ISC2 CISSP: key terms

Flashcards for this exam ISC2 CISSP guide Class dates

• Abuse CaseA description of how a user could intentionally misuse a system's functionality to cause harm, used to derive security requirements and tests.Intermediate
• Acceptable Use Policy (AUP)Policy defining permitted and prohibited uses of organizational systems, networks, and data by users.Foundational
• Access ControlSecurity mechanisms that determine who or what can view, use, or change resources, and under what conditions.Foundational
• Access Control List (ACL)Ordered list of rules attached to an object or interface that permits or denies access to specific subjects or traffic.Foundational
• Access Control VestibuleSmall space with two interlocking doors where only one opens at a time, preventing tailgating; formerly called a mantrap.Foundational
• Access ReviewPeriodic verification by managers or owners that users' access rights are still appropriate.Intermediate
• Access TokenCredential issued by an authorization server that a client presents to an API to access protected resources.Intermediate
• Account LockoutDisabling an account temporarily or permanently after a set number of failed login attempts.Foundational
• AccountabilityThe ability to trace actions on a system to a unique, authenticated identity.Foundational
• Active Directory (AD)Microsoft's on-premises directory service for Windows domains, using LDAP, Kerberos, and DNS.Foundational
• Address Space Layout Randomization (ASLR)An OS exploit mitigation that randomizes where code, stack, heap and libraries are loaded in memory.Intermediate
• Administrative ControlA security control based on policies, procedures, training, and personnel management.Foundational
• AdmissibilityWhether evidence meets legal standards to be accepted in court, such as relevance, reliability and proper handling.Intermediate
• Advanced Encryption Standard (AES)NIST-standard symmetric block cipher (Rijndael) with a 128-bit block and 128-, 192-, or 256-bit keys.Foundational
• Advanced Persistent Threat (APT)A well-resourced, stealthy adversary that gains long-term access to a target to steal data or prepare for disruption.Intermediate
• Air GapPhysically isolating a system or network from all other networks, including the internet.Foundational
• Annex AReference control set in ISO/IEC 27001 listing 93 information security controls in four themes.Intermediate
• Annualized Loss Expectancy (ALE)Expected yearly monetary loss from a risk: ALE = SLE x ARO.Foundational
• Annualized Rate of Occurrence (ARO)Estimated number of times a specific threat event is expected to occur in one year.Foundational
• AnonymizationIrreversibly transforming personal data so individuals can no longer be identified by any means reasonably likely to be used.Intermediate
• Application ControlsControls built into business applications to ensure complete, accurate, and valid processing of transactions.Foundational
• Application Security ProgramThe organizational structure, policies, tools and processes that manage security risk across an organization's software portfolio.Intermediate
• Application-Level Gateway (ALG)Proxy firewall that terminates connections and inspects traffic at the application layer for specific protocols.Intermediate
• Argon2Memory-hard password hashing function that won the 2015 Password Hashing Competition; Argon2id is recommended.Advanced
• Asset ValuationDetermining the worth of an asset, including replacement cost, revenue impact, and intangible value, to support risk analysis.Intermediate
• Asymmetric EncryptionEncryption using a mathematically related key pair: a public key to encrypt or verify and a private key to decrypt or sign.Foundational
• Attack SurfaceThe total set of points where an unauthorized user could try to enter or extract data from a system.Foundational
• Attack Surface AnalysisIdentifying and assessing all the points where an attacker could interact with or send input to an application.Foundational
• Attack TreeA hierarchical diagram with an attacker's goal at the root and the alternative ways to achieve it as child nodes.Intermediate
• AttestationProcess by which a device or workload provides cryptographic evidence of its identity and integrity to a verifier.Advanced
• Attribute-Based Access Control (ABAC)Access control model that evaluates attributes of the subject, object, action, and environment against policies.Intermediate
• Audit CharterFormal document defining internal audit's purpose, authority, responsibility, and accountability.Foundational
• Audit EvidenceInformation used by auditors to arrive at conclusions on which opinions are based.Foundational
• Audit ScopeBoundaries of an audit: the systems, locations, processes, period, and organizational units covered.Foundational
• Audit TrailChronological record of system activities that allows reconstruction of events and accountability.Foundational
• Auditor IndependenceFreedom from conditions that threaten the auditor's ability to perform work objectively, in fact and in appearance.Foundational
• Authenticated Encryption with Associated Data (AEAD)Encryption that provides confidentiality, integrity, and authenticity, while also authenticating unencrypted header data.Advanced
• AuthenticationVerifying that a user, device, or process is who or what it claims to be.Foundational
• Authentication FactorCategory of evidence used to prove identity: something you know, have, or are, plus contextual attributes.Foundational
• Authentication Header (AH)IPsec protocol (IP protocol 51) that provides integrity, data origin authentication, and anti-replay but no encryption.Intermediate
• Authentication, Authorization, and Accounting (AAA)Framework that verifies identity, determines permitted actions, and records what users do.Foundational
• Authenticator Assurance Level (AAL)NIST SP 800-63B rating (AAL1-AAL3) of confidence that the person authenticating controls the account's authenticators.Advanced
• AuthenticityAssurance that data, a message, or an entity is genuine and comes from its claimed source.Foundational
• AuthorizationDetermining what an authenticated subject is permitted to access or do.Foundational
• Authorization PackageSet of documents presented to the authorizing official for an authorization decision.Intermediate
• Authorization to Operate (ATO)Official management decision by an authorizing official to accept the risk of operating a federal information system.Intermediate
• Authorizing Official (AO)Senior official with authority to formally assume responsibility and accept risk for operating a system.Intermediate
• AvailabilitySecurity goal ensuring authorized users have timely, reliable access to data and systems when needed.Foundational
• Avalanche EffectProperty where a tiny change in input, such as one bit, causes a large, unpredictable change in output.Intermediate
• Backup TypesThe main backup methods: full, incremental and differential, plus snapshots and synthetic full backups.Foundational
• bcryptAdaptive password-hashing function based on Blowfish with a configurable cost factor.Intermediate
• Bell-LaPadula Model (BLP)Formal confidentiality model enforcing 'no read up, no write down' using security labels.Advanced
• Biba ModelFormal integrity model enforcing 'no read down, no write up' to prevent corruption of higher-integrity data.Advanced
• Biometric AuthenticationVerifying identity using unique physiological or behavioral characteristics.Foundational
• Birthday AttackCryptographic attack exploiting the birthday paradox to find hash collisions in about the square root of the output space.Intermediate
• Block CipherA symmetric cipher that encrypts fixed-size blocks of data, such as 128 bits, using a key.Foundational
• BlockchainDistributed, append-only ledger where blocks are cryptographically chained by hashes to resist tampering.Intermediate
• BlowfishSymmetric block cipher by Bruce Schneier with a 64-bit block and variable key length from 32 to 448 bits.Intermediate
• BollardShort, sturdy post that prevents vehicles from entering or ramming into a protected area while allowing pedestrians through.Foundational
• Breach Notification LawsLaws requiring organizations to notify individuals, regulators, or others after unauthorized access to personal information.Foundational
• Brewer-Nash ModelAccess control model, also called the Chinese Wall, that prevents conflicts of interest by restricting access dynamically.Advanced
• Business Continuity Planning (BCP)Planning to keep essential business functions operating during and after a disruption.Foundational
• Business Email Compromise (BEC)A fraud in which attackers impersonate or take over business email accounts to trick staff into sending money or data.Intermediate
• Business Impact Analysis (BIA)An analysis that identifies critical business functions and the impact of their disruption over time.Foundational
• CA/Browser ForumIndustry body of certificate authorities and browser/OS vendors that sets rules for publicly trusted certificates.Advanced
• California Consumer Privacy Act (CCPA)California law, effective 2020 and amended by the CPRA, granting consumers privacy rights over personal information held by businesses.Foundational
• Caller ID SpoofingFalsifying the calling number or name presented on a call to impersonate a trusted party or hide the caller.Foundational
• Capability Maturity Model Integration (CMMI)Process improvement model defining maturity and capability levels from initial to optimizing.Intermediate
• Cardholder Data Environment (CDE)People, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus connected systems.Intermediate
• Certificate AuthorityTrusted entity that verifies identities and issues, signs, and revokes digital certificates.Foundational
• Certificate Lifecycle Management (CLM)Processes and tools to discover, issue, deploy, renew, and revoke certificates across an organization.Intermediate
• Certificate LifetimeThe validity period of a certificate, between its notBefore and notAfter dates.Intermediate
• Certificate PinningAssociating a host with an expected certificate or public key so other valid-looking certificates are rejected.Advanced
• Certificate Revocation List (CRL)CA-signed list of serial numbers of certificates that have been revoked before their expiration date.Foundational
• Certificate Signing Request (CSR)Message sent to a CA containing a public key and subject information, signed with the requester's private key.Foundational
• Certificate Transparency (CT)Public, append-only logs of issued TLS certificates that let anyone monitor which certificates exist for a domain.Intermediate
• Certificate-Based Authentication (CBA)Authenticating a user or device by proving possession of the private key matching a trusted certificate.Intermediate
• Certification Practice Statement (CPS)Document describing how a CA operates and implements its certificate policy.Advanced
• ChaCha20-Poly1305AEAD algorithm combining the ChaCha20 stream cipher with the Poly1305 authenticator, standardized in RFC 8439.Advanced
• Chain of CustodyDocumentation that records every person who handled evidence, when, why and how, from collection to presentation.Foundational
