryption using a mathematically related key pair, where one key encrypts and the other decrypts, enabling secure key exchange and digital signatures without sharing a secret.

A cryptographic value computed over a message with a private key that a recipient can verify with the corresponding public key to confirm origin and detect tampering.

A one-way algorithm that maps input of any length to a fixed-length digest, such that small input changes produce very different outputs and the original cannot feasibly be recovered.

Adding a unique random value to each password before hashing so identical passwords yield different digests, defeating precomputed lookup tables and shared-hash attacks.

Periodically replacing cryptographic keys with new ones and retiring the old, limiting the volume of data protected by any single key and reducing exposure after compromise.

Storing a copy of cryptographic keys with a trusted third party so authorized parties can recover data if the original key holder is unavailable or loses access.

Automated probing of systems and applications to identify known weaknesses, missing patches, and misconfigurations, producing findings that feed into remediation tracking.

Authorized simulated attacks that chain real weaknesses together to demonstrate practical exploitability and business impact, going beyond what automated scanning reports.

A structured analysis performed during design that identifies assets, adversaries, attack paths, and required mitigations before code is built, guiding secure architecture decisions.

A platform that centralizes logs from many sources, correlates events against detection rules, and alerts analysts to suspicious activity across the environment.

The policy and practice of keeping system and security logs for a defined period, supporting investigations, audits, and compliance obligations before records are purged.

Documented, unbroken record of who handled evidence, when, and how, proving that collected items were not altered and remain admissible in investigations or legal proceedings.

A documented set of roles, communication paths, and phased procedures for detecting, containing, eradicating, and recovering from security incidents, with lessons learned afterward.

The maximum acceptable elapsed time to restore a business process or system after disruption, driving backup design and continuity investment decisions.

The maximum acceptable amount of data loss measured in time, indicating how recent a backup or replica must be to meet continuity requirements.

A study that identifies critical business functions, quantifies the harm from their disruption over time, and establishes recovery priorities and objectives.

A structured process that identifies threats and vulnerabilities, estimates likelihood and impact, and ranks risks so treatment decisions can be prioritized and justified.

Choosing how to handle an identified risk by mitigating it with controls, transferring it such as through insurance, avoiding the activity, or formally accepting the residual exposure.

The risk that remains after controls have been applied, which management must explicitly accept or further reduce based on the organization's risk tolerance.

A governance document listing each control from a chosen standard, stating whether it applies, how it is implemented, and the justification for any exclusion.

Evaluating whether a security control is designed appropriately and operates effectively over time, producing evidence used in audits and continuous improvement.

Curated information about adversaries, their tools, and indicators of compromise that helps defenders prioritize detections and proactively block known attack activity.

An automated attack that replays username and password pairs stolen from one breach against many other services, exploiting password reuse across sites.

A control requiring two authorized individuals to act together, or to be present, before a highly sensitive operation can proceed, preventing solitary misuse of powerful capabilities.