CLASSIFIED

FOR OFFICIAL STUDY USE ONLY

REF: COMPTIA-SEC-PLUS-GLO-001 DOMAIN COVERAGE: 1–5 OF 5 TERMS INDEXED: — CLEARANCE: CANDIDATE

SECURITY+
REFERENCE DOSSIER

CompTIA Security+ SY0-701 exam preparation glossary. All 5 domains covered. Click any row to expand full definition and contextual example. Press / to search · Esc to clear.

— visible

— D1 General Security

— D2 Threats & Vulns

— D3 Architecture

— D4 Operations

— D5 Governance

DOMAIN 01

General Security Concepts

12% of exam · sections 1.1 – 1.4

1.1 — Security Control Types

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Categories	Broad classifications describing the nature and purpose of security controls: technical, managerial, operational, and physical.	Controls are categorized as technical, managerial, operational, and physical to streamline implementation.
Definition Broad classifications that describe the nature and purpose of security controls, enabling organized application across different domains of an organization. Contextual Example Security controls are categorized into technical, managerial, operational, and physical to streamline their implementation and management.
Compensating	Alternative controls that achieve security goals when primary controls are not feasible due to technical or operational constraints.	When full encryption is not possible, strong access controls and logging serve as compensating controls.
Definition Controls that provide an alternative method to achieve security goals when primary controls cannot be implemented due to technical, financial, or operational constraints. Contextual Example If an organization cannot implement a complete encryption solution, it might protect sensitive data with compensating controls such as strong access controls and logging.
Control Types	Categories of security mechanisms: preventive, detective, corrective, deterrent, compensating, and directive.	Preventive stops threats; detective identifies incidents; corrective restores systems; deterrent discourages attacks.
Definition Categories of security mechanisms designed to mitigate risks, enforce policies, and safeguard systems. Includes preventive, detective, corrective, deterrent, compensating, and directive types. Contextual Example Organizations use preventive controls to stop threats before they occur, detective controls to identify incidents, and corrective controls to restore systems after a breach.
Corrective	Controls that respond to and rectify security incidents after they have occurred, including patching and policy updates.	Post-breach patching of vulnerabilities and updating security protocols are corrective controls.
Definition Controls activated after an incident to minimize damage, restore operations, and prevent recurrence. Include patch management, system restoration, and policy revisions. Contextual Example After a data breach, an organization implements corrective controls such as patching vulnerabilities and updating security protocols to prevent future incidents.
Detective	Controls that identify and alert organizations to security incidents as they occur through monitoring and analysis.	Intrusion detection systems (IDS) monitor network traffic and alert administrators to suspicious activities.
Definition Controls that monitor systems and activities to identify security incidents in progress or after the fact. They do not prevent attacks but provide visibility and trigger response. Contextual Example IDS monitors network traffic and alerts administrators to suspicious activities, serving as detective controls.
Deterrent	Controls designed to discourage individuals from attempting to breach security measures through visible warnings.	Warning signs about surveillance cameras deter potential intruders from attempting unauthorized access.
Definition Controls that reduce the likelihood of an attack by discouraging adversaries through visible warnings, legal notices, or security presence. Target attacker psychology. Contextual Example Warning signs indicating surveillance cameras are in use act as deterrent controls, making potential intruders think twice before attempting to breach security.
Directive	Controls that guide employee behavior through policies, procedures, standards, and training programs.	A security awareness training program teaching employees to recognize phishing is a directive control.
Definition Controls that guide behavior through policies, procedures, standards, and training. Establish expectations and required actions rather than technical enforcement. Contextual Example A security awareness training program that educates employees on phishing attacks serves as a directive control, guiding them on recognizing and responding to security threats.
Managerial	Controls focusing on managing security policies, procedures, and compliance through organizational practices. Also called administrative controls.	Security policies and employee training programs are managerial controls ensuring security protocols are followed.
Definition Controls addressing the human and policy dimension of security. Include risk assessments, security policies, awareness training, and compliance audits. Also called administrative controls. Contextual Example A company's security policy and employee training programs are managerial controls that ensure security protocols are followed.
Operational	Controls involving day-to-day operations and processes executed by people to maintain security.	Regular security audits and incident response drills are operational controls supporting effective threat response.
Definition Controls implemented and executed by people as part of ongoing operations. Include security monitoring, patch cycles, change management, and incident response procedures. Contextual Example Regular security audits and incident response drills are operational controls that help an organization respond effectively to security threats.
Physical	Security measures protecting physical assets and facilities from unauthorized access, theft, or damage.	Key card access systems and biometric scanners restricting server room entry are physical controls.
Definition Controls protecting tangible assets, facilities, and personnel from unauthorized physical access, theft, damage, or environmental hazards. Operate independently of digital systems. Contextual Example Access control systems such as key cards or biometric scanners are physical controls that restrict entry to sensitive areas.
Preventive	Controls aimed at stopping security incidents before they occur through firewalls, encryption, MFA, and access controls.	Antivirus software and regular patch management are preventive controls protecting systems from malware.
Definition Controls that proactively reduce the likelihood or impact of a security incident. Include firewalls, encryption, MFA, access controls, and security hardening. Contextual Example Installing antivirus software and performing regular updates are preventive controls that help protect systems from malware attacks.
Technical	Security measures using technology to enforce security policies automatically. Also called logical controls.	Firewalls and TLS encryption are technical controls safeguarding data transmitted over networks.
Definition Controls (also called logical controls) using technology to enforce security policies automatically. Include firewalls, IDS/IPS, encryption, ACLs, and authentication systems. Contextual Example Firewalls and encryption are examples of technical controls used to safeguard data during transmission over networks.

1.2 — Fundamental Security Concepts

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
AAA	Framework for controlling access: Authentication verifies identity, Authorization grants permissions, Accounting tracks usage.	A bank uses AAA protocols to ensure only authorized users access accounts and all transactions are logged.
Definition AAA is the foundational access control framework: Authentication verifies who you are; Authorization determines what you can do; Accounting records what you did. RADIUS and TACACS+ are common AAA protocols. Contextual Example A bank uses AAA protocols to ensure that only authorized users can access their accounts and that their transactions are logged for audit purposes.
Availability	Guarantee that systems and data are accessible when needed by authorized users. The 'A' in the CIA triad.	Redundant servers and off-site backups ensure high availability of services during outages.
Definition The 'A' in the CIA triad. Ensures authorized users can access systems and data when needed. Threatened by DoS attacks, hardware failures, and natural disasters. Contextual Example Implementing redundant servers and backups ensures high availability of services during outages.
Confidentiality	Principle ensuring sensitive information is not disclosed to unauthorized individuals. The 'C' in the CIA triad.	Encrypting emails containing personal information maintains confidentiality during transmission.
Definition The 'C' in the CIA triad. Ensures data is accessible only to those with authorized access. Protected through encryption, access controls, data classification, and need-to-know policies. Contextual Example Encrypting emails to protect personal information is a common practice to maintain confidentiality.
Integrity	Assurance that data is accurate and unaltered except by authorized users. The 'I' in the CIA triad.	Hashing files ensures data integrity, allowing users to verify a file has not been modified since creation.
Definition The 'I' in the CIA triad. Ensures data has not been tampered with by unauthorized parties. Protected through cryptographic hashing, digital signatures, checksums, and version control. Contextual Example Hashing files can ensure data integrity, allowing users to verify that the file has not been modified since its creation.
Non-Repudiation	Security principle preventing individuals from denying their actions related to data or transactions.	Digital signatures provide non-repudiation, proving the sender sent a specific message or transaction.
Definition Ensures the origin of data or a transaction cannot be denied. Achieved through digital signatures, audit logs, and timestamping. Critical for legal admissibility and financial transactions. Contextual Example Digital signatures provide non-repudiation, allowing the sender to prove that they sent a message or transaction.
Zero Trust	Security model requiring strict identity verification for every access request regardless of network location. "Never trust, always verify."	In zero-trust environments, all access requests are authenticated and authorized even for internal users.
Definition Operates on "never trust, always verify." Every access request — inside or outside the perimeter — must be authenticated, authorized, and continuously validated against policy. Eliminates implicit trust zones. Contextual Example In a zero-trust environment, all access requests must be authenticated and authorized, even for users within the corporate network.
Gap Analysis	Comparing actual security performance with desired performance to identify discrepancies and improvement areas.	A company evaluates its cybersecurity measures against industry best practices to identify shortfalls.
Definition A process identifying the difference between an organization's current security posture and a target state. The output is a prioritized remediation roadmap aligned to a framework or regulation. Contextual Example A company conducts a gap analysis to evaluate its current cybersecurity measures against industry best practices.
Honeypot	A decoy system designed to attract and detect unauthorized access attempts, capturing attacker tools and techniques.	A honeypot mimics a vulnerable server to monitor attacker behavior and gather threat intelligence.
Definition A purposely vulnerable decoy system that appears to be a legitimate target. Detects unauthorized access, captures attacker tools and techniques, and generates early-warning alerts with zero false-positives. Contextual Example A honeypot can mimic a vulnerable server to monitor attacker behavior and gather intelligence on security threats.
Honeynet	A network of honeypots simulating a real environment to capture a broader range of attack behavior data.	Security researchers deploy honeynets to study APTs by observing how attackers move across multiple decoy systems.
Definition A controlled network of interconnected honeypots simulating an entire production environment, enabling researchers to observe complete attack kill-chains from initial access through lateral movement. Contextual Example Security researchers deploy a honeynet to study advanced persistent threats (APTs) by observing how attackers interact with multiple decoy systems.
Honeyfile	A file planted in a system that appears valuable but is designed to alert administrators when accessed.	A file labeled "Confidential Financial Data" triggers an alert if any user attempts to open it.
Definition A decoy document placed where an attacker would likely access during reconnaissance. Any read, write, or access attempt triggers an alert — zero false-positives since no legitimate use exists. Contextual Example A company might place a honeyfile labeled "Confidential Financial Data" to trigger an alert if someone attempts to open it.
Honeytoken	A piece of data appearing legitimate that serves as a trap to detect unauthorized access or misuse.	A fake user account (honeytoken) lets security teams monitor unauthorized attempts to use stolen credentials.
Definition Digital decoys — fake credentials, API keys, database records, or email addresses — with no legitimate use. Any attempt to use them is an unambiguous indicator of compromise. Contextual Example Using a honeytoken, such as a fake user account, allows security teams to monitor unauthorized attempts to access sensitive resources.
Access Badge	A physical card containing encoded credentials that authenticates the holder and grants access to controlled physical spaces.	Employees scan badges at entry points to unlock doors to secure areas within an office.
Definition A physical or smart card containing encoded credentials (magnetic strip, RFID, or smart chip) that authenticates the holder and grants access to controlled physical spaces. Contextual Example Employees must scan their access badges at entry points to unlock doors and access secure areas within an office.
Access Control Vestibule	An enclosed interlocking door system preventing tailgating. Also called a mantrap.	Corporate offices use vestibules with security guards to verify identities before allowing entry into secured areas.
Definition An interlocking door system preventing tailgating. The first door must close and authentication must complete before the second door opens. Also called a mantrap. Contextual Example Many corporate offices use access control vestibules with security guards to verify identities before allowing entry.
Bollards	Short, sturdy vertical posts that control vehicle access and protect infrastructure from vehicle-borne attacks.	Bollards in front of government buildings prevent unauthorized vehicle entry and protect against ramming attacks.
Definition Vehicle access control devices — fixed or removable steel or concrete posts — that prevent unauthorized vehicles from entering a protected area. Protect against vehicle-borne IED attacks. Contextual Example Bollards are often used in front of government buildings to prevent unauthorized vehicle entry and enhance security.
Video Surveillance	CCTV and IP camera systems providing continuous monitoring, recording, and deterrence.	Retail stores use video surveillance systems to deter theft and provide evidence of security incidents.
Definition CCTV and IP camera systems providing continuous monitoring, recording, and deterrence. Modern systems include analytics for automated motion detection, facial recognition, and anomaly alerts. Contextual Example Retail stores utilize video surveillance systems to deter theft and monitor customer behavior.