• Chain of TrustSequence of certificates from an end-entity certificate through intermediates to a trusted root CA.Foundational
• Challenge-Handshake Authentication Protocol (CHAP)PPP authentication protocol using a three-way challenge-response with a hash of a shared secret.Intermediate
• Chief Information Security Officer (CISO)Senior executive responsible for the organization's information security strategy, program, and risk communication.Foundational
• CIA TriadThe three core goals of information security: confidentiality, integrity, and availability.Foundational
• CipherAn algorithm that performs encryption and decryption.Foundational
• Cipher Block Chaining (CBC)Block cipher mode in which each plaintext block is XORed with the previous ciphertext block before encryption.Intermediate
• Cipher SuiteNamed combination of algorithms used by TLS for key exchange, authentication, bulk encryption, and hashing.Intermediate
• CiphertextThe unreadable, encrypted output of a cipher that requires the correct key to decrypt.Foundational
• CIS BenchmarksConsensus-based secure configuration guides for operating systems, cloud platforms, applications, and devices.Foundational
• CIS Critical Security Controls (CIS Controls)Prioritized set of 18 cybersecurity safeguard groups from the Center for Internet Security.Foundational
• CIS Implementation Groups (IG)Three tiers (IG1, IG2, IG3) prioritizing CIS Controls safeguards by organizational risk and resources.Intermediate
• CISA Zero Trust Maturity Model (ZTMM)CISA framework describing zero trust progress across five pillars and four maturity stages.Advanced
• Clark-Wilson ModelCommercial integrity model using well-formed transactions and separation of duties to protect data.Advanced
• Client CertificateCertificate issued to a user or device to authenticate it to a server or network.Intermediate
• Client to Authenticator Protocol (CTAP)FIDO protocol for communication between a client device and an external authenticator over USB, NFC, or Bluetooth.Advanced
• Code SigningDigitally signing software so users and systems can verify its publisher and that it has not been modified.Foundational
• Code Signing CertificateCertificate used to digitally sign software so users can verify its publisher and integrity.Intermediate
• Cold SiteAn alternate facility with basic infrastructure such as power and space but no ready equipment or data.Foundational
• Column-Level EncryptionEncrypting specific database columns so sensitive fields remain protected even from users with table access.Intermediate
• Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)NSA's quantum-resistant algorithm suite and transition timeline for US national security systems.Advanced
• Common Attack Pattern Enumeration and Classification (CAPEC)MITRE's catalog of common attack patterns describing how adversaries exploit known weaknesses.Intermediate
• Common ControlSecurity or privacy control inherited by multiple systems and provided by an organizational entity.Intermediate
• Common Criteria (CC)International standard (ISO/IEC 15408) for evaluating the security of IT products against defined requirements.Advanced
• Common Vulnerabilities and Exposures (CVE)A public dictionary of unique identifiers for publicly disclosed cybersecurity vulnerabilities.Foundational
• Common Vulnerability Scoring System (CVSS)An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.Foundational
• Communication PlanThe part of the IR plan defining who is notified, how, when and by whom during an incident.Foundational
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• Complete MediationDesign principle that every access to every object must be checked for authorization every time.Intermediate
• ComplianceConforming to laws, regulations, contracts, standards, and internal policies.Foundational
• Compliance-Based Penetration TestingPenetration testing performed to satisfy a regulatory or standards requirement, such as PCI DSS or FedRAMP.Intermediate
• Confidential ComputingProtection of data in use by performing computation in hardware-based, attested trusted execution environments.Advanced
• ConfidentialitySecurity goal ensuring information is disclosed only to authorized people, processes, or systems.Foundational
• Confusion and DiffusionShannon's two properties of secure ciphers: hide the key-ciphertext relationship and spread plaintext influence across ciphertext.Advanced
• Context-Aware AuthenticationAuthentication that evaluates contextual signals such as location, device, time, and behavior.Intermediate
• Continuity of Operations Planning (COOP)A US federal government term for planning that ensures essential functions continue during a wide range of emergencies.Intermediate
• Continuous MonitoringMaintaining ongoing awareness of security, vulnerabilities, and threats to support risk decisions.Intermediate
• Control BaselinePredefined set of controls serving as a starting point for protecting a system at a given impact level.Intermediate
• Control DiversityCombining different types of controls, such as technical, administrative, and physical, to protect an asset.Intermediate
• Control FamilyGrouping of related controls in a catalog such as NIST SP 800-53, identified by a two-letter code.Intermediate
• Control ObjectiveStatement of the desired result or purpose to be achieved by implementing controls.Foundational
• Control TailoringModifying a control baseline to align with the organization's mission, environment, and risk.Intermediate
• Controlled Unclassified Information (CUI)Government-created or -owned information requiring safeguarding or dissemination controls under law, regulation, or policy, but not classified.Intermediate
• Coordinated Vulnerability Disclosure (CVD)A disclosure model where a researcher privately reports a flaw and publication is delayed until the vendor can release a fix.Intermediate
• Corrective ControlControl that reduces the impact of an event or restores systems after it occurs.Foundational
• Counter Mode (CTR)Block cipher mode that encrypts a nonce-plus-counter value and XORs the result with plaintext, acting like a stream cipher.Advanced
• Covert ChannelUnauthorized communication path that transfers information in a way that violates security policy.Advanced
• Crime Prevention Through Environmental Design (CPTED)Approach that uses building and landscape design to deter crime through natural surveillance, access control, and territoriality.Advanced
• Cross-CertificationEstablishing trust between separate PKI hierarchies by having CAs sign each other's certificates.Advanced
• Crossover Error Rate (CER)Point where a biometric system's FAR equals its FRR; lower CER means a more accurate system.Intermediate
• CryptanalysisThe study of analyzing and breaking cryptographic systems.Intermediate
• Crypto-ShreddingRendering encrypted data unrecoverable by securely destroying the encryption keys.Intermediate
• Cryptographic AgilityAbility to replace cryptographic algorithms, keys, and parameters quickly without major system redesign.Advanced
• Cryptographic KeyA secret or public value used by a cryptographic algorithm to transform data.Foundational
• Cryptographically Secure Pseudorandom Number Generator (CSPRNG)Random number generator whose output is unpredictable enough for cryptographic use.Advanced
• CryptographyThe science of protecting information by transforming it so only intended parties can read or verify it.Foundational
• CSF CoreTaxonomy of cybersecurity outcomes in the NIST CSF, organized as functions, categories, and subcategories.Intermediate
• CSF Detect FunctionCSF function for finding and analyzing possible cybersecurity attacks and compromises.Foundational
• CSF Govern Function (GV)CSF 2.0 function covering cybersecurity risk management strategy, expectations, policy, roles, oversight, and supply chain risk.Intermediate
• CSF Identify FunctionCSF function for understanding current cybersecurity risks to assets, suppliers, and the organization.Foundational
• CSF Implementation TiersFour levels describing the rigor of an organization's cybersecurity risk governance and management: Partial, Risk Informed, Repeatable, Adaptive.Intermediate
• CSF Organizational ProfileDescription of an organization's current or target cybersecurity posture in terms of CSF Core outcomes.Intermediate
• CSF Protect FunctionCSF function covering safeguards to manage cybersecurity risk, such as identity management, training, and data security.Foundational
• CSF Recover Function (RC)CSF function for restoring assets and operations affected by a cybersecurity incident.Foundational
• CSF Respond Function (RS)CSF function for taking action regarding a detected cybersecurity incident.Foundational
• Curve25519Elliptic curve designed by Daniel Bernstein for fast, safe Diffie-Hellman key agreement (X25519).Advanced
• Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)2022 US law directing CISA to require critical infrastructure entities to report covered cyber incidents and ransom payments.Advanced
• Cyber Threat Intelligence (CTI)Evidence-based knowledge about threats and threat actors that informs security decisions.Foundational
• Cybersecurity Supply Chain Risk Management (C-SCRM)Practices to identify, assess, and mitigate cybersecurity risks throughout the supply chain of products and services.Intermediate
• DAD TriadThe opposite of the CIA triad: disclosure, alteration, and destruction (denial) of information.Foundational
• Data at RestData stored on persistent media such as disks, databases, backups, or cloud object storage.Foundational
• Data BreachA security incident resulting in confirmed unauthorized access to or disclosure of sensitive data.Foundational
• Data Breach NotificationLegal or contractual obligations to inform regulators, affected individuals or partners after a qualifying data breach.Intermediate
• Data ClassificationCategorizing data by sensitivity and value to determine required protection and handling.Foundational
• Data ControllerEntity that determines the purposes and means of processing personal data.Foundational
• Data CustodianRole responsible for implementing and maintaining the controls that protect data on behalf of the data owner.Foundational
• Data Encryption Standard (DES)Legacy symmetric block cipher with a 64-bit block and 56-bit effective key, now insecure.Foundational
• Data Execution Prevention (DEP)A mitigation that marks memory regions such as the stack and heap as non-executable, using the CPU's NX/XD bit.Intermediate
• Data in TransitData moving across a network between systems, also called data in motion.Foundational
• Data in UseData actively being processed in memory or by a CPU, which is typically unencrypted during computation.Intermediate
• Data Loss Prevention (DLP)Technology that detects and blocks unauthorized transmission or storage of sensitive data.Foundational
• Data MaskingObscuring parts of sensitive data so it remains usable for some purposes without revealing the full value.Foundational
• Data OwnerSenior individual accountable for a data set, including its classification, access approval, and protection requirements.Foundational
