Sec + Module 1 Terms

3DES

Triple Data Encryption Standard — An older symmetric block cipher that applies the Data Encryption Standard algorithm three times to each data block; now deprecated.

Access Control Vestibules

Double-door entry systems (man-traps) that hold individuals in a secure transition area to prevent tailgating or piggybacking.

Accounting

The tracking of user activity, resource consumption, and system access through logs and auditing to ensure accountability and non-repudiation.

Acoustical

Sensor technology used in physical intrusion detection systems that listens for specific sound frequencies or noises (such as breaking glass).

AES

Advanced Encryption Standard — A highly secure, widely adopted symmetric block cipher using 128, 192, or 256-bit keys.

Asymmetric Encryption

Cryptography using a key pair—a public key to encrypt and a private key to decrypt (or vice versa for digital signatures).

Authentication

The process of verifying the identity of a user, device, or service (e.g., via passwords, biometrics, or Multi-Factor Authentication).

Automated Provisioning

Dynamically deploying and configuring IT infrastructure and user accounts automatically without manual intervention.

Authorization

Determining what specific resources and actions an authenticated entity has permission to access.

Availability

Ensuring that systems, data, and network services are accessible to authorized users whenever needed.

Baseline Configuration

A secure, standardized template configuration for operating systems, servers, or network devices.

Blackout

A complete, total loss of electrical power.

Blockchain

A decentralized, immutable distributed ledger technology that ensures cryptographically verified transaction integrity.

Broken

A cryptographic algorithm or protocol with known, exploitable vulnerabilities that make it completely unsafe for security use.

Brownout

A sustained drop or reduction in electrical voltage.

Change Management

A structured methodology for managing modifications to IT systems, infrastructure, or applications to minimize downtime and risk.

Cipher Algorithm

The mathematical formula or rule used to encrypt and decrypt data.

Ciphertext

Data that has been encrypted into an unreadable, secure format.

Collision

A cryptographic hash vulnerability where two entirely different inputs produce the exact same hash output.

Compensating Controls

Alternative security measures implemented when primary controls are not feasible due to cost, technical, or business constraints.

Concealment

Hiding sensitive data or assets in plain sight (such as through steganography) rather than using mathematical encryption.

Confidentiality

Ensuring that sensitive data is accessed only by authorized individuals, protecting it from unauthorized disclosure.

CI

Configuration Item — Any individual component, asset, or service managed under Configuration Management.

Configuration Management

Tracking, managing, and documenting the baseline states and lifecycle of IT assets.

Control Baselines

A minimum, standardized level of security controls that an organization must implement and maintain.

Control Objective

The specific goal or purpose a security control is designed to achieve.

Control Plane

The network architecture layer that handles routing decisions, configurations, and management signaling.

Corrective Controls

Measures taken to mitigate, repair, or reverse the impact of an incident after it has occurred (e.g., restoring from backups, patching).

Cost-Benefit Analysis Controls

Evaluating whether the cost of implementing a security control is justified by the value of the asset being protected.

Cover Image

The ordinary, innocent-looking image file used to conceal a hidden secret message in steganography.

CPTED

Crime Prevention Through Environmental Design — Designing physical environments (lighting, landscaping, architecture) to naturally deter crime.

Cryptography

The science of protecting information by transforming it into secure, unreadable formats.

Data Plane

The network architecture layer that forwards actual user traffic and data packets.

Demand-generated Resource Allocation

Dynamically scaling computing resources up or down automatically based on real-time operational demand.

Deprecated

An outdated algorithm, protocol, or technology that is discouraged from use and phased out in favor of stronger alternatives.

Detective Controls

Measures designed to identify and record security events and intrusions as they happen or shortly after (e.g., IDS, SIEM, logs).

Deterrent Controls

Measures intended to discourage potential attackers from attempting a breach (e.g., warning signs, cameras, policy banners).

DH

Diffie-Hellman — A protocol used to securely exchange cryptographic keys across an insecure public network.

Digital Certificates

Electronic credentials bound by a Certificate Authority (CA) that tie a public key to an entity's identity.

Digital Signatures

An asymmetric cryptographic mechanism providing authentication, integrity, and non-repudiation by signing data with a private key.

Digital Watermark

A hidden or visible marker embedded in digital media to verify authenticity and copyright ownership.

Directive Controls

Measures that mandate specific behavior through organizational policies, guidelines, and compliance training.

DSA

Digital Signature Algorithm — A standard federal digital signature algorithm based on discrete logarithms.

ECC

Elliptic Curve Cryptography — Asymmetric cryptography based on algebraic structures of elliptic curves, providing strong security with smaller key sizes.

Effectiveness

The degree to which a security control successfully mitigates risk and achieves its stated objective.

El Gamal

An asymmetric encryption algorithm based on the Diffie-Hellman key exchange used for encryption and digital signatures.

EMI

Electromagnetic Interference — Electrical noise generated by external sources that can disrupt network cables or sensitive equipment.

Emergency Change

Urgent, unplanned changes implemented rapidly to fix critical vulnerabilities, security incidents, or major outages.

Encryption

The process of converting readable plaintext into unreadable ciphertext.

Environmental Baselines

Standardized operating ranges (temperature, humidity, power) maintained in a facility to prevent hardware failure.

ESD

Electrostatic Discharge — The sudden flow of electricity between two objects, which can permanently damage sensitive computer components.

Fail-safe

A security state where a system defaults to an unlocked or open state during a power failure to prioritize human safety and emergency egress.

Fail-secure

A security state where a system defaults to a locked or secured state during a power failure to protect high-value physical assets or data.

