1.1 Module A: Security concepts

Asset

Anything of value to an organization that needs protection.

Threat

Anything that can harm an asset.

Risk

The chance of harm coming to an asset.

Vulnerability

A weakness that can be exploited by a threat.

Threat vector / Attack vector

The method or mechanism used by a threat to attack an asset.

CIA Triad

The three core goals of cybersecurity: Confidentiality, Integrity, and Availability.

Confidentiality

Ensuring information is accessible only to authorized users or systems.

Integrity

Ensuring information remains accurate and complete and is not improperly changed.

Availability

Ensuring information is accessible to authorized users when needed.

Authenticity

Verifying that information comes from a trustworthy source and has not been improperly changed.

Non-repudiation

Ensuring a person cannot deny being the source or author of information.

Accountability

Ensuring actions can be traced to a specific person or actor.

Privacy

Protecting personally identifiable information (PII) and the individual's rights regarding that information.

Safety

Protecting human life and well-being.

Security control

Anything used to protect assets by controlling risk.

Managerial control

Organizational policies, procedures, and training used to achieve security goals.

Technical control

Technology used to enforce security, such as firewalls, authentication, and encryption.

Operational control

Day-to-day activities performed by employees to achieve security goals.

Physical control

Methods used to physically protect assets, such as locks, fences, cameras, and guards.

Preventative control

A control designed to prevent a security problem from occurring.

Directive control

A control designed to encourage or require secure behavior.

Detective control

A control that detects or records security problems.

Corrective control

A control used after a security problem to reduce damage and prevent recurrence.

Deterrent control

A visible control designed to discourage attacks or unwanted behavior.

Compensating control

An alternative control that provides equal or better protection when the required control cannot be implemented.

Least privilege

Giving users only the permissions they need to perform their duties.

Need to know

Restricting access to information only to people who specifically need that information.

Separation of duties

Splitting critical tasks among different people so one person cannot perform the entire sensitive process alone.

Access controls

Controls that restrict access to systems and resources.

Encryption

Using mathematical processes to make data unreadable without the proper decryption key.

Steganography

Hiding a secret message inside an ordinary message or file.

Hashing

Creating a small, fixed-size fingerprint of data so changes to the original can be detected.

Digital signature

A cryptographic method that verifies the authenticity and integrity of information and can provide non-repudiation.

Backups

Copies of data used to restore information after it is changed or lost.

Version control

Keeping multiple versions of files and tracking changes so earlier versions can be restored.

Redundancy

Having multiple or backup systems so another can take over if one fails.

Fault tolerance

The ability of a system to continue functioning when a component fails.

Patch management

Managing security and stability updates while minimizing disruption to system availability.

Five nines

99.999% availability, which allows about 5.26 minutes of downtime per year.

Event

A detectable change in a system's state that occurs at a specific time.

Incident

An unexpected or unusual event that poses a meaningful threat to system functionality or security.

Alert

A signal that an event might be a security incident.

True positive

A problem occurred and the analysis correctly recognized it.

True negative

The event was benign and the analysis correctly recognized it as benign.

False positive

The event was benign but the analysis incorrectly identified it as a problem.

False negative

A problem occurred but the analysis incorrectly identified it as benign.

Metric

Anything that can be consistently measured to make meaningful comparisons.

Capability

A system's features, functions, and mechanisms.

Performance

The speed or efficiency of completing intended tasks.

Latency

The time delay between an action and its response.

Availability

A system's ability to avoid outages and remain accessible.

Usability

How easy a system or control is for users to interact with.

Maintainability

The difficulty of maintaining a system or control.

Scalability

A system's ability to handle increasing workload or stress.

Recoverability

The ability or difficulty of recovering a system after a failure.

Cost

How much a system or control costs to operate.

Indicator

A metric that is useful for identifying trends or making decisions.

KPI (Key Performance Indicator)

A measurable performance metric relevant to business goals.

KRI (Key Risk Indicator)

A metric that shows an organization's level of risk and how it changes.

KCI (Key Control Indicator)

A metric that measures how effective a security control is.

SMART

Specific, Measurable, Assignable, Relevant, and Time-Bound.

Gap analysis

Comparing the current status with a target status to identify what needs to improve.

Trend analysis

Tracking changes over time to identify trends and anticipate future problems.

CIS (Center for Internet Security)

Develops and promotes cybersecurity best practices, benchmarks, and assessment tools.

IEEE (Institute of Electrical and Electronics Engineers)

Publishes standards in technology and networking, including Ethernet and Wi-Fi standards.

IETF (Internet Engineering Task Force)

Develops Internet standards and protocols.

ISO (International Organization for Standardization)

Develops international standards, including information technology and security standards.

ISOC (Internet Society)

Supports Internet development and organizes Internet-related activities.

ITU (International Telecommunication Union)

UN agency responsible for telecommunications and global technical standards.

NIST (National Institute of Standards and Technology)

A U.S. government agency that develops standards and cybersecurity guidance.

NSA (National Security Agency)

A U.S. intelligence agency involved in information gathering, cryptography, and government security.

OWASP (Open Web Application Security Project)

Provides resources and guidelines for web application security.

Alice

A placeholder name for a person or system sending a secure message.

Bob

A placeholder name for a person or system receiving a secure message.

Eve

A placeholder name for an eavesdropper.

Mallory

A placeholder name for an attacker who modifies data.

Craig

A placeholder name for a password cracker.