ISC2 SSCP: key terms

Flashcards for this exam ISC2 SSCP guide Class dates

• Access ControlSecurity mechanisms that determine who or what can view, use, or change resources, and under what conditions.Foundational
• Access Control List (ACL)Ordered list of rules attached to an object or interface that permits or denies access to specific subjects or traffic.Foundational
• Access Control VestibuleSmall space with two interlocking doors where only one opens at a time, preventing tailgating; formerly called a mantrap.Foundational
• Access ReviewPeriodic verification by managers or owners that users' access rights are still appropriate.Intermediate
• Account LockoutDisabling an account temporarily or permanently after a set number of failed login attempts.Foundational
• AccountabilityThe ability to trace actions on a system to a unique, authenticated identity.Foundational
• Administrative ControlA security control based on policies, procedures, training, and personnel management.Foundational
• Advanced Encryption Standard (AES)NIST-standard symmetric block cipher (Rijndael) with a 128-bit block and 128-, 192-, or 256-bit keys.Foundational
• Air GapPhysically isolating a system or network from all other networks, including the internet.Foundational
• Application-Level Gateway (ALG)Proxy firewall that terminates connections and inspects traffic at the application layer for specific protocols.Intermediate
• Asymmetric EncryptionEncryption using a mathematically related key pair: a public key to encrypt or verify and a private key to decrypt or sign.Foundational
• Attribute-Based Access Control (ABAC)Access control model that evaluates attributes of the subject, object, action, and environment against policies.Intermediate
• AuthenticationVerifying that a user, device, or process is who or what it claims to be.Foundational
• Authentication FactorCategory of evidence used to prove identity: something you know, have, or are, plus contextual attributes.Foundational
• Authentication Header (AH)IPsec protocol (IP protocol 51) that provides integrity, data origin authentication, and anti-replay but no encryption.Intermediate
• Authentication, Authorization, and Accounting (AAA)Framework that verifies identity, determines permitted actions, and records what users do.Foundational
• AuthenticityAssurance that data, a message, or an entity is genuine and comes from its claimed source.Foundational
• AuthorizationDetermining what an authenticated subject is permitted to access or do.Foundational
• AvailabilitySecurity goal ensuring authorized users have timely, reliable access to data and systems when needed.Foundational
• Avalanche EffectProperty where a tiny change in input, such as one bit, causes a large, unpredictable change in output.Intermediate
• bcryptAdaptive password-hashing function based on Blowfish with a configurable cost factor.Intermediate
• Bell-LaPadula Model (BLP)Formal confidentiality model enforcing 'no read up, no write down' using security labels.Advanced
• Biba ModelFormal integrity model enforcing 'no read down, no write up' to prevent corruption of higher-integrity data.Advanced
• Biometric AuthenticationVerifying identity using unique physiological or behavioral characteristics.Foundational
• Birthday AttackCryptographic attack exploiting the birthday paradox to find hash collisions in about the square root of the output space.Intermediate
• Block CipherA symmetric cipher that encrypts fixed-size blocks of data, such as 128 bits, using a key.Foundational
• BlowfishSymmetric block cipher by Bruce Schneier with a 64-bit block and variable key length from 32 to 448 bits.Intermediate
• BollardShort, sturdy post that prevents vehicles from entering or ramming into a protected area while allowing pedestrians through.Foundational
• Certificate AuthorityTrusted entity that verifies identities and issues, signs, and revokes digital certificates.Foundational
• Certificate Revocation List (CRL)CA-signed list of serial numbers of certificates that have been revoked before their expiration date.Foundational
• Certificate Signing Request (CSR)Message sent to a CA containing a public key and subject information, signed with the requester's private key.Foundational
• Chain of TrustSequence of certificates from an end-entity certificate through intermediates to a trusted root CA.Foundational
• Challenge-Handshake Authentication Protocol (CHAP)PPP authentication protocol using a three-way challenge-response with a hash of a shared secret.Intermediate