Fingerprint

A unique, fixed-length hash value or identifier used to verify the integrity or identity of a file, certificate, or device.

Fire Surge

A sudden, dangerous spike in electrical voltage or fire hazard requiring suppression and surge protection.

Hashing

A one-way mathematical function that converts data of any size into a fixed-length string to ensure integrity.

HMAC

Hash-based Message Authentication Code — A technique combining a secret cryptographic key with a hash function to verify both data integrity and authenticity.

Hot Aisle / Cold Aisle

Data center rack layout design that optimizes cooling efficiency by separating cold intake air from hot exhaust air.

HSM

Hardware Security Module — A physical, tamper-resistant hardware device dedicated to securely storing cryptographic keys and accelerating crypto operations.

Humidity

The amount of moisture in the air; must be regulated in data centers to prevent static electricity (too dry) or corrosion/short circuits (too damp).

IaC

Infrastructure as Code — Managing and provisioning computing infrastructure through machine-readable definition files rather than manual hardware configuration.

Idempotence

The property where applying an automation script or operation multiple times yields the exact same result without changing state beyond the first application.

Immutability

The property where infrastructure components cannot be modified after deployment; updates require destroying and replacing the component.

Integrity

Ensuring that data and systems are accurate, complete, and uncompromised by unauthorized tampering or modification.

ITIL

Information Technology Infrastructure Library — A widely accepted framework for IT service management (ITSM) best practices.

Key

A secret piece of information (string of bits) used by a cryptographic algorithm to encrypt or decrypt data.

KMS

Key Management Service — A centralized system or service used to generate, store, rotate, and revoke cryptographic keys.

KPI

Key Performance Indicator — A measurable quantitative metric used to evaluate the success, efficiency, and security posture of IT operations.

Layered Security

Defense-in-Depth — Using multiple, overlapping security controls so that if one layer fails, subsequent layers protect the asset.

Major Change

High-risk, high-impact changes requiring extensive testing and approval by upper management or a Change Advisory Board (CAB).

Malvertising

The malicious use of legitimate online advertising channels to distribute malware or direct users to phishing sites.

Managerial Controls

Administrative Controls — Security policies, procedures, risk assessments, and compliance frameworks defined by management.

MD

Message Digest — The fixed-size output of a hashing algorithm (such as the broken/deprecated MD5).

Microwave

Active motion-detection sensors that emit microwave pulses and measure reflections to detect physical movement.

Non-repudiation

A security service that provides undeniable proof of data origin and integrity, preventing a user from denying an action they performed.

Normal Change

Standard non-emergency changes that require formal review, scheduling, testing, and approval before deployment.

OECD

Organisation for Economic Co-operation and Development — Established internationally recognized privacy principles governing the ethical collection and protection of personal data.

One-way Representation

A cryptographic hash output that cannot be mathematically reversed back into the original input data.

Operational Controls

Day-to-day security procedures executed by personnel (e.g., security guard patrols, awareness training, configuration reviews).

OT

Operational Technology — Hardware and software systems that monitor and control physical devices, industrial equipment, and critical infrastructure (e.g., ICS, SCADA).

PA

Policy Administrator — The Zero Trust component responsible for establishing or shutting down the communication path between a subject and a resource.

PDP

Policy Decision Point — The Zero Trust component (consisting of the Policy Engine and Policy Administrator) that evaluates requests and decides whether to grant access.

PE

Policy Engine — The Zero Trust component that evaluates access requests against organizational policies and external threat intelligence to make the final grant/deny decision.

PEP

Policy Enforcement Point — The Zero Trust component responsible for enabling, monitoring, and eventually terminating connections between a user/device and an enterprise resource.

PHE

Partially Homomorphic Encryption — Encryption that allows a single type of mathematical operation (either addition or multiplication) to be performed on encrypted data.

Photometric

The measurement of visible light intensity; used in physical security to ensure adequate outdoor and facility lighting to deter crime.

Physical Controls

Tangible measures (fences, guards, locks, CCTV) designed to protect physical facilities, equipment, and personnel.

Physical Security

The protection of personnel, hardware, software, networks, and data from physical actions and events that could cause serious loss or damage.

Pick Resistant Lock

High-security mechanical locks designed with specialized pins or tumblers to resist physical manipulation and picking tools.

PIR

Passive Infrared — Motion sensors that detect changes in infrared radiation (body heat) within an area.

PKI

Public Key Infrastructure — The complete framework of hardware, software, policies, and procedures to create, manage, distribute, and revoke digital certificates.

Post-quantum Encryption

Cryptographic algorithms engineered to remain secure against attacks by quantum computers.

Power

Electrical supply management; critical to maintain continuous availability and protect hardware from surges, sags, and blackouts.

Preventative Controls

Measures designed to stop security incidents before they occur (e.g., firewalls, access control lists, physical locks).

Privacy

The right of individuals to control or restrict access to their personal information.

Private Key

The secret half of an asymmetric key pair, kept strictly confidential by the owner and used to decrypt data or create digital signatures.

Proportionality

Ensuring that the strength and cost of a security control are appropriate relative to the level of risk and value of the asset.

Public Key

The openly shared half of an asymmetric key pair, used by others to encrypt messages for the key owner or verify their digital signatures.

Quantum Encryption

Using principles of quantum mechanics (such as Quantum Key Distribution) to secure data transmission and detect eavesdropping.

RC4

Rivest Cipher 4 — A widely deprecated symmetric stream cipher known for severe cryptographic vulnerabilities.