- CIA Triad
- The foundational security model of Confidentiality, Integrity, and Availability used to evaluate and design protections for information and systems.
- Confidentiality
- The security property ensuring information is disclosed only to authorized individuals, entities, or processes.
- Integrity
- The security property ensuring data and systems are accurate, complete, and unaltered except by authorized action.
- Availability
- The security property ensuring authorized users can access information and systems when needed.
- Non-repudiation
- A security assurance that a party cannot deny having performed an action, typically supported by digital signatures and audit logs.
- Risk
- The potential for loss or harm resulting from a threat exploiting a vulnerability, generally assessed by likelihood and impact.
- Threat
- Any circumstance or event with the potential to cause harm to an asset, such as a hacker, malware, or natural disaster.
- Vulnerability
- A weakness in a system, process, or control that could be exploited by a threat to cause harm.
- Defense in Depth
- A layered security strategy that combines multiple independent controls so a single point of failure does not compromise the whole system.
- Least Privilege
- An access control principle requiring users and processes be granted only the minimum permissions necessary to perform their function.
- Separation of Duties
- A control that splits a sensitive task among multiple people to prevent any single individual from acting alone in a way that causes harm or fraud.
- Business Continuity Plan (BCP)
- A documented plan describing how an organization will continue critical business functions during and after a disruptive event.
- Incident Response
- The structured process an organization follows to prepare for, detect, contain, eradicate, and recover from security incidents.
- Discretionary Access Control (DAC)
- An access control model in which the resource owner determines who is granted access to that resource.
- Mandatory Access Control (MAC)
- An access control model where access decisions are enforced by the system based on fixed classification labels, not by resource owners.
- Role-Based Access Control (RBAC)
- An access control model that assigns permissions to defined roles, and users inherit permissions through their assigned role(s).
- Firewall
- A network security device or software that filters incoming and outgoing traffic based on predefined rules.
- Intrusion Detection System (IDS)
- A monitoring tool that analyzes network or host activity for signs of malicious behavior and generates alerts without blocking traffic.
- Intrusion Prevention System (IPS)
- A security tool that actively detects and blocks malicious network traffic in real time.
- Virtual Private Network (VPN)
- A technology that creates an encrypted communication tunnel over a public or untrusted network to protect data in transit.
- Demilitarized Zone (DMZ)
- A network segment positioned between an untrusted external network and a trusted internal network, used to host public-facing services securely.