• Data ProcessorEntity that processes personal data on behalf of and under the instructions of a controller.Foundational
• Data Protection Officer (DPO)GDPR-mandated role that independently advises on and monitors data protection compliance.Intermediate
• Data Retention PolicyPolicy defining how long categories of data are kept and how they are disposed of when no longer needed.Foundational
• Data SovereigntyPrinciple that data is subject to the laws and governance of the country in which it is collected or stored.Foundational
• Data StewardRole responsible for data quality, metadata, and appropriate use of data according to policy.Intermediate
• Defense in DepthLayering multiple, independent security controls so that the failure of one does not compromise the asset.Foundational
• Delphi TechniqueStructured, anonymous, iterative method for reaching expert consensus, often used in qualitative risk analysis.Intermediate
• DeprovisioningRemoving or disabling a user's accounts and access when they leave or no longer need it.Foundational
• Detective ControlControl that identifies and records an undesired event after or while it occurs.Foundational
• Deterrent ControlControl that discourages potential attackers or violators from attempting an action.Foundational
• DiameterAAA protocol designed as a successor to RADIUS, using TCP or SCTP on port 3868.Intermediate
• Diffie-Hellman (DH)Key agreement protocol that lets two parties derive a shared secret over an insecure channel.Foundational
• Digital CertificateElectronic document signed by a CA that binds a public key to an identity such as a domain, person, or device.Foundational
• Digital ForensicsThe scientific collection, preservation, analysis and presentation of digital evidence in a legally defensible manner.Foundational
• Digital Operational Resilience Act (DORA)EU Regulation (2022/2554), applicable from 17 January 2025, on ICT risk management for financial entities.Advanced
• Digital SignatureCryptographic value created with a private key over a message hash that proves origin, integrity, and non-repudiation.Foundational
• Digital Signature Algorithm (DSA)Legacy NIST signature algorithm based on the discrete logarithm problem.Intermediate
• Directive ControlControl that specifies required behavior, such as policies, standards, and procedures.Foundational
• Directory ServiceCentralized database that stores and organizes information about users, groups, devices, and resources for authentication and lookup.Foundational
• Disaster Recovery Plan (DRP)A documented plan for restoring IT systems, data and infrastructure after a disruptive event.Foundational
• Discretionary Access Control (DAC)Access control model where the owner of a resource decides who may access it.Foundational
• Domain Name System Security Extensions (DNSSEC)DNS extensions that digitally sign records so resolvers can verify their authenticity and integrity.Intermediate
• Domain Validation Certificate (DV)Certificate issued after the CA verifies only that the requester controls the domain.Foundational
• DREADA threat risk-rating model scoring Damage, Reproducibility, Exploitability, Affected users and Discoverability.Intermediate
• Dual ControlRequiring two or more authorized people to act together to perform a sensitive operation.Intermediate
• Due CareActing as a reasonable person would to protect assets, by implementing and maintaining appropriate safeguards.Foundational
• Due DiligenceInvestigation and analysis performed to understand risks before and while making decisions.Foundational
• Due Professional CareApplying the care and skill expected of a reasonably prudent and competent auditor.Intermediate
• E-DiscoveryThe process of identifying, preserving, collecting, reviewing and producing electronically stored information for legal proceedings.Intermediate
• Economy of MechanismSaltzer and Schroeder principle that security designs should be as simple and small as possible.Intermediate
• Edwards-curve Digital Signature Algorithm (EdDSA)Deterministic signature scheme on twisted Edwards curves, most commonly Ed25519.Advanced
• Electromagnetic LockLock that uses an electromagnet to hold a door closed, releasing when power is removed.Intermediate
• Electronic Codebook (ECB)Block cipher mode that encrypts each block independently, so identical plaintext blocks yield identical ciphertext.Intermediate
• Elevation of Privilege (EoP)Gaining capabilities beyond those that were authorized, such as a normal user gaining administrative rights.Foundational
• ElGamalAsymmetric encryption and signature scheme based on the discrete logarithm problem, an extension of Diffie-Hellman.Advanced
• Elliptic Curve Cryptography (ECC)Public key cryptography based on elliptic curve math, offering strong security with short keys.Intermediate
• Elliptic Curve Diffie-Hellman (ECDH)Diffie-Hellman key agreement performed with elliptic curve groups, providing equal security with smaller keys.Intermediate
• Elliptic Curve Digital Signature Algorithm (ECDSA)Digital signature algorithm using elliptic curve cryptography, standardized in FIPS 186-5.Intermediate
• Embedded System SecurityProtecting purpose-built computing devices with constrained resources, often running real-time operating systems and long-lived firmware.Intermediate
• Encapsulating Security Payload (ESP)IPsec protocol (IP protocol 50) that provides confidentiality, integrity, authentication, and anti-replay.Intermediate
• EncryptionConverting plaintext into ciphertext using an algorithm and key so only authorized parties can read it.Foundational
• Enterprise Risk Management (ERM)Organization-wide approach to identifying, assessing, and managing all risks to achieve objectives.Intermediate
• Enterprise Security ArchitectureStructured design of security controls, processes, and technologies aligned to an organization's business goals and risks.Intermediate
• EntropyMeasure of randomness or unpredictability, critical for generating strong keys and passwords.Intermediate
• Ephemeral KeyA key generated for a single session or transaction and discarded afterward.Intermediate
• Executive Order 14028The May 2021 U.S. order 'Improving the Nation's Cybersecurity' that drove federal SBOM and secure development attestation requirements.Intermediate
• Exposure Factor (EF)Percentage of an asset's value expected to be lost if a specific threat event occurs.Foundational
• Extended Validation Certificate (EV)Certificate issued after the most rigorous CA vetting of an organization's legal, physical, and operational existence.Intermediate
• Extensible Authentication Protocol (EAP)Authentication framework supporting multiple methods, used with 802.1X, PPP, and wireless networks.Intermediate
• Extensible Authentication Protocol-Transport Layer Security (EAP-TLS)EAP method using mutual certificate authentication between client and server.Intermediate
• External AuditAudit performed by an independent party outside the organization, such as a CPA firm or certification body.Foundational
• Factor Analysis of Information Risk (FAIR)Open quantitative model that decomposes risk into loss event frequency and loss magnitude for financial analysis.Advanced
• Fail-OpenFailure mode where a system allows access or traffic to continue when it fails, favoring availability.Intermediate
• Fail-SafeFailure mode that defaults to a state protecting human life, often unlocking doors when power fails.Foundational
• Fail-Safe DefaultsBase access decisions on explicit permission rather than exclusion, so the default is no access.Intermediate
• Fail-SecureFailure mode where a system defaults to a locked or denied state, protecting assets when it fails.Foundational
• FailoverAutomatic or manual switching to a redundant or standby system when the primary fails.Foundational
• False Acceptance Rate (FAR)Biometric error rate at which unauthorized users are incorrectly accepted; a Type II error.Intermediate
• False Rejection Rate (FRR)Biometric error rate at which legitimate users are incorrectly rejected; a Type I error.Intermediate
• Faraday CageEnclosure of conductive material that blocks electromagnetic fields and radio signals.Intermediate
• Fault ToleranceAbility of a system to continue operating without interruption when one or more components fail.Intermediate
• Federal Information Processing Standard 140-3 (FIPS 140-3)US/Canadian standard for validating cryptographic modules at four increasing security levels.Advanced
• Federal Information Security Modernization Act (FISMA)US law requiring federal agencies to develop, document, and implement agency-wide information security programs.Foundational
• Federal Risk and Authorization Management Program (FedRAMP)U.S. government program that standardizes security assessment and authorization of cloud products used by federal agencies.Intermediate
• FederationTrust relationship letting identities from one domain access resources in another without separate accounts.Intermediate
• FedRAMPFederal Risk and Authorization Management Program, the US government-wide approach to security assessment and authorization of cloud services.Intermediate
• Feistel NetworkBlock cipher structure that splits data into halves and applies repeated rounds of a round function and swapping.Advanced
• FIDO2FIDO Alliance and W3C standard for phishing-resistant, public key-based passwordless authentication.Intermediate
• File-Level EncryptionEncrypting individual files rather than entire volumes, so protection can travel with the file.Foundational
• Final Security Review (FSR)A pre-release assessment confirming that all security requirements and SDL activities were completed and residual risks are accepted.Intermediate
• FIPS 199Federal standard for categorizing information and systems by potential impact (low, moderate, high) on confidentiality, integrity, and availability.Intermediate
• FIPS 200Federal standard specifying minimum security requirements for federal information and systems.Advanced
• Fire Suppression SystemSystem that detects and extinguishes fires, chosen to match fire classes and protect people and equipment.Intermediate
• FirewallA device or software that permits or denies traffic between networks or hosts according to a security policy.Foundational
• Fraud RiskRisk of intentional deception for gain, including asset misappropriation, corruption, and financial statement fraud.Intermediate
• Full Disk Encryption (FDE)Encrypting an entire storage device, including the OS and free space, so data is unreadable without authentication.Foundational
• Full Interruption TestA disaster recovery test that shuts down the primary site and moves operations completely to the recovery site.Intermediate
• Galois/Counter Mode (GCM)Authenticated block cipher mode combining counter mode encryption with Galois field authentication (GHASH).Intermediate
• Gap AnalysisComparison of current state with a desired state or requirement to identify deficiencies and actions.Foundational
• General Data Protection Regulation (GDPR)EU regulation (2016/679), applicable since 25 May 2018, governing processing of personal data of individuals in the EU/EEA.Foundational
