Archives: Glossary

Access control is the set of policies, processes, and technologies that decide who can reach a resource and what they may do with it. It turns a verified identity into a concrete set of permissions, granting one person read-only rights… Read More

An Access Control List (ACL) is a table attached to a resource that spells out which users or systems may access it and what they are allowed to do. On a file system, an ACL sets read, write, and execute… Read More

Adversarial Machine Learning (AML) is the study of how machine learning models can be deliberately fooled, along with the defenses that make fooling them harder. An attacker shapes an input that looks perfectly ordinary to a person yet nudges the… Read More

AI Security is the practice of protecting artificial intelligence systems, including their models, training data, and serving pipelines, from attack, misuse, and unintended failure. It covers two sides of one coin: securing AI itself, and using AI to defend other… Read More

Annualized Loss Expectancy (ALE) estimates the money a specific threat is expected to cost over a single year. It is calculated by multiplying the Single Loss Expectancy (SLE), the dollar impact of one occurrence, by the Annualized Rate of Occurrence… Read More

API Security is the practice of protecting application programming interfaces (APIs) from misuse, unauthorized access, and data exposure across their full lifecycle. APIs now carry most of the traffic between web apps, mobile clients, and microservices, which makes them a… Read More

Application whitelisting, also called application allowlisting, permits only explicitly approved software to run and blocks everything else by default. It inverts the model traditional antivirus uses. Instead of chasing known-bad files and letting the rest execute, allowlisting assumes nothing is… Read More

Asymmetric encryption is a method that uses a mathematically linked pair of keys, a public key that can be shared freely and a private key that stays secret. Data locked with the public key can only be opened with the… Read More

The attack surface is the sum of every point where an unauthorized party could try to get into a system or pull data out of it. That includes open ports, running services, exposed APIs, user input fields, and any other… Read More

Attribute-Based Access Control (ABAC) grants or denies access by evaluating a mix of attributes rather than a single role. It weighs user attributes such as department and clearance, resource attributes such as classification and sensitivity, and environmental attributes such as… Read More

An audit trail is a chronological record of events and activities within a system that shows who did what, when, and often from where. Built from logs across applications, operating systems, and network devices, it provides the evidence needed to… Read More

Authentication is the process of proving that a user, device, or service is who or what it claims to be before access is granted. It answers the question “who are you?” and precedes authorization, which decides what you may then… Read More

Authorization is the process of deciding what an authenticated identity is allowed to do. Once authentication confirms who you are, authorization checks your permissions to determine whether you can open a file, run a command, or change a setting. Those… Read More

The Bell-LaPadula model is a formal security model built for the US Department of Defense to enforce confidentiality in systems handling multiple classification levels. It expresses access through two core rules: the simple security property, no read up, meaning a… Read More

Biometric authentication verifies a person’s identity by measuring a unique physical or behavioral trait, such as a fingerprint, iris pattern, face geometry, or typing rhythm, and comparing it against a stored template. It represents the something you are factor in… Read More

The Blue Team is the group of defenders responsible for detecting, responding to, and preventing attacks against an organization’s systems, networks, and data. Blue team work centers on continuous monitoring and fast response. Analysts watch logs through a SIEM, tune… Read More

A Buffer Overflow is a software vulnerability that occurs when a program writes more data to a fixed-length memory buffer than it was designed to hold, overwriting adjacent memory. When input exceeds the space allocated for it, the excess spills… Read More

Business Continuity is the set of plans and processes that keep an organization’s essential operations running during and after a disruption. It is broader than disaster recovery, which restores IT. Continuity covers the whole business: staff, facilities, communications, suppliers, and… Read More

Business Impact Analysis (BIA) identifies an organization’s critical processes and measures what their disruption would cost as time passes. Where a risk assessment studies threats, a BIA studies consequences. It asks a plain question: if this process stops, what breaks… Read More

Chain of custody is the documented, unbroken record showing who collected, handled, transferred, and analyzed a piece of evidence from the moment it was seized through any legal proceeding. Its purpose is to prove the evidence presented is the same… Read More

