Cybersecurity Chapters 4-8

Vulnerability

A specific weakness in a system that a threat can exploit.

Common Vulnerabilities and Exposures (CVE)

A database of publicly known cybersecurity vulnerabilities and exposures.

Zero-Day Vulnerability

An undiscovered flaw in an application or operating system; that is, a gap in security for which there is no defense or patch because the software maker does not know it exists—they have had “zero days” to prepare an effective response.

Attack Vectors

The methods or pathways that attackers use to breach a system’s defenses.

Attack Surface

The set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from that system, system element, or environment.

Cyber Hygiene

The practices that users of computers and other devices follow, and the steps they take, to maintain system health and improve online security. These practices are often part of a routine to ensure the safety of identity and other details that could be stolen or corrupted.

Credential Stuffing

A cyberattack where attackers use stolen username/password combinations to gain unauthorized access to multiple accounts.

Operational Vulnerabilities

Weaknesses in an organization’s processes or systems that can be exploited to cause operational failures or security breaches.

Intrusion Detection and Prevention Software/System (IDPS)

Hardware and/or software tools that detect and respond to suspicious activities on a network or system, combining both detection and prevention functionalities.

Virtual Private Network (VPN)

A technology that creates a secure, encrypted connection over a less-secure network, such as the Internet.

Cybersecurity and Infrastructure Security Agency (CISA)

A US federal agency responsible for protecting the nation’s critical infrastructure from physical and cyber threats.

Hidden Backdoor Program Vulnerabilities (Backdoor)

Security weaknesses in software that allow unauthorized access to a system, often intentionally left by developers for maintenance purposes.

Human Vulnerabilities

User errors can easily expose sensitive data, create

exploitable access points for attackers, or disrupt system

SQL Injection

A type of attack where malicious SQL code is inserted into a database query, allowing the attacker to gain unauthorized access to data.

Remote Code Execution (RCE)

A cyberattack where an attacker can execute code on a remote system.

Software Vulnerabilities

Weaknesses or flaws in software that can be exploited by attackers to gain unauthorized access or cause damage.

Transmission Control Protocol (TCP)

A communication protocol that establishes a reliable connection between two systems and ensures the correct delivery of data packets.

SYN Flood

A type of denial-of-service (DoS) attack that targets the TCP three-way handshake used to open connections. The attacker overwhelms a server with so many half-open TCP connection requests (SYN packets) that the server runs out of resources for legitimate clients—causing slowdowns or service outages.

Network Segmentation

The practice of dividing a computer network into smaller, isolated sections (segments) to improve security, performance, and manageability.

Common Vulnerability Scoring System (CVSS)

A free and open industry standard for assessing the severity of computer system security vulnerabilities.

Cyberattack Equation

Threat + Vunerability = Cyberattack

Risk Equation

Likelihood x Impact = Risk

Operational Information Security Risk

The risk of loss resulting from inadequate or failed processes, systems, human errors, or external events relating to information security.

Reputational Risk

The potential for any event, controllable or otherwise, to damage your organization’s reputation.

Compliance Risk

The potential for legal or regulatory sanctions, financial loss, or damage to reputation that an organization may suffer as a result of its failure to comply with laws, regulations, and standards.

General Data Protection Regulation (GDPR)

A regulation in EU law governing data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the transfer of personal data outside the EU and EEA.

Cyber Value at Risk (VaR)

A quantitative risk management approach that applies the financial value at risk (VaR) concept to cybersecurity. It estimates the potential financial loss an organization could face from cyber incidents within a defined time horizon and at a specified confidence level.

Risk Appetite

The amount of risk that an organization is willing to accept in pursuit of its objectives.

Risk Tolerance

The acceptable level of variation in performance or outcomes that an organization (or individual) is willing to withstand in pursuit of its objectives.

Qualitative Risk Assessment

A method of evaluating risks based on subjective judgment and non-numeric criteria, such as severity or likelihood.

Factor Analysis of Information Risk (FAIR)

A risk management framework used to understand, analyze, and quantify information risk in financial terms.

FAIR Risk Assesment Steps

Classify System, Identify Threats, Assess controls, Calculate Chance of Cyberattack, Determine Risk

Monte Carlo Simulation

A mathematical technique used to model the probability of different outcomes when there is uncertainty in the input variables. Instead of producing a single outcome, it runs a large number of trials (often thousands or millions), each time using randomly generated values within defined ranges, to estimate the distribution of possible results.

Information Security Management System (ISMS

A framework of policies and procedures used to manage an organization’s information security risks.

ISO/IEC 27005

An international standard that provides guidelines for information security risk management. Identify, Analyze, Evaluate

NIST SP800-30

A NIST special publication that provides guidelines for conducting risk assessments for information systems

Acceptable Risk

The level of risk that is deemed tolerable in an organization’s operations, given the expected benefits and controls.

Technical Controls

The measures that organizations put in place to safeguard their digital assets.

Administrative Controls

The creation and enforcement of security policies, rules, procedures, and guidelines that are set by management.

Physical Controls

The measures that organizations take to physically protect their assets.

