Definitions and pro-tips for the CC certification.
Acceptable Use Policy (AUP) is a set of rules applied by the owner or administrator of a network or service that restricts how the system may be used. It ensures users understand their responsibilities and the legal consequences of misusing corporate resources.
Access Control List (ACL) is a table that tells a computer operating system or network device which access rights each user or IP address has to a specific object. It acts as a filter to permit or deny traffic based on defined criteria.
The ability to trace actions performed on a system back to a specific individual or process, typically through audit logs.
Security controls that focus on personnel and business practices, such as policies, procedures, and security awareness training.
An Air Gap is a security measure that ensures a computer or network is physically isolated from all other networks, including the public internet. This physical separation prevents remote attacks and unauthorized data exfiltration, making it ideal for highly sensitive systems.
Anything of value to an organization that must be protected, including hardware, software, data, and personnel.
Also known as public-key cryptography, it uses a pair of related keys: a public key for encryption and a private key for decryption.
The Attack Surface refers to the total sum of all possible points, or 'attack vectors,' where an unauthorized user can try to enter or extract data from an environment. Reducing the attack surface minimizes the potential for successful exploits.
Attribute-Based Access Control (ABAC) is a flexible access control model that grants access based on a combination of attributes. These attributes can include user characteristics, resource properties, environmental conditions, and specific action requests to determine if access is permitted.
Audit Trail is a chronological record of security-related activities that provides documentary evidence of the sequence of events that have affected a specific operation or system. It is essential for forensic analysis and maintaining organizational accountability.
The process of verifying the identity claimed by a user or system, often using passwords, tokens, or biometrics.
The process of determining what an authenticated user is permitted to do or access within a system.
The security principle that ensures systems, applications, and data are accessible to authorized users when they are needed.
A Baseline is a minimum set of security controls and configurations that must be applied to a system to ensure a consistent level of protection. It provides a known good state that can be used to detect unauthorized changes over time.
The use of unique physical or behavioral characteristics to verify identity, such as fingerprints, facial recognition, or iris scans.
A strategy for maintaining essential business operations during and after a significant disruption or disaster.
Business Impact Analysis (BIA) is a systematic process used to determine the potential effects of an interruption to critical business operations. It identifies the most critical functions and the maximum tolerable downtime for each, forming the foundation for the BCP and DRP.
Change Management is a structured approach to transitioning IT systems from a current state to a desired future state. It ensures that modifications to infrastructure are documented, tested, and approved to minimize service disruptions and security regressions.
The foundational model for information security consisting of Confidentiality, Integrity, and Availability. It serves as a guide for policies and security controls within an organization.
A disaster recovery facility that provides space, power, and cooling but has no pre-installed IT equipment or data.
Compliance is the process of ensuring that an organization adheres to established laws, regulations, guidelines, and specifications relevant to its industry. This often involves regular audits to verify that security controls meet mandated legal and regulatory requirements.
The security principle that ensures information is accessible only to those authorized to have access. It prevents unauthorized disclosure of sensitive data.
The process of organizing data into categories based on its sensitivity and the impact if it were disclosed or lost.
Data Loss Prevention (DLP) is a set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users. It monitors data in use, data in motion, and data at rest to prevent leaks.
A security strategy that uses multiple layers of security controls (physical, technical, and administrative) to protect an asset.
Denial-of-Service (DoS) is a cyberattack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by disrupting services. This is typically achieved by flooding the target with superfluous requests to exhaust resources.
A backup that includes all data that has changed since the last full backup.
Digital Signature is a mathematical scheme for demonstrating the authenticity of digital messages or documents. It provides a way to verify that a message was created by a known sender and that it was not altered during transit.
A subset of the BCP that focuses specifically on the technical procedures required to restore IT infrastructure and data after a disaster.
Discretionary Access Control (DAC) is a type of access control where the owner of the data or resource decides who is granted access. The owner has total discretion over permissions, making it highly flexible but less secure than centralized models.
A physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, usually the internet.
The Domain Name System (DNS) is the hierarchical and decentralized naming system used to translate human-readable domain names, such as example.com, into machine-readable IP addresses. It acts as the internet's phonebook, allowing users to access websites without remembering complex numerical addresses.
