Security Terminologies

Comprehensive glossary of cybersecurity terms, definitions, real-world examples, and implementation guidance.

90
Security Terms
Comprehensive cybersecurity terminology
15
Critical Severity
High-impact security concepts
41
High Severity
Important security knowledge
42
Categories
Diverse security domains covered

Zero Trust

A security framework that requires verification from everyone trying to access resources in a network, regardless of their location.

Critical Framework Transformational
Technical Overview: Based on 'never trust, always verify' principle with identity as the primary security perimeter
Real-World Examples
  • Google BeyondCorp implementation
  • Microsoft Zero Trust architecture
  • Cisco Zero Trust platform
  • Okta identity-based access control
Prevention Methods
  • Implement identity verification for all users and devices
  • Use least privilege access principles
  • Deploy continuous monitoring and analytics
  • Segment networks with micro-segmentation
Detection Methods
  • Behavioral analytics and anomaly detection
  • Real-time access monitoring
  • Device compliance verification
  • Network traffic analysis
Mitigation Strategies
  • Multi-factor authentication
  • Device certificates
  • Conditional access policies
  • Risk-based authentication
Notable Real-World Cases
Google's BeyondCorp protecting against insider threats since 2010
Microsoft's corporate network transition post-2014 breach
NASA implementing Zero Trust after multiple security incidents
Common Targets
Corporate networks Cloud environments Remote workforce IoT devices
Related Terms
IAM RBAC Network Segmentation Conditional Access
Industry Standards & Frameworks
NIST SP 800-207 CISA Zero Trust Maturity Model Forrester Zero Trust eXtended

Phishing

A cyber attack that uses disguised email as a weapon to trick users into revealing sensitive information or installing malware.

High Attack High
Technical Overview: Often uses spoofed sender addresses, malicious attachments, or links to credential harvesting sites
Real-World Examples
  • Fake banking emails requesting login credentials
  • CEO fraud targeting finance departments
  • COVID-19 themed phishing campaigns
  • Microsoft Office 365 credential harvesting
Prevention Methods
  • User security awareness training
  • Email filtering and anti-phishing solutions
  • Domain-based Message Authentication (DMARC)
  • Regular phishing simulation exercises
Detection Methods
  • Email security gateways
  • URL reputation scanning
  • Behavioral analysis of email patterns
  • User reporting mechanisms
Mitigation Strategies
  • Email authentication protocols
  • Link protection
  • Sandboxing
  • User education
Notable Real-World Cases
Target data breach 2013 via phishing email to HVAC vendor
DNC email hack 2016 through spear-phishing campaign
Twitter Bitcoin scam 2020 via social engineering and phishing
Common Targets
Financial institutions Healthcare organizations Government agencies Small businesses
Related Terms
Spear Phishing Whaling Social Engineering Email Security
Industry Standards & Frameworks
NIST Cybersecurity Framework ISO 27001 CIS Controls

Multi-Factor Authentication (MFA)

A security method that requires users to provide two or more verification factors to gain access to a resource.

Critical Authentication High
Technical Overview: Three factors: something you know (password), have (token), or are (biometric)
Real-World Examples
  • SMS codes combined with passwords
  • Hardware tokens (YubiKey, RSA SecurID)
  • Biometric authentication (fingerprint, face recognition)
  • Push notifications to mobile apps
Prevention Methods
  • Implement across all critical systems
  • Use hardware tokens for high-privilege accounts
  • Deploy passwordless authentication where possible
  • Regular review of MFA methods and policies
Detection Methods
  • Failed authentication attempt monitoring
  • Anomalous login pattern detection
  • Device fingerprinting
  • Location-based access analysis
Mitigation Strategies
  • Hardware security keys
  • App-based TOTP
  • Biometric verification
  • Risk-based authentication
Notable Real-World Cases
Microsoft blocking 99.9% of account compromises with MFA
Twitter implementing mandatory 2FA for high-profile accounts after 2020 breach
Banks reducing fraud by 95% with SMS-based MFA
Common Targets
Online banking Cloud services VPN access Administrative accounts
Related Terms
2FA Authentication Identity Management Single Sign-On
Industry Standards & Frameworks
NIST SP 800-63B FIDO2 OATH TOTP/HOTP WebAuthn

Ransomware

Malicious software designed to block access to a computer system until money is paid.

Critical Malware Critical
Technical Overview: Uses asymmetric encryption to lock files, often spreads via email attachments or network vulnerabilities
Real-World Examples
  • WannaCry global outbreak 2017
  • NotPetya destructive ransomware 2017
  • Ryuk targeting healthcare and municipalities
  • REvil/Sodinokibi ransomware-as-a-service
Prevention Methods
  • Regular automated backups stored offline
  • Endpoint detection and response (EDR)
  • Network segmentation and access controls
  • User security awareness training
Detection Methods
  • File integrity monitoring
  • Behavioral analysis of file encryption patterns
  • Network traffic anomaly detection
  • Canary files and honeypots
Mitigation Strategies
  • Immutable backups
  • Network segmentation
  • Patch management
  • Email security
Notable Real-World Cases
Colonial Pipeline shutdown 2021 (DarkSide ransomware)
Costa Rica government systems compromised by Conti
JBS meat processing plants shut down globally by REvil
Common Targets
Healthcare systems Municipal governments Educational institutions Critical infrastructure
Related Terms
Malware Encryption Backup Recovery Incident Response
Industry Standards & Frameworks
NIST Ransomware Profile CISA Ransomware Guide ISO 27035

SQL Injection

A code injection technique used to attack data-driven applications by inserting malicious SQL statements.