Change management is the structured process for requesting, reviewing, approving, implementing, and documenting any change to IT systems. Software updates, firewall rule edits, and new deployments all move through defined steps so a routine tweak does not turn into an… Read More

A CI/CD Pipeline (Continuous Integration and Continuous Delivery or Deployment) is an automated workflow that builds, tests, and releases software changes quickly and consistently. Continuous integration merges and tests code changes frequently so problems surface early, while continuous delivery or… Read More

The CIA triad (Confidentiality, Integrity, and Availability) is the three-part model that defines what security controls exist to protect. Confidentiality keeps information away from unauthorized eyes, integrity ensures data stays accurate and unaltered, and availability guarantees that authorized users can… Read More

Cloud Security Posture Management (CSPM) is a category of tooling that continuously inspects cloud environments for misconfigurations, policy violations, and compliance drift. The reason it exists is blunt: a large share of cloud breaches trace back to simple mistakes like… Read More

A cold site is a backup facility that supplies the basics for recovery, meaning power, cooling, floor space, and network connectivity, but no pre-installed servers, software, or current data. Bringing operations up at a cold site means shipping in hardware,… Read More

Common Criteria (CC) is an international standard (ISO/IEC 15408) for evaluating and certifying the security properties of IT products, giving buyers a repeatable way to judge whether a product meets its stated security claims. It replaced older national schemes such… Read More

Common Vulnerabilities and Exposures (CVE) is a publicly available list that assigns a unique identifier to each known security vulnerability so that everyone can refer to the same flaw consistently. Each entry has an ID in the form CVE-YYYY-NNNN, a… Read More

The Common Vulnerability Scoring System (CVSS) is an open framework for rating the severity of security vulnerabilities on a numerical scale from 0.0 to 10.0. CVSS builds a score from several metric groups. Base metrics describe the intrinsic characteristics of… Read More

Compliance means satisfying the obligations placed on an organization by laws, regulations, industry standards, and contracts. Healthcare answers to HIPAA, card processors to PCI DSS, public companies to SOX. Fall short and the consequences stack up: fines, legal liability, lost… Read More

Configuration management is the discipline of establishing and maintaining known, approved settings for systems across their entire lifecycle. It tracks hardware, software versions, and configuration parameters against a defined baseline, then watches for drift when something changes without authorization. Security… Read More

Containerization is a method of packaging an application together with its libraries, configuration, and dependencies into one portable unit, a container, that behaves the same way on a laptop, a test server, or a cloud host. Containers share the host… Read More

Continuity of Operations (COOP) is the set of plans and procedures that let an organization keep its essential functions running during and after a disruptive event. It is broader than disaster recovery: where disaster recovery focuses on restoring IT systems,… Read More

A covert channel is a communication path that moves information in a way the system was never designed to permit, sidestepping security policy by abusing shared resources. A covert storage channel passes data by altering the contents or existence of… Read More

Cross-Site Scripting (XSS) is a web application flaw that lets an attacker inject malicious script into pages that other users then view. When a site fails to sanitize or encode user-supplied content, the injected JavaScript runs in a victim’s browser… Read More

A cryptographic hash is a fixed-length value produced when data of any size passes through a one-way function such as SHA-256. The same input always yields the same digest, yet changing a single bit produces a completely different result, which… Read More

Cryptography is the science of protecting information by converting readable data into a form that stays unintelligible to anyone without the correct key. Modern schemes lean on mathematical problems that are impractical to reverse without that key, such as factoring… Read More

Data Classification is the practice of labeling information by sensitivity so its handling, storage, and transmission match the damage exposure would cause. Government schemes commonly run Unclassified, Confidential, Secret, and Top Secret. Commercial ones often use Public, Internal, Confidential, and… Read More

Data loss prevention (DLP) is a set of technologies and policies that identify, monitor, and protect sensitive information to stop it from leaving an organization through unauthorized channels. DLP inspects data in three states, at rest in storage, in motion… Read More

Data masking is a technique that replaces sensitive information with realistic but fictitious values so the data stays usable for testing, development, or analytics without exposing the real thing. A masked record keeps the same format and behavior as the… Read More