Due Care is the legal concept of taking the reasonable steps that a prudent person would take under similar circumstances to avoid harm to others. In cybersecurity, it refers to the actual implementation of security controls.
Due Diligence is the act of investigating and researching a situation to ensure that all necessary precautions are taken before entering into an agreement. It involves the verification, auditing, and continuous monitoring of security controls.
The process of converting information or data into a code, especially to prevent unauthorized access.
Endpoint Detection and Response (EDR) is an integrated security solution that monitors end-user devices to detect and respond to cyber threats like ransomware. It provides real-time visibility and automated response capabilities for endpoints across the network.
An Exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a vulnerability to cause unintended behavior in software or hardware. This allows attackers to gain unauthorized access or escalate privileges.
A network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies.
A complete copy of all selected data, regardless of whether it has changed since the last backup.
Hashing is the process of transforming a piece of data into a fixed-length string of characters, called a hash value or digest, using a mathematical algorithm. Unlike encryption, hashing is a one-way function designed to verify data integrity by ensuring the input has not been altered.
A Honeypot is a decoy system designed to lure attackers away from critical systems and to gather intelligence on their methods. By mimicking a vulnerable target, it allows security teams to observe attack patterns without risking actual production data.
A fully equipped and operational disaster recovery facility that can take over business operations almost immediately.
The process by which a user or system claims an identity, typically by providing a username or ID number.
A security system that monitors network or system activities for malicious activities or policy violations and produces alerts.
Implicit Deny is a security principle where any request or traffic that is not explicitly allowed by a security rule is automatically blocked. This ensures a 'deny-all' default posture, significantly reducing the overall attack surface.
Incident Containment is the phase of the incident response process focused on limiting the scope and magnitude of a security breach. The goal is to stop the threat from spreading further across the network, thereby protecting other systems and reducing overall impact.
The formal process for handling security incidents, typically including Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned.
A backup that only includes data that has changed since the last backup of any kind (full or incremental).
Infrastructure as a Service (IaaS) is a cloud computing model that provides virtualized computing resources, such as servers, storage, and networking, over the internet. The provider manages the physical hardware, while the customer is responsible for managing the operating system and applications.
The security principle that ensures information is accurate, complete, and has not been modified by unauthorized users or processes.
An active security system that monitors network traffic and takes automated actions to block or prevent detected threats.
The practice of limiting user access rights to only the bare minimum permissions necessary to perform their specific job functions.
Short for 'malicious software,' it is a broad term for any software intentionally designed to cause damage to a computer, server, or network.
A Man-in-the-Middle (MitM) attack occurs when a malicious actor secretly intercepts and potentially alters the communication between two parties who believe they are talking directly to each other. This allows the attacker to steal credentials or inject malicious data.
Mandatory Access Control (MAC) is a strict access control system where the operating system restricts the ability of a subject to access or perform operations on an object. Access is based on security labels and clearances assigned by a central authority.
A Mantrap is a physical security access control system consisting of a small space with two interlocking doors. The first door must close and lock before the second door can be opened, preventing unauthorized 'tailgating' into a secure area.
Maximum Tolerable Downtime (MTD) is the total amount of time a business process can be disrupted before the organization suffers irreparable harm. It serves as the absolute ceiling for determining the Recovery Time Objective (RTO) for a system.
A security mechanism that requires two or more different types of evidence (factors) to verify a user's identity.
Need-to-Know is a security principle that restricts access to specific information to only those individuals who require it to perform their official duties. Unlike least privilege, which focuses on system permissions, need-to-know focuses on access to specific data.
Network Address Translation (NAT) is a method used by routers to map multiple private IP addresses within a local network to a single public IP address. This process conserves the limited pool of IPv4 addresses and provides a basic layer of security by hiding internal structures.
Network Segmentation is the practice of splitting a computer network into smaller, isolated sub-networks to improve security and performance. It limits the 'blast radius' of an attack by preventing lateral movement by an attacker within the network.