High Vulnerability High
Technical Overview: Exploits poor input validation to manipulate SQL queries and access unauthorized data
Real-World Examples
  • Login bypass: ' OR '1'='1' --
  • Data extraction: UNION SELECT username, password FROM users
  • Blind SQL injection using time delays
  • Second-order SQL injection via stored data
Prevention Methods
  • Use parameterized queries and prepared statements
  • Input validation and sanitization
  • Least privilege database access
  • Web application firewalls (WAF)
Detection Methods
  • Database activity monitoring
  • Web application security scanning
  • Anomalous query pattern detection
  • Error message analysis
Mitigation Strategies
  • Parameterized queries
  • Input validation
  • Database firewall
  • Code review
Notable Real-World Cases
Equifax breach 2017 affecting 147 million people
Heartland Payment Systems breach 2008
Sony Pictures hack 2011 via SQL injection
Common Targets
E-commerce websites Content management systems Customer databases Financial applications
Related Terms
Code Injection Database Security Web Application Security Input Validation
Industry Standards & Frameworks
OWASP Top 10 CWE-89 ISO 27001 PCI DSS

DDoS Attack

Distributed Denial of Service attack that attempts to disrupt normal traffic by overwhelming the target with a flood of internet traffic.

High Attack High
Technical Overview: Uses multiple compromised devices to generate massive traffic volumes targeting victim services
Real-World Examples
  • Mirai botnet attacking DNS provider Dyn 2016
  • GitHub attacked with 1.35 Tbps DDoS in 2018
  • Volumetric attacks using amplification techniques
  • Application-layer attacks targeting web servers
Prevention Methods
  • DDoS protection services and CDNs
  • Rate limiting and traffic shaping
  • Anycast network architecture
  • Capacity planning and over-provisioning
Detection Methods
  • Traffic volume and pattern analysis
  • Network flow monitoring
  • Response time degradation alerts
  • Behavioral baseline comparison
Mitigation Strategies
  • CDN deployment
  • Traffic filtering
  • Rate limiting
  • Redundant infrastructure
Notable Real-World Cases
Estonia cyberattacks 2007 crippling government and banking
Cloudflare mitigating 2.3 Tbps DDoS attack in 2021
Amazon Web Services DDoS attack reaching 2.3 Tbps
Common Targets
Financial services Government websites Gaming platforms E-commerce sites
Related Terms
Botnet Network Security Load Balancing Traffic Analysis
Industry Standards & Frameworks
RFC 4732 NIST SP 800-61 ISO 27035

Encryption

The process of converting information or data into a code to prevent unauthorized access.

Critical Protection Foundational
Technical Overview: Uses mathematical algorithms to transform plaintext into ciphertext using encryption keys
Real-World Examples
  • AES-256 encryption for file protection
  • TLS 1.3 for web traffic encryption
  • End-to-end messaging encryption (Signal, WhatsApp)
  • Database encryption at rest and in transit
Prevention Methods
  • Implement strong encryption algorithms (AES-256, RSA-4096)
  • Proper key management and rotation
  • Certificate management and PKI
  • Regular cryptographic assessments
Detection Methods
  • Encryption compliance monitoring
  • Weak cipher detection
  • Certificate expiration tracking
  • Key usage auditing
Mitigation Strategies
  • Strong algorithms
  • Key rotation
  • Hardware security modules
  • Certificate pinning
Notable Real-World Cases
Apple vs FBI iPhone encryption case 2016
WhatsApp implementing end-to-end encryption for 2 billion users
GDPR driving widespread adoption of encryption in EU
Common Targets
Personal data Financial transactions Communications Storage systems
Related Terms
Cryptography PKI Digital Certificates Key Management
Industry Standards & Frameworks
FIPS 140-2 Common Criteria NIST SP 800-57 RFC standards

Social Engineering

The use of deception to manipulate individuals into divulging confidential information or performing actions that compromise security.

High Attack High
Technical Overview: Exploits human psychology rather than technical vulnerabilities to gain unauthorized access
Real-World Examples
  • Pretexting as IT support to obtain passwords
  • Baiting with infected USB drives
  • Tailgating to gain physical access
  • Quid pro quo offering fake services
Prevention Methods
  • Security awareness training programs
  • Verification procedures for sensitive requests
  • Physical security controls
  • Regular security culture assessments
Detection Methods
  • Unusual access pattern monitoring
  • Verification call-back procedures
  • Security incident reporting systems
  • Behavioral anomaly detection
Mitigation Strategies
  • Training programs
  • Verification procedures
  • Access controls
  • Incident response
Notable Real-World Cases
Kevin Mitnick's social engineering exploits in the 1990s
Twitter Bitcoin scam 2020 via employee manipulation
Target breach 2013 starting with HVAC vendor credentials
Common Targets
Help desk personnel Receptionists Finance departments System administrators
Related Terms
Phishing Human Factor Security Awareness Psychological Manipulation
Industry Standards & Frameworks
NIST SP 800-50 ISO 27001 SANS Security Awareness

Firewall

A network security device that monitors and filters incoming and outgoing network traffic based on predetermined security rules.

Critical Protection Foundational
Technical Overview: Operates at multiple OSI layers, from packet filtering to application-layer inspection
Real-World Examples
  • pfSense open-source firewall
  • Cisco ASA enterprise firewalls
  • Cloud-based firewalls (AWS Security Groups)
  • Next-generation firewalls with DPI
Prevention Methods
  • Regular rule review and optimization
  • Default-deny policies
  • Network segmentation implementation
  • Firewall management best practices
Detection Methods
  • Firewall log analysis
  • Rule compliance monitoring
  • Traffic pattern analysis
  • Configuration change tracking
Mitigation Strategies
  • Defense in depth
  • Regular updates
  • Configuration management
  • Monitoring
Notable Real-World Cases
SolarWinds attack bypassing traditional firewalls through trusted software
Firewall misconfiguration leading to Capital One breach 2019
Great Firewall of China demonstrating large-scale traffic filtering
Common Targets
Network perimeters Internal segments Cloud environments Remote access points
Related Terms
Network Security Access Control Traffic Filtering Intrusion Prevention
Industry Standards & Frameworks
NIST SP 800-41 Common Criteria ICSA Labs certification

VPN (Virtual Private Network)

Virtual Private Network that creates a secure connection between devices over the internet.