• GeofencingUsing a device's geographic location to create virtual boundaries that trigger security policies.Foundational
• Governance, Risk, and Compliance (GRC)Integrated approach to aligning IT and security with business objectives, managing risk, and meeting legal and regulatory requirements.Foundational
• Gramm-Leach-Bliley Act (GLBA)1999 US law requiring financial institutions to protect customers' nonpublic personal information and disclose privacy practices.Intermediate
• GuidelineRecommended, non-mandatory advice for implementing policies and standards when no specific standard applies.Foundational
• HardeningReducing a system's attack surface by removing unnecessary functions and applying secure configurations.Foundational
• Hardware Security KeyPhysical token, such as a USB or NFC key, that performs FIDO2 or U2F authentication.Foundational
• Hardware Security Module (HSM)Tamper-resistant hardware device that generates, stores, and uses cryptographic keys without exposing them.Foundational
• Harvest Now, Decrypt Later (HNDL)Strategy of collecting encrypted data today to decrypt it once a quantum computer can break the encryption.Advanced
• Hash CollisionWhen two different inputs produce the same hash digest.Intermediate
• Hash FunctionOne-way function that maps input of any size to a fixed-size digest, used to verify integrity.Foundational
• Hash-Based Message Authentication Code (HMAC)MAC construction that combines a cryptographic hash function with a secret key (RFC 2104).Intermediate
• Health Insurance Portability and Accountability Act (HIPAA)1996 US law whose administrative simplification rules protect the privacy and security of protected health information.Foundational
• HeartbleedA 2014 OpenSSL vulnerability (CVE-2014-0160) in the TLS heartbeat extension that let attackers read up to 64 KB of server memory per request.Foundational
• High Availability (HA)Design goal of keeping a system operational and accessible for a high percentage of time by eliminating single points of failure.Foundational
• High-Water MarkPrinciple that a system's overall impact level equals the highest impact level of any security objective or information type it handles.Intermediate
• HIPAA Security RuleHIPAA rule requiring administrative, physical, and technical safeguards for electronic PHI.Intermediate
• HMAC-Based One-Time Password (HOTP)OTP algorithm (RFC 4226) that generates codes from a shared secret and an incrementing counter.Intermediate
• Homomorphic EncryptionEncryption that allows computation on ciphertext, producing encrypted results that decrypt to the correct answer.Advanced
• Host-Based FirewallSoftware firewall running on an individual endpoint that filters traffic to and from that host.Foundational
• Hot SiteA fully equipped alternate facility with current systems and data that can take over operations almost immediately.Foundational
• Hybrid ControlControl implemented partly as a common control and partly by the individual system.Intermediate
• Hybrid CryptosystemSystem that uses asymmetric cryptography to exchange a symmetric key, then symmetric encryption for bulk data.Foundational
• IdentificationThe act of a subject claiming an identity, such as entering a username, before it is authenticated.Foundational
• Identity and Access Management (IAM)Policies, processes, and technologies for managing digital identities and controlling their access to resources.Foundational
• Identity Governance and Administration (IGA)Discipline and tools for managing identity lifecycle, access requests, certifications, and policy compliance.Advanced
• Identity Lifecycle ManagementManaging identities from creation through role changes to removal, often called joiner-mover-leaver.Intermediate
• Identity ProofingVerifying that a person is who they claim to be before issuing credentials.Intermediate
• Identity Provider (IdP)System that authenticates users and issues identity assertions or tokens to relying applications.Foundational
• IEC 62443The ISA/IEC series of standards for cybersecurity of industrial automation and control systems (IACS), covering asset owners, integrators and product suppliers.Intermediate
• IEEE 802.1XPort-based network access control standard that authenticates devices before allowing traffic on wired or wireless networks.Foundational
• Immutable BackupA backup that cannot be modified or deleted for a defined retention period, even by administrators.Intermediate
• ImpactThe magnitude of harm or consequence if a risk event occurs.Foundational
• Implicit DenyDefault rule that blocks any traffic or access not explicitly permitted.Foundational
• Incident Commander (IC)The person who coordinates the overall response to a major incident, delegating work and managing communication rather than fixing the issue directly.Intermediate
• Incident Response (IR)The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.Foundational
• Incident Response Plan (IRP)A documented set of policies, roles and procedures guiding how an organization responds to security incidents.Foundational
• Incident Response Team (CSIRT)The group responsible for handling security incidents, also called a computer security incident response team.Foundational
• Industrial Control System (ICS)A general term for control systems (SCADA, DCS, PLC-based systems) used to operate industrial processes.Foundational
• Information DisclosureExposure of information to someone not authorized to see it.Foundational
• Information Rights Management (IRM)Technology that applies persistent usage restrictions to documents and emails wherever they travel.Intermediate
• Information Security GovernanceThe leadership, structures, and processes that ensure security strategy supports business objectives and manages risk to an acceptable level.Foundational
• Information Security Management System (ISMS)Systematic, risk-based management system for protecting information through policies, processes, and controls.Foundational
• Information Sharing and Analysis Center (ISAC)A sector-based organization that facilitates sharing of threat information among member companies.Foundational
• Inherence FactorAuthentication factor based on something the user is, such as a fingerprint, face, iris, or voice.Foundational
• Initialization Vector (IV)A random or unique value combined with a key to ensure the same plaintext encrypts to different ciphertext.Intermediate
• Input ValidationChecking that all untrusted input conforms to expected type, length, format and range before it is processed.Foundational
• Insider ThreatA risk posed by a current or former employee, contractor or partner who misuses authorized access, maliciously or by accident.Foundational
• IntegritySecurity goal ensuring data and systems are accurate, complete, and not altered by unauthorized parties.Foundational
• Intermediate Certificate AuthorityA subordinate CA whose certificate is signed by a root or another intermediate and that issues end-entity certificates.Foundational
• Internal AuditIndependent, objective assurance and consulting activity within an organization that evaluates governance, risk management, and control.Foundational
• Internal ControlProcess designed to provide reasonable assurance about achieving objectives in operations, reporting, and compliance.Foundational
• Internet Key Exchange (IKE)Protocol that negotiates IPsec security associations and keys, using UDP 500 and UDP 4500 for NAT traversal.Advanced
• Internet of Things SecurityPractices for protecting connected devices with limited resources, long lifespans, and often weak default security.Intermediate
• Internet Protocol Security (IPsec)Suite of protocols that authenticates and encrypts IP packets, used mainly for site-to-site and remote-access VPNs.Intermediate
• Intrusion Detection System (IDS)System that monitors network or host activity and alerts on suspicious or malicious behavior without blocking it.Foundational
• Intrusion Prevention System (IPS)Inline security system that detects and actively blocks malicious traffic in real time.Foundational
• ISO 22301International standard specifying requirements for a business continuity management system (BCMS).Intermediate
• ISO 31000International standard providing principles, a framework, and a process for managing any type of risk.Intermediate
• ISO/IEC 27001International standard specifying requirements for establishing, implementing, maintaining, and improving an information security management system.Foundational
• ISO/IEC 27002Code of practice providing guidance on implementing information security controls.Intermediate
• ISO/IEC 27005ISO standard giving guidance on information security risk management in support of ISO/IEC 27001.Intermediate
• IsolationSeparating processes, systems, or networks so that compromise of one does not affect others.Foundational
• IT General Controls (ITGC)Controls over the IT environment that support the reliable operation of applications, such as access, change, and operations.Foundational
• Job RotationPeriodically moving staff between roles to reduce fraud risk, detect misuse, and cross-train employees.Foundational
• JSON Web Token (JWT)A compact, URL-safe token format consisting of a base64url-encoded header, payload of claims, and signature.Intermediate
• Jump ServerHardened intermediary host used to access and manage devices in a secure zone.Intermediate
• Just-in-Time Access (JIT Access)Granting elevated privileges only when needed and only for a limited time, removing standing privileges.Intermediate
• KerberosTicket-based network authentication protocol using a trusted KDC and symmetric cryptography.Intermediate
• Kerckhoffs's PrincipleA cryptosystem should remain secure even if everything about it except the key is public knowledge.Intermediate
• Key CeremonyFormal, audited procedure for generating or using high-value keys, such as a root CA key, under multi-person control.Advanced
• Key Derivation Function (KDF)Function that derives one or more cryptographic keys from a secret value such as a password or shared secret.Advanced
• Key Distribution Center (KDC)Kerberos component that authenticates principals and issues tickets, consisting of the AS and TGS.Advanced
• Key Encryption Key (KEK)A key used to encrypt (wrap) other keys rather than data.Intermediate
• Key EscrowStoring a copy of cryptographic keys with a trusted third party so they can be recovered if needed.Intermediate
• Key ExchangeProcess by which parties establish a shared cryptographic key, by key transport or key agreement.Foundational
• Key LengthThe size of a cryptographic key in bits, which determines the size of the key space and resistance to brute force.Foundational
• Key LifecycleStages a cryptographic key passes through: generation, distribution, storage, use, rotation, archival, and destruction.Intermediate
• Key ManagementPractices and systems for securely generating, distributing, storing, rotating, and destroying cryptographic keys.Foundational
• Key Recovery AgentDesignated person or account authorized to recover encrypted data or archived private keys.Intermediate