Non-repudiation is a security service that provides proof of the origin and integrity of data, ensuring that a sender cannot deny having sent a message. It is typically achieved through the use of digital signatures and public key infrastructure to verify the identity of the sender.
The Open Systems Interconnection (OSI) Model is a conceptual framework used to describe the functions of a networking system through seven distinct layers. It standardizes communication functions so that different hardware and software products can interoperate seamlessly across a network.
A conceptual framework that characterizes and standardizes the communication functions of a telecommunication or computing system into seven layers.
Patch Management is the process of identifying, acquiring, testing, and installing software updates, known as patches, to fix vulnerabilities or bugs. It is a critical component of vulnerability management used to maintain system security and stability.
Penetration Testing is a simulated cyber attack against a computer system to check for exploitable vulnerabilities. It is a proactive security exercise used to evaluate the effectiveness of security controls by attempting to breach the system in a controlled manner.
Any data that could potentially identify a specific individual, such as a name, SSN, or email address.
A type of social engineering where an attacker sends a fraudulent message designed to trick a person into revealing sensitive information.
Security controls that protect the physical environment, such as fences, locks, badges, and security guards.
Platform as a Service (PaaS) is a cloud computing model that provides a framework for developers to build, test, and deploy applications without managing the underlying infrastructure. The provider manages the runtime, middleware, and OS, allowing developers to focus solely on code.
A type of malware that encrypts a victim's files, with the attacker demanding a payment to restore access.
The maximum tolerable amount of data loss, measured in time, that an organization can sustain after a disruption.
The maximum tolerable length of time that a system, application, or function can be down after a failure or disaster.
Risk is the potential for loss, damage, or destruction of an asset as a result of a threat exploiting a vulnerability. It is often calculated as the product of the probability of an event occurring and the magnitude of its impact.
Risk Acceptance occurs when an organization acknowledges a risk exists but decides not to take any action to mitigate, transfer, or avoid it. This decision is typically made when the cost of the countermeasure outweighs the potential loss from the risk.
Risk Appetite is the total amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. It serves as a guiding boundary for decision-making, helping leadership determine when to mitigate a threat or accept the potential loss.
The process of identifying, analyzing, and evaluating risks to determine their likelihood and potential impact on an organization.
Risk Avoidance is a risk management strategy that involves eliminating the cause of a risk entirely by choosing not to engage in the activity that creates the risk. This might include disabling a dangerous software feature or deciding not to enter a high-risk market.
Risk Management is the systematic process of identifying, evaluating, and prioritizing risks followed by the coordinated application of resources to minimize, monitor, and control the probability or impact of unfortunate events. It is a continuous lifecycle essential for organizational resilience.
Risk Mitigation involves implementing controls and countermeasures to reduce the likelihood or the impact of an identified threat. This strategy focuses on bringing the risk down to an acceptable level, often through technical solutions, policy changes, or improved employee training.
Risk Transfer is the strategy of shifting the financial or operational burden of a potential loss to a third party. The most common examples include purchasing cyber insurance or outsourcing a specific business function to a specialized, third-party service provider.
Risk Transference is the strategy of shifting the financial or operational burden of a potential loss to another party. The most common example is purchasing cyber insurance or outsourcing a high-risk process to a specialized third-party vendor.
An access control model where permissions are assigned to specific job roles rather than individual users.
A Security Baseline is a minimum set of security controls and configurations that must be applied to a system to ensure it meets a required security level. It provides a consistent starting point for hardening systems before they are deployed into production.
The framework of rules, practices, and processes by which an organization ensures that its security activities align with business objectives.
Security Information and Event Management (SIEM) is a software solution that aggregates and analyzes activity from many different sources across an IT infrastructure. It provides real-time analysis of security alerts and long-term log storage.
Security Operations Center (SOC) is a centralized unit that deals with security issues on an organizational and technical level. It employs security analysts to monitor, detect, analyze, and respond to cybersecurity incidents in real-time.
A Security Policy is a high-level document that outlines an organization's security requirements, goals, and overall approach to protecting its assets. It serves as the foundational governance document that mandates security behaviors and provides the authority for all other security controls.