Medium Protection Medium
Technical Overview: Creates encrypted tunnels over public networks using protocols like IPSec, SSL/TLS, or WireGuard
Real-World Examples
  • Site-to-site VPN connecting branch offices
  • Remote access VPN for telecommuters
  • Mobile VPN for field workers
  • Consumer VPN services (NordVPN, ExpressVPN)
Prevention Methods
  • Strong encryption protocols (IKEv2, OpenVPN)
  • Multi-factor authentication for VPN access
  • Regular security updates and patches
  • Network access control integration
Detection Methods
  • VPN connection monitoring
  • Traffic analysis and logging
  • Failed authentication tracking
  • Endpoint compliance verification
Mitigation Strategies
  • Split tunneling controls
  • Kill switches
  • DNS leak protection
  • Regular audits
Notable Real-World Cases
COVID-19 pandemic driving massive VPN adoption for remote work
Pulse Secure VPN vulnerabilities exploited by nation-state actors
Corporate VPN breaches leading to network compromises
Common Targets
Remote workers Branch offices Mobile devices Cloud connections
Related Terms
Tunneling Remote Access Network Security Encryption
Industry Standards & Frameworks
RFC 4301 (IPSec) RFC 5246 (TLS) FIPS 140-2

APT (Advanced Persistent Threat)

A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period.

Critical Attack Critical
Technical Overview: Characterized by stealth, persistence, and sophisticated techniques to avoid detection
Real-World Examples
  • APT1 (Comment Crew) targeting intellectual property
  • Lazarus Group responsible for Sony Pictures hack
  • Cozy Bear (APT29) in SolarWinds supply chain attack
  • Equation Group developing advanced malware tools
Prevention Methods
  • Advanced threat detection and response
  • Network segmentation and zero trust
  • Threat intelligence integration
  • Regular security assessments and red teaming
Detection Methods
  • Behavioral analytics and machine learning
  • Threat hunting and forensic analysis
  • Indicators of compromise (IoC) monitoring
  • Lateral movement detection
Mitigation Strategies
  • Threat hunting
  • Deception technology
  • Microsegmentation
  • Incident response
Notable Real-World Cases
Operation Aurora attacking Google and other companies 2009
APT1 stealing terabytes of data from 141 companies
SolarWinds Orion compromise affecting 18,000+ organizations
Common Targets
Government agencies Critical infrastructure Large corporations Research institutions
Related Terms
Nation-State Actors Cyber Espionage Lateral Movement Zero-Day Exploits
Industry Standards & Frameworks
MITRE ATT&CK Framework NIST Cybersecurity Framework ISO 27035

Vulnerability Assessment

The process of identifying, quantifying, and prioritizing vulnerabilities in a system or network.

High Assessment High
Technical Overview: Uses automated tools and manual techniques to identify security weaknesses
Real-World Examples
  • Automated scanning with Nessus or OpenVAS
  • Web application testing with OWASP ZAP
  • Infrastructure penetration testing
  • Code review and static analysis
Prevention Methods
  • Regular automated vulnerability scanning
  • Continuous security monitoring
  • Patch management programs
  • Security-focused development practices
Detection Methods
  • Vulnerability scanners and tools
  • Configuration compliance checks
  • Code analysis and review
  • Penetration testing exercises
Mitigation Strategies
  • Regular scanning
  • Risk-based prioritization
  • Automated patching
  • Remediation tracking
Notable Real-World Cases
Equifax breach could have been prevented with timely vulnerability patching
WannaCry exploiting unpatched Windows SMB vulnerabilities
BlueKeep vulnerability threatening Windows RDP systems
Common Targets
Network infrastructure Web applications Operating systems Database systems
Related Terms
Penetration Testing Risk Assessment Patch Management Security Testing
Industry Standards & Frameworks
OWASP Testing Guide NIST SP 800-115 CVSS scoring system

SIEM (Security Information and Event Management)

Technology that provides real-time analysis of security alerts generated by applications and network hardware.

High Monitoring High
Technical Overview: Aggregates and analyzes log data from multiple sources to identify security incidents
Real-World Examples
  • Splunk Enterprise Security platform
  • IBM QRadar security intelligence
  • Microsoft Azure Sentinel cloud SIEM
  • LogRhythm threat lifecycle management
Prevention Methods
  • Comprehensive log collection and correlation
  • Real-time alerting and response
  • Threat intelligence integration
  • User and entity behavior analytics (UEBA)
Detection Methods
  • Rule-based correlation engines
  • Machine learning anomaly detection
  • Threat intelligence feeds
  • Behavioral baseline analysis
Mitigation Strategies
  • Proper tuning
  • Regular rule updates
  • Staff training
  • Integration with other tools
Notable Real-World Cases
Target breach detection delays highlighted SIEM limitations
JP Morgan Chase using SIEM to detect insider threats
Government agencies leveraging SIEM for threat hunting
Common Targets
Enterprise networks Cloud environments Critical infrastructure Financial services
Related Terms
SOC Log Management Incident Response Threat Detection
Industry Standards & Frameworks
NIST SP 800-92 ISO 27035 SANS SIEM guidelines

Penetration Testing

Authorized simulated cyberattack on a computer system to evaluate the security of the system.

Medium Assessment Medium
Technical Overview: Simulates real-world attacks using same tools and techniques as malicious hackers
Real-World Examples
  • Network penetration testing
  • Web application security testing
  • Social engineering assessments
  • Red team exercises
Prevention Methods
  • Regular penetration testing schedules
  • Scope definition and rules of engagement
  • Professional ethical hacker certification
  • Comprehensive reporting and remediation
Detection Methods
  • Vulnerability discovery techniques
  • Exploitation frameworks (Metasploit)
  • Social engineering testing
  • Physical security assessments
Mitigation Strategies
  • Regular testing
  • Remediation tracking
  • Retesting
  • Staff awareness
Notable Real-World Cases
Pentagon's Hack the Pentagon bug bounty program
Tesla's vehicle security testing program
Banking industry regular penetration testing requirements
Common Targets
Web applications Network infrastructure Wireless networks Mobile applications
Related Terms
Ethical Hacking Red Team Security Assessment Vulnerability Testing
Industry Standards & Frameworks
OWASP Testing Guide NIST SP 800-115 PTES (Penetration Testing Execution Standard)

Malware

Any software intentionally designed to cause damage to a computer, server, client, or computer network.

