Cybersecurity

Security

Protection of valuable assets from harm, misuse, loss, or disruption.

Asset

Something valuable to an individual or organization (e.g., data, money, accounts, services, reputation, intellectual property, AI models).

Threat

A potential cause of harm or loss (e.g., attackers, accidents, disasters, bugs, malicious insiders).

Vulnerability

A flaw or weakness in a system that can be exploited (e.g., missing security patch, weak password, misconfigured bucket).

Attack Vector

The route or path used by a threat actor to exploit a vulnerability (e.g., phishing emails, exposed APIs, stolen laptops).

Control / Mitigation

Safeguards or countermeasures put in place to reduce risk (e.g., MFA, encryption, firewalls, backups).

Risk

The combination of the likelihood of an event occurring and the severity of its potential impact.

Confidentiality

Ensures data is accessible only to authorized entities.

Integrity

Ensures information and systems are accurate, complete, and protected against improper modification or tampering.

Availability

Ensures systems, networks, and data are operational and accessible when needed by authorized users.

Least Privilege

Users and applications receive only the minimum permissions necessary to complete their functions.

Defense in Depth

Deploy multiple layered controls so that the failure of a single mechanism does not cause total compromise.

Know What Matters

Identify assets, trust boundaries, users, and critical dependencies.

Assume Systems Fail

Design architectures under the assumption that individual controls or components will fail.

Make Risk Visible

Maintain logging, continuous monitoring, and testing to observe failures.

STRIDE

Threat modeling framework categorizing threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

Consequentialism

Judging the moral correctness of actions strictly by their outcomes or results.

Deontology

Judging actions by their adherence to explicit duties, rules, or obligations, regardless of outcome.

Virtue Ethics

Judging actions based on the internal character traits and virtues they foster.

Privacy

The right of individuals to control how information about themselves is collected, used, shared, and retained.

Security

Technical and operational protections applied to safeguard assets from threats.

Full Disclosure

Publicly publishing bug details immediately without notifying the vendor first.

Coordinated Disclosure

Security researchers report vulnerabilities privately to the vendor first.

Dual-Use Technology

Tools or techniques that serve defensive, legitimate purposes as well as offensive/harmful applications.

Risk Formula

Risk = Asset + Threat + Vulnerability.

Single Loss Expectancy (SLE)

The financial loss expected each time a threat occurs.

Annualized Rate of Occurrence (ARO)

The estimated frequency with which a threat occurs per year.

Annualized Loss Expectancy (ALE)

The expected annual financial loss for a specific risk.

Quantitative Analysis

Uses numeric data and financial values to calculate exact monetary impact.

Qualitative Analysis

Uses categorical ratings (e.g., High, Medium, Low) based on expert judgment.

Avoid

Modify business processes so the risk no longer applies.

Mitigate

Implement security controls to reduce the likelihood or impact of the risk.

Transfer

Shift the financial burden of the risk to a third party.

Accept

Consciously and formally document the decision to live with the risk.

Physical Controls

Locks, fences, environmental suppressors, badge access.

Procedural/Administrative Controls

Security policies, training, background checks, incident response plans.

Technical/Logical Controls

Firewalls, ACLs, EDR/XDR, encryption, access control lists.

Legal/Regulatory Controls

Compliance requirements, vendor contracts, privacy legislation.

Stateful Inspection

Tracks active connection states and allows inbound traffic only if it is a legitimate response to an established outbound request.

Intrusion Detection System (IDS)

Operates passively and generates alerts upon detecting suspicious patterns.

Intrusion Prevention System (IPS)

Deployed inline with network traffic and actively inspects and drops malicious packets in real time.

VLAN Segmentation

Logically divides Layer 2 broadcast domains on switches.

Demilitarized Zone (DMZ)

A perimeter network segment hosting public-facing services.

Air Gapping

Complete physical and logical separation of a system from all external networks.

Network Address Translation (NAT)

Maps internal, private IP addresses to a public IP address.

Routing

Routers inspect destination IP addresses and query internal Routing Tables.

Domain Name System (DNS)

Resolves human-readable domain names into routable IP addresses.

Time To Live (TTL)

A numerical value in seconds determining how long DNS records are cached.

Traffic Filtering

Enforces boundary access-control policies between trusted and untrusted networks.