A data owner is the person, usually a senior business manager, who holds ultimate accountability for a specific set of data, including its classification, protection, and acceptable use. The data owner decides how sensitive the data is and who may… Read More

A data retention policy is a documented rule set that defines how long an organization keeps each category of information and what happens when that period ends. It specifies retention periods, storage locations, and the disposal method, tying each decision… Read More

Data sovereignty is the principle that data is subject to the laws of the country where it is stored or processed, not the laws of wherever the company that owns it happens to be based. As workloads move to cloud… Read More

Defense in depth is a security strategy that stacks independent layers of controls so that a failure in any single layer does not expose the whole system. If a firewall is bypassed, intrusion detection, host hardening, encryption, and access controls… Read More

Degaussing permanently destroys data on magnetic media by subjecting it to a strong magnetic field that scrambles the alignment holding the bits, leaving the previous contents unrecoverable. It is a standard sanitization method for hard disk drives and magnetic tape… Read More

DevSecOps is a way of building software that folds security directly into the DevOps pipeline, so controls and testing run continuously instead of waiting at a final gate before release. The name joins development, security, and operations into one flow…. Read More

A digital certificate is an electronic document that binds a public key to a verified identity and is signed by a trusted certificate authority (CA). When you open an HTTPS site, the server presents its certificate to prove it controls… Read More

Digital forensics is the discipline of recovering, preserving, and analyzing electronic evidence in a manner that keeps it intact and admissible for legal proceedings. Investigators examine disks, memory, network logs, and cloud data to reconstruct what happened during an incident,… Read More

A digital signature is a cryptographic mechanism that provides authentication, integrity, and non repudiation for a message or document. The signer hashes the content and encrypts that hash with their private key. Anyone holding the matching public key can verify… Read More

Disaster Recovery (DR) is the part of resilience planning focused on restoring IT systems and data after a serious disruption. Where business continuity keeps the wider organization functioning, DR is specifically about the technology: servers, networks, applications, and the data… Read More

Discretionary Access Control (DAC) is an access control model in which the owner of a resource decides who may use it and what they may do with it. The standard file permissions on Windows and Unix or Linux are the… Read More

A Distributed Denial of Service (DDoS) attack tries to make a system, service, or network unavailable by overwhelming it with traffic from many compromised sources at the same time. Because the flood arrives from thousands of hosts, often a botnet… Read More

A demilitarized zone (DMZ) is a screened subnet that sits between an untrusted network, usually the internet, and an organization’s internal network, and it hosts the services that have to be reachable from the outside. Public-facing servers such as web,… Read More

The Domain Name System Security Extensions (DNSSEC) are a set of specifications that add cryptographic signatures to DNS records, letting a resolver verify that an answer genuinely came from the authoritative zone and was not altered along the way. Ordinary… Read More

Due care and due diligence are two related governance concepts: due care is doing what a reasonable person would do to protect the organization, while due diligence is the ongoing effort to gather information and verify that those protections work…. Read More

Dynamic Application Security Testing (DAST) is a method of finding security vulnerabilities by testing an application while it is running, without access to its source code. A DAST tool interacts with a live application much as an attacker would, sending… Read More

Egress filtering is the practice of controlling and monitoring the traffic leaving a network, blocking or logging outbound connections that break security policy. Most organizations pour effort into stopping inbound attacks, yet the outbound direction is where an intrusion turns… Read More

Encryption is the process of transforming readable plaintext into unreadable ciphertext using an algorithm and a key, so that only someone holding the correct key can recover the original data. It is the primary tool for protecting confidentiality, whether data… Read More

Endpoint Detection and Response (EDR) is a class of security tooling that continuously watches activity on laptops, servers, and other endpoints, recording process launches, file changes, network connections, and registry edits. When something looks like an attack, EDR alerts analysts… Read More

An exploit is a piece of code, a command sequence, or a technique that takes advantage of a specific vulnerability to make software or hardware behave in a way its designers never intended, often to gain unauthorized access, escalate privileges,… Read More