• Key RotationReplacing cryptographic keys with new ones on a schedule or after suspected compromise.Intermediate
• Key SpaceThe total number of possible keys for an algorithm, equal to 2 to the power of the key length for random binary keys.Intermediate
• Key StretchingTechnique that makes a weak key or password more resistant to brute force by applying many computational rounds.Foundational
• Key Usage ExtensionX.509 extensions that restrict what a certificate's key may be used for, such as signing or server authentication.Advanced
• Knowledge FactorAuthentication factor based on something the user knows, such as a password, PIN, or passphrase.Foundational
• Least Common MechanismDesign principle that mechanisms shared by multiple users should be minimized to reduce unintended information paths.Advanced
• Least PrivilegePrinciple of granting users and processes only the minimum access rights needed to perform their tasks.Foundational
• Legal HoldA directive to preserve all potentially relevant information when litigation or investigation is reasonably anticipated.Foundational
• Leveraging Existing ComponentsReuse proven, vetted security components instead of building new ones, to reduce attack surface and errors.Intermediate
• Lightweight Directory Access Protocol (LDAP)A protocol for querying and modifying directory services such as Active Directory, using TCP/UDP port 389.Foundational
• LikelihoodThe chance or probability that a risk event will occur within a time frame.Foundational
• Linux Unified Key Setup (LUKS)Standard Linux disk encryption format built on dm-crypt that supports multiple passphrase key slots.Intermediate
• Log RetentionPolicy defining how long logs are stored, balancing investigation needs, compliance requirements and cost.Intermediate
• Login BannerWarning message displayed before or at sign-in stating that use is monitored and unauthorized access is prohibited.Foundational
• M of N ControlRequiring any M of N designated custodians to cooperate to perform a sensitive operation.Intermediate
• Managed Security Service Provider (MSSP)A third party that delivers outsourced security monitoring and management services.Foundational
• Managerial ControlControl category focused on governance and risk management activities such as policies, assessments, and planning.Foundational
• Mandatory Access Control (MAC)Access control model where a central authority enforces access based on security labels and clearances.Foundational
• Mandatory VacationPolicy requiring employees to take consecutive days off so others can perform their duties and uncover fraud.Foundational
• Master Service Agreement (MSA)An umbrella contract setting the general legal terms for all future work between a client and a service provider.Foundational
• Maturity ModelStructured scale for measuring the capability and consistency of processes from ad hoc to optimized.Intermediate
• Maximum Tolerable Downtime (MTD)The longest period a business function can be unavailable before causing unacceptable or irrecoverable harm.Intermediate
• Mean Time Between Failures (MTBF)The average operating time between failures of a repairable system, a measure of reliability.Foundational
• Mean Time to Repair (MTTR)The average time required to repair a failed component or system and return it to service.Foundational
• Measured BootBoot process that records hashes of each component into the TPM so the boot state can be verified later.Advanced
• Message Authentication Code (MAC)Short tag computed with a shared secret key that verifies a message's integrity and origin.Intermediate
• Message Digest 5 (MD5)Legacy 128-bit hash function that is broken for collision resistance.Foundational
• MicrosegmentationDividing networks into very small, workload-level zones with granular policies controlling east-west traffic.Intermediate
• Microsoft Security Development Lifecycle (SDL)Microsoft's prescriptive secure development process defining security practices from training and requirements through release and response.Intermediate
• Mission-Essential Function (MEF)A business function that must continue or be quickly restored for the organization to fulfill its mission.Foundational
• Misuse CaseA UML-style use case that models an actor performing actions the system should prevent, linked to the use cases it threatens.Intermediate
• Mobile Device ForensicsAcquiring and analyzing data from smartphones and tablets, such as messages, location history and app data.Intermediate
• Mode of OperationA method that defines how a block cipher repeatedly applies its transformation to encrypt data longer than one block.Intermediate
• Module-Lattice-Based Digital Signature Algorithm (ML-DSA)NIST post-quantum digital signature standard (FIPS 204), derived from CRYSTALS-Dilithium.Advanced
• Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)NIST post-quantum key encapsulation standard (FIPS 203), derived from CRYSTALS-Kyber.Advanced
• Multifactor Authentication (MFA)Authentication requiring two or more factors from different categories.Foundational
• Mutual TLS (mTLS)TLS in which both client and server present and verify certificates, providing two-way authentication and encryption.Intermediate
• Nation-State ActorA threat actor sponsored or directed by a government, with high sophistication, funding and strategic goals.Foundational
• National Vulnerability Database (NVD)The US government repository, maintained by NIST, that enriches CVE records with CVSS scores, CWE and CPE data.Foundational
• Need to KnowPrinciple that access to specific information is granted only when it is required for a person's duties.Foundational
• NERC CIPMandatory North American Electric Reliability Corporation Critical Infrastructure Protection standards for the bulk electric system.Advanced
• Network Access Control (NAC)Technology that authenticates and checks devices before granting network access, enforcing policy at the edge.Foundational
• Network SegmentationDividing a network into separate zones, such as VLANs or subnets, with controlled traffic between them.Foundational
• NIS2 DirectiveEU Directive (2022/2555) imposing cybersecurity risk-management and incident-reporting obligations on essential and important entities.Intermediate
• NIST Cybersecurity Framework (CSF)A NIST framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Foundational
• NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)Voluntary NIST framework (Feb 2024) organizing cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.Foundational
• NIST Definition of Cloud Computing (NIST SP 800-145)The NIST special publication that defines cloud computing via 5 essential characteristics, 3 service models and 4 deployment models.Foundational
• NIST SP 800-115NIST's Technical Guide to Information Security Testing and Assessment, covering review, target identification and vulnerability validation techniques.Intermediate
• NIST SP 800-137NIST guidance on Information Security Continuous Monitoring (ISCM) for federal systems and organizations.Advanced
• NIST SP 800-171NIST requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.Intermediate
• NIST SP 800-30NIST guide for conducting information security risk assessments for federal systems and organizations.Intermediate
• NIST SP 800-37NIST publication defining the Risk Management Framework for information systems and organizations.Intermediate
• NIST SP 800-39NIST guidance on managing information security risk at organization, mission, and system tiers.Advanced
• NIST SP 800-53NIST catalog of security and privacy controls for information systems and organizations.Intermediate
• NIST SP 800-61The NIST publication providing guidance on computer security incident handling and response.Intermediate
• NIST SP 800-82NIST's Guide to Operational Technology Security, providing recommendations for securing ICS and other OT systems.Intermediate
• NISTIR 8259NIST's foundational guidance on cybersecurity activities and capabilities that IoT device manufacturers should provide.Advanced
• Non-Disclosure Agreement (NDA)A legally binding contract that obligates parties to keep shared confidential information secret.Foundational
• Non-repudiationAssurance that a party cannot credibly deny having performed an action, such as sending a message or signing a document.Foundational
• NonceA 'number used once' that ensures uniqueness in a cryptographic operation to prevent replay and keystream reuse.Intermediate
• NT LAN Manager (NTLM)Legacy Microsoft challenge-response authentication protocol, now deprecated in favor of Kerberos.Intermediate
• OAuth 2.0An authorization framework that lets applications obtain limited, delegated access tokens to APIs without handling user passwords.Intermediate
• ObfuscationMaking data or code difficult to understand without changing its function, to hinder analysis.Foundational
• OCSP StaplingTLS feature where the server fetches and attaches a signed OCSP response to its handshake.Intermediate
• OCTAVEOperationally Critical Threat, Asset, and Vulnerability Evaluation, a self-directed risk assessment methodology from Carnegie Mellon SEI.Advanced
• Offline Root CAA root certificate authority kept powered off or disconnected from networks to protect its private key.Intermediate
• One-Time Pad (OTP)Cipher using a truly random key as long as the message, used only once, offering information-theoretic security.Intermediate
• One-Time Password (OTP)Password valid for only one login session or transaction, generated by a token, app, or service.Foundational
• Ongoing AuthorizationTime-driven or event-driven authorization approach that replaces fixed-term reauthorization using continuous monitoring data.Advanced
• Online Certificate Status Protocol (OCSP)Protocol (RFC 6960) for querying the real-time revocation status of a single certificate.Intermediate
• Open DesignDesign principle that security should not depend on the secrecy of the design or implementation.Intermediate
• Open Source Security Testing Methodology Manual (OSSTMM)A peer-reviewed security testing methodology from ISECOM focused on measurable, repeatable operational security testing.Intermediate
• OpenID Connect (OIDC)Identity layer on top of OAuth 2.0 that authenticates users and returns an ID token.Intermediate
• Operational Technology (OT)Hardware and software that monitor and control physical devices, processes and infrastructure, such as in manufacturing, utilities and transportation.Foundational
• Order of VolatilityThe sequence for collecting evidence from most to least volatile so short-lived data is not lost.Foundational
• Organization Validation Certificate (OV)Certificate issued after the CA verifies domain control and the legal existence of the requesting organization.Intermediate
• Out-of-Band Key ExchangeDelivering keys through a separate channel from the one the keys will protect.Intermediate
• Out-of-Band Management (OOB)Managing network devices through a dedicated path separate from production data traffic.Intermediate
• Packet-Filtering FirewallStateless firewall that allows or denies individual packets based on header information such as IP, port, and protocol.Foundational