1.3 — Change Management & Security Impact

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Allow / Deny Lists	Allow lists explicitly permit only approved entities; deny lists block known-bad entities.	An allow list permits only trusted IP addresses to access internal applications, blocking everything else.
Definition Allow lists (whitelists) explicitly permit only approved entities; everything else is denied by default. Deny lists (blacklists) block known-bad entities. Allow lists provide stronger security but require more management. Contextual Example An organization uses an allow list to permit only trusted IP addresses to access its internal applications, enhancing security.
Backout Plan	A predefined strategy for reversing changes if an implementation fails or causes adverse effects.	A backout plan restored previous configurations after a new security software deployment caused system instability.
Definition A rollback plan specifying exactly how to restore prior state if a change causes unintended problems. Required component of any change request in a mature change management process. Contextual Example A backout plan was activated to restore previous configurations after the deployment of a new security software caused system instability.
Maintenance Window	A pre-approved time period — often nights or weekends — during which changes can be applied with minimal business impact.	An organization scheduled a weekend maintenance window to apply critical security patches to all servers.
Definition A pre-approved time period — often nights or weekends — during which changes can be applied to systems with minimal business impact. Part of formal change management processes. Contextual Example The organization scheduled a maintenance window over the weekend to apply critical security patches to all servers.
Standard Operating Procedure	Step-by-step instructions outlining how to perform specific tasks to ensure consistency and quality in operations.	An SOP for incident response provides detailed steps for detecting, reporting, and addressing security incidents.
Definition Documented, repeatable procedures ensuring tasks are performed consistently and correctly regardless of who executes them. SOPs are essential for incident response, change management, and audit compliance. Contextual Example An SOP for incident response provides detailed steps for detecting, reporting, and addressing security incidents systematically.
Version Control	A system tracking changes to documents or code over time, enabling rollback to known-good states and providing audit trails.	Version control helps teams track changes to security documentation, ensuring everyone uses the most current information.
Definition Systems like Git track changes to code, configuration files, and documentation over time. Enables rollback to known-good states, provides audit trails, and prevents unauthorized or accidental changes. Contextual Example Version control systems help teams track changes to security documentation, ensuring all team members are working with the most current information.
Impact Analysis	A systematic assessment of how a proposed change could affect business operations, security posture, and compliance.	Conducting an impact analysis before implementing new security measures helps ensure minimal disruption to critical operations.
Definition A systematic assessment of how a proposed change could affect business operations, security posture, and compliance. Mandatory before implementing changes that could disrupt critical services. Contextual Example Conducting an impact analysis before implementing new security measures helps ensure minimal disruption to critical business operations.

1.4 — Cryptographic Solutions

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Asymmetric Encryption	Encryption using a mathematically linked key pair (public/private). Data encrypted with the public key can only be decrypted by the private key.	Asymmetric encryption allows secure data exchange without sharing private keys, enhancing security.
Definition Uses mathematically linked key pairs: data encrypted with the public key can only be decrypted by the corresponding private key. Slower than symmetric encryption; used for key exchange and digital signatures. Contextual Example Asymmetric encryption allows for the exchange of secure data without sharing private keys, enhancing security.
Symmetric Encryption	Encryption using the same key for both encryption and decryption. Faster than asymmetric; AES is the standard.	Symmetric encryption is faster than asymmetric and used for encrypting large amounts of data like files or databases.
Definition Uses a single shared key for both encryption and decryption. Much faster than asymmetric encryption. Key distribution is a challenge — the shared key must be securely exchanged before communication. AES is the standard. Contextual Example Symmetric encryption is faster and often used for encrypting large amounts of data, such as files or databases.
Hashing	A one-way mathematical function producing a fixed-length digest of any input. Used for password storage and integrity verification.	Hashing passwords ensures the actual passwords remain unrecoverable even if the database is compromised.
Definition A one-way mathematical function producing a fixed-length digest of any input. Used for password storage, integrity verification, and digital signatures. Cannot be reversed to obtain the original data. Contextual Example Hashing passwords ensures that even if the database is compromised, the actual passwords remain secure and unrecoverable.
Salting	Adding a random unique value to each password before hashing to defeat rainbow table and dictionary attacks.	Salting passwords before hashing prevents attackers from using rainbow tables to crack password hashes.
Definition A random unique value appended to each password before hashing. Ensures that identical passwords produce different hashes, defeating rainbow table and dictionary attacks. Contextual Example Salting passwords before hashing prevents attackers from using rainbow tables to crack password hashes.
Digital Signatures	Provides authentication, integrity, and non-repudiation by hashing a message and encrypting with the sender's private key.	Digital signatures confirm an email is from the claimed sender and has not been altered during transmission.
Definition Created by hashing a message and encrypting the hash with the sender's private key. Recipients decrypt with the sender's public key and verify the hash matches. Provides authentication, integrity, and non-repudiation. Contextual Example Digital signatures ensure that an email is from the claimed sender and has not been altered during transmission.
PKI	The complete system of hardware, software, policies, and procedures that manages digital certificates and public-private key pairs.	PKI is used in secure email communication, ensuring only intended recipients can decrypt messages.
Definition The complete system of hardware, software, policies, and procedures that manages digital certificates and public-private key pairs. Includes CAs, registration authorities, certificate stores, and revocation mechanisms. Contextual Example PKI is used in secure email communication, ensuring that only intended recipients can decrypt messages.
Certificate Authorities	Trusted third parties that issue, sign, and revoke digital certificates in the PKI hierarchy.	Certificate authorities provide SSL/TLS certificates to websites, enabling secure encrypted connections.
Definition Trusted third parties in the PKI hierarchy that issue, sign, and revoke digital certificates. They validate identity before issuing certificates, establishing chain-of-trust in cryptographic systems. Contextual Example Certificate authorities, such as Let's Encrypt, provide SSL certificates to websites, enabling secure connections.
Hardware Security Module	A tamper-resistant hardware device providing secure key generation, storage, and cryptographic operations. Keys never leave in plaintext.	Financial institutions use HSMs to safeguard sensitive transaction data and cryptographic keys.
Definition A tamper-resistant hardware device providing secure key generation, storage, and cryptographic operations. Keys never leave the HSM in plaintext. Used for PKI roots, code signing, and payment processing. Contextual Example Financial institutions often use HSMs to safeguard sensitive transaction data and cryptographic keys.
Trusted Platform Module	A dedicated microcontroller chip on the motherboard providing hardware-based security: key generation, storage, and platform integrity measurement.	Computers use TPM to ensure secure boot and provide hardware-based encryption capabilities like BitLocker.
Definition A dedicated microcontroller chip on the motherboard providing hardware-based security functions: secure key generation and storage, platform integrity measurement, and sealed storage tied to platform state. Contextual Example Computers often use TPM to ensure secure boot and hardware-based encryption capabilities.
Tokenization	Substitutes sensitive data with randomly generated tokens stored in a token vault, dramatically reducing data breach impact.	Tokenization replaces credit card numbers with unique tokens in payment processing, reducing PCI scope.
Definition Substitutes sensitive data values with randomly generated tokens stored in a token vault. The original data is never transmitted or stored in business systems, dramatically reducing data breach impact. Contextual Example Tokenization is used in payment processing to replace credit card numbers with unique tokens, enhancing security.
Steganography	Conceals the existence of a message by embedding it within ordinary-looking files (images, audio, video) without altering visible appearance.	A secret message can be concealed within an image file without altering its visible appearance.
Definition Conceals the existence of a message by embedding it within ordinary-looking files (images, audio, video). Unlike encryption (which hides content), steganography hides the fact that a message exists at all. Contextual Example Using steganography, a secret message can be concealed within an image file without altering its visible appearance.
Key Stretching	Applies hash functions repeatedly (PBKDF2, bcrypt, Argon2) to a weak key to produce a stronger derived key, slowing brute-force attacks.	Key stretching makes brute-force attacks harder by increasing the computational time needed to test each key.
Definition Takes a weak key (e.g., a user password) and applies hash functions repeatedly (PBKDF2, bcrypt, Argon2) to produce a stronger derived key. The added computation dramatically slows brute-force attacks. Contextual Example Key stretching makes brute-force attacks more difficult by increasing the time required to test each key candidate.
Full-Disk Encryption	Encrypts the entire contents of a storage device including OS, applications, and user data. Protects against physical device theft.	Full-disk encryption on laptops safeguards all data if the device is lost or stolen.
Definition Encrypts the entire contents of a storage device, including the OS, applications, and user data. Data is decrypted on-the-fly during normal use; protects against physical device theft. Contextual Example Full-disk encryption is commonly used on laptops to safeguard data if the device is lost or stolen.

DOMAIN 02

Threats, Vulnerabilities & Mitigations

22% of exam · sections 2.1 – 2.4

2.1 — Threat Actors & Motivations

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Nation-State	Government-sponsored groups conducting long-term APT campaigns for intelligence collection and geopolitical advantage. Most sophisticated threat actors.	A nation-state actor orchestrates attacks to steal intellectual property and boost domestic industries.
Definition The most sophisticated and well-resourced threat actors, operating with government backing. Conduct long-term APT campaigns for intelligence collection, critical infrastructure disruption, and geopolitical advantage. Contextual Example A nation-state actor might orchestrate cyberattacks to steal intellectual property from foreign corporations, aiming to boost domestic industries and gain an economic advantage.
Organized Crime	Professional criminal enterprises with specialized roles: access brokers, ransomware developers, negotiators, and money laundering networks.	Organized crime syndicates execute ransomware attacks on healthcare providers, demanding hefty ransoms.
Definition Professional criminal enterprises with specialized roles: initial access brokers, ransomware developers, negotiators, and money laundering networks. Financially motivated and increasingly sophisticated. Contextual Example Organized crime syndicates might execute ransomware attacks on healthcare providers, encrypting patient data and demanding hefty ransoms.
Hacktivist	Politically or socially motivated hackers using DDoS, defacement, and data leaks to advance their cause.	A hacktivist collective defaces a government website during a political protest to draw public attention.
Definition Politically or socially motivated hackers. Operations include website defacement, DDoS attacks on target organizations, and publication of stolen data to embarrass or expose targets. Anonymous is a well-known example. Contextual Example A hacktivist collective might deface a government website during a significant political protest, using hacking skills to raise awareness about human rights violations.
Insider Threat	A current or former employee, contractor, or partner who uses authorized access to harm the organization. Bypasses perimeter controls.	A disgruntled employee steals customer data before leaving the company and plans to sell it to competitors.
Definition Uniquely dangerous because they bypass perimeter controls. Includes malicious insiders (intentional harm), negligent insiders (accidental exposure), and compromised insiders (credentials stolen by external actors). Contextual Example A disgruntled employee who feels undervalued may steal sensitive customer data before leaving the company, intending to sell it to competitors.
Unskilled Attacker	Also called script kiddies. Use automated tools that lower the attack barrier, primarily targeting unpatched vulnerabilities.	An unskilled attacker uses publicly available exploit tools to attack unsecured websites with common CVEs.
Definition Also called script kiddies. Despite low skills, they pose real risk by using automated tools that lower the attack barrier. Primarily target widely known, unpatched vulnerabilities. Contextual Example An unskilled attacker might employ publicly available tools like Metasploit to exploit common vulnerabilities on unsecured websites without understanding the underlying technology.
Shadow IT	IT systems, devices, or services used by employees without IT department approval, creating security gaps and compliance violations.	Employees using unapproved cloud storage expose sensitive company data to potential security breaches.
Definition IT systems, devices, software, or services used by employees without IT department approval. Creates security gaps: data outside organizational controls, compliance violations, and unmanaged vulnerabilities. Contextual Example Employees may use unapproved cloud storage solutions to share files, exposing sensitive company data to potential breaches.
Data Exfiltration	The unauthorized movement of data from within an organization to an external destination. A primary objective of many cyberattacks.	An insider threat secretly copies client lists to a USB drive, planning to sell the data to competitors.
Definition The unauthorized movement of data from within an organization to an external destination. Can be performed via network transfer, physical media, email, or cloud storage. A primary objective of many cyberattacks. Contextual Example An insider threat may exfiltrate sensitive data by secretly copying client lists to a USB drive and planning to sell this information to competitors.
Espionage	Covert collection of sensitive information from adversaries or competitors through long-term, stealthy APT campaigns.	A nation-state infiltrates a rival corporation's network to steal trade secrets and gain competitive advantage.
Definition The covert collection of sensitive information from adversaries or competitors. Cyber espionage is conducted through APT campaigns — long-term, stealthy operations targeting high-value intellectual property or government secrets. Contextual Example A nation-state might engage in cyber espionage to infiltrate a rival corporation's network, stealing trade secrets to gain a competitive edge.
Financial Gain	The most common motivation for cyberattacks, driving ransomware, BEC fraud, credit card theft, and sale of stolen data.	Organized crime targets financial institutions with phishing schemes to steal account credentials and transfer funds.
Definition The most common motivation for cyberattacks. Includes ransomware, BEC fraud, credit card theft, cryptocurrency mining, and sale of stolen data. Drives the majority of the global cybercrime economy. Contextual Example Organized crime syndicates often target financial institutions with sophisticated phishing schemes, aiming for financial gain by stealing account credentials.