High Threat High
Technical Overview: Includes various types like viruses, worms, trojans, ransomware, and spyware
Real-World Examples
  • Trojan horses disguised as legitimate software
  • Computer worms spreading through networks
  • Spyware collecting user information
  • Adware displaying unwanted advertisements
Prevention Methods
  • Antivirus and anti-malware solutions
  • Email filtering and sandboxing
  • Application whitelisting
  • User education and awareness
Detection Methods
  • Signature-based detection
  • Heuristic and behavioral analysis
  • Machine learning algorithms
  • Network traffic monitoring
Mitigation Strategies
  • Endpoint protection
  • Network segmentation
  • Patch management
  • Backup systems
Notable Real-World Cases
Stuxnet targeting Iranian nuclear facilities
WannaCry ransomware global outbreak
Conficker worm infecting millions of computers
Common Targets
Desktop computers Mobile devices Servers IoT devices
Related Terms
Virus Trojan Rootkit Endpoint Protection
Industry Standards & Frameworks
NIST Cybersecurity Framework ISO 27001 Common Criteria

Identity and Access Management (IAM)

Framework for ensuring that the right users have the appropriate access to technology resources.

Critical Framework Critical
Technical Overview: Manages digital identities and controls access to resources through authentication and authorization
Real-World Examples
  • Active Directory domain services
  • Azure AD cloud identity platform
  • Okta identity-as-a-service
  • Single sign-on (SSO) solutions
Prevention Methods
  • Principle of least privilege
  • Regular access reviews and certifications
  • Role-based access control (RBAC)
  • Privileged access management (PAM)
Detection Methods
  • Access pattern analytics
  • Privileged account monitoring
  • Identity governance tools
  • Authentication log analysis
Mitigation Strategies
  • Multi-factor authentication
  • Privileged access controls
  • Regular audits
  • Automated provisioning
Notable Real-World Cases
Capital One breach 2019 due to misconfigured IAM policies
SolarWinds attack exploiting privileged access
Microsoft Azure AD protecting billions of identities
Common Targets
Enterprise applications Cloud services Database systems Network resources
Related Terms
SSO RBAC PAM Directory Services
Industry Standards & Frameworks
NIST SP 800-63 SAML 2.0 OAuth 2.0 OpenID Connect

Incident Response

Organized approach to addressing and managing the aftermath of a security breach or cyberattack.

Critical Process Critical
Technical Overview: Follows structured phases: preparation, identification, containment, eradication, recovery, lessons learned
Real-World Examples
  • Security Operations Center (SOC) response
  • Computer Security Incident Response Team (CSIRT)
  • Forensic investigation procedures
  • Business continuity activation
Prevention Methods
  • Incident response plan development
  • Regular tabletop exercises
  • Team training and certification
  • Technology stack preparation
Detection Methods
  • Security monitoring and alerting
  • Threat hunting activities
  • User and system reporting
  • Third-party threat intelligence
Mitigation Strategies
  • Preparation planning
  • Regular drills
  • Communication protocols
  • Legal compliance
Notable Real-World Cases
Maersk NotPetya incident response and recovery
Equifax breach response and congressional hearings
Target's incident response improvements post-2013 breach
Common Targets
All organizational assets Critical business processes Customer data Intellectual property
Related Terms
CSIRT Digital Forensics Business Continuity Crisis Management
Industry Standards & Frameworks
NIST SP 800-61 ISO 27035 SANS Incident Response

Data Loss Prevention (DLP)

Set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users.

High Protection High
Technical Overview: Uses content analysis, context analysis, and statistical analysis to identify sensitive data
Real-World Examples
  • Email DLP preventing sensitive data transmission
  • Endpoint DLP monitoring file transfers
  • Network DLP scanning traffic for data leaks
  • Cloud DLP protecting cloud-stored data
Prevention Methods
  • Data classification and labeling
  • Content inspection and analysis
  • User activity monitoring
  • Encryption and rights management
Detection Methods
  • Pattern matching and fingerprinting
  • Machine learning classification
  • Behavioral analytics
  • Policy violation alerting
Mitigation Strategies
  • Data discovery
  • Policy enforcement
  • User training
  • Encryption
Notable Real-World Cases
Edward Snowden NSA data exfiltration highlighting DLP gaps
Healthcare organizations using DLP for HIPAA compliance
Financial services implementing DLP for PCI DSS
Common Targets
Customer data Intellectual property Financial records Personal information
Related Terms
Data Classification Information Rights Management Data Governance Privacy Protection
Industry Standards & Frameworks
ISO 27001 GDPR HIPAA PCI DSS

Blockchain Security

Security measures and protocols designed to protect blockchain networks and cryptocurrency transactions.

High Technology High
Technical Overview: Relies on cryptographic hashing, digital signatures, and distributed consensus for security
Real-World Examples
  • Bitcoin's proof-of-work consensus mechanism
  • Ethereum smart contract security audits
  • Multi-signature wallets for cryptocurrency
  • Permissioned blockchain networks
Prevention Methods
  • Smart contract security audits
  • Consensus mechanism design
  • Private key management
  • Multi-signature implementations
Detection Methods
  • Blockchain analysis and monitoring
  • Transaction pattern analysis
  • Smart contract vulnerability scanning
  • Wallet security assessments
Mitigation Strategies
  • Code audits
  • Formal verification
  • Bug bounties
  • Gradual deployment
Notable Real-World Cases
DAO hack 2016 leading to Ethereum hard fork
Mt. Gox exchange collapse and bitcoin theft
Poly Network $611 million DeFi hack 2021
Common Targets
Cryptocurrency exchanges DeFi protocols NFT marketplaces Supply chain systems
Related Terms
Cryptocurrency Smart Contracts Distributed Ledger Consensus Mechanisms
Industry Standards & Frameworks
NIST Blockchain Technology Overview ISO/TC 307 Blockchain

Cloud Security

Set of policies, controls, procedures and technologies that work together to protect cloud-based systems, data and infrastructure.

