- CIA Triad
- The foundational security model comprising Confidentiality, Integrity, and Availability, used to evaluate and design protections for information systems.
- Zero Trust
- A security model that assumes no user or device is inherently trusted, requiring continuous verification of identity and context before granting access to resources, regardless of network location.
- Attack Surface
- The total sum of all points where an unauthorized user could attempt to enter or extract data from a system, including software, hardware, and human vectors.
- Threat Actor
- An individual or group responsible for carrying out a cyberattack, such as a nation-state, hacktivist, insider, or organized crime group, each with different motivations and capabilities.
- Advanced Persistent Threat (APT)
- A sophisticated, often state-sponsored threat actor that gains and maintains unauthorized, long-term access to a network to conduct stealthy, targeted operations such as espionage or data theft.
- Botnet
- A network of compromised, internet-connected devices controlled remotely by an attacker, commonly used to launch distributed denial-of-service attacks or spam campaigns.
- Privilege Escalation
- A technique in which an attacker gains higher-level access than originally granted, either vertically (obtaining admin rights) or horizontally (accessing other accounts at the same privilege level).
- SQL Injection
- An attack technique that inserts malicious SQL statements into input fields to manipulate a database, potentially exposing, altering, or deleting data.
- Cross-Site Scripting (XSS)
- A web application vulnerability where an attacker injects malicious scripts into trusted web pages, which then execute in the browsers of unsuspecting users.
- Public Key Infrastructure (PKI)
- The framework of policies, roles, hardware, and software used to create, manage, distribute, and revoke digital certificates that bind public keys to identities.
- Certificate Authority (CA)
- A trusted entity that issues and digitally signs digital certificates, vouching for the authenticity of the public key and identity contained within them.
- Security Information and Event Management (SIEM)
- A platform that aggregates, correlates, and analyzes log and event data from across an organization's systems in real time to detect and support response to security incidents.
- Security Orchestration, Automation, and Response (SOAR)
- A set of tools and processes that automate incident response workflows, integrating with security tools to execute predefined playbooks and reduce manual response time.
- Data Loss Prevention (DLP)
- A set of tools and policies designed to detect and prevent sensitive data from being exfiltrated, leaked, or improperly accessed outside authorized boundaries.
- Role-Based Access Control (RBAC)
- An access control model that assigns permissions to users based on their organizational role rather than individually, simplifying administration and enforcing least privilege.
- Single Sign-On (SSO)
- An authentication mechanism that allows a user to log in once and gain access to multiple independent systems or applications without re-authenticating for each.
- Federation
- A trust relationship between separate organizations or identity providers that allows users to authenticate once and access resources across multiple systems or domains.
- Penetration Testing
- An authorized, simulated cyberattack against a system performed to identify exploitable vulnerabilities before real attackers can find and use them.
- Vulnerability Scanning
- An automated process of identifying known security weaknesses in systems, applications, or networks by comparing them against databases of known vulnerabilities.
- Incident Response Plan
- A documented set of procedures for detecting, containing, eradicating, and recovering from security incidents, typically following phases such as preparation, identification, containment, eradication, recovery, and lessons learned.
- Business Continuity Plan (BCP)
- A documented strategy outlining how an organization will continue critical operations during and after a disruptive event.
- Data Classification
- The process of categorizing data based on its sensitivity and criticality (e.g., public, internal, confidential, restricted) to apply appropriate handling and protection controls.
- Segmentation
- The practice of dividing a network or system into isolated zones or subnets to limit the scope of a compromise and enforce controlled access between areas.
- Threat Intelligence
- Evidence-based knowledge about existing or emerging threats, including indicators of compromise and adversary tactics, used to inform proactive defensive decisions.