2.2 — Threat Vectors & Attack Surfaces

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Phishing	Mass social engineering attacks sent to broad audiences. Spear phishing targets specific individuals; whaling targets executives; vishing is via phone.	A phishing email mimicking a bank deceives users into entering credentials on a fake website.
Definition Mass social engineering attacks sent to broad audiences. Spear phishing targets specific individuals; whaling targets executives; vishing is via phone. The most common initial access vector in data breaches. Contextual Example A phishing email from a bank can deceive users into entering their login credentials on a fake website, leading to unauthorized access to their accounts.
Vishing	Voice phishing conducted via phone calls using pretexting, urgency, and authority to manipulate targets into divulging information.	A vishing call from "tech support" tricks victims into providing remote system access or personal details.
Definition Social engineering conducted via voice calls. Attackers use pretexting, urgency, and authority to manipulate targets. Often targets elderly individuals or employees with access to financial systems. Contextual Example A vishing call from someone claiming to be from tech support could trick victims into providing access to their systems or personal details.
Smishing	SMS-based phishing exploiting higher open rates and lower suspicion associated with text messages.	A smishing message from a fake bank urgently requests account verification via a link to a fraudulent website.
Definition SMS-based phishing (smishing) exploits the higher open rates and lower suspicion associated with text messages. Often impersonates financial institutions, delivery services, or government agencies to create urgency. Contextual Example A smishing message appears to come from a financial institution, urgently requesting sensitive data via text to verify account information, leading users to a fraudulent website.
Business Email Compromise	Sophisticated scam targeting businesses where attackers impersonate executives using spoofed or compromised email accounts. Causes billions in annual losses.	An attacker impersonates a CEO via email, requesting a wire transfer to a fraudulent account.
Definition A sophisticated scam targeting businesses that regularly perform wire transfers. Attackers impersonate executives or vendors using spoofed or compromised email accounts. BEC causes billions in annual losses globally. Contextual Example In a BEC attack, an attacker impersonates a CEO via email and requests a wire transfer to a fraudulent account, exploiting employee trust in executive authority.
Supply Chain Attack	Attacks targeting less-secure elements in a supply chain to compromise the ultimate target through trusted relationships. SolarWinds is the prime example.	A breach at an MSP exposes its client companies as attackers gain access through a trusted third party.
Definition Attacks targeting less-secure elements in a supply chain — software vendors, hardware manufacturers, service providers — to compromise the ultimate target through trusted relationships. SolarWinds is the prime example. Contextual Example A breach at a managed service provider (MSP) can expose its client companies to potential security threats as attackers gain access through a trusted third party.
Watering Hole Attack	Attackers compromise a website frequently visited by the intended target to deliver malware to specific visitors.	Attackers compromise an industry website to infect visitors from a specific target organization with tailored malware.
Definition A targeted attack where adversaries compromise websites known to be frequented by their actual target. Rather than attacking the target directly, they poison a trusted site the target regularly visits. Contextual Example Attackers might conduct a watering hole attack by compromising an industry-related website, infecting visitors from a specific organization with malware tailored to exploit their systems.
Typosquatting	Registers misspelled or visually similar domain names to intercept users who make typing errors. Also called URL hijacking.	An attacker registers "goolge.com" hoping users mistype "google.com" and visit the malicious fake site.
Definition Also called URL hijacking. Registers misspelled or visually similar domain names to intercept users who make typing errors. The fake site may steal credentials, serve malware, or conduct phishing attacks. Contextual Example An attacker uses typosquatting by registering a domain like "goolge.com", hoping users mistype "google.com" and visit the fake site, which can steal their login information.
Removable Device (USB Drop)	Physical media used to introduce malware into secure systems. Autorun features can execute malware immediately upon connection.	A USB stick labeled "Confidential Report" found in a parking lot installs malware when plugged in.
Definition Physical media used to introduce malware into air-gapped or otherwise secure systems. The "USB drop" attack exploits human curiosity. Autorun features can execute malware immediately upon connection. Contextual Example A USB stick labeled "Confidential Report" is left in a public area. When an unsuspecting user plugs it in, it installs malware that compromises system security.
Default Credentials	Factory-set credentials publicly documented and not changed during deployment. Especially problematic in IoT devices and network equipment.	IoT devices with unchanged default credentials allow attackers easy access to their settings and capabilities.
Definition Factory-set credentials that are publicly documented and not changed during deployment. Represent low-effort targets for attackers. Especially problematic in IoT devices, network equipment, and cloud services. Contextual Example Many IoT devices are compromised because users fail to change default credentials, which allows attackers easy access to the devices' settings and capabilities.

2.3 — Types of Vulnerabilities

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Zero-Day	A vulnerability unknown to the vendor with no available patch. Highly valued in criminal and nation-state markets.	Zero-day vulnerabilities allow attackers to exploit systems without fear of detection or patching, causing widespread damage.
Definition A vulnerability unknown to the vendor and/or without an available patch. Attackers who discover or purchase zero-days can exploit them indefinitely until disclosed and patched. Highly valued in criminal and nation-state markets. Contextual Example Zero-day vulnerabilities pose a significant threat, as attackers can exploit them without fear of immediate detection or patching, leading to potential widespread damage.
SQL Injection	Injects malicious SQL code through user input fields. Can extract data, bypass authentication, or execute OS commands. Prevention requires parameterized queries.	An attacker sends malicious SQL commands to a web application, exposing sensitive customer data from the database.
Definition Injects malicious SQL code through user input fields into database queries. Can extract confidential data, modify database records, bypass authentication, or execute OS commands. Prevention requires parameterized queries. Contextual Example During a SQL injection attack, an attacker sends malicious SQL commands to a web application, potentially exposing sensitive customer data stored in the database.
Cross-Site Scripting (XSS)	Injects malicious client-side scripts into web pages viewed by other users. Types: reflected, stored, and DOM-based.	An attacker embeds harmful JavaScript in a webpage; any visitor's browser executes it, potentially stealing their session cookies.
Definition Injects malicious client-side scripts into web pages viewed by other users. Types include reflected (URL-based), stored (persistent in database), and DOM-based XSS. Can steal session cookies, credentials, or redirect users. Contextual Example An attacker exploits XSS by embedding harmful JavaScript into a web page. The script executes in the browser of any user who visits the page, potentially stealing their data.
Buffer Overflow	A program writes more data to a memory buffer than it can hold, overwriting adjacent memory and potentially allowing arbitrary code execution.	An attacker feeds excessive data into an input field, causing the application to crash or execute malicious code.
Definition Occurs when a program writes more data to a memory buffer than it can hold, overwriting adjacent memory. Can cause crashes or, if exploited precisely, allow an attacker to redirect execution to injected code. Contextual Example An attacker exploits a buffer overflow by feeding excessive data into an input field, causing the application to crash or execute malicious code.
Misconfiguration	Incorrect settings in software, networks, or devices. One of the most common vulnerability categories and often the root cause of major breaches.	A firewall misconfiguration leaves sensitive data accessible to unauthorized users, causing a compliance breach.
Definition One of the most common vulnerability categories. Includes default credentials left unchanged, unnecessary services enabled, overly permissive access controls, and improperly configured cloud storage. Often the root cause of major breaches. Contextual Example A firewall misconfiguration leaves sensitive data accessible to unauthorized users, potentially leading to breaches and compliance issues.
VM Escape	Exploits hypervisor vulnerabilities to break out of a VM's isolation boundary, gaining code execution on the host or other VMs.	A VM escape vulnerability allows an attacker to move from a compromised VM to the host system.
Definition Exploits hypervisor vulnerabilities to break out of a VM's isolation boundary, gaining code execution on the host or other VMs. Considered a critical severity vulnerability in virtualized environments. Contextual Example A VM escape vulnerability allows an attacker to move from a compromised virtual environment to the host system, compromising sensitive data and applications.
Race Condition / TOCTOU	Vulnerability arising when system behavior depends on the timing of events. Attacker changes state between check (TOC) and use (TOU).	An attacker alters a file after validity is checked but before it is used, leading to unauthorized actions.
Definition Occur when multiple processes access shared resources concurrently without proper synchronization. In TOCTOU (Time-of-Check Time-of-Use), an attacker changes a resource between when it's verified and when it's used. Contextual Example An attacker takes advantage of a TOCTOU vulnerability by altering a file after it has been checked for validity but before it is used, leading to unauthorized actions.
End-of-Life (EOL)	The point at which a vendor ceases providing security updates. All vulnerabilities discovered after EOL remain permanently unpatched.	End-of-life devices are attractive targets because they lack security patches for known vulnerabilities.
Definition The point at which a vendor ceases providing security updates and support for a product. All vulnerabilities discovered after EOL remain permanently unpatched, representing an ever-growing attack surface. Contextual Example End-of-life devices are susceptible to exploitation due to the lack of security patches and updates, making them attractive targets for attackers.

2.4 — Indicators of Malicious Activity

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
DDoS	Uses a botnet of compromised devices to flood targets with traffic. Types include volumetric, protocol, and application-layer attacks.	Thousands of compromised devices flood a company's web server with traffic, crashing it and making it inaccessible.
Definition Uses a botnet of compromised devices (zombies) to flood targets with traffic or resource-exhausting requests. Harder to mitigate than single-source DoS. Types include volumetric (bandwidth), protocol, and application-layer attacks. Contextual Example The company's website suffers a DDoS attack. Thousands of compromised devices flood the server, crashing it and making it inaccessible to users.
Brute Force	Exhaustive search attack trying all possible combinations. Mitigated by MFA, account lockout, and strong passwords.	A hacker systematically tries thousands of password combinations until successfully gaining admin account access.
Definition Exhaustive search attack trying all possible combinations. Pure brute force tries every possibility; dictionary attacks use word lists; credential stuffing uses known breached passwords. Mitigated by MFA, account lockout, and strong passwords. Contextual Example A hacker employs a brute force attack on the admin account, systematically trying thousands of password combinations until they successfully gain access.
Malware	Malicious software including viruses, worms, trojans, ransomware, spyware, adware, rootkits, and keyloggers.	Ransomware encrypts an organization's files and demands payment in cryptocurrency for the decryption key.
Definition Any software intentionally designed to cause disruption, gain unauthorized access, steal data, or hold systems for ransom. Categories include viruses (self-replicating), worms (self-propagating), trojans, ransomware, and rootkits. Contextual Example Ransomware encrypts an organization's critical files and demands payment in cryptocurrency for the decryption key, causing operational disruption.
Ransomware	Malware that encrypts victim files and demands ransom for the decryption key. Often deployed via phishing or RDP exploitation.	A hospital's files are encrypted; attackers demand $1M in Bitcoin before providing the decryption key.
Definition A category of malware that encrypts victim data and demands payment for the decryption key. Modern ransomware often includes double extortion: threatening to publish stolen data if the ransom is not paid. Contextual Example A hospital's patient records are encrypted by ransomware; attackers demand significant payment in cryptocurrency before providing a decryption key, disrupting patient care.
Rootkit	Malware that hides its presence by modifying the OS at a deep level. Extremely difficult to detect and remove.	A rootkit hides malicious processes from the OS task manager, allowing persistent unauthorized access to go undetected.
Definition Malware designed to gain privileged access and conceal its presence by modifying OS components. Can intercept and alter OS calls to hide files, processes, and network connections. Firmware rootkits survive OS reinstalls. Contextual Example A rootkit hides malicious processes from the OS task manager, allowing an attacker persistent unauthorized access that goes undetected by standard security tools.
Birthday Attack	Cryptographic attack exploiting probability to find two different inputs producing the same hash. Used to forge digital signatures.	A birthday attack enables an attacker to discover two messages with the same hash, breaking digital signature security.
Definition Based on the birthday paradox in probability. Exploits that hash collisions occur more easily than intuition suggests. Used to forge digital signatures or create malicious documents with the same hash as legitimate ones. Contextual Example The birthday attack enables an attacker to discover two distinct messages that yield the same hash value, breaking the security of digital signatures.
Man-in-the-Middle (MitM)	Attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly.	On public Wi-Fi, an attacker intercepts traffic between a user and their bank, capturing login credentials.
Definition An attacker secretly positions themselves between two communicating parties, intercepting and potentially modifying messages. Common on unsecured networks. Mitigated by TLS/SSL, certificate pinning, and MFA. Contextual Example On a public Wi-Fi network, an attacker intercepts traffic between a user and their online bank, capturing session tokens and login credentials.