Critical Framework Critical
Technical Overview: Addresses unique challenges of cloud environments including shared responsibility and dynamic infrastructure
Real-World Examples
  • AWS Security Groups and NACLs
  • Azure Security Center and Sentinel
  • Google Cloud Security Command Center
  • Cloud Access Security Broker (CASB)
Prevention Methods
  • Shared responsibility model understanding
  • Cloud security posture management (CSPM)
  • Identity and access management
  • Data encryption in transit and at rest
Detection Methods
  • Cloud security monitoring tools
  • Configuration compliance scanning
  • Cloud audit logging
  • Threat detection services
Mitigation Strategies
  • Configuration management
  • Access controls
  • Monitoring
  • Compliance automation
Notable Real-World Cases
Capital One breach 2019 via misconfigured AWS resources
Accenture data exposure through unsecured AWS S3 bucket
Toyota data leak through misconfigured cloud database
Common Targets
Cloud workloads API endpoints Storage buckets Container environments
Related Terms
CASB CSPM Shared Responsibility Multi-tenancy
Industry Standards & Frameworks
CSA Cloud Controls Matrix NIST SP 800-144 ISO 27017/27018

Endpoint Detection and Response (EDR)

Cybersecurity solution that continuously monitors and collects activity data from endpoints to identify and respond to cyber threats.

High Protection High
Technical Overview: Provides visibility into endpoint activities and enables rapid threat detection and response
Real-World Examples
  • CrowdStrike Falcon endpoint protection
  • Microsoft Defender for Endpoint
  • Carbon Black (VMware) EDR solution
  • SentinelOne autonomous endpoint protection
Prevention Methods
  • Continuous endpoint monitoring
  • Behavioral analytics and machine learning
  • Threat hunting capabilities
  • Automated response and remediation
Detection Methods
  • File and process behavior monitoring
  • Network connection analysis
  • Memory and registry inspection
  • Threat intelligence correlation
Mitigation Strategies
  • Real-time monitoring
  • Automated response
  • Threat hunting
  • Forensic analysis
Notable Real-World Cases
SolarWinds attack detection through endpoint telemetry
Ransomware response using EDR behavioral analysis
Advanced persistent threat hunting with EDR data
Common Targets
Workstations Servers Mobile devices IoT endpoints
Related Terms
XDR Endpoint Protection Threat Hunting Behavioral Analysis
Industry Standards & Frameworks
MITRE ATT&CK Framework NIST Cybersecurity Framework

Bug Bounty

Reward offered by organizations for finding and reporting software bugs, especially security vulnerabilities.

Medium Process Medium
Technical Overview: Leverages external security researchers to identify vulnerabilities before malicious actors
Real-World Examples
  • HackerOne crowdsourced security platform
  • Google Vulnerability Reward Program
  • Microsoft Security Response Center
  • Tesla vehicle security bug bounty
Prevention Methods
  • Clear vulnerability disclosure policies
  • Defined scope and rules of engagement
  • Fair reward structures
  • Legal safe harbor provisions
Detection Methods
  • Crowdsourced security testing
  • Responsible disclosure processes
  • Vulnerability validation procedures
  • Coordinated disclosure timelines
Mitigation Strategies
  • Vulnerability rewards
  • Public recognition
  • Fast response times
  • Clear communication
Notable Real-World Cases
Facebook paying $2.6 million in bug bounties in 2020
Apple's maximum $1 million payout for iOS vulnerabilities
Pentagon's Hack the Pentagon program finding 138 vulnerabilities
Common Targets
Web applications Mobile apps APIs Cloud services
Related Terms
Responsible Disclosure Vulnerability Management Crowdsourced Security White Hat Hacking
Industry Standards & Frameworks
ISO 29147 CVE Program FIRST Guidelines

Security Orchestration, Automation and Response (SOAR)

Technologies that enable organizations to collect inputs monitored by the security operations team and respond to low-level security events without human assistance.

High Automation High
Technical Overview: Combines security orchestration, automation, and response capabilities in unified platforms
Real-World Examples
  • Phantom (Splunk) security automation platform
  • IBM Resilient incident response platform
  • Demisto (Palo Alto) security orchestration
  • Microsoft Azure Logic Apps for security
Prevention Methods
  • Playbook development and automation
  • Integration with security tools
  • Workflow orchestration
  • Standardized response procedures
Detection Methods
  • Automated threat detection workflows
  • Cross-platform data correlation
  • Machine learning-driven analysis
  • Real-time response automation
Mitigation Strategies
  • Process automation
  • Response standardization
  • Tool integration
  • Efficiency improvement
Notable Real-World Cases
Financial institutions automating fraud detection response
Healthcare organizations orchestrating HIPAA compliance
Government agencies automating threat intelligence sharing
Common Targets
SOC operations Incident response teams Threat hunting Compliance reporting
Related Terms
Security Automation Incident Response Workflow Orchestration Playbooks
Industry Standards & Frameworks
NIST Cybersecurity Framework MITRE ATT&CK OASIS STIX/TAXII

DevSecOps

Philosophy that integrates security practices within the DevOps process by embedding security throughout the software development lifecycle.

High Methodology High
Technical Overview: Integrates security tools and practices into automated development and deployment pipelines
Real-World Examples
  • Automated security testing in CI/CD pipelines
  • Container security scanning with Docker
  • Infrastructure as Code security validation
  • Security-focused code review processes
Prevention Methods
  • Shift-left security testing
  • Automated security tools integration
  • Security training for developers
  • Continuous security monitoring
Detection Methods
  • Static Application Security Testing (SAST)
  • Dynamic Application Security Testing (DAST)
  • Container vulnerability scanning
  • Infrastructure security validation
Mitigation Strategies
  • Automated testing
  • Security gates
  • Developer training
  • Tool integration
Notable Real-World Cases
Netflix implementing security automation in microservices
Capital One's cloud-native DevSecOps transformation
Government agencies adopting DevSecOps for faster deployment
Common Targets
Development pipelines Container environments Cloud infrastructure Application code
Related Terms
CI/CD Security Shift-Left Security Container Security Application Security
Industry Standards & Frameworks
NIST Secure Software Development Framework OWASP DevSecOps Guideline

Cyber Threat Intelligence (CTI)

Information about threats and threat actors that helps mitigate harmful events in cyberspace.