• Parallel TestA disaster recovery test in which recovery systems are brought up at the alternate site and run alongside production without interrupting it.Intermediate
• Parkerian HexadDonn Parker's six-element security model: confidentiality, possession, integrity, authenticity, availability, and utility.Intermediate
• PasskeyFIDO2 discoverable credential that replaces passwords, either synced across devices or bound to one device.Intermediate
• Password Authentication Protocol (PAP)Legacy PPP authentication protocol that sends usernames and passwords in cleartext.Foundational
• Password HashingStoring passwords as salted, slow, one-way hashes rather than plaintext or reversible encryption.Intermediate
• Password PolicyRules governing password creation, storage, and use, now guided by NIST SP 800-63B.Foundational
• Password-Based Key Derivation Function 2 (PBKDF2)Key derivation function that applies an HMAC many times with a salt to stretch a password.Intermediate
• Passwordless AuthenticationAuthentication methods that remove passwords, using cryptographic keys, biometrics, or possession factors instead.Intermediate
• Patch ManagementThe process of acquiring, testing, deploying and verifying software updates to fix vulnerabilities and defects.Foundational
• Payment Card Industry Data Security Standard (PCI DSS)Industry standard with 12 requirements for protecting payment account data, maintained by the PCI Security Standards Council.Foundational
• PCI Security Standards Council (PCI SSC)Global forum founded by major card brands that develops and maintains PCI security standards.Intermediate
• Penetration TestingAn authorized, simulated attack on systems to find and safely exploit vulnerabilities before real attackers do.Foundational
• PepperA secret value added to passwords before hashing and stored separately from the password database.Intermediate
• Perfect Forward Secrecy (PFS)Property ensuring that compromise of long-term keys does not compromise past session keys.Intermediate
• Personal Data Breach NotificationGDPR requirement to notify the supervisory authority within 72 hours and affected individuals when risk is high.Foundational
• Personal Identity Verification (PIV)US federal smart card standard (FIPS 201) for employee and contractor identity credentials.Intermediate
• Personally Identifiable Information (PII)Information that can be used to distinguish or trace an individual's identity, alone or combined with other information.Foundational
• Phishing-Resistant MFAMFA methods that cannot be relayed or tricked into authenticating to a fake site, such as FIDO2 or PKI.Intermediate
• Physical ControlControl that restricts or monitors physical access to facilities and assets.Foundational
• Physical SecurityProtecting facilities, hardware, and people from physical threats such as unauthorized entry, theft, and environmental hazards.Foundational
• PlaintextReadable, unencrypted data that is input to an encryption algorithm or output from decryption.Foundational
• Plan of Action and Milestones (POA&M)Document tracking weaknesses, planned remediation actions, resources, and target completion dates.Intermediate
• Plan-Do-Check-Act (PDCA)Iterative four-step management cycle for continual improvement: plan, do, check, act.Foundational
• Policy Decision Point (PDP)Zero trust component that evaluates access requests against policy and decides whether to grant them.Advanced
• Policy Enforcement Point (PEP)Zero trust component that enables, monitors, and terminates connections between subjects and resources as directed by the PDP.Advanced
• Possession FactorAuthentication factor based on something the user has, such as a security key, smartphone, or smart card.Foundational
• Post-Quantum Cryptography (PQC)Classical cryptographic algorithms designed to resist attacks by both classical and quantum computers.Intermediate
• Pre-Shared Key (PSK)Secret shared in advance between parties and used for authentication or key derivation.Foundational
• PrecursorA sign that an incident may occur in the future.Intermediate
• Pretty Good Privacy (PGP)Encryption program and standard (OpenPGP) for signing and encrypting email and files using a hybrid cryptosystem.Foundational
• Preventive ControlControl designed to stop an undesired event from occurring.Foundational
• Primary Account Number (PAN)The unique payment card number identifying the issuer and cardholder account.Foundational
• Principle of Least FunctionalityConfiguring systems to provide only essential capabilities and disabling unneeded ports, protocols, and services.Intermediate
• Privacy by Design (PbD)Approach that embeds privacy into the design and operation of systems, processes, and business practices from the outset.Foundational
• Private KeyThe secret half of an asymmetric key pair, used to decrypt data or create digital signatures.Foundational
• Privilege CreepGradual accumulation of access rights beyond what a user's current role requires.Foundational
• Privileged Access Management (PAM)Controls and tools that secure, monitor, and limit use of administrative and other privileged accounts.Intermediate
• Privileged Access Workstation (PAW)Hardened, dedicated device used only for administrative tasks to protect privileged credentials.Advanced
• ProcedureDetailed, step-by-step mandatory instructions for performing a specific task in compliance with policy and standards.Foundational
• Process for Attack Simulation and Threat Analysis (PASTA)A seven-stage, risk-centric threat modeling methodology that aligns technical threats with business objectives.Intermediate
• Programmable Logic Controller (PLC)A ruggedized industrial computer that reads inputs from sensors and controls outputs to machinery according to a stored program.Foundational
• Protected Extensible Authentication Protocol (PEAP)EAP method that creates a TLS tunnel using only a server certificate, then authenticates the user inside it.Intermediate
• Protected Health Information (PHI)Individually identifiable health information held or transmitted by a covered entity or business associate.Foundational
• Proximity CardContactless access card read by radio frequency when held near a reader, commonly used for badge entry.Foundational
• Proxy ServerA server that acts as an intermediary for requests between clients and other servers.Foundational
• PseudonymizationProcessing personal data so it cannot be attributed to an individual without separately kept additional information.Intermediate
• Psychological AcceptabilityDesign principle that security mechanisms should be easy to use so people do not bypass them.Intermediate
• Public KeyThe shareable half of an asymmetric key pair, used to encrypt data for the owner or verify the owner's signatures.Foundational
• Public Key Cryptography Standards (PKCS)Set of standards originally published by RSA Laboratories for public key cryptography formats and operations.Advanced
• Public Key Cryptography Standards #12 (PKCS #12)Password-protected archive format (.pfx/.p12) that bundles a certificate, its chain, and the private key.Intermediate
• Public Key Infrastructure (PKI)Framework of CAs, policies, and technology for issuing, managing, and revoking digital certificates.Foundational
• Purdue ModelThe Purdue Enterprise Reference Architecture, a layered model that segments industrial networks from physical processes up to enterprise IT.Foundational
• Qualitative Risk AnalysisRisk analysis that ranks risks using descriptive scales such as low, medium, and high rather than monetary values.Intermediate
• Quantitative Risk AnalysisRisk analysis that assigns numeric, usually monetary, values to assets, impacts, and probabilities.Intermediate
• Rainbow TableA precomputed table of hash values used to rapidly reverse unsalted password hashes.Intermediate
• Recovery ControlA control that restores systems, data, and operations after a disruptive incident.Intermediate
• Recovery Point Objective (RPO)Maximum acceptable amount of data loss measured in time before a disruption.Foundational
• Recovery Time Objective (RTO)Maximum acceptable time to restore a service after a disruption.Foundational
• RedundancyDuplicating critical components so a backup takes over if one fails.Foundational
• Reference MonitorAbstract machine that mediates all access by subjects to objects according to a security policy.Advanced
• Refresh TokenLong-lived OAuth credential used to obtain new access tokens without re-prompting the user.Advanced
• Registration AuthorityPKI component that verifies the identity of certificate requesters before the CA issues certificates.Intermediate
• Remote Authentication Dial-In User Service (RADIUS)AAA protocol commonly used for network access, using UDP 1812 (authentication) and 1813 (accounting).Foundational
• ReplicationCopying data continuously or frequently to another system or location to support availability and low RPO.Intermediate
• RepudiationA user or system denying that it performed an action because there is insufficient evidence to prove otherwise.Foundational
• Requirements Traceability Matrix (RTM)A table that maps each requirement to its design elements and test cases to show it is implemented and verified.Intermediate
• Residual RiskRisk that remains after controls and treatments have been applied.Foundational
• Reverse ProxyA proxy that sits in front of servers and accepts client requests on their behalf, often providing TLS termination, caching and load balancing.Intermediate
• RiskThe combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.Foundational
• Risk AcceptanceFormal decision by an authorized risk owner to tolerate a risk without further treatment.Foundational
• Risk AnalysisProcess of comprehending the nature of risk and determining its level by considering likelihood and impact.Foundational
• Risk AppetiteBroad amount and type of risk an organization is willing to pursue or retain to achieve its objectives.Foundational
• Risk AssessmentOverall process of risk identification, risk analysis, and risk evaluation.Foundational
• Risk AvoidanceEliminating a risk by not starting or by discontinuing the activity that creates it.Foundational
• Risk Executive FunctionOrganizational role or group in NIST guidance that provides a holistic, enterprise view of risk.Advanced
• Risk FramingEstablishing the context, assumptions, constraints, tolerances, and priorities for risk decisions.Advanced
• Risk IdentificationProcess of finding, recognizing, and describing risks that could affect objectives.Foundational
• Risk Management Framework (RMF)NIST SP 800-37 process for managing security and privacy risk of federal information systems in seven steps.Intermediate
• Risk MitigationRisk treatment that reduces likelihood or impact by implementing controls.Foundational
• Risk OwnerPerson or entity with the accountability and authority to manage a risk, including accepting it.Foundational
• Risk RejectionIgnoring or denying the existence of a risk; an unacceptable response distinct from acceptance.Intermediate
• Risk ToleranceAcceptable variation around objectives or risk appetite for a specific risk or category.Foundational