Extended Detection and Response (XDR) is a security platform that gathers and correlates telemetry across endpoints, networks, email, and cloud services, then detects and responds to threats from a single console. It stretches the endpoint-only reach of EDR across many… Read More

Failover is the automatic switch to a standby system when a primary component fails or drops offline. Automation is the defining trait: the cutover happens without a person deciding to pull the lever, which is what separates true failover from… Read More

Federated identity is an arrangement that lets a user authenticate once with a trusted identity provider and then reach applications run by separate organizations without creating a new account at each one. Trust between the parties is established in advance,… Read More

A firewall is a network security device, either hardware or software, that inspects traffic crossing a boundary and permits or blocks it according to a defined rule set. It sits between zones of differing trust, most classically a corporate network… Read More

Fuzzing (fuzz testing) is an automated testing technique that feeds large volumes of malformed, unexpected, or random input to a program in order to uncover crashes, memory errors, and security flaws. A fuzzer generates or mutates inputs and watches how… Read More

The General Data Protection Regulation (GDPR) is a European Union law, in force since 2018, that governs how organizations collect, process, and protect the personal data of people in the EU. GDPR applies to any organization handling the data of… Read More

Governance is the framework of policies, structures, and oversight that directs and controls an organization’s security. It keeps security aligned with business goals, puts resources where the risk is, applies risk decisions consistently, and makes accountability clear. Crucially, it originates… Read More

Hardening is the process of reducing a system’s attack surface by turning off unnecessary services, removing default or unused accounts, applying patches, tightening file permissions, and configuring settings to a known secure standard. A fresh operating system ships with plenty… Read More

A hash function is a one way algorithm that takes input of any size and produces a fixed length output called a hash or digest. The same input always yields the same digest, yet changing even a single bit produces… Read More

The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law that sets national standards for protecting individuals’ health information. HIPAA applies to covered entities (health plans, healthcare providers, and clearinghouses) and their business associates. Its Privacy… Read More

A honeynet is a network of deliberately vulnerable, heavily monitored systems built to attract attackers so defenders can study how they operate. Where a honeypot is a single decoy, a honeynet stands up an entire fake environment of servers, workstations,… Read More

A hot site is a fully equipped backup facility that mirrors the primary data center in near real time, ready to take over production within minutes or a few hours. It keeps duplicate hardware, licensed software, current data, and live… Read More

Identity and Access Management (IAM) is the discipline of making sure the right people hold the right access to the right resources at the right time, in a way that is auditable and can be revoked when it should be…. Read More

Identity governance is the set of policies, processes, and technologies that ensures the right individuals have the right access to the right resources at the right time, and that every one of those access rights can be justified and reviewed…. Read More

An Identity Provider (IdP) is a trusted service that authenticates users and issues assertions or tokens confirming their identity to other applications, which are called relying parties or service providers. Rather than each application maintaining its own password store, they… Read More

Incident Response (IR) is the organized way an organization detects, contains, and recovers from security incidents. When a breach lands, a phishing message works, or malware starts spreading, IR procedures move the team through detection, containment, eradication, recovery, and a… Read More

An insider threat is a risk that comes from someone who already holds legitimate access: an employee, contractor, business partner, or a former staffer whose credentials were never revoked. What makes these threats hard to catch is that the access… Read More

An intrusion detection system (IDS) is a monitoring tool that watches network traffic or host activity for signs of malicious behavior and policy violations, then raises alerts for analysts to review. The key point that trips people up is simple:… Read More

An intrusion prevention system (IPS) is a security control that detects malicious traffic and actively blocks it, rather than only alerting the way an intrusion detection system does. Because it sits inline with the traffic flow, an IPS can drop… Read More

Just-in-Time Access (JIT) is a privileged access practice that grants elevated permissions only for the short window a user actually needs them, then automatically revokes those permissions when the task is finished or a timer expires. Standing access is replaced… Read More

Kerberos is a network authentication protocol that uses time-limited tickets to let systems prove their identity over an untrusted network without sending passwords across it. Developed at MIT and used as the default authentication mechanism in Windows Active Directory, it… Read More