High Intelligence High
Technical Overview: Provides actionable information about current and emerging security threats
Real-World Examples
  • Indicators of Compromise (IoCs) sharing
  • Threat actor profiling and attribution
  • Attack pattern and technique analysis
  • Industry-specific threat bulletins
Prevention Methods
  • Threat intelligence platform implementation
  • Information sharing partnerships
  • Automated threat feed integration
  • Proactive threat hunting programs
Detection Methods
  • STIX/TAXII threat intelligence formats
  • Threat intelligence feeds and APIs
  • Dark web monitoring
  • Open source intelligence (OSINT)
Mitigation Strategies
  • Intelligence sharing
  • Proactive defense
  • Attribution analysis
  • Trend monitoring
Notable Real-World Cases
FireEye's APT1 report exposing Chinese cyber espionage
COVID-19 themed cyber threats intelligence sharing
SolarWinds attack attribution and IoC distribution
Common Targets
Critical infrastructure Financial services Government agencies Healthcare
Related Terms
IoCs TTPs STIX/TAXII Threat Hunting
Industry Standards & Frameworks
STIX 2.1 TAXII 2.1 MITRE ATT&CK Traffic Light Protocol

Insider Threat

Security threat to an organization that comes from people within the organization who have authorized access to systems and data.

High Risk High
Technical Overview: Requires monitoring of authorized users' activities for malicious or negligent behavior
Real-World Examples
  • Malicious insiders stealing intellectual property
  • Negligent employees causing data breaches
  • Compromised insider accounts used by attackers
  • Third-party contractor access abuse
Prevention Methods
  • User and Entity Behavior Analytics (UEBA)
  • Privileged access management
  • Data loss prevention controls
  • Regular access reviews and monitoring
Detection Methods
  • Behavioral baseline analysis
  • Unusual access pattern detection
  • Data exfiltration monitoring
  • Privilege escalation alerts
Mitigation Strategies
  • Access controls
  • Monitoring systems
  • Training programs
  • Background checks
Notable Real-World Cases
Edward Snowden NSA document leak 2013
Tesla employee sabotage and data theft 2018
Morgan Stanley financial advisor data theft
Common Targets
Intellectual property Customer data Financial information Trade secrets
Related Terms
UEBA Privileged Access Data Exfiltration Behavioral Analytics
Industry Standards & Frameworks
NIST SP 800-53 CISA Insider Threat Mitigation

Zero-Day Exploit

Cyberattack that occurs on the same day a weakness is discovered in software before a security patch is available.

Critical Exploit Critical
Technical Overview: Exploits unknown vulnerabilities giving attackers advantage before patches are available
Real-World Examples
  • Stuxnet using multiple Windows zero-days
  • WannaCry exploiting EternalBlue SMB vulnerability
  • Chrome browser zero-day exploits
  • iOS zero-days used by NSO Group Pegasus
Prevention Methods
  • Defense-in-depth security strategies
  • Application sandboxing and isolation
  • Behavior-based detection systems
  • Regular security updates and patching
Detection Methods
  • Anomaly-based intrusion detection
  • Behavioral analysis and heuristics
  • Threat intelligence monitoring
  • Honeypot and deception technology
Mitigation Strategies
  • Virtual patching
  • Application isolation
  • Behavioral monitoring
  • Threat hunting
Notable Real-World Cases
Operation Aurora using Internet Explorer zero-day 2009
SolarWinds Orion platform zero-day exploitation
Microsoft Exchange Server zero-day attacks 2021
Common Targets
Operating systems Web browsers Office applications Network devices
Related Terms
Vulnerability Exploit Kit Advanced Threats Patch Management
Industry Standards & Frameworks
CVE Program MITRE ATT&CK NIST Vulnerability Management

Digital Forensics

Branch of forensic science encompassing the recovery and investigation of material found in digital devices related to cybercrime.

Medium Investigation Medium
Technical Overview: Uses specialized tools and techniques to collect, preserve, and analyze digital evidence
Real-World Examples
  • Hard drive imaging and analysis
  • Network packet capture examination
  • Mobile device forensic extraction
  • Cloud forensics and data recovery
Prevention Methods
  • Forensic readiness planning
  • Evidence preservation procedures
  • Chain of custody protocols
  • Legal compliance frameworks
Detection Methods
  • File system analysis tools
  • Network traffic examination
  • Timeline and correlation analysis
  • Deleted data recovery techniques
Mitigation Strategies
  • Proper procedures
  • Tool validation
  • Expert testimony
  • Documentation
Notable Real-World Cases
Enron email investigation and analysis
Hillary Clinton email server investigation
Sony Pictures hack forensic investigation
Common Targets
Computer systems Mobile devices Network logs Cloud storage
Related Terms
eDiscovery Incident Response Legal Holds Evidence Preservation
Industry Standards & Frameworks
ISO 27037 NIST SP 800-86 RFC 3227

Business Email Compromise (BEC)

Type of cybercrime which uses email fraud to attack commercial, government and non-profit organizations to achieve a financial gain.

High Attack High
Technical Overview: Often involves compromised email accounts or spoofed domains to impersonate executives
Real-World Examples
  • CEO fraud targeting finance departments
  • Vendor email compromise and payment redirection
  • Real estate wire fraud schemes
  • W-2 tax information phishing campaigns
Prevention Methods
  • Email authentication (SPF, DKIM, DMARC)
  • Multi-factor authentication for email
  • Payment verification procedures
  • Employee training and awareness
Detection Methods
  • Email security gateways
  • Behavioral email analysis
  • Domain spoofing detection
  • Financial transaction monitoring
Mitigation Strategies
  • Verification procedures
  • Email security
  • Training programs
  • Process controls
Notable Real-World Cases
Ubiquiti Networks $46.7 million BEC fraud 2015
FACC aerospace company CEO termination after $61M loss
Facebook and Google $100 million invoice fraud scheme
Common Targets
Finance departments Accounting personnel Executive assistants Vendors
Related Terms
CEO Fraud Email Security Financial Fraud Social Engineering
Industry Standards & Frameworks
FBI IC3 Guidelines NIST Cybersecurity Framework

Supply Chain Attack

Cyberattack that seeks to damage an organization by targeting less-secure elements in the supply chain network.