• Risk TransferenceShifting the financial impact of a risk to a third party, such as through insurance or contracts.Foundational
• Risk TreatmentSelecting and implementing options to modify risk: mitigate, transfer, avoid, or accept.Foundational
• Rivest Cipher 4 (RC4)Legacy stream cipher once used in WEP, WPA-TKIP, and SSL/TLS, now prohibited due to biases.Intermediate
• Rivest-Shamir-Adleman (RSA)Asymmetric algorithm based on the difficulty of factoring large integers, used for encryption and digital signatures.Foundational
• RMF Assess StepRMF step where an assessor determines whether controls are implemented correctly, operating as intended, and producing desired outcomes.Intermediate
• RMF Authorize StepRMF step in which a senior official decides whether the residual risk of operating a system is acceptable.Intermediate
• RMF Categorize StepRMF step that determines a system's security category based on impact of loss of confidentiality, integrity, and availability.Intermediate
• RMF Implement StepRMF step in which selected controls are put in place and implementation details documented.Intermediate
• RMF Monitor StepRMF step maintaining ongoing awareness of system security and privacy posture to support risk decisions.Intermediate
• RMF Prepare StepRMF step establishing context and priorities at organization and system levels before categorization.Intermediate
• RMF Select StepRMF step in which controls are chosen, tailored, and documented in security and privacy plans.Intermediate
• Role-Based Access Control (RBAC)The Kubernetes authorization mode that grants permissions through Roles/ClusterRoles bound to users, groups, or service accounts.Intermediate
• Root Cause Analysis (RCA)A structured investigation to identify the underlying causes of an incident so they can be eliminated.Foundational
• Root Certificate Authority (Root CA)The top-level CA in a hierarchy whose self-signed certificate is the trust anchor for all subordinate certificates.Foundational
• Root of Trust (RoT)Inherently trusted hardware or firmware component from which a chain of trust is built.Intermediate
• Rule-Based Access Control (RuBAC)Access control model that applies global rules to all subjects, such as time-of-day or firewall rules.Foundational
• SABSASherwood Applied Business Security Architecture, a risk-driven enterprise security architecture framework.Advanced
• Safety Instrumented System (SIS)An independent control system that brings an industrial process to a safe state when dangerous conditions are detected.Advanced
• SaltA Python-based configuration management and remote execution tool (SaltStack, now owned by Broadcom) using a master/minion architecture over a ZeroMQ event bus.Intermediate
• Saltzer and Schroeder Design PrinciplesEight classic secure design principles from 1975 that underpin modern secure software design.Intermediate
• SAML AssertionSigned XML statement from an IdP containing authentication, attribute, and authorization information about a subject.Advanced
• SandboxingRunning code in a restricted, isolated environment that limits its access to the system.Foundational
• Sarbanes-Oxley Act (SOX)2002 US law requiring public companies to maintain and attest to internal control over financial reporting.Foundational
• Scope CreepUncontrolled growth of an engagement's scope beyond what was originally agreed.Foundational
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Screened SubnetNetwork segment, formerly called a DMZ, that hosts public-facing services between the internet and the internal network.Foundational
• scryptMemory-hard key derivation function designed to make large-scale hardware password cracking expensive.Advanced
• SEC Cybersecurity Disclosure Rules2023 SEC rules requiring public companies to disclose material cybersecurity incidents and describe cyber risk management and governance.Intermediate
• Secure BootUEFI feature that allows only cryptographically signed bootloaders and OS components to run at startup.Intermediate
• Secure by DefaultPrinciple that systems ship with the most secure settings enabled out of the box.Foundational
• Secure by DesignApproach where security is built into a product's architecture and development from the start rather than added later.Intermediate
• Secure Coding StandardAn organization's documented rules for writing code that avoids known vulnerability classes.Foundational
• Secure EnclaveIsolated, hardware-protected processor or memory region that handles sensitive data and keys apart from the main OS.Intermediate
• Secure Hash Algorithm 1 (SHA-1)Legacy 160-bit hash function with practical collision attacks; deprecated for security use.Foundational
• Secure Hash Algorithm 2 (SHA-2)NIST family of hash functions including SHA-224, SHA-256, SHA-384, and SHA-512.Foundational
• Secure Hash Algorithm 3 (SHA-3)NIST hash standard based on the Keccak sponge construction, standardized in FIPS 202.Intermediate
• Secure Multi-Party Computation (SMPC)Cryptographic technique letting parties jointly compute a function over their inputs without revealing those inputs to each other.Advanced
• Secure Shell (SSH)An encrypted protocol for remote command-line access, tunneling and file transfer, using TCP port 22.Foundational
• Secure Software Development Framework (SSDF)NIST SP 800-218, a set of high-level secure software development practices grouped into Prepare, Protect, Produce and Respond categories.Intermediate
• Secure Software Development Life Cycle (SSDLC)A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.Foundational
• Secure/Multipurpose Internet Mail Extensions (S/MIME)Standard for signing and encrypting email using X.509 certificates.Intermediate
• Security Assertion Markup Language (SAML)XML-based standard for exchanging authentication and authorization data between an IdP and SP.Intermediate
• Security Assessment Report (SAR)Document presenting results of a control assessment, including findings and recommendations.Intermediate
• Security Awareness Training (SAT)Education that teaches staff to recognize and report security threats such as phishing and social engineering.Foundational
• Security BaselineA documented minimum set of security configurations and controls that a system type must meet.Foundational
• Security CategorizationProcess of determining the impact level of a system or information based on potential harm from loss of CIA.Intermediate
• Security Content Automation Protocol (SCAP)A NIST suite of specifications for automating vulnerability management, measurement and compliance checking.Advanced
• Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
• Security IncidentAn occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of information or systems, or violates security policy.Foundational
• Security KernelThe hardware, firmware, and software within the TCB that implements the reference monitor concept.Advanced
• Security MetricsQuantifiable measurements used to track security program performance, risk, and control effectiveness.Intermediate
• Security PerimeterThe boundary separating trusted components from untrusted ones, either within a system or around a network.Foundational
• Security PolicyHigh-level management statement of intent, direction, and requirements for protecting information assets.Foundational
• Security RequirementsStatements of what security properties and controls software must provide, defined early in the SDLC alongside functional requirements.Foundational
• Security StandardMandatory requirement specifying uniform use of technologies, configurations, or methods to support policy.Foundational
• Security Technical Implementation Guide (STIG)DISA configuration standards for securing DoD information systems and software.Intermediate
• Security Through ObscurityRelying on secrecy of design or implementation, rather than sound controls, as the main form of protection.Foundational
• Segregation of Duties (SoD)Dividing critical tasks among different people so no single person can both commit and conceal errors or fraud.Foundational
• Self-Encrypting Drive (SED)Storage drive with built-in hardware encryption that encrypts all data automatically.Intermediate
• Self-Signed CertificateCertificate signed with its own private key rather than by a trusted CA.Foundational
• Semi-Quantitative Risk AnalysisHybrid approach that assigns numeric scores to qualitative scales to rank and combine risks.Intermediate
• Sensitive Authentication Data (SAD)Card security data such as full track data, card verification codes, and PINs that must not be stored after authorization.Intermediate
• Separation of Duties (SoD)Dividing a critical task among multiple people so no single individual can complete it alone.Foundational
• Separation of PrivilegeRequire more than one condition, key or party to grant access to sensitive functions.Intermediate
• Service AccountA Kubernetes identity for processes running in pods to authenticate to the API server and, via federation, to cloud services.Intermediate
• Service Provider (SP)Application that relies on an identity provider's assertion to grant users access; called a relying party in OIDC.Intermediate
• Session KeyA temporary symmetric key used to encrypt a single communication session.Foundational
• Shadow ITHardware, software or cloud services used inside an organization without the approval or knowledge of IT and security.Foundational
• Shamir's Secret Sharing (SSS)Algorithm that splits a secret into N shares where any threshold of M shares can reconstruct it.Advanced
• Shared Responsibility ModelFramework dividing security and operational duties between the cloud provider (of the cloud) and customer (in the cloud).Foundational
• Sherwood Applied Business Security Architecture (SABSA)Business-driven enterprise security architecture framework built on six layers of views.Advanced
• Shor's AlgorithmQuantum algorithm that efficiently factors integers and computes discrete logarithms, breaking RSA, DH, and ECC.Advanced
• Side-Channel AttackAttack that extracts secrets from physical or implementation leaks such as timing, power, or electromagnetic emissions.Advanced
• Signaling System 7 (SS7)The carrier-grade out-of-band signaling network used between PSTN switches for call setup, routing and number portability.Intermediate
• Simulation ExerciseAn exercise that simulates an incident with hands-on activity in a controlled environment to test response capabilities.Intermediate
• Single Loss Expectancy (SLE)Expected monetary loss from one occurrence of a threat event: SLE = Asset Value x Exposure Factor.Foundational
• Single Point of Failure (SPOF)Component whose failure stops the entire system because no redundant alternative exists.Foundational
• Single Sign-On (SSO)Allowing a user to authenticate once and access multiple applications without signing in again.Foundational
• Smart CardCredit-card-sized card with an embedded chip that securely stores certificates and private keys for authentication.Foundational
• SMS-Based AuthenticationSending one-time codes by text message as a second factor; convenient but weak.Foundational
• SOC 1Report on a service organization's controls relevant to user entities' internal control over financial reporting.Intermediate