Key management is the set of policies, procedures, and technology for handling cryptographic keys across their full lifecycle: generation, distribution, storage, rotation, and destruction. Get any one stage wrong and the strongest algorithm stops protecting anything. Keys start with a… Read More

Least privilege is the principle that every user, process, and system should hold only the permissions needed to do its job, and nothing beyond that. A help desk technician can reset passwords without touching payroll, and a backup service can… Read More

Log management is the practice of collecting, storing, protecting, analyzing, and retaining system and security logs. Those logs record the small events that add up to a story: authentication attempts, configuration changes, network connections, and application activity that becomes essential… Read More

Malware is any software written to damage, disrupt, or gain unauthorized access to systems and data. The label covers a wide family, including viruses that attach to legitimate programs, worms that self replicate across networks, trojans that hide inside something… Read More

A man-in-the-middle (MitM) attack happens when an attacker secretly positions themselves between two parties who believe they are talking directly, intercepting and sometimes altering the messages that pass between them. Neither side realizes a third party is reading, and possibly… Read More

Mandatory Access Control (MAC) is an access control model in which a central authority, not the individual data owner, decides who can reach a resource based on security labels. Every subject (a user or process) and every object (a file… Read More

Maximum Tolerable Downtime (MTD) is the longest a business can go without a given function before the damage becomes unacceptable, whether that means financial loss it cannot recover from, customers who never return, a regulatory breach, or outright failure. MTD… Read More

MITRE ATT&CK is a free, continuously updated knowledge base that documents the real tactics and techniques adversaries use once they gain a foothold in an environment. The name stands for Adversarial Tactics, Techniques, and Common Knowledge. The framework is organized… Read More

Multi-factor authentication (MFA) is an access control that requires two or more verification factors from different categories before a user is admitted. The categories are knowledge (a password), possession (a token or phone), and inherence (a biometric), and the factors… Read More

Need to Know is an access principle that limits information to the people whose current tasks actually require it, no matter how high their clearance sits. A Top Secret clearance does not open every Top Secret file. You also have… Read More

Network Access Control (NAC) is a set of technologies that decide whether a device is allowed to join a network and what it may reach once connected, based on the device identity and its security posture. A NAC deployment often… Read More

Network segmentation is the practice of dividing a computer network into smaller, isolated zones so that traffic between them can be controlled, inspected, or blocked. Instead of one flat network where any host can reach any other, segmentation creates boundaries… Read More

Non-repudiation is the security property that stops someone from credibly denying an action they actually took. When a person sends a message, approves a payment, or edits a record, non-repudiation mechanisms produce evidence strong enough that the person cannot later… Read More

OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user’s resources on another service without ever seeing that user’s password. Instead of handing over credentials, the user approves a scoped grant and the application… Read More

OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that lets a client verify who a user is and receive basic profile information in a standard, verifiable way. Where OAuth 2.0 handles authorization alone, OIDC adds… Read More

The OWASP Top 10 is a regularly updated awareness document, published by the Open Worldwide Application Security Project, that ranks the most critical security risks to web applications. Each entry describes a category of risk, such as broken access control,… Read More

Passwordless authentication is any method of verifying a user’s identity without a shared secret password, relying instead on possession and biometric factors such as a hardware security key, a device-bound passkey, or a fingerprint. The aim is to remove the… Read More

Patch management is the process of acquiring, testing, and deploying software updates that close security vulnerabilities and fix functional bugs. Vendors ship patches once a flaw is confirmed, and the window between a public disclosure and a working exploit is… Read More

Penetration Testing is an authorized, simulated attack that tries to actually exploit weaknesses rather than just list them. That is what separates it from vulnerability scanning. A scanner flags a potential flaw; a penetration test proves whether that flaw leads… Read More

Personally Identifiable Information (PII) is any data that can identify a specific individual, either on its own or when combined with other information. Examples range from obvious direct identifiers, such as a full name, Social Security number, or passport number,… Read More