• CIA TriadThe three core goals of information security: confidentiality, integrity, and availability.Foundational
• CipherAn algorithm that performs encryption and decryption.Foundational
• Cipher Block Chaining (CBC)Block cipher mode in which each plaintext block is XORed with the previous ciphertext block before encryption.Intermediate
• CiphertextThe unreadable, encrypted output of a cipher that requires the correct key to decrypt.Foundational
• Clark-Wilson ModelCommercial integrity model using well-formed transactions and separation of duties to protect data.Advanced
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• ConfidentialitySecurity goal ensuring information is disclosed only to authorized people, processes, or systems.Foundational
• Confusion and DiffusionShannon's two properties of secure ciphers: hide the key-ciphertext relationship and spread plaintext influence across ciphertext.Advanced
• Corrective ControlControl that reduces the impact of an event or restores systems after it occurs.Foundational
• Covert ChannelUnauthorized communication path that transfers information in a way that violates security policy.Advanced
• Crime Prevention Through Environmental Design (CPTED)Approach that uses building and landscape design to deter crime through natural surveillance, access control, and territoriality.Advanced
• Crossover Error Rate (CER)Point where a biometric system's FAR equals its FRR; lower CER means a more accurate system.Intermediate
• CryptanalysisThe study of analyzing and breaking cryptographic systems.Intermediate
• Cryptographic KeyA secret or public value used by a cryptographic algorithm to transform data.Foundational
• CryptographyThe science of protecting information by transforming it so only intended parties can read or verify it.Foundational
• DAD TriadThe opposite of the CIA triad: disclosure, alteration, and destruction (denial) of information.Foundational
• Data at RestData stored on persistent media such as disks, databases, backups, or cloud object storage.Foundational
• Data ClassificationCategorizing data by sensitivity and value to determine required protection and handling.Foundational
• Data CustodianRole responsible for implementing and maintaining the controls that protect data on behalf of the data owner.Foundational
• Data Encryption Standard (DES)Legacy symmetric block cipher with a 64-bit block and 56-bit effective key, now insecure.Foundational
• Data in TransitData moving across a network between systems, also called data in motion.Foundational
• Data Loss Prevention (DLP)Technology that detects and blocks unauthorized transmission or storage of sensitive data.Foundational
• Data OwnerSenior individual accountable for a data set, including its classification, access approval, and protection requirements.Foundational
• Defense in DepthLayering multiple, independent security controls so that the failure of one does not compromise the asset.Foundational
• DeprovisioningRemoving or disabling a user's accounts and access when they leave or no longer need it.Foundational
• Detective ControlControl that identifies and records an undesired event after or while it occurs.Foundational
• Deterrent ControlControl that discourages potential attackers or violators from attempting an action.Foundational
• DiameterAAA protocol designed as a successor to RADIUS, using TCP or SCTP on port 3868.Intermediate
• Diffie-Hellman (DH)Key agreement protocol that lets two parties derive a shared secret over an insecure channel.Foundational
• Digital CertificateElectronic document signed by a CA that binds a public key to an identity such as a domain, person, or device.Foundational
• Digital SignatureCryptographic value created with a private key over a message hash that proves origin, integrity, and non-repudiation.Foundational
• Digital Signature Algorithm (DSA)Legacy NIST signature algorithm based on the discrete logarithm problem.Intermediate
• Directive ControlControl that specifies required behavior, such as policies, standards, and procedures.Foundational
• Directory ServiceCentralized database that stores and organizes information about users, groups, devices, and resources for authentication and lookup.Foundational
• Discretionary Access Control (DAC)Access control model where the owner of a resource decides who may access it.Foundational
• Distinguished Encoding Rules (DER)Binary encoding format for X.509 certificates and keys.Intermediate
• Domain Name System Security Extensions (DNSSEC)DNS extensions that digitally sign records so resolvers can verify their authenticity and integrity.Intermediate