DOMAIN 03

Security Architecture

18% of exam · sections 3.1 – 3.4

3.1 — Architecture Models

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Cloud Computing	Delivery of computing services over the internet. Models: IaaS, PaaS, SaaS. Deployments: public, private, hybrid, community.	A company migrates its email server to Microsoft 365 (SaaS), eliminating on-premises infrastructure management.
Definition On-demand delivery of IT resources over the internet. Service models: IaaS (infrastructure), PaaS (platform), SaaS (software). Deployment models: public (shared), private (dedicated), hybrid (both), community (sector-shared). Contextual Example A company migrates its email server to Microsoft 365 (SaaS), eliminating on-premises infrastructure management and shifting security responsibility to the shared responsibility model.
Hybrid Cloud	Combines on-premises infrastructure with public cloud resources, allowing data and applications to move between environments.	A bank keeps customer data on private servers while using public cloud for burst compute workloads during tax season.
Definition An architecture combining private (on-premises or hosted) and public cloud resources. Organizations keep sensitive workloads on-premises while leveraging public cloud scalability for less sensitive workloads. Contextual Example A bank keeps regulated customer financial data on private on-premises servers while using public cloud for burst compute workloads, maintaining compliance while gaining scalability.
Serverless Architecture	Cloud model where the provider manages infrastructure; developers deploy code as functions. Shifts OS/runtime security responsibility to the provider.	A company deploys payment processing logic as AWS Lambda functions, eliminating server patch management.
Definition Functions-as-a-Service model where code runs in stateless containers managed entirely by the cloud provider. Reduces infrastructure management but creates risks around function-level IAM permissions and injection vulnerabilities. Contextual Example A company deploys payment processing logic as AWS Lambda functions, eliminating server patch management but requiring careful IAM permission scoping for each function.
Microservices	Architecture where applications are built as small, independent services communicating via APIs. Each service has its own security boundary.	An e-commerce app splits into separate services for payments, inventory, and user auth, each requiring its own security controls.
Definition An architectural style where applications are composed of small, loosely coupled services. Each microservice has its own security boundary and can be independently deployed, scaled, and updated. Contextual Example An e-commerce platform splits into separate microservices for payments, inventory, and authentication, each requiring its own security controls, API gateway protection, and network policies.
Containerization	Packages applications and their dependencies into isolated containers (Docker, Kubernetes). Containers share the host OS kernel, creating shared attack surface.	Developers use Docker containers to ensure consistent security configurations across development and production environments.
Definition Technology packaging application code and dependencies into lightweight, portable containers. Containers share the host OS kernel (unlike VMs), so kernel vulnerabilities affect all containers. Kubernetes orchestrates containerized workloads. Contextual Example Developers use Docker containers to ensure consistent security configurations across development and production environments, but must ensure images are scanned for vulnerabilities before deployment.
Infrastructure as Code	Managing and provisioning infrastructure through machine-readable configuration files rather than manual processes. Enables security as code.	A company uses Terraform to define security group rules as code, ensuring consistent configuration across all cloud deployments.
Definition Treating infrastructure configuration as code managed in version control. Enables consistent, repeatable provisioning and eliminates configuration drift. Security policies can be embedded in IaC templates and enforced via policy-as-code. Contextual Example A company uses Terraform templates to define security group rules as code, ensuring every new cloud deployment automatically applies the same security configurations without manual intervention.
SASE	Converges WAN networking and network security functions (CASB, FWaaS, ZTNA, SWG) into a unified cloud-delivered service.	A distributed company uses SASE to provide consistent security policies for remote employees regardless of location.
Definition Secure Access Service Edge converges SD-WAN capabilities with cloud-native security functions. Delivers security enforcement at the network edge close to users, enabling zero-trust access for distributed workforces. Contextual Example A company with remote employees worldwide uses SASE to provide consistent, identity-aware security policies regardless of where users connect or what applications they access.
SD-WAN	Software-Defined Wide Area Network that uses software to control network connectivity, replacing or augmenting traditional MPLS connections.	A retail chain uses SD-WAN to securely connect hundreds of store locations with centralized security policy management.
Definition Software-Defined WAN abstracts the underlying transport and centrally manages WAN connectivity. Enables dynamic path selection, application-aware routing, and centralized security policy enforcement across distributed locations. Contextual Example A retail chain uses SD-WAN to securely connect hundreds of store locations, applying consistent security policies and enabling centralized visibility into all branch traffic from a single management console.
Shared Responsibility Model	Defines which security tasks are the cloud provider's responsibility versus the customer's, varying by service model (IaaS/PaaS/SaaS).	In AWS IaaS, AWS secures the physical data center; the customer is responsible for OS patches and application security.
Definition In IaaS, the provider secures physical infrastructure; customers manage everything above the hypervisor. In PaaS, the provider also manages the OS/runtime. In SaaS, the provider manages everything except data and user access. Contextual Example An organization running on AWS EC2 (IaaS) must patch its own OS and applications; AWS is responsible only for the underlying physical infrastructure, networking, and hypervisor.

3.2 — Secure Network Infrastructure

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Network Segmentation	Dividing a network into isolated segments to contain breaches, reduce attack surface, and improve compliance.	A hospital separates its clinical systems, guest Wi-Fi, and administrative network into distinct VLANs with firewall enforcement.
Definition Divides a network into isolated zones using firewalls, VLANs, or microsegmentation. Limits lateral movement: an attacker who compromises one segment cannot freely access others. Critical for PCI DSS compliance. Contextual Example A hospital separates clinical systems, payment processing, guest Wi-Fi, and admin networks into distinct segments. A breach in the guest network cannot propagate to patient record systems.
DMZ	A perimeter network segment between the internet and internal network hosting public-facing servers. Provides an additional security layer.	Web servers are placed in the DMZ so internet users can access them without direct access to internal databases.
Definition A network zone between untrusted (internet) and trusted (internal) networks, hosting public-facing services. Firewalls control traffic into and out of the DMZ, limiting exposure if a DMZ host is compromised. Contextual Example Public web servers are placed in the DMZ. Internet users access the web servers, but strict firewall rules prevent the web servers from initiating connections directly to internal database servers.
Firewall	Network security device monitoring and controlling incoming/outgoing traffic based on predefined security rules. Types: packet-filtering, stateful, NGFW, WAF.	A next-generation firewall inspects application-layer traffic and blocks attempts to exploit web application vulnerabilities.
Definition Controls network traffic between zones based on rules. Packet-filtering inspects headers; stateful tracks connection state; NGFW adds application awareness and IPS; WAF (Web Application Firewall) protects web apps from OWASP Top 10 attacks. Contextual Example A next-generation firewall inspects application-layer traffic, identifies SQL injection attempts in HTTP requests, and blocks them before they reach the web server, operating independently of signature updates.
IDS / IPS	Intrusion Detection System monitors and alerts; Intrusion Prevention System actively blocks detected threats. Both use signature and anomaly-based detection.	An IPS automatically blocks network traffic matching known attack signatures before it reaches internal servers.
Definition IDS (passive) inspects traffic and generates alerts without blocking. IPS (inline, active) can block or drop malicious traffic in real time. Both use signature-based detection (known attacks) and anomaly-based detection (behavioral deviations). Contextual Example An IPS deployed inline between the internet and internal servers automatically drops packets matching known exploit signatures, preventing attacks from reaching their targets in real time.
VPN	Creates an encrypted tunnel over an untrusted network. Types: site-to-site (connecting offices) and remote-access (connecting individuals).	Remote employees use VPN to securely access corporate resources over public internet connections.
Definition Extends a private network over a public one by creating an encrypted tunnel. IPSec VPNs encrypt at the network layer; SSL/TLS VPNs operate at the transport layer. Split tunneling sends only organizational traffic through the VPN. Contextual Example Remote employees connect to the corporate VPN before accessing internal systems, ensuring all data transmitted over the public internet is encrypted and that access is authenticated.
Proxy Server	An intermediary between clients and the internet. Forward proxies protect clients; reverse proxies protect servers. Can perform SSL inspection and content filtering.	A company's forward proxy filters web traffic, blocking malicious sites and enforcing acceptable use policies.
Definition An intermediary that processes requests on behalf of clients (forward proxy) or servers (reverse proxy). Forward proxies filter outbound traffic and cache content; reverse proxies load balance and protect web servers from direct exposure. Contextual Example A forward proxy at the network perimeter intercepts all outbound web traffic, performs SSL inspection to detect malware in encrypted streams, and blocks access to known malicious domains.
Load Balancer	Distributes incoming network traffic across multiple servers to ensure high availability and prevent any single server from becoming a bottleneck.	A load balancer distributes web traffic across five servers, ensuring service continuity if one server fails.
Definition Distributes traffic across a pool of servers using algorithms (round-robin, least connections, IP hash). Provides both availability and performance benefits. Can perform health checks to remove failed servers from rotation. Contextual Example A load balancer distributes web traffic across five application servers, automatically routing requests away from any server that fails a health check, ensuring continuous availability.
NAC	Enforces security policy compliance before granting network access. Checks device health, OS patch level, antivirus status, and user identity.	NAC prevents a laptop with outdated antivirus from connecting to the corporate network until remediated.
Definition Evaluates devices against security policy before granting network access. Non-compliant devices can be quarantined, given limited access, or blocked. Uses 802.1X authentication for wired/wireless enforcement. Contextual Example NAC checks every connecting device for current OS patches, active antivirus, and valid certificates. A laptop missing critical updates is quarantined in a remediation VLAN until patched.
VLAN	Logical segmentation of a physical network at Layer 2. Groups devices regardless of physical location; isolates broadcast domains.	A company places all IoT devices on a separate VLAN, preventing compromised devices from reaching corporate servers.
Definition Virtual LANs create logical network segments on a physical switch infrastructure. Traffic between VLANs requires a Layer 3 device (router/firewall), enabling granular access control and containing broadcast traffic. Contextual Example A company creates a dedicated VLAN for IoT devices. Even if an IoT sensor is compromised, it cannot directly communicate with servers on the corporate VLAN without traversing the firewall.

3.3 — Data Protection Strategies

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Data Classification	Categorizes data by sensitivity level to apply appropriate security controls. Common levels: public, internal, confidential, restricted.	A company labels documents as Public, Internal, Confidential, or Top Secret, applying stricter controls to higher classifications.
Definition Organizes data into categories based on sensitivity and required protection level. Enables appropriate security control application: public data has minimal controls while restricted/top secret data receives maximum protection including encryption and strict access controls. Contextual Example A financial firm classifies data as Public, Internal, Confidential, and Restricted. Restricted data (customer SSNs, account numbers) requires encryption at rest, strict access logging, and cannot be stored on portable devices.
DLP	Technology monitoring, detecting, and blocking unauthorized transmission of sensitive data via email, web, or removable media.	DLP software alerts security when an employee tries to email a file containing credit card numbers to an external address.
Definition Systems that monitor data in use (endpoints), in motion (network), and at rest (storage) to detect and prevent unauthorized disclosure. Use content inspection, contextual analysis, and pattern matching (regex for SSNs, credit cards). Contextual Example DLP software scans all outbound emails and blocks any message containing patterns matching credit card numbers, alerting the security team and preventing unintentional data exposure.
Data at Rest	Inactive data stored on physical media: hard drives, databases, backups, or cloud storage. Protected by encryption and access controls.	Customer records stored in a database are encrypted at rest using AES-256, protecting them from storage media theft.
Definition Data stored on any persistent medium — local storage, databases, backup tapes, cloud object storage. Encryption at rest (TDE, BitLocker, cloud-native encryption) protects against unauthorized access to the physical or logical storage layer. Contextual Example Customer PII in a database is encrypted at rest using Transparent Data Encryption (TDE). If backup tapes are stolen, the data remains unreadable without the encryption key.
Data in Transit	Data moving between systems over a network. Protected by transport encryption protocols like TLS to prevent interception.	HTTPS encrypts web traffic between users and servers, protecting credentials and personal data from eavesdropping.
Definition Data actively moving through a network between endpoints. TLS is the standard protection. Also covers data transferred via API, email (S/MIME, TLS), and VPN tunnels. Vulnerable to eavesdropping and MitM attacks if unencrypted. Contextual Example An e-commerce site enforces HTTPS for all pages, ensuring customer payment details and session tokens are encrypted in transit, preventing interception on public networks.
Data in Use	Data actively being processed in memory. Hardest to protect; threats include memory scraping attacks and cold boot attacks.	Secure enclaves (Intel SGX) process sensitive computations in isolated memory that the OS cannot access.
Definition Data currently being processed in RAM or CPU registers. Must be decrypted to be used, creating exposure. Secure enclaves and trusted execution environments provide hardware-isolated processing of sensitive data. Contextual Example A payment terminal uses secure enclaves to process card decryption in isolated memory inaccessible to the main OS, protecting against memory-scraping malware that plagued older POS systems.
Rights Management	Controls how data can be used, copied, printed, or forwarded even after it has been shared. Persists with the document regardless of location.	IRM prevents a confidential document recipient from forwarding, printing, or copy-pasting its contents.
Definition Information Rights Management (IRM) and Digital Rights Management (DRM) embed usage policies within documents and media files. Policies persist with the content, enforcing restrictions even after distribution outside the organization. Contextual Example A law firm applies IRM policies to client contracts, preventing recipients from forwarding, printing, or screen-capturing the documents, even if they are forwarded outside the firm's email system.