Phishing is a social engineering attack that uses deceptive emails, messages, or websites to trick people into handing over sensitive information or taking a harmful action. The attacker poses as someone trusted, a bank, an employer, a familiar service, and… Read More

Physical security is the set of controls that protect facilities, hardware, and people from tangible threats like forced entry, theft, vandalism, environmental damage, and espionage. The point that candidates sometimes underrate: an attacker who reaches your server room can sidestep… Read More

Post-Quantum Cryptography (PQC) is cryptography built to stay secure even against an adversary holding a large, fault-tolerant quantum computer. It swaps algorithms like RSA and elliptic-curve, which such a machine could break, for math problems believed to resist quantum attack…. Read More

Privileged Access Management (PAM) is the set of controls that governs, monitors, and audits accounts with elevated permissions: system and database administrators, and the service accounts that can make sweeping changes across an environment. Because those accounts can do the… Read More

A proxy server is an intermediary that sits between clients and the servers they talk to, forwarding requests on a client’s behalf and passing responses back. To the destination, the request appears to originate from the proxy rather than the… Read More

Public Key Infrastructure (PKI) is the combined framework of hardware, software, policies, and procedures used to create, distribute, store, and revoke digital certificates and to manage public-key encryption. It lets two parties who have never met establish a trusted, encrypted… Read More

A Purple Team is a collaborative exercise in which offensive (red team) and defensive (blue team) specialists work together to improve an organization’s ability to detect and respond to attacks. Rather than red and blue operating in isolation, purple teaming… Read More

Quantum cryptography uses the behavior of particles at the quantum level to secure communication in ways classical methods cannot match. Its best-known form, Quantum Key Distribution (QKD), lets two parties build a shared key such that any attempt to eavesdrop… Read More

Ransomware is malicious software that encrypts a victim’s files or entire systems and then demands payment, usually in cryptocurrency, for the decryption key. What began as opportunistic malware is now a professionalized industry, with criminal groups running negotiation desks and… Read More

Recovery Point Objective (RPO) is the maximum data loss an organization can accept, measured as a span of time. A one-hour RPO means backups or replication must capture data at least every hour, so a failure never costs more than… Read More

Recovery Time Objective (RTO) is the longest a system, application, or process can stay down after a disruption before the damage becomes unacceptable. If email carries a four-hour RTO, the recovery plan has to restore email within four hours of… Read More

A red team is a group of security professionals who emulate real adversaries, borrowing their tactics and techniques to test an organization’s defenses, detection, and response under realistic conditions. A red team engagement goes further than a standard penetration test…. Read More

Residual risk is the risk that remains after security controls have been applied to an original, or inherent, risk. Because no control reduces the chance or impact of an event to zero, some exposure always survives, and that leftover exposure… Read More

Risk appetite is the amount and kind of risk an organization is willing to accept while pursuing its goals. It is a strategic decision owned by executive leadership and the board, not something a technical team sets on its own…. Read More

Risk Assessment is the process of identifying and evaluating risks to an organization’s assets. It inventories what matters, identifies the threats and vulnerabilities against each asset, estimates how likely a loss is and how much it would hurt, and produces… Read More

Risk management is the continuous process of identifying, analyzing, and responding to risks that could keep an organization from meeting its objectives. In security terms, it means understanding the threats facing your assets, judging how exploitable your weaknesses are, and… Read More

Risk transfer is a risk response strategy that shifts the financial impact of a risk onto another party. The most familiar example is cyber liability insurance: the organization pays premiums, and the insurer agrees to cover losses from qualifying incidents… Read More

Role-based access control (RBAC) is an access control model that assigns permissions to roles rather than to individuals, then places users into the roles that match their jobs. A “Finance Analyst” role carries a defined set of rights, and everyone… Read More

Sandboxing is a security technique that runs code inside an isolated, tightly restricted environment so it cannot reach or damage the rest of the host system. You already rely on it constantly. Web browsers put each tab in its own… Read More

A Secure Software Development Lifecycle (SDLC) is a development process that embeds security activities into every phase of building software, from requirements and design through coding, testing, deployment, and maintenance, rather than testing for flaws only at the end. In… Read More