• Dual ControlRequiring two or more authorized people to act together to perform a sensitive operation.Intermediate
• Electromagnetic LockLock that uses an electromagnet to hold a door closed, releasing when power is removed.Intermediate
• Electronic Codebook (ECB)Block cipher mode that encrypts each block independently, so identical plaintext blocks yield identical ciphertext.Intermediate
• Elliptic Curve Cryptography (ECC)Public key cryptography based on elliptic curve math, offering strong security with short keys.Intermediate
• Encapsulating Security Payload (ESP)IPsec protocol (IP protocol 50) that provides confidentiality, integrity, authentication, and anti-replay.Intermediate
• EncryptionConverting plaintext into ciphertext using an algorithm and key so only authorized parties can read it.Foundational
• EntropyMeasure of randomness or unpredictability, critical for generating strong keys and passwords.Intermediate
• Extensible Authentication Protocol (EAP)Authentication framework supporting multiple methods, used with 802.1X, PPP, and wireless networks.Intermediate
• Extensible Authentication Protocol-Transport Layer Security (EAP-TLS)EAP method using mutual certificate authentication between client and server.Intermediate
• Fail-OpenFailure mode where a system allows access or traffic to continue when it fails, favoring availability.Intermediate
• Fail-SafeFailure mode that defaults to a state protecting human life, often unlocking doors when power fails.Foundational
• Fail-SecureFailure mode where a system defaults to a locked or denied state, protecting assets when it fails.Foundational
• False Acceptance Rate (FAR)Biometric error rate at which unauthorized users are incorrectly accepted; a Type II error.Intermediate
• False Rejection Rate (FRR)Biometric error rate at which legitimate users are incorrectly rejected; a Type I error.Intermediate
• Faraday CageEnclosure of conductive material that blocks electromagnetic fields and radio signals.Intermediate
• Fault ToleranceAbility of a system to continue operating without interruption when one or more components fail.Intermediate
• FederationTrust relationship letting identities from one domain access resources in another without separate accounts.Intermediate
• File Transfer Protocol Secure (FTPS)FTP secured with TLS, either explicitly via AUTH TLS on port 21 or implicitly on ports 990 (control) and 989 (data).Intermediate
• Fire Suppression SystemSystem that detects and extinguishes fires, chosen to match fire classes and protect people and equipment.Intermediate
• FirewallA device or software that permits or denies traffic between networks or hosts according to a security policy.Foundational
• Full Disk Encryption (FDE)Encrypting an entire storage device, including the OS and free space, so data is unreadable without authentication.Foundational
• Galois/Counter Mode (GCM)Authenticated block cipher mode combining counter mode encryption with Galois field authentication (GHASH).Intermediate
• GNU Privacy Guard (GPG)Free, open-source implementation of the OpenPGP standard.Foundational
• HardeningReducing a system's attack surface by removing unnecessary functions and applying secure configurations.Foundational
• Hardware Security Module (HSM)Tamper-resistant hardware device that generates, stores, and uses cryptographic keys without exposing them.Foundational
• Hash CollisionWhen two different inputs produce the same hash digest.Intermediate
• Hash FunctionOne-way function that maps input of any size to a fixed-size digest, used to verify integrity.Foundational
• Hash-Based Message Authentication Code (HMAC)MAC construction that combines a cryptographic hash function with a secret key (RFC 2104).Intermediate
• High Availability (HA)Design goal of keeping a system operational and accessible for a high percentage of time by eliminating single points of failure.Foundational
• HMAC-Based One-Time Password (HOTP)OTP algorithm (RFC 4226) that generates codes from a shared secret and an incrementing counter.Intermediate
• Host-Based FirewallSoftware firewall running on an individual endpoint that filters traffic to and from that host.Foundational
• Hybrid CryptosystemSystem that uses asymmetric cryptography to exchange a symmetric key, then symmetric encryption for bulk data.Foundational
• Hypertext Transfer Protocol Secure (HTTPS)HTTP carried inside TLS encryption, using TCP port 443 by default (and UDP 443 for HTTP/3).Foundational