• SOC 2Report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy.Foundational
• SOC 3General-use summary report of a SOC 2 examination suitable for public distribution.Intermediate
• SOC Type 1 ReportSOC report on the fairness of the description and suitability of control design as of a specific date.Foundational
• SOC Type 2 ReportSOC report covering both design and operating effectiveness of controls over a specified period.Foundational
• Software Assurance (SwA)The level of confidence that software is free from vulnerabilities and functions as intended throughout its life cycle.Foundational
• Software Assurance Maturity Model (SAMM)OWASP's open framework for assessing and improving an organization's software security posture across five business functions.Intermediate
• Software Supply Chain SecurityProtecting the integrity, provenance and security of all code, dependencies, tools and processes used to build and deliver software.Intermediate
• Software-Defined Perimeter (SDP)Architecture that hides resources from the network and grants per-session access only after authentication.Advanced
• SolarWinds Supply Chain AttackThe 2020 compromise in which attackers inserted the SUNBURST backdoor into SolarWinds Orion builds, which were signed and distributed to about 18,000 customers.Foundational
• Spam over Internet Telephony (SPIT)Unsolicited bulk VoIP calls or messages, the telephony equivalent of email spam.Intermediate
• Split KnowledgeDividing a secret, such as a cryptographic key, so that no single person knows the whole value.Intermediate
• Split TunnelingVPN configuration that sends only corporate traffic through the tunnel while other traffic goes directly to the internet.Foundational
• SpoofingPretending to be another user, system or component in order to gain its access or trust.Foundational
• Stateful FirewallA firewall that tracks the state of connections and automatically allows return traffic for sessions initiated from trusted networks.Foundational
• Statement of Applicability (SoA)ISO/IEC 27001 document listing all Annex A controls, whether each is included or excluded, and justification.Intermediate
• Statement of Work (SOW)A contract document detailing the specific deliverables, timeline, scope and cost of a particular engagement.Foundational
• Statement on Standards for Attestation Engagements No. 18 (SSAE 18)AICPA attestation standard under which SOC 1, SOC 2, and SOC 3 examinations are performed.Advanced
• SteganographyHiding the existence of data inside other data, such as an image, audio, or network traffic.Foundational
• Strategic AlignmentEnsuring the information security strategy directly supports and enables business goals and objectives.Foundational
• Stream CipherA symmetric cipher that encrypts data one bit or byte at a time by combining it with a pseudorandom keystream.Foundational
• STRIDEMicrosoft's threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.Foundational
• StuxnetA sophisticated worm discovered in 2010 that sabotaged Iranian uranium enrichment centrifuges by manipulating PLCs.Intermediate
• Subject Alternative Name (SAN)X.509 extension listing additional identities, such as DNS names or IPs, that a certificate is valid for.Foundational
• Substitution CipherCipher that replaces each plaintext unit with another symbol according to a fixed or keyed system.Foundational
• Supervisory Control and Data Acquisition (SCADA)An ICS architecture for monitoring and controlling geographically dispersed assets from a central location.Foundational
• Supply Chain AttackAn attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.Intermediate
• Symmetric EncryptionEncryption in which the same secret key is used to both encrypt and decrypt data.Foundational
• System and Organization Controls Report (SOC report)AICPA attestation report by a CPA on controls at a service organization.Foundational
• System OwnerOfficial responsible for procurement, development, integration, operation, and maintenance of a system.Intermediate
• System Security Plan (SSP)Formal document describing a system's boundary, environment, security requirements, and how controls are implemented.Intermediate
• Tabletop Exercise (TTX)A discussion-based exercise in which participants walk through a simulated incident scenario to test plans and roles.Foundational
• TamperingUnauthorized modification of data, code or configuration in transit, at rest or in memory.Foundational
• Technical ControlControl implemented through hardware, software, or firmware that enforces security automatically.Foundational
• TEMPESTStandards and techniques for limiting compromising electromagnetic emanations from electronic equipment.Advanced
• Terminal Access Controller Access-Control System Plus (TACACS+)Cisco-developed AAA protocol over TCP 49 that encrypts the full payload and separates authentication, authorization, and accounting.Foundational
• ThreatAny potential cause of an unwanted incident that may harm an asset, such as an actor, event, or circumstance.Foundational
• Threat Model Data Flow Diagram (DFD)A diagram of processes, data stores, external entities, data flows and trust boundaries used as the basis for threat modeling.Intermediate
• Threat ModelingStructured process of identifying threats, attack paths, and mitigations for a system during design.Intermediate
• Ticket-Granting Ticket (TGT)Kerberos ticket issued after initial authentication that is used to request service tickets.Advanced
• Time-Based One-Time Password (TOTP)OTP algorithm (RFC 6238) that generates codes from a shared secret and the current time, typically every 30 seconds.Foundational
• Time-of-Check to Time-of-Use (TOCTOU)A race condition in which a resource changes between the time it is checked and the time it is used.Intermediate
• TOGAFThe Open Group Architecture Framework, an enterprise architecture methodology centered on the Architecture Development Method.Advanced
• TokenizationReplacing sensitive data with a non-sensitive surrogate value (token) that maps back to the original via a secure vault.Intermediate
• Total RiskThe amount of risk an organization faces before safeguards: threats x vulnerabilities x asset value.Intermediate
• Transparent Data Encryption (TDE)Database feature that encrypts data and log files at rest without requiring application changes.Intermediate
• Transport Layer Security (TLS)The cryptographic protocol that secures application traffic with encryption, integrity and certificate-based authentication; successor to SSL.Foundational
• Transport Layer Security 1.3 (TLS 1.3)Current TLS version (RFC 8446) with a faster handshake, mandatory forward secrecy, and only AEAD ciphers.Intermediate
• Transposition CipherCipher that rearranges the order of plaintext characters without changing the characters themselves.Foundational
• Triple DES (3DES)Symmetric cipher applying DES three times (encrypt-decrypt-encrypt) to increase effective key strength.Foundational
• Trust BoundaryA point where data or execution passes between components with different levels of trust.Intermediate
• Trust Services Criteria (TSC)AICPA criteria for security, availability, processing integrity, confidentiality, and privacy used in SOC 2 and SOC 3.Intermediate
• Trust StoreCollection of trusted root CA certificates maintained by an operating system, browser, or application.Intermediate
• Trusted Computing Base (TCB)All hardware, firmware, and software components critical to enforcing a system's security policy.Advanced
• Trusted Execution Environment (TEE)Hardware-isolated area of a processor that protects code and data from the rest of the system, including the OS.Advanced
• Trusted Platform Module (TPM)Secure cryptoprocessor chip on a device that stores keys, measures boot integrity, and supports attestation.Foundational
• TwofishSymmetric block cipher with a 128-bit block and keys up to 256 bits; an AES competition finalist.Intermediate
• Unidirectional GatewayA hardware-enforced network device that allows data to flow in only one direction, typically from OT out to IT.Intermediate
• Vendor DiversityUsing products from different vendors in layered defenses so a single flaw cannot defeat all layers.Intermediate
• Verification and Validation (V&V)Verification checks that software is built correctly against its specifications; validation checks that the right software was built for user needs.Intermediate
• Video SurveillanceUse of cameras (CCTV or IP cameras) to deter, detect, and record physical security events.Foundational
• Virtual Private Network (VPN)Encrypted tunnel that securely connects remote users or sites across an untrusted network.Foundational
• VoIP EavesdroppingIntercepting voice or video traffic, for example by capturing unencrypted RTP and reconstructing the audio.Intermediate
• VulnerabilityA weakness in an asset, control, or process that a threat could exploit.Foundational
• Vulnerability AssessmentA systematic process of identifying, quantifying and prioritizing vulnerabilities without attempting to exploit them.Foundational
• Vulnerability ManagementThe continuous process of identifying, assessing, prioritizing, remediating and verifying security weaknesses.Foundational
• Warm SiteAn alternate facility with some equipment and connectivity in place but requiring data restoration and configuration before use.Foundational
• Weakest LinkA system is only as secure as its weakest component, so defenses should be balanced.Foundational
• Web Application Firewall (WAF)Layer 7 firewall that inspects HTTP/HTTPS traffic to protect web applications from attacks such as SQL injection and XSS.Foundational
• Web Authentication (WebAuthn)W3C API that lets websites register and authenticate users with public key credentials.Advanced
• Web of TrustDecentralized trust model where users vouch for one another's public keys instead of relying on a central CA.Intermediate
• Wildcard CertificateCertificate that secures all first-level subdomains of a domain using an asterisk, such as *.example.com.Foundational
• Work FactorThe estimated time or effort required to break a cryptosystem or security control.Intermediate
• Work Recovery Time (WRT)The time needed after systems are restored to verify data, test functionality and resume normal operations.Advanced
• X.509ITU-T standard defining the format of public key certificates and certificate revocation lists.Intermediate
• XEX-based Tweaked-codebook mode with ciphertext Stealing (XTS)Block cipher mode designed for disk and storage encryption, using a sector-based tweak.Advanced
• Zachman FrameworkEnterprise architecture ontology using a 6x6 matrix of perspectives and interrogatives.Advanced
• Zero Trust Architecture (ZTA)Security model that assumes no implicit trust and continuously verifies every user, device, and request before granting access.Intermediate
• Zero-Day VulnerabilityA vulnerability unknown to the vendor or without an available patch, which attackers may exploit before defenders can fix it.Foundational
• Zero-Knowledge Proof (ZKP)Protocol in which one party proves a statement is true without revealing any information beyond its truth.Advanced