Cybersecurity Foundations: Assets, Frameworks, Cloud Security, and Risk

A comprehensive vocabulary review of core cybersecurity terms, the NIST Cybersecurity Framework, cloud computing service models, and foundational risk concepts.

Asset

An item perceived as having value to an organization.

Asset classification

The practice of labeling assets based on sensitivity and importance to an organization.

Asset inventory

A catalog of assets that need to be protected.

Asset management

The process of tracking assets and the risks that affect them.

Compliance

The process of adhering to internal standards and external regulations.

Data

Information that is translated, processed, or stored by a computer.

Data at rest

Data not currently being accessed.

Data in transit

Data traveling from one point to another.

Data in use

Data being accessed by one or more users.

Information security (InfoSec)

The practice of keeping data in all states away from unauthorized users.

National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)

A voluntary framework originally released in 2014 that consists of standards, guidelines, and best practices to manage cybersecurity risk.

Policy

A set of rules that reduce risk and protect information.

Procedures

Step-by-step instructions to perform a specific security task.

Regulations

Rules set by a government or other authority to control the way something is done.

Risk

Anything that can impact confidentiality, integrity, or availability of an asset.

Standards

References that inform how to set policies.

Threat

Any circumstance or event that can negatively impact assets.

Vulnerability

A weakness that can be exploited by a threat.

CSF Core

A component of the NIST CSF that provides a set of desired cybersecurity outcomes across six functions: Identify, Protect, Detect, Respond, Recover, and Govern.

Govern (NIST CSF)

A function added to the NIST CSF core in February of 2024 to emphasize leadership and decision-making when managing cybersecurity risks.

CSF Tiers

A component of the NIST CSF used to measure the sophistication of an organization's cybersecurity program on a scale of 1 to 4, where Tier 1 represents the lowest score.

CSF Profiles

Pre-made templates of the NIST CSF developed by industry experts, tailored to address specific organizational or industry risks and set a security baseline.

Cybersecurity and Infrastructure Security Agency (CISA)

A U.S. agency that provides detailed guidance and four-step implementation recommendations for organizations applying the NIST CSF.

Cloud computing

An on-demand, massively scalable service, hosted on shared infrastructure, accessible via the internet, as defined by the U.K.'s National Cyber Security Centre.

Software as a service (SaaS)

A cloud service category referring to front-end applications accessed via a web browser, with back-end systems fully hosted, managed, and maintained by the provider.

Platform as a service (PaaS)

A cloud service category offering online development tools that allow clients to write code and build, manage, and deploy applications while the provider manages the underlying hardware and software.

Infrastructure as a service (IaaS)

A cloud service category giving customers remote access to back-end computing resources hosted by the provider, including data processing servers, storage, and networking resources.

Cloud security

A subfield of cybersecurity that focuses specifically on protecting data, applications, and infrastructure located in the cloud.

Shared responsibility model

A cloud security model where security obligations are split between the provider and customer, with customers securing elements within their direct control like identity management, configuration, and data handling.

Risk calculation formula

A formula used to quantify risk based on negative events: $\text{Likelihood} \times \text{Impact} = \text{Risk}$.

Intentional threat

A category of threat involving deliberate malicious actions aimed at impacting assets, such as a malicious hacker targeting a misconfigured application.

Unintentional threat

A category of threat that harms assets without malicious intent, such as an employee holding open a restricted door for an unauthorized person.

Technical vulnerability

A category of vulnerability rooted in system flaws or weaknesses, such as misconfigured software granting unauthorized data access.

Human vulnerability

A category of vulnerability resulting from human error or behavior, such as an employee losing an access card in a parking lot.