• IdentificationThe act of a subject claiming an identity, such as entering a username, before it is authenticated.Foundational
• Identity and Access Management (IAM)Policies, processes, and technologies for managing digital identities and controlling their access to resources.Foundational
• Identity Lifecycle ManagementManaging identities from creation through role changes to removal, often called joiner-mover-leaver.Intermediate
• Implicit DenyDefault rule that blocks any traffic or access not explicitly permitted.Foundational
• Inherence FactorAuthentication factor based on something the user is, such as a fingerprint, face, iris, or voice.Foundational
• Initialization Vector (IV)A random or unique value combined with a key to ensure the same plaintext encrypts to different ciphertext.Intermediate
• IntegritySecurity goal ensuring data and systems are accurate, complete, and not altered by unauthorized parties.Foundational
• Intermediate Certificate AuthorityA subordinate CA whose certificate is signed by a root or another intermediate and that issues end-entity certificates.Foundational
• Internet Key Exchange (IKE)Protocol that negotiates IPsec security associations and keys, using UDP 500 and UDP 4500 for NAT traversal.Advanced
• Internet Protocol Security (IPsec)Suite of protocols that authenticates and encrypts IP packets, used mainly for site-to-site and remote-access VPNs.Intermediate
• Intrusion Detection System (IDS)System that monitors network or host activity and alerts on suspicious or malicious behavior without blocking it.Foundational
• Intrusion Prevention System (IPS)Inline security system that detects and actively blocks malicious traffic in real time.Foundational
• IsolationSeparating processes, systems, or networks so that compromise of one does not affect others.Foundational
• Job RotationPeriodically moving staff between roles to reduce fraud risk, detect misuse, and cross-train employees.Foundational
• Jump ServerHardened intermediary host used to access and manage devices in a secure zone.Intermediate
• KerberosTicket-based network authentication protocol using a trusted KDC and symmetric cryptography.Intermediate
• Kerckhoffs's PrincipleA cryptosystem should remain secure even if everything about it except the key is public knowledge.Intermediate
• Key Distribution Center (KDC)Kerberos component that authenticates principals and issues tickets, consisting of the AS and TGS.Advanced
• Key EscrowStoring a copy of cryptographic keys with a trusted third party so they can be recovered if needed.Intermediate
• Key ExchangeProcess by which parties establish a shared cryptographic key, by key transport or key agreement.Foundational
• Key LengthThe size of a cryptographic key in bits, which determines the size of the key space and resistance to brute force.Foundational
• Key LifecycleStages a cryptographic key passes through: generation, distribution, storage, use, rotation, archival, and destruction.Intermediate
• Key ManagementPractices and systems for securely generating, distributing, storing, rotating, and destroying cryptographic keys.Foundational
• Key SpaceThe total number of possible keys for an algorithm, equal to 2 to the power of the key length for random binary keys.Intermediate
• Key StretchingTechnique that makes a weak key or password more resistant to brute force by applying many computational rounds.Foundational
• Knowledge FactorAuthentication factor based on something the user knows, such as a password, PIN, or passphrase.Foundational
• Least PrivilegePrinciple of granting users and processes only the minimum access rights needed to perform their tasks.Foundational
• Lightweight Directory Access Protocol (LDAP)A protocol for querying and modifying directory services such as Active Directory, using TCP/UDP port 389.Foundational
• Lightweight Directory Access Protocol over SSL (LDAPS)LDAP secured with TLS on TCP port 636 to protect directory queries and credentials.Foundational
• Load BalancerA device or service that distributes client requests across multiple servers to improve performance and availability.Foundational
• Login BannerWarning message displayed before or at sign-in stating that use is monitored and unauthorized access is prohibited.Foundational
• M of N ControlRequiring any M of N designated custodians to cooperate to perform a sensitive operation.Intermediate
• Mandatory Access Control (MAC)Access control model where a central authority enforces access based on security labels and clearances.Foundational
