SOCOA Key Terms

Cybersecurity

The practice of protecting systems, networks, and programs from digital attacks

CIA Triad

Core principles of cybersecurity

Confidentiality

Ensures only authorized parties have access to sensitve information

Integrity

Ensures data is accurate and has not been altered

Availability

Ensures data is accessible when needed

Threat

A potential cause of an unwanted incident

Vulnerability

A weakness that can be exploited by a threat

Risk

The potential impact when a threat exploits a vulnerability

Threat Actor

The individual/group behind the threat

Attack Vector

The method used to exploit a vulnerability

Insider Threat

Someone within the organization who poses a threat

Nation-State Actor

A threat actor sponsored by the government

Attack

An actual occurrence where a threat has been realized

Reconnaissance

The process of gathering information about the target system or organization

Exploit

A software, Script, or code used to take advantage of a vulnerability

Cyber Kill Chain

A detailed step-by-step instruction for attacking

Vendor Risk

Security exposure due to third party systems

Social Engineering

Manipulating people into giving confidential/personal information

Phishing

Deceptive emails/messages used to trick people into clicking malicious links or stealing sensitive information

Spear Phishing

A targeted attack directed a specific person/group

Pretexting

Creating a fake scenario to get information

Baiting

Offering something interesting/enticing to lure people into a trap to get information

Tailgating

Following authorized people into a restricted area without proper credentials

Impersonation

Pretending to be someone trusted to gain access

Malware

Malicious software designed to harm or exploit a system, device or network

Virus

Type of malware that attaches itself to host files and spreads when human interaction activates it

Worm

Type of malware that self-replicates independently across systems

Trojan Horse

Type of malware that disguises itself as legit software on a device

Ransomware

Type of malware that encrypts files and demands payment for decryption

Spyware

Type of malware that gathers information on a device without consent

Adware

Type of malware that disrupts a system by displaying unwanted ads

Rootkit

Hides malware by modifying the OS

Keylogger

Captures keystrokes to gather personal information such as passwords

Denial of Service (DoS)

Disruption of normal access to systems or services

Incident Response

The process of detecting, investigating, and recovering from cybersecurity breaches

Path Management

Regular updates to fix software vulnerabilities

Framework

A set of guidelines and standards that organizations follow to manage cybersecurity risks

Enterprise Risk Management (ERM)

The systematic process of identifying, assessing, mitigating, and monitoring risks that could impact a organization’s objectives

Financial Risk

Monetary loss a business loses due to fraud, breaches, or outages

Reputational Risk

Loss of trust from customers/clients after a cyber incident becomes public

Strategic Risk

Cyber events that undermine long term objectives

Operational Risk

Disruption to essential business daily services

Compliance Risk

Fines or legal consequences due to violation of laws and regulations

Cybersecurity Risk Management (CRM)

The process of identifying and mitigating risks specifically associated with information systems

Cybersecurity Governance

A set of responsibilities that guide guides organizations to mitigate and manage risks

Framework

A structured set of guidelines and standards that organizations can follow to manage cybersecurity risks

System Risk Management

The process of protecting specific IT systems

(Servers, applications, and networks)

Risk Appetite

The amount & type of risk an organization is willing to accept

Risk Ownership

The process of assigning responsibility of a specific risk to an individual who has the authority to manage it

Risk Register

A detailed list of identified risks, its likelihood, owner and status

Risk Remediation

The actions taken to eliminate or reduce a security problem

Authorize to Operate

Formal confirmation given to continue operation

IT Asset Management (ITAM)

Tracks and manages IT assets

Qualitative Risk Assessment

Risk assessment based on descriptive scales and expert judgement to measure risk probability

Quantitative Risk Assessment

Risk assessment that use structured formulas and numerical values to measure risk probability

Asset Value (AV)

Monetary value of the asset at risk

Exposure Factor (EF)

Percentage of an assets value that would be loss if a breach occurred

Single Loss Expectancy (SLE)

The estimated dollar value loss for a single incident

Annual Rate of Occurrence (ARO)

How often a threat is expected to occur yearly

Annual Loss Expectancy (ALE)

The expected yearly loss for a specific threat

Compliance

Refers to following laws, regulations and contractual requirements that govern the protection of Information Systems and data

Sarbanes Oxley Act of 2002 (SOX)

US law requiring CEO/CFOs to attest to the accuracy and integrity of financial and IT controls

Federal Information Security Modernization Act (FISMA)

Requires federal agencies to have & maintain proper cybersecurity protection for sensitive systems

Health Insurance Portability & Accountability Act (HIPAA)

Protects health related information used by healthcare providers

Federal Education Rights & Protection Rights Act (FERPA)

Protects student educational records & privacy in academic institutions

Gramm-Leach Billey Act (GLBA)

Requires financial institutions to protect customers financial data

Payment Card Industry Data Security Standard (PCI DSS)

Protects customers credit card data

General Data Protection Regulation (GDPR)

EU law governing personal data privacy for any company that collects and/or processes EU residents data

Security Audit

An evaluation of a system to ensure security measures put in place are effective and strong

Penetration Testing

A simulation of an attack to attempt to exploit known vulnerabilities within a system

Cybersecurity Policies and Procedures

Documents rules and guidelines put in place to ensure everyone in the organization understands their role and follows best practices when handling sensitive digital information

Acceptable Use Policies (AUP)

Defines how employees can use the organization’s IT resources

Security Controls

Techniques organizations use to protect its system and data

Preventative Security Control

Stops incidents before the occur

Directive Security Control

Encourages correct behavior

Detective Security Control

Identifies that an event has occurred

Corrective Security Control

Repairs damages and restores systems

Deterrent Security Control

Discourages unwanted behavior

Physical Security Control

Protects physical spaces and assets

Business Continuity Plan (BCP)

A strategy developed to ensure that an organization continue operation during and after an disruption

Business Impact Analysis (BIA)

Plan that identifies which systems, processes and resources are critical for operation survival

Recovery Time Objective (RTO)

The maximum amount of time a system/service can be down without consequence

Recovery Point Objective (RPO)

Measures the maximum tolerable amount of data that can be lost

Disaster Recovery Plan (DRP)

Strategy developed to restore systems and data after an outage or attack

Operating System (OS)

System software that manages computer hardware and software resources

Kernel

Core of the Operating System that manages CPU, memory and device control

Command Line Interface (CLI)

Text-based interface used to operate the system

Graphical User Interface (GUI)

Visual based interface using windows and icons

Interrupts

An alert from hardware and software that needs attention

Virtual Memory

Memory management technique used by computer operating systems to expand available storage

Shell

Program that interprets commands from the user

Terminal

Application used to access the shell

Absolute Path

A path that starts at the root directory

Relative Path

A path that starts at the current directory