Preventive Control

A control put in place with the intention to avoid an incident or prevent it from occurring.

Detective Control

A control put in place to detect and alert about an incident that has already occurred.

Corrective Control

A control put in place to correct the damage done as a result of an incident that has already occurred.

Compensating Control

Supplementary measures that are implemented to protect against identified risks or threats when primary controls are ineffective, infeasible, or inefficient.

Logical Access Control

Tools and/or protocols used to identify, authenticate, authorize, and hold accountable individuals trying to access a system.

Discretionary Access Control

The owner of a resource decides who can access it and what they can do.

Mandatory Access Control

Access is controlled by system-enforced rules based on classifications (e.g., Top Secret, Confidential). Users cannot change permissions.

Role-Based Access Control

A type of control where permissions are assigned to roles (e.g., “Manager,” “HR”) and users inherit permissions through their role(s).

Attribute-Based Access Control

Access decisions are based on attributes (user, resource, environment) and policies.

Rule-Based Access Control

A type of control that uses predefined rules to grant/deny access, often based on conditions like time of day or IP address.

Risk-Adaptive Access Control

A type of control that considers contextual risk and adjusts access dynamically.

Encryption

The process of converting data into a coded format to prevent unauthorized acces

Cipher

An algorithm for encrypting and decrypting information.

Symmetric Encryption

An encryption method that uses a single shared key to encrypt and decrypt data.

Asymmetric Encryption

An encryption method that uses a pair of keys (public and private) to encrypt and decrypt data.

Firewall

A security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

ntrusion Detection and Prevention Software (IDPS)

Hardware and/or software tools that detect and respond to suspicious activities on a network or system, combining both detection and prevention functionalities.

System Information and Event Management (SIEM)

A solution that provides real-time analysis of security alerts generated by network hardware and applications.

Blue Screen of Death (BSOD)

An error screen displayed on Windows computers following a fatal system error.

Access Control Policy

A set of rules that determines who is allowed to access specific data, applications, or resources and under what conditions.

Data Security Policy

A formal document that outlines an organization’s guidelines, rules, and standards for managing and protecting sensitive data assets.

Incident Response Policy

A formal document that outlines the procedures and responsibilities an organization follows to detect, respond to, and manage cybersecurity incidents.

Incident Response Plan (IRP)

A set of procedures and guidelines that an organization follows when responding to a cybersecurity incident.

Computer Security Incident Response Team (CSIRT)

A group within an organization that responds to security incidents and breaches.

Incident Simulation

A strategic exercise that replicates potential cyberattacks or security incidents to assess and improve an organization’s ability to detect, respond to, and mitigate threats in a controlled environment.

Separation of Duties

An organizational principle that divides tasks and responsibilities among multiple individuals to reduce the risk of fraud or error.

CIS Critical Security Controls

A risk management model made up of a prescriptive, prioritized, and simplified set of best practices that can be used to strengthen a cybersecurity posture.

NIST Cybersecurity Framework Functions

Govern, Identify, Protect, Detect, Respond, Recover

Endpoint Detection and Response (EDR)

Technology that continuously monitors endpoints for evidence of threats and performs automatic actions to help mitigate them.

Statement on Auditing Standards (SAS)

Official guidelines issued by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA). The SAS provides rules and procedures that auditors must follow when conducting audits of companies in the United States.

Sarbanes-Oxley Act (SOX)

A US federal law that sets requirements for public company boards, management, and public accounting firms to protect investors from fraudulent financial reporting.

Control Criteria

Standards or benchmarks used to evaluate the design and effectiveness of internal controls in an organization. They define what “good” controls should look like and provide a framework for assessing whether controls are achieving their intended purpose.

Internal Control Over Financial Reporting (ICFR)

The policies and procedures a company puts in place to reasonably ensure that its financial statements are accurate, complete, reliable, and prepared in accordance with the applicable accounting standards

SOC 2 Readiness Assessment

A pre-audit evaluation designed to help an organization prepare for a SOC 2 examination. It identifies gaps in its security, privacy, and internal control practices before the formal audit begins.

Carve-Out Method

An approach used in SOC 1 or SOC 2 audits when a service organization relies on a subservice organization but does not include that organization’s controls in the scope of its own SOC report.

Inclusive Method

An approach used in SOC 1 or SOC 2 audits when a service organization includes the controls of a subservice organization within the scope of its own SOC examination. The auditor(s) will therefore evaluate and test the subservice organization’s controls as if they were part of the primary organization’s system.

Complementary Subservice Organization Controls (CSOCs)

Specific controls that a subservice organization is expected to implement and operate effectively to support the overall system of controls described in a SOC 1 or SOC 2 report. These controls are excluded from testing by auditors using the carve-out method but are included in testing using the inclusive method.

Complementary User Entity Controls (CUECs)

Controls that a service organization assumes its customers (user entities) will implement for the service organization’s system of controls to operate effectively.

Testing Matrix

A structured tool used in audits, risk assessments, or compliance reviews to organize and track the testing of internal controls. It helps auditors or control testers clearly map what is being tested, how it’s being tested, and what the results are.