Security architecture is the design discipline that translates business and risk requirements into a coherent structure of security domains, controls, and guiding principles. Rather than bolting protections onto finished systems, a security architect defines how identity, data protection, network segmentation,… Read More

Security Assertion Markup Language (SAML) is an open, XML-based standard that lets an identity provider pass authentication and authorization details to a service provider, making single sign-on possible across otherwise separate systems. The flow is straightforward once you see it…. Read More

A Security Audit is an independent check of controls, policies, and practices against a defined standard. Internal audits come from the organization’s own audit function; external audits bring in an independent third party. Either way, the goal is evidence that… Read More

Security awareness training is an ongoing program that teaches employees about security threats, organizational policies, and their own role in protecting company assets. Typical topics include recognizing phishing, handling passwords and sensitive data, physical security, and reporting incidents. The aim… Read More

A security baseline is the minimum set of controls a system has to meet before it is allowed into production. Think of it as the floor rather than the ceiling: it defines what secure enough to connect means for a… Read More

Security by design is an engineering approach that builds protective measures into a system from the earliest planning stages rather than adding them after the product is already built. Security requirements are treated as first-class design goals alongside functionality, cost,… Read More

A security control is a safeguard or countermeasure put in place to reduce risk by protecting the confidentiality, integrity, or availability of information and systems. Controls are the practical mechanisms that turn a risk decision into actual protection. They are… Read More

A security framework is a structured set of guidelines, standards, and practices that organizations use to manage cybersecurity risk in a consistent, repeatable way. Instead of designing a program from a blank page, teams adopt a framework that supplies proven… Read More

Security metrics are quantitative measurements that show whether a security program is actually working, track progress toward defined goals, and translate technical activity into terms leadership can act on. Strong metrics tie back to business outcomes and decisions, not just… Read More

Security operations is the ongoing work of keeping an organization protected day to day: monitoring for threats, investigating and responding to incidents, managing vulnerabilities, running forensics, and keeping security tooling healthy. If security architecture designs the defenses, security operations is… Read More

A Security Operations Center (SOC) is the centralized team and facility that monitors, detects, investigates, and responds to security events, usually around the clock. Analysts work alerts, hunt for threats that slipped past automated detection, and coordinate the response when… Read More

A Security Policy is a high-level document that states an organization’s security objectives, its scope, who is responsible for what, and management’s commitment to protecting information assets. Senior leadership approves it, and it becomes the foundation every other security document… Read More

A security token is a physical device or digital object that a user presents to prove identity during authentication. A hardware token might generate a time based one time password that rolls over every thirty seconds, while a digital token… Read More

Separation of Duties (SoD) is a control that splits a sensitive process across two or more people so no single person can complete it alone. The employee who requests a payment does not approve it. The developer who writes code… Read More

A side-channel attack is a method of breaking a system by measuring the physical byproducts of its operation, such as timing, power consumption, electromagnetic emissions, or even sound, instead of attacking the algorithm or its mathematics directly. The idea is… Read More

Security information and event management (SIEM) is a platform that collects log and event data from across an environment, correlates it to surface threats, and presents alerts and dashboards for security teams. The name reflects its two roots, security information… Read More

Single sign-on (SSO) is an authentication arrangement that lets a user sign in once to a central identity provider and then reach many connected applications without entering credentials again. One morning login can open email, file shares, and cloud apps… Read More

Social engineering is the practice of manipulating people into performing actions or revealing confidential information, rather than breaking through technology. Attackers exploit reliable human tendencies, including trust, a wish to be helpful, fear, urgency, and deference to authority, to obtain… Read More

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency that goes into a piece of software. The easiest way to picture it is an ingredients list printed on the side of an… Read More

Software Defined Networking (SDN) is an architecture that separates the control plane, which decides where traffic should go, from the data plane, which actually forwards it. In a traditional switch or router both live inside the same box. SDN lifts… Read More