Critical Attack Critical
Technical Overview: Targets trusted relationships between organizations and their technology suppliers
Real-World Examples
  • SolarWinds Orion platform compromise
  • CCleaner malware distribution
  • Kaseya VSA ransomware attack
  • CodeCov bash uploader compromise
Prevention Methods
  • Vendor security assessments
  • Software supply chain security
  • Third-party risk management
  • Software bill of materials (SBOM)
Detection Methods
  • Software integrity verification
  • Vendor security monitoring
  • Anomalous behavior detection
  • Threat intelligence feeds
Mitigation Strategies
  • Vendor vetting
  • Code signing
  • Network segmentation
  • Incident response
Notable Real-World Cases
SolarWinds affecting 18,000+ organizations globally
NotPetya spreading through M.E.Doc accounting software
ASUS Live Update tool compromise affecting 1 million users
Common Targets
Software vendors Managed service providers Hardware manufacturers Cloud services
Related Terms
Third-Party Risk Vendor Management Software Security SBOM
Industry Standards & Frameworks
NIST SSDF Executive Order 14028 ISO 28000

Cryptojacking

Unauthorized use of someone else's computer to mine cryptocurrency without their knowledge or consent.

Medium Attack Medium
Technical Overview: Uses victim's computational resources to mine cryptocurrency for attackers' benefit
Real-World Examples
  • Coinhive JavaScript mining in web browsers
  • Cryptomining malware on compromised servers
  • Mobile app cryptojacking schemes
  • Cloud infrastructure cryptocurrency mining
Prevention Methods
  • Ad blockers and script blockers
  • Network monitoring for mining traffic
  • Endpoint protection solutions
  • Regular system performance monitoring
Detection Methods
  • CPU usage pattern analysis
  • Network traffic monitoring
  • Mining pool communication detection
  • Browser extension analysis
Mitigation Strategies
  • Content filtering
  • Resource monitoring
  • Endpoint protection
  • Network controls
Notable Real-World Cases
Tesla cloud infrastructure cryptojacking incident
WannaMine cryptojacking worm spreading globally
YouTube ads delivering cryptojacking malware
Common Targets
Web browsers Cloud services IoT devices Mobile applications
Related Terms
Cryptocurrency Browser Mining Malware Resource Abuse
Industry Standards & Frameworks
Anti-malware best practices Network monitoring guidelines

Internet of Things (IoT) Security

Practice of protecting connected devices and networks in the Internet of Things ecosystem.

High Technology High
Technical Overview: Addresses unique challenges of resource-constrained devices with limited security capabilities
Real-World Examples
  • Smart home device security
  • Industrial IoT (IIoT) protection
  • Connected vehicle cybersecurity
  • Healthcare IoT device management
Prevention Methods
  • Device authentication and encryption
  • Regular firmware updates
  • Network segmentation for IoT devices
  • Strong default credentials
Detection Methods
  • IoT device discovery and inventory
  • Network behavior monitoring
  • Firmware vulnerability scanning
  • Communication pattern analysis
Mitigation Strategies
  • Device management
  • Network isolation
  • Security by design
  • Lifecycle support
Notable Real-World Cases
Mirai botnet infecting IoT devices for DDoS attacks
Jeep Cherokee remote hack demonstration 2015
Ring doorbell unauthorized access incidents
Common Targets
Smart home devices Industrial sensors Medical devices Connected vehicles
Related Terms
Device Security Embedded Systems Industrial Control Smart Devices
Industry Standards & Frameworks
NIST IoT Cybersecurity IEC 62443 IoT Security Foundation

Artificial Intelligence Security

Security considerations and protections for AI systems including adversarial attacks and model protection.

Medium Technology Medium
Technical Overview: Protects AI models from manipulation, extraction, and adversarial attacks
Real-World Examples
  • Adversarial examples fooling image recognition
  • Data poisoning attacks on ML models
  • Model extraction and intellectual property theft
  • Deepfake detection and prevention
Prevention Methods
  • Adversarial training and robustness
  • Model validation and testing
  • Data quality and integrity controls
  • AI ethics and governance frameworks
Detection Methods
  • Adversarial example detection
  • Model behavior monitoring
  • Data anomaly detection
  • Performance degradation alerts
Mitigation Strategies
  • Robust training
  • Model monitoring
  • Data protection
  • Ethical guidelines
Notable Real-World Cases
Tesla Autopilot spoofed by adversarial road signs
Microsoft Tay chatbot manipulation 2016
Facial recognition system bias and security issues
Common Targets
ML models Training data AI applications Decision systems
Related Terms
Machine Learning Adversarial AI Model Security AI Ethics
Industry Standards & Frameworks
NIST AI Risk Management ISO/IEC 23053 IEEE AI Ethics

Quantum Cryptography

Use of quantum mechanical properties to perform cryptographic tasks and secure communication.

Low Technology Future Critical
Technical Overview: Leverages quantum mechanics for security while preparing for quantum computing threats
Real-World Examples
  • Quantum key distribution (QKD) systems
  • Post-quantum cryptographic algorithms
  • Quantum random number generators
  • Quantum-safe communication protocols
Prevention Methods
  • Post-quantum algorithm implementation
  • Quantum-resistant protocol adoption
  • Cryptographic agility planning
  • Quantum threat timeline monitoring
Detection Methods
  • Quantum computing advancement tracking
  • Cryptographic vulnerability assessment
  • Algorithm lifecycle monitoring
  • Standards compliance verification
Mitigation Strategies
  • Algorithm transition
  • Hybrid approaches
  • Standards adoption
  • Future planning
Notable Real-World Cases
China's quantum communication satellite network
NIST post-quantum cryptography standardization
Banking industry preparing for quantum threats
Common Targets
Current encryption Digital signatures Key exchange Secure communications
Related Terms
Post-Quantum Cryptography Quantum Computing Cryptographic Agility
Industry Standards & Frameworks
NIST PQC Standards ETSI QKD ITU-T Quantum Security

Compliance Frameworks

Structured sets of guidelines and requirements organizations must follow to meet regulatory and industry standards.