3.4 — Resilience & Recovery

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
High Availability	System design ensuring continuous operation with minimal downtime using redundancy, failover, and clustering. Often expressed as uptime percentages (99.999% = 5 nines).	A critical application runs on an HA cluster; if one node fails, another automatically takes over within seconds.
Definition Architecture eliminating single points of failure through redundant components, automatic failover, and load distribution. "Five nines" (99.999%) availability allows only ~5 minutes of downtime per year. Achieved through clustering, replication, and geographic distribution. Contextual Example A hospital's patient management system runs on an active-active HA cluster across two data centers. A complete failure of one data center triggers automatic failover with no user-visible downtime.
Redundancy	Duplicating critical system components so that backup components can take over when the primary fails.	Dual power supplies in a server ensure it continues operating if one power supply fails.
Definition The duplication of critical components or functions to increase reliability and availability. Includes hardware redundancy (dual NICs, RAID), network redundancy (multiple ISPs), geographic redundancy (multiple data centers), and personnel redundancy (cross-training). Contextual Example A data center implements redundant power (dual UPS systems, generator), networking (dual ISPs with BGP failover), and storage (RAID 6) to ensure no single failure causes service interruption.
RAID	Redundant Array of Independent Disks. Combines multiple drives for performance, redundancy, or both. Key levels: RAID 0 (striping), RAID 1 (mirroring), RAID 5 (striping+parity), RAID 6, RAID 10.	RAID 5 allows a database server to continue operating and recover data after a single hard drive fails.
Definition RAID 0: Striping (performance, no redundancy). RAID 1: Mirroring (full redundancy). RAID 5: Striping with distributed parity (tolerates 1 drive failure). RAID 6: Tolerates 2 drive failures. RAID 10: Mirroring + striping (highest performance + redundancy). Contextual Example A file server uses RAID 6, which can survive simultaneous failure of two drives. This provides sufficient time to replace the failed drives before data integrity is at risk.
Backup Types	Full (all data), Incremental (changes since last backup), Differential (changes since last full backup). 3-2-1 rule: 3 copies, 2 media types, 1 off-site.	A company runs full backups weekly and incremental backups nightly, reducing backup windows while ensuring recoverability.
Definition Full: backs up all data (slowest to create, fastest to restore). Incremental: backs up changes since the last backup (fastest to create, slowest to restore). Differential: changes since last full (middle ground). The 3-2-1 rule is the backup gold standard. Contextual Example Following the 3-2-1 rule, an organization keeps 3 copies of critical data: the production system, a local NAS backup, and an off-site encrypted cloud backup — ensuring recovery from ransomware or physical disaster.
Disaster Recovery	Documented plans and procedures for restoring IT systems after a disaster. Key metrics: RTO (recovery time) and RPO (data loss tolerance).	A company's DR plan activates a warm standby site when the primary data center is destroyed, restoring operations within 4 hours.
Definition Plans, procedures, and resources enabling restoration of IT operations after a disaster. Site types: hot (fully operational, immediate failover), warm (partially configured, hours to recover), cold (empty facility, days to recover). Must be regularly tested. Contextual Example A financial firm maintains a hot standby DR site with real-time data replication. In a disaster, operations fail over automatically within minutes, meeting their 15-minute RTO requirement.
RTO	The maximum acceptable time to restore operations after a disruption. Defines how long a system can be offline before the impact is unacceptable.	The e-commerce platform has an RTO of 2 hours, meaning it must be restored within that timeframe to avoid major revenue loss.
Definition RTO defines the maximum tolerable downtime for a system. Drives disaster recovery infrastructure investment: a 15-minute RTO requires a hot standby; a 48-hour RTO may only need a cold site. Must be established through Business Impact Analysis. Contextual Example A hospital's patient monitoring system has an RTO of 30 minutes. This drives the requirement for an active-active HA cluster that automatically fails over without manual intervention.
RPO	The maximum acceptable amount of data loss measured in time. Defines how frequently backups must occur to meet business requirements.	An RPO of 15 minutes means the company can lose at most 15 minutes of transactions in a disaster scenario.
Definition RPO defines the maximum data loss an organization can tolerate, expressed as time since the last backup. A 1-hour RPO requires hourly backups (or continuous replication). Closely related to RTO in determining DR investment. Contextual Example A payment processor sets an RPO of 5 seconds, requiring synchronous real-time replication to a secondary site. No transaction can be lost, justifying the significant infrastructure investment.
Geographic Dispersal	Distributing systems across physically separate locations to protect against regional disasters, power outages, and natural events.	A cloud provider runs three geographically separated availability zones so a regional hurricane cannot cause total outage.
Definition Placing redundant systems in geographically separate locations protects against site-level disasters. Cloud availability zones and regions implement geographic dispersal. Must consider data sovereignty laws when dispersing across international borders. Contextual Example A streaming service replicates its content delivery infrastructure across data centers in three different cities. A regional power outage or natural disaster affects only one site while others continue serving users normally.

DOMAIN 04

Security Operations

28% of exam · sections 4.1 – 4.3

4.1 — Automation & Scripting

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Integrations and APIs	Utilizing APIs to automate interactions between different software applications, enabling seamless data exchange and task execution.	An automation script updates user information across multiple applications using API calls whenever there is a change to ensure consistency.
Definition Application Programming Interfaces (APIs) allow different software systems to communicate and share data automatically. Security automation leverages APIs to connect SIEM, ticketing systems, threat intelligence platforms, and endpoint tools into unified workflows. Contextual Example An automation script updates user information across multiple applications using API calls whenever there is a change to ensure consistency across systems.
Reaction Time	The speed at which organizations can respond to incidents or changes, significantly enhanced through automation and SOAR platforms.	Automated alerts notify the security team of potential threats in real time, enabling quicker responses to mitigate risks.
Definition The elapsed time between detection of a security event and execution of a response action. Automation dramatically reduces reaction time from hours (manual) to seconds (automated playbook execution), limiting attacker dwell time. Contextual Example Automated alerts notify the security team of potential threats in real time, enabling quicker responses to mitigate risks before significant damage occurs.
Resource Provisioning	The automated assignment of computing resources — storage, memory, processing power — based on predefined criteria.	A cloud service automatically allocates additional storage space for a department when their usage reaches a certain threshold.
Definition Automated allocation and configuration of computing resources. In security contexts, ensures newly provisioned resources automatically receive baseline security configurations, preventing configuration drift and human error. Contextual Example A cloud service automatically allocates additional storage space for a department when their usage reaches a certain threshold, ensuring no disruption in their operations.
Scaling Securely	The ability to grow infrastructure while automatically applying security measures to newly provisioned resources to maintain compliance.	As user demand increases, additional cloud resources are automatically provisioned with security policies pre-applied.
Definition Ensuring that security controls scale automatically alongside infrastructure growth. Security groups, IAM policies, and network rules must be applied at provisioning time to prevent newly added resources from creating security gaps. Contextual Example As user demand increases, additional resources are automatically provisioned in the cloud, and security policies are applied to these resources to maintain compliance.
Security Groups	Collections of users or devices sharing the same security policies, making it easier to manage permissions and access control at scale.	A security group for the finance team allows members to access financial applications while restricting access for other departments.
Definition Logical groupings used to apply consistent security policies to multiple resources or users simultaneously. In cloud environments, security groups act as virtual firewalls controlling inbound and outbound traffic to instances. Contextual Example A security group for the finance team allows members to access financial applications while restricting access to sensitive financial data for other departments.
Single Point of Failure	A potential risk where a single failure in an automated process could lead to complete system failure or loss of functionality.	If the automation tool that provisions user accounts fails, no new employees can be onboarded until the issue is resolved.
Definition Any component whose failure would cause the entire system or process to fail. Automation creates new single points of failure that must be identified and mitigated through redundancy, failover mechanisms, and manual fallback procedures. Contextual Example If the automation tool that provisions user accounts fails, no new employees can be onboarded until the issue is resolved, potentially disrupting operations.
Standard Infrastructure Configs	Maintaining uniformity in system setups to ensure security and operational effectiveness, facilitated by automated configuration management.	New servers are automatically configured with security settings defined in templates to ensure consistency.
Definition Pre-approved, security-hardened configuration templates applied consistently across all systems of the same type. Eliminates configuration drift and human error. Tools like Ansible, Chef, and Puppet enforce standard configurations at scale. Contextual Example New servers are automatically configured with security settings defined in templates to ensure consistency and reduce the risk of human error during setup.
Technical Debt	The future costs of shortcuts or compromises in automation that may require rework or additional effort later.	An organization that opts for quick automation solutions might face the need to revise those solutions later, incurring more costs.
Definition The accumulated cost of shortcuts taken during development or implementation. In security automation, technical debt manifests as brittle scripts, hardcoded credentials, undocumented exceptions, and lack of error handling that must eventually be remediated. Contextual Example An organization that opts for quick automation solutions might face the need to revise those solutions later, incurring more costs and effort than if they had implemented robust processes initially.
Ticket Creation	The automated process of generating support tickets for incidents or requests, ensuring efficient tracking and management of issues.	An automated system creates a support ticket whenever a user reports an issue via email, ensuring IT can promptly track the problem.
Definition Automation that generates ITSM tickets (ServiceNow, Jira) directly from monitoring alerts or user reports. Ensures every detected event is tracked, assigned, and followed through to resolution without manual intervention. Contextual Example An automated system creates a support ticket whenever a user reports an issue via email, ensuring that IT can promptly track and respond to the problem.
User Provisioning	Automated creation, management, and deactivation of user accounts and permissions to ensure timely and appropriate access to resources.	When a new employee is onboarded, their user account is automatically created and they receive access to essential applications.
Definition Automates the identity lifecycle: account creation, role assignment, access provisioning, and account deactivation. Integrates with HR systems to trigger automatically on hire, transfer, and termination events. Critical for preventing orphaned accounts. Contextual Example When a new employee is onboarded, their user account is automatically created, and they receive access to essential applications like email and project management tools.
Workforce Multiplier	The concept of increasing workforce effectiveness through automation, allowing fewer staff to achieve greater operational results.	A small IT team can manage a complex infrastructure effectively due to automation tools, maximizing productivity without additional hires.
Definition Automation acts as a force multiplier, enabling small security teams to operate at the scale and speed needed to defend modern environments. SOAR platforms are the primary workforce multiplier in security operations. Contextual Example A small IT team can manage a complex infrastructure effectively due to automation tools, maximizing productivity without needing additional hires.