• Mandatory VacationPolicy requiring employees to take consecutive days off so others can perform their duties and uncover fraud.Foundational
• Message Authentication Code (MAC)Short tag computed with a shared secret key that verifies a message's integrity and origin.Intermediate
• Message Digest 5 (MD5)Legacy 128-bit hash function that is broken for collision resistance.Foundational
• Mode of OperationA method that defines how a block cipher repeatedly applies its transformation to encrypt data longer than one block.Intermediate
• Multifactor Authentication (MFA)Authentication requiring two or more factors from different categories.Foundational
• Need to KnowPrinciple that access to specific information is granted only when it is required for a person's duties.Foundational
• Network Access Control (NAC)Technology that authenticates and checks devices before granting network access, enforcing policy at the edge.Foundational
• Network SegmentationDividing a network into separate zones, such as VLANs or subnets, with controlled traffic between them.Foundational
• Non-repudiationAssurance that a party cannot credibly deny having performed an action, such as sending a message or signing a document.Foundational
• NonceA 'number used once' that ensures uniqueness in a cryptographic operation to prevent replay and keystream reuse.Intermediate
• OAuth 2.0An authorization framework that lets applications obtain limited, delegated access tokens to APIs without handling user passwords.Intermediate
• One-Time Pad (OTP)Cipher using a truly random key as long as the message, used only once, offering information-theoretic security.Intermediate
• One-Time Password (OTP)Password valid for only one login session or transaction, generated by a token, app, or service.Foundational
• Online Certificate Status Protocol (OCSP)Protocol (RFC 6960) for querying the real-time revocation status of a single certificate.Intermediate
• Out-of-Band Key ExchangeDelivering keys through a separate channel from the one the keys will protect.Intermediate
• Packet-Filtering FirewallStateless firewall that allows or denies individual packets based on header information such as IP, port, and protocol.Foundational
• Password Authentication Protocol (PAP)Legacy PPP authentication protocol that sends usernames and passwords in cleartext.Foundational
• Password HashingStoring passwords as salted, slow, one-way hashes rather than plaintext or reversible encryption.Intermediate
• Password ManagerApplication that generates, stores, and autofills strong unique passwords in an encrypted vault.Foundational
• Password PolicyRules governing password creation, storage, and use, now guided by NIST SP 800-63B.Foundational
• Password-Based Key Derivation Function 2 (PBKDF2)Key derivation function that applies an HMAC many times with a salt to stretch a password.Intermediate
• Physical ControlControl that restricts or monitors physical access to facilities and assets.Foundational
• Physical SecurityProtecting facilities, hardware, and people from physical threats such as unauthorized entry, theft, and environmental hazards.Foundational
• PlaintextReadable, unencrypted data that is input to an encryption algorithm or output from decryption.Foundational
• Possession FactorAuthentication factor based on something the user has, such as a security key, smartphone, or smart card.Foundational
• Pre-Shared Key (PSK)Secret shared in advance between parties and used for authentication or key derivation.Foundational
• Pretty Good Privacy (PGP)Encryption program and standard (OpenPGP) for signing and encrypting email and files using a hybrid cryptosystem.Foundational
• Preventive ControlControl designed to stop an undesired event from occurring.Foundational
• Privacy-Enhanced Mail Format (PEM)Base64-encoded certificate or key format wrapped in -----BEGIN----- and -----END----- lines.Foundational
• Private KeyThe secret half of an asymmetric key pair, used to decrypt data or create digital signatures.Foundational
• Privilege CreepGradual accumulation of access rights beyond what a user's current role requires.Foundational
• Privileged Access Management (PAM)Controls and tools that secure, monitor, and limit use of administrative and other privileged accounts.Intermediate
• Protected Extensible Authentication Protocol (PEAP)EAP method that creates a TLS tunnel using only a server certificate, then authenticates the user inside it.Intermediate
• Proximity CardContactless access card read by radio frequency when held near a reader, commonly used for badge entry.Foundational