A Security Procedure is a detailed, step-by-step set of instructions that describes how to perform a specific security task. Procedures ensure that tasks are carried out consistently and correctly, such as the specific steps for offboarding an employee's system access.
A Security Standard is a mandatory requirement or a specific set of technical specifications that must be followed to achieve the goals set by a security policy. Standards ensure consistency across the organization, such as requiring a specific encryption algorithm for all databases.
A security control that divides a sensitive task into multiple steps performed by different individuals to prevent fraud or error.
A session and user authentication service that allows a user to use one set of login credentials to access multiple applications.
The psychological manipulation of people into performing actions or divulging confidential information.
Software as a Service (SaaS) is a cloud computing model where applications are hosted by a provider and made available to customers over the internet via a subscription. The provider manages everything from the hardware to the software updates and maintenance.
Spear Phishing is a targeted phishing attack directed at a specific individual, group, or organization. Attackers research their targets to create highly personalized messages, increasing the likelihood that the victim will trust the communication and take the malicious bait.
A type of encryption where the same key is used for both encrypting and decrypting the data.
Tailgating is a physical security breach where an unauthorized person follows an authorized person into a secure area without providing their own credentials. This often occurs when a legitimate user holds the door open out of courtesy for someone behind them.
The TCP/IP Model is a concise four-layer suite of communication protocols used to interconnect network devices on the internet. It consists of the Network Access, Internet, Transport, and Application layers, providing a practical implementation of the theoretical concepts found in the OSI model.
Security controls implemented through hardware or software technology, such as firewalls, encryption, and intrusion detection systems.
Any potential event or person that could exploit a vulnerability to cause damage to an asset.
Threat Intelligence is evidence-based knowledge about an existing or emerging menace or hazard to assets. It includes information on threat actors, their motives, and the specific tactics, techniques, and procedures (TTPs) they utilize.
Transmission Control Protocol (TCP) is a connection-oriented transport layer protocol that ensures reliable delivery of data packets between two hosts. It uses a three-way handshake to establish a connection and provides error-checking and sequencing to guarantee data integrity.
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. It encrypts the data sent between a client and a server, and is the standard protocol used to secure HTTPS web traffic.
User Datagram Protocol (UDP) is a connectionless transport layer protocol used for fast, low-latency data transmission where reliability is less critical than speed. Unlike TCP, it does not establish a formal connection or guarantee delivery, making it ideal for streaming and VoIP.
A Virtual Private Network (VPN) is a secure tunnel created over a public network, such as the internet, to connect remote users or offices to a private network. It uses encryption to ensure that data transmitted between the client and the server remains confidential.
A technology that creates a safe and encrypted connection over a less secure network, such as the internet.
A weakness in an asset or control that could be exploited by a threat to cause harm.
Vulnerability Management is the cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating software vulnerabilities. This process ensures that security weaknesses are addressed systematically to reduce the overall risk of a successful cyber attack.
Vulnerability Scanning is the automated process of identifying known security weaknesses in a network, system, or application. It compares system attributes against a database of known vulnerabilities to flag potential risks for remediation by the security team.
A disaster recovery facility that is partially equipped with hardware and network connectivity but requires data restoration to become operational.
Whaling is a specialized form of spear phishing that targets high-profile executives, such as CEOs or CFOs. These attacks use sophisticated lures to trick senior leadership into authorizing large financial transfers or releasing highly sensitive corporate information.
Zero Trust is a security framework based on the principle 'never trust, always verify.' It requires strict identity verification for every person and device attempting to access resources, regardless of whether they are inside or outside the network perimeter.
A security model that requires continuous verification of every user and device, regardless of whether they are inside or outside the network perimeter.
A Zero-Day Vulnerability is a software security flaw that is unknown to the vendor or the party responsible for patching it. Because the developer has had zero days to create a fix, these vulnerabilities are highly prized by attackers for creating effective exploits.
We're adding new exams every week. Let us know what you're studying for, and we'll bump it up our priority list! (Typical turnaround: 2-3 days)
Your feedback has been submitted successfully. We appreciate your help in making Cert Sensei better!