4.2 — Incident Response Activities

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Preparation	The initial incident response phase focusing on planning, training, and establishing resources and protocols to handle potential incidents.	Conducting training sessions for the incident response team to familiarize them with their roles before an incident occurs.
Definition The first phase of the incident response lifecycle (PICERL). Includes developing IR plans, building the team, acquiring tools, running tabletop exercises, and establishing communication procedures. The quality of preparation determines response effectiveness. Contextual Example Conducting training sessions for the incident response team to familiarize them with their roles and responsibilities before an incident occurs.
Detection	Identifying and recognizing potential security incidents through monitoring and analysis of systems, networks, and data.	A SIEM system alerts the security team to unusual network activity indicating a possible breach.
Definition The process of identifying potential security incidents through automated monitoring (SIEM, EDR, NDR) and human analysis. Incidents can be detected via alerts, anomalies, user reports, or threat intelligence. Speed of detection limits attacker dwell time. Contextual Example Implementing a security information and event management (SIEM) system that alerts the security team to unusual network activity indicating a possible breach.
Containment	Actions taken to limit the impact of a security incident and prevent further damage or data loss.	During a malware outbreak, the IT team isolates affected systems from the network to stop the spread of infection.
Definition Short-term containment (immediate isolation of affected systems) and long-term containment (hardening remaining systems, deploying temporary fixes) limit the blast radius. Must balance stopping the attack with preserving forensic evidence. Contextual Example During a malware outbreak, the IT team isolates affected systems from the network to stop the spread of the infection.
Eradication	Removing the cause of a security incident from the environment — malware, attacker persistence mechanisms, and exploited vulnerabilities.	After confirming a breach, the security team identifies and removes the malicious software used by the attackers.
Definition Complete removal of all attacker footholds: malware, backdoors, compromised credentials, and exploited vulnerabilities. Must be thorough — missed persistence mechanisms allow attackers to regain access after recovery. Contextual Example After confirming a breach, the security team identifies and removes the malicious software used by the attackers to regain control of the systems.
Recovery	Restoring affected systems and data to normal operations following an incident, ensuring systems are clean and secure before returning to service.	After eradicating a threat, the organization restores data from backups and conducts testing before going live.
Definition Restoring systems to normal operation from known-good backups or rebuilt images. Includes verification that systems are clean, monitoring for signs of re-infection, and gradual reconnection to production networks. Contextual Example After eradicating a threat, the organization restores data from backups and conducts thorough testing to confirm systems are functioning correctly before going live.
Lessons Learned	Post-incident review identifying what worked well and what can be improved in the incident response process for future events.	After a security incident, the team holds a meeting to discuss the response's effectiveness and updates their incident response plan.
Definition A structured post-incident review (typically within 2 weeks) examining the timeline, response effectiveness, gaps, and improvements. Output feeds back into the Preparation phase, continuously improving the IR capability. Contextual Example After a security incident, the team holds a meeting to discuss the response's effectiveness and updates their incident response plan based on the findings.
Digital Forensics	Application of forensic techniques to collect, preserve, and analyze electronic data to support security incident investigations.	A digital forensics team retrieves and analyzes logs from compromised servers to understand the scope of a data breach.
Definition Scientifically sound collection and analysis of digital evidence. Must follow established procedures to maintain admissibility. Encompasses disk forensics (deleted files, artifacts), memory forensics, network forensics, and log analysis. Contextual Example A digital forensics team retrieves and analyzes logs from compromised servers to understand the scope of a data breach and collect evidence for potential legal proceedings.
Chain of Custody	The documented process of maintaining and handling evidence to ensure its integrity and admissibility in legal proceedings.	Documenting each time evidence is accessed or transferred ensures chain of custody remains intact for legal purposes.
Definition A documented, unbroken record of who collected evidence, when it was collected, where it has been, and who has accessed it. Essential for evidence admissibility in court. Any gap or break in chain of custody can invalidate evidence. Contextual Example Properly documenting each time evidence is accessed or transferred during an investigation ensures the chain of custody remains intact for legal purposes.
Acquisition	Collecting and securing data and evidence from systems while maintaining integrity and chain of custody. Bit-for-bit copies preserve original data.	Investigators create bit-by-bit copies of hard drives to preserve original data for analysis while ensuring evidence integrity.
Definition Creating forensically sound copies of evidence (disk images, memory dumps, network captures) without altering the original. Write blockers prevent accidental modification. Hash verification (SHA-256) confirms the copy is identical to the original. Contextual Example During a forensic investigation, investigators create bit-by-bit copies of hard drives to preserve original data for analysis while ensuring evidence integrity.
Legal Hold	Preserving relevant information and data for legal purposes, preventing alteration or deletion during an investigation or litigation.	An organization places a legal hold on all data related to a security breach to ensure evidence is preserved for potential legal action.
Definition A directive suspending normal data destruction policies for data potentially relevant to litigation or regulatory investigation. Organizations must implement legal holds immediately upon awareness of potential legal proceedings to avoid spoliation claims. Contextual Example An organization places a legal hold on all data related to a security breach to ensure that evidence is preserved for any potential legal actions.
Root Cause Analysis	Systematic process identifying the underlying causes of incidents to prevent future recurrence by addressing vulnerabilities.	After a data breach, the security team determines how attackers gained access and what security measures failed.
Definition A structured investigation technique (fishbone, 5-Whys) that identifies the fundamental causes of an incident, not just the symptoms. Distinguishes between proximate causes (what happened) and root causes (why it happened) to drive meaningful remediation. Contextual Example After a data breach, the security team conducts a root cause analysis to determine how the attackers gained access and what security measures failed.
Tabletop Exercise	A discussion-based exercise where team members review and discuss responses to simulated incident scenarios to identify process strengths and weaknesses.	Organizing a tabletop exercise involving senior management to discuss their roles during a data breach and evaluate communication plans.
Definition A facilitated discussion-based exercise where participants walk through an incident scenario verbally. Less resource-intensive than full simulations; ideal for testing decision-making processes, communication flows, and policy gaps across teams. Contextual Example Organizing a tabletop exercise involving senior management to discuss their roles during a data breach and evaluate the organization's communication plan.
Threat Hunting	Proactive search for indicators of compromise within an organization's network to identify threats before they cause damage.	Security analysts review network traffic patterns to detect suspicious activity that automated systems might miss.
Definition Hypothesis-driven, proactive security analysis searching for evidence of adversary activity that has evaded automated detection. Hunters formulate hypotheses based on threat intelligence, then test them by querying logs, EDR telemetry, and network data. Contextual Example Security analysts perform threat hunting by reviewing network traffic patterns to detect any suspicious activity that automated systems might miss.
Simulation	A practical exercise that mimics real-world incidents, allowing teams to practice responses in a controlled environment and evaluate effectiveness.	Running a simulated ransomware attack where teams must respond to a series of challenges to practice incident response skills.
Definition A hands-on exercise recreating real incident conditions. Can range from red team/blue team exercises to full-scale disaster recovery tests. More resource-intensive than tabletop exercises but provides more realistic preparation. Contextual Example Running a simulated ransomware attack where teams must respond to a series of challenges to practice their incident response skills.

4.3 — Data Sources for Investigation

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Application Logs	Records created by applications documenting events, transactions, and errors that occur during operation. Useful for troubleshooting and performance monitoring.	An application log shows a series of error messages when a user attempts to access a feature that is currently down for maintenance.
Definition Application-generated logs record user actions, transactions, errors, and security events within a specific application. Critical for investigating application-layer attacks like SQL injection, authentication bypass, and privilege escalation. Contextual Example An application log might show a series of error messages when a user attempts to access a feature that is currently down for maintenance.
Endpoint Logs	Logs from endpoint devices tracking user activity, system events, software installations, and security incidents. Crucial for endpoint security analysis.	An endpoint log includes details about software installations, user logins, and any detected malware activities on the device.
Definition Telemetry from desktops, laptops, and mobile devices including process execution, file system changes, registry modifications, network connections, and user activity. EDR platforms aggregate and analyze endpoint logs for threat detection. Contextual Example An endpoint log might include details about software installations, user logins, and any detected malware activities on the device.
Firewall Logs	Logs generated by firewalls tracking allowed and denied network traffic based on predefined rules. Help identify access attempts and policy violations.	A firewall log entry indicates an attempt to access a restricted port, prompting the security team to investigate further.
Definition Records every connection attempt evaluated by the firewall: source/destination IP, port, protocol, action (allow/deny), and timestamp. Essential for detecting port scans, lateral movement, data exfiltration attempts, and policy violations. Contextual Example A firewall log entry can indicate an attempt to access a restricted port, allowing the security team to investigate further.
IPS/IDS Logs	Logs from Intrusion Prevention/Detection Systems tracking suspicious activities and potential security incidents based on signatures and anomaly detection.	An IDS log captures an alert for a detected port scan, prompting security analysts to investigate the source of the scanning activity.
Definition Alert logs generated when traffic matches attack signatures or behavioral baselines. Include alert type, severity, source/destination, and signature match details. High-volume sources requiring tuning to reduce false positives. Contextual Example An IDS log might capture an alert for a detected port scan, prompting security analysts to investigate the source of the scanning activity.
Network Logs	Logs from networking devices (routers, switches) providing insights into traffic patterns, connection attempts, and network performance.	A network log shows the volume of data transmitted to and from specific IP addresses, helping identify unusual traffic spikes.
Definition Network device telemetry including flow data (NetFlow, sFlow), routing table changes, interface statistics, and DHCP/DNS logs. Used to reconstruct attack timelines, identify compromised hosts, and detect data exfiltration. Contextual Example A network log can show the volume of data transmitted to and from specific IP addresses, helping network administrators identify unusual traffic spikes.
OS Security Logs	Security logs generated by the operating system recording authentication attempts, system events, and configuration changes. Help identify breaches and unauthorized access.	Windows Security Event logs record user logins, failed access attempts, and changes made to system security settings.
Definition Windows Security Event Log, Linux syslog/auditd, and macOS Unified Log record authentication events, privilege use, object access, and policy changes. Critical for detecting pass-the-hash, privilege escalation, and account compromise. Contextual Example Windows Security Event logs record user logins, failed access attempts, and changes made to system security settings, assisting in monitoring user activity.
Metadata	Data providing information about other data — creation dates, file sizes, access permissions, author, GPS coordinates embedded in files.	Metadata associated with log files includes timestamps, authors, and file formats, which help organize and retrieve logs during analysis.
Definition Descriptive information about files, emails, and documents. Can reveal author information, location data, edit history, and timestamps. Investigators analyze metadata to establish timelines and attribute actions to specific users or systems. Contextual Example Metadata associated with log files can include timestamps, authors, and file formats, which help organize and retrieve logs during analysis.
Dashboards	Visual interfaces aggregating and displaying key security metrics from various sources for real-time monitoring and analysis.	A SOC dashboard displays real-time alerts, incident statistics, and system health metrics, allowing analysts to prioritize responses.
Definition Centralized visual displays aggregating data from SIEM, EDR, network monitoring, and threat intelligence platforms. Enable SOC analysts to quickly identify high-priority events and trends without manually reviewing individual log sources. Contextual Example A security operations center (SOC) dashboard displays real-time alerts, incident statistics, and system health metrics, allowing analysts to prioritize their response efforts.
Automated Reports	Predefined reports generated by security tools summarizing findings, trends, and metrics related to security events and compliance.	A weekly automated report from a SIEM includes statistics on detected incidents, response times, and trends over the past week.
Definition Scheduled security reports generated automatically by SIEM, vulnerability scanners, and compliance tools. Provide management visibility into security posture, trend analysis, and compliance status without manual effort. Contextual Example A weekly automated report from a SIEM system might include statistics on detected incidents, response times, and trends in security events over the past week.