• Proxy ServerA server that acts as an intermediary for requests between clients and other servers.Foundational
• Public KeyThe shareable half of an asymmetric key pair, used to encrypt data for the owner or verify the owner's signatures.Foundational
• Public Key Cryptography Standards #12 (PKCS #12)Password-protected archive format (.pfx/.p12) that bundles a certificate, its chain, and the private key.Intermediate
• Public Key Cryptography Standards #7 (PKCS #7)Format (.p7b/.p7c) for signed or enveloped data, often used to bundle certificate chains without private keys.Intermediate
• Public Key Infrastructure (PKI)Framework of CAs, policies, and technology for issuing, managing, and revoking digital certificates.Foundational
• Recovery ControlA control that restores systems, data, and operations after a disruptive incident.Intermediate
• RedundancyDuplicating critical components so a backup takes over if one fails.Foundational
• Reference MonitorAbstract machine that mediates all access by subjects to objects according to a security policy.Advanced
• Registration AuthorityPKI component that verifies the identity of certificate requesters before the CA issues certificates.Intermediate
• Remote Authentication Dial-In User Service (RADIUS)AAA protocol commonly used for network access, using UDP 1812 (authentication) and 1813 (accounting).Foundational
• Reverse ProxyA proxy that sits in front of servers and accepts client requests on their behalf, often providing TLS termination, caching and load balancing.Intermediate
• Rivest Cipher 4 (RC4)Legacy stream cipher once used in WEP, WPA-TKIP, and SSL/TLS, now prohibited due to biases.Intermediate
• Rivest-Shamir-Adleman (RSA)Asymmetric algorithm based on the difficulty of factoring large integers, used for encryption and digital signatures.Foundational
• Role-Based Access Control (RBAC)The Kubernetes authorization mode that grants permissions through Roles/ClusterRoles bound to users, groups, or service accounts.Intermediate
• Root Certificate Authority (Root CA)The top-level CA in a hierarchy whose self-signed certificate is the trust anchor for all subordinate certificates.Foundational
• Rule-Based Access Control (RuBAC)Access control model that applies global rules to all subjects, such as time-of-day or firewall rules.Foundational
• SaltA Python-based configuration management and remote execution tool (SaltStack, now owned by Broadcom) using a master/minion architecture over a ZeroMQ event bus.Intermediate
• SandboxingRunning code in a restricted, isolated environment that limits its access to the system.Foundational
• Screened SubnetNetwork segment, formerly called a DMZ, that hosts public-facing services between the internet and the internal network.Foundational
• Secure Hash Algorithm 1 (SHA-1)Legacy 160-bit hash function with practical collision attacks; deprecated for security use.Foundational
• Secure Hash Algorithm 2 (SHA-2)NIST family of hash functions including SHA-224, SHA-256, SHA-384, and SHA-512.Foundational
• Secure Real-time Transport Protocol (SRTP)Profile of RTP that provides encryption, authentication, and replay protection for voice and video streams.Intermediate
• Secure Shell (SSH)An encrypted protocol for remote command-line access, tunneling and file transfer, using TCP port 22.Foundational
• Secure/Multipurpose Internet Mail Extensions (S/MIME)Standard for signing and encrypting email using X.509 certificates.Intermediate
• Security Assertion Markup Language (SAML)XML-based standard for exchanging authentication and authorization data between an IdP and SP.Intermediate
• Security BaselineA documented minimum set of security configurations and controls that a system type must meet.Foundational
• Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
• Security PerimeterThe boundary separating trusted components from untrusted ones, either within a system or around a network.Foundational
• Security Through ObscurityRelying on secrecy of design or implementation, rather than sound controls, as the main form of protection.Foundational
• Self-Signed CertificateCertificate signed with its own private key rather than by a trusted CA.Foundational
• Separation of Duties (SoD)Dividing a critical task among multiple people so no single individual can complete it alone.Foundational
• Service AccountA Kubernetes identity for processes running in pods to authenticate to the API server and, via federation, to cloud services.Intermediate