Spear phishing is a targeted form of phishing in which the attacker researches a specific person and crafts a personalized message built to fool that one individual. Where mass phishing casts generic lures at thousands of inboxes, a spear phishing… Read More

SQL injection (SQLi) is an attack in which malicious SQL code is slipped into a query that an application sends to its database. When the application fails to properly validate or parameterize user input, the attacker can rewrite the query… Read More

Static Application Security Testing (SAST) is a method of analyzing an application’s source code, bytecode, or binaries for security flaws without executing the program. SAST tools read code from the inside and flag risky patterns such as SQL injection, hardcoded… Read More

Steganography is the practice of hiding a secret message inside an ordinary-looking file so that the very existence of the message stays concealed. That is the key distinction from encryption: encryption scrambles content so it cannot be read, while steganography… Read More

A supply chain attack goes after a weaker link in a software or hardware supply chain instead of hitting the ultimate target head-on. The 2020 SolarWinds compromise is the textbook case: attackers slipped malicious code into a legitimate software update… Read More

Symmetric encryption is a method that uses one shared secret key for both encryption and decryption. Both parties must already hold the same key before they can exchange protected messages. Its great strength is speed, so symmetric ciphers do the… Read More

Third-Party Risk Management (TPRM) is the process of identifying, assessing, and controlling the risk that vendors, suppliers, contractors, and partners introduce when they touch an organization’s systems or data. The hard truth behind it: you can outsource the work but… Read More

A threat is any potential cause of an unwanted incident that could harm a system, an organization, or a person. Threats come in several forms: natural events such as floods and earthquakes, human actions such as hacking or theft, and… Read More

Threat intelligence is evidence-based knowledge about existing or emerging cyber threats, including the actors behind them, their motivations, and the tactics, techniques, and procedures they use, refined into a form that supports security decisions. It turns raw data about attacks… Read More

Threat modeling is a structured way to identify, evaluate, and rank the threats to a system before an attacker does it for you. Teams walk through how a design could be abused, often using a framework like STRIDE to make… Read More

Tokenization is a data protection technique that replaces a sensitive value, such as a credit card number, with a non-sensitive substitute called a token that has no exploitable meaning outside the system that issued it. The real data is stored… Read More

Transport Layer Security (TLS) is a cryptographic protocol that provides confidentiality, integrity, and authentication for data in transit across a network, most visibly protecting the HTTPS traffic behind the browser padlock. TLS is the successor to the older SSL protocol,… Read More

The Trusted Computing Base (TCB) is the total set of hardware, firmware, and software components that are critical to enforcing a system’s security policy. If any part of the TCB fails or is subverted, the security of the entire system… Read More

A Trusted Platform Module (TPM) is a dedicated, tamper-resistant hardware chip that securely generates, stores, and uses cryptographic keys, keeping those secrets isolated from the main operating system and processor. It provides a hardware root of trust that software alone… Read More

A virtual private network (VPN) is a technology that builds an encrypted tunnel across an untrusted network, letting two endpoints communicate as though they shared a private link. A remote employee uses one to reach corporate systems safely over home… Read More

A vulnerability is a weakness in a system, application, or process that a threat can exploit to cause harm. Weaknesses live in many places: unpatched software, buffer overflows, default passwords, open ports, missing access reviews, and people who fall for… Read More

Vulnerability Assessment is the systematic hunt for security weaknesses across systems, applications, and configurations. Scanners probe for known flaws, missing patches, weak settings, and services that should not be exposed, then rank what they find by severity and likely impact… Read More

Vulnerability disclosure is the process by which a researcher reports a discovered weakness to the affected vendor or, eventually, to the public. Under responsible or coordinated disclosure, the researcher notifies the vendor privately first and allows a defined window to… Read More

Zero Trust is a security model that removes automatic trust based on network location and instead verifies every request as though it came from an open, hostile network. The guiding assumption is that a breach has already happened, so no… Read More

A zero-day vulnerability is a software flaw the vendor does not yet know about, which means no patch exists and defenders have zero days to prepare. Whoever discovers it first, a researcher or an attacker, holds a window in which… Read More