DOMAIN 05

Security Program Management & Oversight

20% of exam · sections 5.1 – 5.6

5.1 — Effective Security Governance

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Acceptable Use Policy	A document outlining acceptable activities and restrictions for using an organization's systems and resources.	Employees must adhere to the AUP, which prohibits using company devices for unauthorized activities like personal file downloads.
Definition A policy defining permitted and prohibited uses of organizational IT resources. All employees typically acknowledge the AUP as part of onboarding. Violations can result in disciplinary action up to and including termination. Contextual Example Employees must adhere to the AUP, which prohibits using company devices for unauthorized activities like personal file downloads.
Data Owners	Individuals or entities responsible for data who make decisions about access, usage, and classification.	The department head acts as the data owner, defining who can access specific datasets within the company's CRM system.
Definition Senior individuals responsible for a data set. Define classification, access permissions, and retention requirements. Accountable for ensuring their data is appropriately protected but typically rely on data custodians for technical implementation. Contextual Example The department head acts as the data owner, defining who can access specific datasets within the company's CRM system.
Data Custodians	Individuals who maintain the integrity, security, and availability of data within an organization as directed by data owners.	IT administrators function as data custodians, ensuring that data is securely stored and regularly backed up.
Definition Technical administrators responsible for implementing and maintaining security controls protecting data as directed by data owners. Perform backups, encryption, access provisioning, and monitoring. Do not set policy — they implement it. Contextual Example IT administrators function as data custodians, ensuring that data is securely stored and regularly backed up.
Data Controllers	Entities that determine how personal data is processed and for what purpose. Accountable under GDPR and similar privacy laws.	As the data controller, the company decides how customer information is collected, processed, and used for marketing.
Definition Under GDPR, the data controller determines the purposes and means of processing personal data. Controllers bear primary accountability and must ensure processors provide sufficient guarantees of compliance. Contextual Example As the data controller, the company decides how customer information is collected, processed, and used for marketing.
Data Processors	Entities that process data on behalf of the data controller under their instructions.	A cloud service provider acts as a data processor, storing and managing customer data according to the controller's instructions.
Definition Process personal data strictly on behalf of and under instructions from the data controller. Must maintain records of processing activities and notify controllers of breaches. Enter into Data Processing Agreements (DPAs) with controllers. Contextual Example A cloud service provider acts as a data processor, storing and managing customer data according to the controller's instructions.
Governance Structures	The framework of authority and decision-making within an organization, which can be centralized or decentralized.	The company's governance structure includes a central board that makes key strategic decisions and committees that oversee specific operations.
Definition The organizational framework defining how security decisions are made, who has authority, and how accountability is assigned. Includes boards, committees, working groups, and executive roles like CISO, CIO, and DPO. Contextual Example The company's governance structure includes a central board that makes key strategic decisions and committees that oversee specific security operations.
Playbooks	Step-by-step guides detailing responses to specific incidents such as phishing, ransomware, or data breaches. Reduce decision fatigue during incidents.	The incident response team follows a playbook to manage phishing attacks, isolating compromised accounts and conducting forensic analysis.
Definition Documented, pre-approved response procedures for known incident types. Reduce response time and ensure consistent, compliant actions under pressure. SOAR platforms automate playbook execution. Must be regularly updated based on lessons learned. Contextual Example The incident response team follows a playbook to manage and resolve phishing attacks, isolating compromised accounts and conducting forensic analysis.
Onboarding/Offboarding	Processes for integrating new employees (provisioning access) and securely removing access when they leave the organization.	HR ensures new hires have proper access through onboarding, while IT handles offboarding by revoking all access when an employee exits.
Definition Onboarding provisions access aligned to role and AUP acknowledgment. Offboarding must be immediate and comprehensive: disable accounts, revoke certificates, recover devices, transfer data. Delayed offboarding is a common source of insider threat risk. Contextual Example HR ensures new hires have proper access through onboarding, while IT handles offboarding by revoking access when an employee exits.
Password Standards	Guidelines defining the complexity, length, and management requirements for passwords. Modern standards (NIST SP 800-63B) emphasize length over complexity.	The organization enforces password standards requiring a minimum of 12 characters with a mix of character types.
Definition Policies governing password creation and management. NIST 800-63B recommends: minimum 8 characters, check against breach databases, no periodic forced resets unless compromised, and support for password managers. Complexity rules are now considered less effective than length. Contextual Example The organization enforces password standards requiring a minimum of 12 characters, with a mix of letters, numbers, and special symbols.

5.2 — Risk Management Process

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Risk Assessment	Evaluation of identified risks based on their severity and likelihood of occurrence to prioritize mitigation efforts.	The company conducts an annual risk assessment to prioritize threats like data breaches and system downtime based on potential impact.
Definition A systematic process identifying assets, threats, vulnerabilities, and the likelihood and impact of potential incidents. Output is a prioritized risk register informing security investment decisions. Can be one-time, recurring, or continuous. Contextual Example The company conducts an annual risk assessment to prioritize threats like data breaches and system downtimes based on their potential impact.
Risk Appetite	The overall amount of risk an organization is willing to accept in pursuit of its objectives.	With a conservative risk appetite, the company avoids high-risk investments and focuses on protecting existing assets.
Definition A board-level declaration of how much risk the organization is willing to accept. Guides all risk management decisions. Expansionary appetite accepts more risk for growth; conservative appetite minimizes risk even at cost to agility. Contextual Example With a conservative risk appetite, the company avoids high-risk investments and focuses on protecting existing assets.
Risk Mitigation	Actions taken to reduce the likelihood or impact of a risk. Implements controls addressing the vulnerability or threat.	The company mitigates the risk of unauthorized access by implementing multifactor authentication across all systems.
Definition The primary risk management strategy: implementing controls to reduce risk to an acceptable level. Can target likelihood (preventive controls) or impact (corrective controls). Residual risk remains after mitigation. Contextual Example The company mitigates the risk of unauthorized access by implementing multifactor authentication across all systems.
Risk Transfer	Shifting the financial responsibility for managing a risk to another party, such as through cyber insurance.	The company purchases cyber insurance to transfer the financial risk of a potential data breach to the insurer.
Definition Contractually shifting financial risk to a third party. Cyber insurance is the primary mechanism. Also includes outsourcing security functions to MSSPs and including liability clauses in vendor contracts. Does not eliminate the risk. Contextual Example The company purchases cyber insurance to transfer the financial risk of a potential data breach.
Risk Avoidance	A strategy where the organization eliminates the risk entirely by not engaging in the risky activity.	The company avoids the risk of third-party cloud storage by opting to store sensitive data entirely in-house.
Definition Eliminating a risk by discontinuing or not starting the activity that creates it. The most extreme risk response. May have business costs — forgoing cloud services avoids cloud risk but loses competitive benefits. Contextual Example The company avoids the risk of using third-party cloud storage by opting to store sensitive data in-house.
Risk Acceptance	The decision to take no additional action to mitigate a risk and accept the potential consequences. Must be documented and approved.	The company accepts the risk of minor outages during system updates, deciding that the potential downtime is manageable.
Definition A formal decision to accept a risk because the cost of mitigation exceeds the cost of the risk itself, or the risk falls within risk tolerance. Must be explicitly documented and approved by appropriate management authority. Contextual Example The company accepts the risk of minor outages during system updates, deciding that the potential downtime is manageable.
Quantitative Risk Analysis	A numerical evaluation of risks using financial metrics. Key formulas: SLE × ARO = ALE. Enables cost-benefit analysis of security investments.	Using quantitative analysis, the team estimates the annual cost of a potential server failure at $100,000 in lost revenue.
Definition Assigns dollar values to risks using formulas: SLE (Single Loss Expectancy) = Asset Value × Exposure Factor; ALE (Annual Loss Expectancy) = SLE × ARO (Annualized Rate of Occurrence). Enables ROI calculations for security controls. Contextual Example Using quantitative risk analysis, the team estimates the cost of a potential server failure at $100,000 in lost revenue and recovery expenses.
Qualitative Risk Analysis	Assessing risks based on subjective judgment, expert opinions, and relative scales (high/medium/low) rather than financial metrics.	The company conducts qualitative analysis through interviews with stakeholders to assess how a data breach would affect customer trust.
Definition Categorizes risks using descriptive scales rather than precise financial values. Faster and simpler than quantitative analysis. Uses risk matrices plotting likelihood vs. impact. Suitable when precise data is unavailable or impractical to gather. Contextual Example The company conducts qualitative risk analysis through interviews with key stakeholders to assess how a data breach could affect customer trust.
Business Impact Analysis	Identifies the potential effects of disruptions on business operations. Establishes RTO and RPO requirements for critical systems.	The BIA shows that a 24-hour power outage could disrupt production and lead to significant financial losses.
Definition Analyzes how disruptions to specific business processes affect organizational objectives. Identifies critical functions, dependencies, maximum tolerable downtime, and data recovery requirements — the foundation for DR/BC planning. Contextual Example The BIA shows that a 24-hour power outage could disrupt production and lead to significant financial losses.
Risk Register	A documented record of identified risks, their severity, assigned owners, and how they will be managed. Living document updated continuously.	The company updates its risk register after each risk assessment, tracking new cybersecurity threats and mitigation strategies.
Definition A comprehensive log of all identified risks including: description, likelihood, impact, risk score, owner, mitigation status, and residual risk. The primary risk management artifact reviewed by boards and audit committees. Contextual Example The company updates its risk register after each risk assessment, tracking new cybersecurity threats and mitigation strategies.
SLE	The expected monetary loss for a single occurrence of a risk event. Formula: SLE = Asset Value × Exposure Factor.	The SLE for a stolen laptop is $2,000, based on the cost of the hardware and the value of the data that could be lost.
Definition SLE = Asset Value × Exposure Factor. Represents the financial impact of a single incident. The building block for ALE calculations. If an asset is worth $100,000 and EF is 30%, SLE = $30,000. Contextual Example The SLE for a stolen laptop is calculated to be $2,000, based on the cost of the hardware and lost data.
ALE	The expected annual monetary loss due to a specific risk. Formula: ALE = SLE × ARO. Used to justify security control investments.	The ALE for phishing attacks is $50,000, calculated based on the frequency and financial impact of incidents.
Definition ALE = SLE × ARO. The annualized expected loss from a specific risk. If a control costs less than the ALE reduction it provides, it's financially justified. Central metric in quantitative security ROI analysis. Contextual Example The ALE for phishing attacks is estimated at $50,000, calculated based on the number of incidents and their financial impact.
MTBF	The average time interval between failures of a system during operation. A measure of reliability and availability planning.	The MTBF for new servers is 12 months, suggesting they are expected to operate without failure for approximately one year between incidents.
Definition Average time a repairable system operates without failure. Used for hardware procurement decisions and maintenance scheduling. Higher MTBF indicates greater reliability. Complements MTTR in availability planning. Contextual Example The MTBF for the company's new servers is currently 12 months, suggesting that the servers are expected to operate without failure for approximately one year between incidents.
MTTR	The average time required to repair a failed system or component. Measures operational response efficiency.	The MTTR for critical servers is 4 hours, meaning the IT team is expected to restore them within that time.
Definition Average time from failure detection to service restoration. Drives staffing and tooling decisions. Lower MTTR requires better diagnostics, spare parts, trained staff, and runbooks. MTTR directly impacts availability calculations. Contextual Example The MTTR for the company's critical servers is 4 hours, meaning the IT team is expected to restore them within that time.

5.3 — Third-Party Risk Management

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Vendor Assessment	The process of evaluating the risk and security posture of a vendor or third party before entering a business relationship.	Before selecting a cloud storage provider, the company performs a thorough vendor assessment including penetration testing and audit reviews.
Definition A comprehensive evaluation of a vendor's security practices, financial stability, compliance certifications, and incident history. Typically involves questionnaires, review of SOC 2 reports, and contractual security requirements. Contextual Example Before selecting a cloud storage provider, the company performs a thorough vendor assessment, including penetration testing and a review of internal audit evidence.
Due Diligence	The thorough investigation conducted before entering a formal agreement to evaluate a vendor's financial health, legal history, and security measures.	As part of vendor selection, the company performs due diligence to evaluate the vendor's financial health and security measures.
Definition Reasonable investigation performed before entering a business relationship. Security due diligence examines vendor security controls, breach history, compliance posture, and data handling practices to identify unacceptable risks before contract execution. Contextual Example As part of the vendor selection, the company performs due diligence to evaluate the vendor's financial health, legal history, and security measures.
SLA	A contract specifying the expected level of service including performance metrics, availability guarantees, and remedies for failure to meet targets.	The SLA with the vendor outlines a 99.9% uptime guarantee, with penalties if this level is not maintained.
Definition A formal agreement defining measurable service standards. Security SLAs should include incident response time commitments, breach notification timelines, uptime guarantees, and audit rights. Non-compliance triggers financial penalties or termination. Contextual Example The SLA with the vendor outlines a 99.9% uptime guarantee, with penalties if this level of service is not maintained.
NDA	A legal contract that prohibits the sharing of confidential information disclosed during a business relationship or evaluation.	The company requires all vendors to sign an NDA to protect its proprietary information during the vendor evaluation process.
Definition A legally binding agreement protecting confidential information shared between parties. Defines what is confidential, how it can be used, and obligations if a breach occurs. Essential before sharing security architecture, source code, or business strategies with vendors. Contextual Example The company requires all vendors to sign an NDA to protect its proprietary information during the vendor evaluation process.
MOU	A non-binding agreement outlining the terms and conditions of an understanding between parties before committing to a formal agreement.	The company signs an MOU with a potential vendor to explore a partnership before committing to a formal agreement.
Definition Establishes a framework of cooperation and shared understanding between parties. Not legally binding like a contract, but sets expectations. Commonly used in government and inter-agency information sharing relationships. Contextual Example The company signs an MOU with a potential vendor to explore a partnership before committing to a formal agreement.
MSA	A long-term contract outlining general terms and conditions under which future work orders will be completed, eliminating renegotiation for each project.	The MSA allows the company to enter into multiple projects with the vendor without negotiating a new contract each time.
Definition A framework agreement establishing standard terms for an ongoing business relationship. Security provisions (data handling, breach notification, audit rights) established in the MSA apply to all subsequent work orders, reducing per-project negotiation time. Contextual Example The MSA allows the company to enter into multiple projects with the vendor without negotiating a new contract each time.
Right-to-Audit	A contract provision granting the organization the ability to audit the vendor's processes and systems to verify compliance with security standards.	The vendor agreement includes a right-to-audit clause, allowing the company to verify vendor compliance with security standards at any time.
Definition A contractual provision allowing the customer to inspect the vendor's security controls, processes, and compliance status. Can be exercised directly or through independent auditors. Essential for highly sensitive data processing relationships. Contextual Example The vendor agreement includes a right-to-audit clause, allowing the company to verify the vendor's compliance with security standards at any time.
Supply Chain Analysis	The process of identifying and assessing security risks throughout the vendor's supply chain, including sub-processors and component suppliers.	The company conducts a supply chain analysis to ensure all vendors producing hardware components adhere to strict security standards.
Definition Maps and assesses the extended network of suppliers, sub-contractors, and service providers that contribute to a product or service. Identifies concentration risks, geographic risks, and third-party dependencies that could propagate to the organization. Contextual Example The company conducts a supply chain analysis to ensure that all vendors involved in producing its hardware components adhere to strict security standards.
Vendor Monitoring	Continuously evaluating a vendor's performance and compliance after the contract is in place to ensure ongoing adherence to security standards.	After signing the contract, the company regularly monitors the vendor's security practices and service levels to ensure SLA compliance.
Definition Ongoing assessment of active vendor relationships. Includes reviewing annual SOC 2 reports, monitoring threat intelligence feeds for vendor breaches, conducting periodic security reviews, and tracking SLA performance metrics. Contextual Example After signing the contract, the company regularly monitors the vendor's security practices and service levels to ensure compliance with the SLA.