• Session KeyA temporary symmetric key used to encrypt a single communication session.Foundational
• Simple Network Management Protocol version 3 (SNMPv3)Version of SNMP adding user-based authentication and encryption for device monitoring and management.Foundational
• Single Sign-On (SSO)Allowing a user to authenticate once and access multiple applications without signing in again.Foundational
• Smart CardCredit-card-sized card with an embedded chip that securely stores certificates and private keys for authentication.Foundational
• SMS-Based AuthenticationSending one-time codes by text message as a second factor; convenient but weak.Foundational
• Split KnowledgeDividing a secret, such as a cryptographic key, so that no single person knows the whole value.Intermediate
• Split TunnelingVPN configuration that sends only corporate traffic through the tunnel while other traffic goes directly to the internet.Foundational
• SSH File Transfer Protocol (SFTP)A secure file transfer protocol that runs as a subsystem of SSH over TCP port 22.Foundational
• Stateful FirewallA firewall that tracks the state of connections and automatically allows return traffic for sessions initiated from trusted networks.Foundational
• SteganographyHiding the existence of data inside other data, such as an image, audio, or network traffic.Foundational
• Stream CipherA symmetric cipher that encrypts data one bit or byte at a time by combining it with a pseudorandom keystream.Foundational
• Subject Alternative Name (SAN)X.509 extension listing additional identities, such as DNS names or IPs, that a certificate is valid for.Foundational
• Substitution CipherCipher that replaces each plaintext unit with another symbol according to a fixed or keyed system.Foundational
• Symmetric EncryptionEncryption in which the same secret key is used to both encrypt and decrypt data.Foundational
• Technical ControlControl implemented through hardware, software, or firmware that enforces security automatically.Foundational
• TEMPESTStandards and techniques for limiting compromising electromagnetic emanations from electronic equipment.Advanced
• Terminal Access Controller Access-Control System Plus (TACACS+)Cisco-developed AAA protocol over TCP 49 that encrypts the full payload and separates authentication, authorization, and accounting.Foundational
• Ticket-Granting Ticket (TGT)Kerberos ticket issued after initial authentication that is used to request service tickets.Advanced
• Time-Based One-Time Password (TOTP)OTP algorithm (RFC 6238) that generates codes from a shared secret and the current time, typically every 30 seconds.Foundational
• Time-of-Day RestrictionsAccess controls that limit when accounts can log in or resources can be used.Foundational
• Transport Layer Security (TLS)The cryptographic protocol that secures application traffic with encryption, integrity and certificate-based authentication; successor to SSL.Foundational
• Transposition CipherCipher that rearranges the order of plaintext characters without changing the characters themselves.Foundational
• Triple DES (3DES)Symmetric cipher applying DES three times (encrypt-decrypt-encrypt) to increase effective key strength.Foundational
• Trusted Computing Base (TCB)All hardware, firmware, and software components critical to enforcing a system's security policy.Advanced
• Trusted Platform Module (TPM)Secure cryptoprocessor chip on a device that stores keys, measures boot integrity, and supports attestation.Foundational
• TwofishSymmetric block cipher with a 128-bit block and keys up to 256 bits; an AES competition finalist.Intermediate
• Video SurveillanceUse of cameras (CCTV or IP cameras) to deter, detect, and record physical security events.Foundational
• Virtual Private Network (VPN)Encrypted tunnel that securely connects remote users or sites across an untrusted network.Foundational
• Web Application Firewall (WAF)Layer 7 firewall that inspects HTTP/HTTPS traffic to protect web applications from attacks such as SQL injection and XSS.Foundational
• Web of TrustDecentralized trust model where users vouch for one another's public keys instead of relying on a central CA.Intermediate
• Wildcard CertificateCertificate that secures all first-level subdomains of a domain using an asterisk, such as *.example.com.Foundational
• Work FactorThe estimated time or effort required to break a cryptosystem or security control.Intermediate
• X.509ITU-T standard defining the format of public key certificates and certificate revocation lists.Intermediate