5.4 — Security Compliance

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Compliance Reporting	Documenting and submitting reports to demonstrate adherence to legal, regulatory, and internal requirements.	The company prepares both internal and external compliance reports to ensure it meets all regulatory standards and internal policies.
Definition Internal reports track compliance program health for management. External reports (SOC 2, PCI DSS assessments, HIPAA attestations) demonstrate compliance to customers, regulators, and auditors. Automation reduces manual effort in both report types. Contextual Example The company prepares both internal and external compliance reports to ensure it meets all regulatory standards and internal policies.
Non-Compliance Consequences	The penalties or adverse effects resulting from failing to comply with legal, regulatory, or contractual obligations.	Failing to meet data protection requirements can lead to significant fines and reputational damage.
Definition Consequences range from financial (fines up to 4% of global revenue under GDPR) to operational (loss of license, contract termination) to reputational (public disclosure of violations). Criminal liability may apply for negligent executives. Contextual Example Failing to meet compliance requirements for customer data protection can lead to significant fines and reputational damage.
Data Inventory & Retention	Cataloging what data exists and determining how long data should be kept based on regulatory or business requirements.	The company maintains a detailed data inventory and retention schedule to ensure compliance with legal requirements.
Definition Data inventory maps what sensitive data exists and where it lives. Retention schedules define how long each data type must be kept (legal minimum) and when it must be deleted (to limit exposure). Balances legal retention requirements against privacy minimization principles. Contextual Example The company maintains a detailed data inventory and retention schedule to ensure compliance with legal requirements.
Right to Be Forgotten	The right of individuals to request deletion of their personal data from an organization's records (GDPR Article 17).	Customers exercise their right to be forgotten, and the company deletes their personal data from its systems accordingly.
Definition Under GDPR Article 17 (Right to Erasure), individuals can request deletion of their personal data when it's no longer necessary, consent is withdrawn, or there's no legitimate interest. Organizations must propagate deletion requests to processors and third parties. Contextual Example Customers exercise their right to be forgotten, and the company deletes their personal data from its systems accordingly.
Global Privacy Laws	International laws governing data protection and privacy, requiring organizations to adhere to multiple jurisdictional requirements simultaneously.	The company adjusts its global operations to meet privacy requirements across the EU, US, and other regions.
Definition Major privacy frameworks: GDPR (EU — extraterritorial scope, up to 4% global revenue fines), CCPA (California), PIPEDA (Canada), LGPD (Brazil), PIPL (China). Organizations operating globally must comply with the strictest applicable law. Contextual Example The company adjusts its global operations to meet privacy requirements across the EU, U.S., and other regions.
Data Subject	An individual whose personal data is collected, stored, or processed by an organization. Has rights under privacy laws including access and deletion.	As a data subject, customers have the right to access and request deletion of their personal information.
Definition Under GDPR and similar laws, the natural person whose personal data is being processed. Data subjects have rights: access (view their data), rectification (correct errors), erasure (right to be forgotten), portability, and objection to processing. Contextual Example As a data subject, customers have the right to access and request the deletion of their personal information from the company's database.

5.5 — Audits & Assessments

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Penetration Testing	Authorized simulated attack on systems to identify vulnerabilities before malicious actors can exploit them. Types: black box, white box, gray box.	The IT team conducts a penetration test to find potential weak points in the organization's security defenses.
Definition Ethical hacking exercise simulating real attacks. Black box (no prior knowledge), white box (full knowledge), gray box (partial). Phases: reconnaissance, scanning, exploitation, post-exploitation, reporting. Must have written authorization (rules of engagement). Contextual Example The IT team conducts a penetration test to find potential weak points in the organization's security defenses before malicious actors can exploit those weak points.
Reconnaissance	Information gathering phase of penetration testing. Passive (observing public data) or active (directly interacting with the target).	The penetration testing team spends several days gathering details about the company's network before launching test attacks.
Definition The first phase of penetration testing. Passive recon uses OSINT (public records, social media, DNS, job postings) without alerting the target. Active recon (port scanning, service enumeration) interacts directly with systems and may trigger alerts. Contextual Example The penetration testing team spends several days in reconnaissance, gathering details about the company's network before launching their test attacks.
Third-Party Audit	An objective audit conducted by an outside firm to verify compliance, financial accuracy, or effectiveness of internal controls.	The company hires an independent third-party firm to audit its security protocols and provide an objective assessment.
Definition An audit conducted by an independent party with no conflict of interest. SOC 2 Type II, ISO 27001, and PCI DSS QSA assessments are common third-party audits. Provide customers and regulators with objective assurance of control effectiveness. Contextual Example To maintain transparency, the company hires an independent third-party firm to audit its financial records and security protocols.
Self-Assessments	Internal evaluations where an organization reviews its own processes, controls, and adherence to regulations or policies.	The IT department conducts self-assessments to identify potential security vulnerabilities before the external audit.
Definition Organizations evaluate their own security controls against a framework (NIST CSF, CIS Controls, ISO 27001). Lower cost than external audits but lacks independence. Used to identify gaps before formal assessments and to demonstrate due care. Contextual Example The IT department conducts self-assessments to identify potential security vulnerabilities before the external audit.
Attestation	Formally affirming or verifying that certain standards or requirements have been met, often through internal or external review and sign-off.	The company provides attestation of its compliance with industry standards through a formal audit conducted by an independent firm.
Definition A formal declaration, typically signed by an executive or auditor, asserting that controls are operating effectively. Internal attestation comes from management; external attestation from independent third parties. Both carry legal accountability. Contextual Example The company provides attestation of its compliance with industry standards through a formal audit conducted by an independent third-party firm.
Rules of Engagement	Guidelines outlining acceptable behavior and interactions during penetration tests or audits, including scope, timing, and restricted systems.	The company defines rules of engagement with its vendor before conducting a penetration test, specifying what systems can be assessed.
Definition The documented agreement governing scope, limitations, timing, and emergency procedures for penetration tests. Defines in-scope and out-of-scope systems, prohibited techniques (e.g., physical intrusion, social engineering), and escalation procedures if critical vulnerabilities are found. Contextual Example The company defines rules of engagement with its vendor before conducting a penetration test, specifying what systems can be assessed and the scope of the test.

5.6 — Security Awareness Practices

▶

TERM	DEFINITION	CONTEXTUAL EXAMPLE
Phishing Campaigns	Coordinated simulated phishing attacks used to test and train employees to recognize and report phishing attempts.	The security team sends simulated phishing emails quarterly to measure and improve employee click-through rates.
Definition Simulated phishing exercises measure employee susceptibility and provide immediate teachable moments. Metrics (click rate, credential submission rate, report rate) track improvement over time. Platforms like KnowBe4 and Proofpoint automate campaign management. Contextual Example A company faces a phishing campaign targeting multiple departments, where fake invoice requests are sent to over 500 employees.
Social Engineering	A tactic where attackers manipulate individuals into divulging confidential information or performing actions that compromise security.	An employee encounters social engineering when a caller pretends to be from IT support, attempting to extract login credentials.
Definition Psychological manipulation exploiting human tendencies: trust, authority, urgency, fear, reciprocity. Techniques: pretexting (fabricated scenario), baiting (tempting offer), quid pro quo (exchange), tailgating (physical access). The most effective attack vector against well-patched environments. Contextual Example An employee encounters social engineering when a caller pretends to be from IT support, attempting to extract login credentials.
Insider Threat Awareness	Training employees to recognize indicators of insider threat behavior — both malicious and unintentional — and to report concerns appropriately.	The security team monitors user activities to identify potential insider threats from employees with access to sensitive information.
Definition Awareness programs educating employees about insider threat indicators: downloading large data volumes, accessing systems outside normal hours, expressing workplace grievances. Combines technical detection (UEBA) with a reporting culture. Contextual Example The security team monitors user activities to identify potential insider threats, particularly from employees with access to sensitive information.
OPSEC	A risk management process that protects sensitive information by identifying and addressing vulnerabilities in day-to-day operations.	The company implements operational security measures, restricting access to sensitive data and training employees on information hygiene.
Definition A process for protecting information that could be aggregated by adversaries to reveal sensitive operational details. Involves identifying critical information, analyzing threats, identifying vulnerabilities, assessing risk, and applying countermeasures. Contextual Example The company implements operational security measures, restricting access to sensitive data to mitigate risks.
Password Management	Best practices and tools for creating, storing, and managing secure passwords to prevent unauthorized access.	Employees participate in password management training, learning to create strong passwords and use password managers effectively.
Definition Awareness training covering: creating strong unique passwords, using password managers (1Password, Bitwarden), recognizing credential-harvesting attacks, and understanding why password reuse is dangerous. Complements technical controls like MFA. Contextual Example Employees participate in password management training, learning how to create strong passwords and effectively use password managers.
Anomalous Behavior Recognition	Identifying actions that deviate from normal patterns — potentially indicating risky, unexpected, or malicious activities.	The security team detects anomalous behavior when an employee attempts to access sensitive files at unusual hours from an unknown location.
Definition Training users and deploying UEBA (User and Entity Behavior Analytics) to detect behavioral deviations. Unusual login times, abnormal data access volumes, and geographic impossibilities are key anomaly indicators. Contextual Example The security team detects anomalous behavior when an employee attempts to access sensitive files at unusual hours.
Situational Awareness	Being aware of one's environment and recognizing potential threats or vulnerabilities in real time, both physical and digital.	Employees improve their situational awareness during training, learning to spot social engineering tactics and suspicious behaviors.
Definition The ongoing ability to perceive and comprehend security-relevant elements of the environment. Includes recognizing tailgating attempts, suspicious USB drives, unexpected callers, and unusual network behavior. A foundational skill for all security-conscious employees. Contextual Example Employees improve their situational awareness during training, learning to spot social engineering tactics.
Removable Media Risks	Portable devices like USB drives and external hard drives must be securely managed to prevent data exfiltration and malware introduction.	Employees receive guidelines on the risks associated with using unsecured removable media and secure data transfer practices.
Definition Removable media creates bidirectional risk: malware introduced into the organization (USB drop attacks) and data exfiltrated out. Controls include DLP policies, device encryption, endpoint USB port disabling, and awareness training. Contextual Example Employees receive guidelines on the risks associated with using unsecured removable media and the need for secure data transfer practices.
Hybrid/Remote Work Security	Work environments where employees work both on-site and remotely, requiring additional security measures to manage associated risks.	The organization updates its security policies to address challenges specific to hybrid environments, focusing on securing home networks.
Definition Remote work expands the attack surface beyond organizational perimeter. Key risks: insecure home Wi-Fi, shoulder surfing, personal device use, VPN split tunneling. Controls: mandatory VPN, endpoint encryption, MFA, and remote work security training. Contextual Example The organization updates its security policies to address challenges specific to hybrid and remote work environments, focusing on securing home networks.

No terms matched your search criteria — try different keywords or clear the filter

SECURITY+REFERENCE DOSSIER

SECURITY+
REFERENCE DOSSIER