High Framework High
Technical Overview: Provides structured approach to meeting legal and regulatory security requirements
Real-World Examples
  • GDPR (General Data Protection Regulation)
  • SOX (Sarbanes-Oxley Act) compliance
  • HIPAA (Health Insurance Portability and Accountability Act)
  • PCI DSS (Payment Card Industry Data Security Standard)
Prevention Methods
  • Regular compliance audits and assessments
  • Policy development and implementation
  • Employee training and awareness
  • Continuous monitoring and reporting
Detection Methods
  • Compliance monitoring tools
  • Audit trail analysis
  • Policy violation detection
  • Regulatory reporting systems
Mitigation Strategies
  • Policy implementation
  • Regular audits
  • Staff training
  • Documentation
Notable Real-World Cases
British Airways £20 million GDPR fine for data breach
Equifax settlement exceeding $700 million
Facebook $5 billion FTC fine for privacy violations
Common Targets
Personal data Financial information Healthcare records Payment systems
Related Terms
Regulatory Compliance Data Protection Privacy Laws Audit Requirements
Industry Standards & Frameworks
ISO 27001 NIST Framework CIS Controls COBIT

Network Segmentation

Practice of splitting a computer network into subnetworks to improve performance and security.

High Architecture High
Technical Overview: Isolates network resources to limit attack spread and improve security posture
Real-World Examples
  • DMZ (Demilitarized Zone) implementation
  • VLAN (Virtual LAN) separation
  • Microsegmentation with software-defined networking
  • Zero trust network architecture
Prevention Methods
  • Network architecture design
  • Access control implementation
  • Traffic monitoring and filtering
  • Regular network topology review
Detection Methods
  • Network traffic analysis
  • Segment breach detection
  • Lateral movement monitoring
  • Access pattern analysis
Mitigation Strategies
  • Network design
  • Access controls
  • Monitoring tools
  • Regular assessment
Notable Real-World Cases
Target breach limited by network segmentation gaps
Maersk NotPetya containment through segmentation
Hospital networks protecting medical devices
Common Targets
Critical systems Sensitive data Industrial controls User networks
Related Terms
Microsegmentation VLAN Network Architecture Access Control
Industry Standards & Frameworks
NIST SP 800-125B SANS Network Segmentation

Security Awareness Training

Educational programs designed to help users recognize and avoid cybersecurity threats.

Medium Education Medium
Technical Overview: Addresses human element as critical component of cybersecurity defense
Real-World Examples
  • Phishing simulation exercises
  • Cybersecurity awareness campaigns
  • Role-based security training
  • Incident reporting procedures
Prevention Methods
  • Regular training program updates
  • Personalized learning approaches
  • Gamification and engagement
  • Continuous reinforcement activities
Detection Methods
  • Training completion tracking
  • Phishing simulation results
  • Security incident correlation
  • Behavioral change measurement
Mitigation Strategies
  • Regular training
  • Simulated attacks
  • Culture building
  • Continuous improvement
Notable Real-World Cases
Google's phishing awareness reducing successful attacks
Healthcare organizations training on HIPAA compliance
Financial services anti-fraud education programs
Common Targets
All employees Executives IT staff Contractors
Related Terms
Human Factor Phishing Simulation Security Culture Behavioral Change
Industry Standards & Frameworks
NIST SP 800-50 SANS Security Awareness ISO 27001

Mobile Device Management (MDM)

Administration of mobile devices, such as smartphones, tablet computers, and laptops, through deployment and management of software agents.

Medium Management Medium
Technical Overview: Provides centralized management and security control for mobile devices
Real-World Examples
  • Microsoft Intune device management
  • VMware Workspace ONE platform
  • IBM MaaS360 mobile security
  • Google Workspace mobile management
Prevention Methods
  • Device enrollment and provisioning
  • Application management and control
  • Data encryption and protection
  • Remote wipe capabilities
Detection Methods
  • Device compliance monitoring
  • Application behavior analysis
  • Location and usage tracking
  • Security policy violation alerts
Mitigation Strategies
  • Policy enforcement
  • App controls
  • Device encryption
  • Remote management
Notable Real-World Cases
BYOD policies in enterprise environments
Government mobile device security requirements
Healthcare mobile device HIPAA compliance
Common Targets
Smartphones Tablets Laptops IoT devices
Related Terms
BYOD Mobile Security Device Compliance App Management
Industry Standards & Frameworks
NIST SP 800-124 ISO 27001 BYOD Security Guidelines

Threat Modeling

Process of identifying potential threats and vulnerabilities in a system and determining countermeasures to address them.

Medium Methodology Medium
Technical Overview: Systematic approach to identifying and addressing potential security threats in systems
Real-World Examples
  • STRIDE threat modeling methodology
  • PASTA (Process for Attack Simulation and Threat Analysis)
  • Attack tree analysis
  • Data flow diagram security review
Prevention Methods
  • Early design phase integration
  • Systematic threat identification
  • Risk assessment and prioritization
  • Countermeasure implementation
Detection Methods
  • Threat modeling tools and frameworks
  • Security architecture review
  • Risk assessment methodologies
  • Vulnerability analysis techniques
Mitigation Strategies
  • Design reviews
  • Risk mitigation
  • Security controls
  • Regular updates
Notable Real-World Cases
Microsoft Security Development Lifecycle (SDL)
OWASP Application Security Verification Standard
Banking application security design reviews
Common Targets
Applications Network architecture Data flows System components
Related Terms
Risk Assessment Security Architecture STRIDE Attack Vectors
Industry Standards & Frameworks
NIST SP 800-154 OWASP Threat Modeling ISO 27005

Container Security

Practice of protecting containerized applications throughout the container lifecycle from build to runtime.

High Technology High
Technical Overview: Secures containerized environments from image vulnerabilities to runtime threats
Real-World Examples
  • Docker container image scanning
  • Kubernetes security policies
  • Container runtime protection
  • Registry security and image signing
Prevention Methods
  • Container image vulnerability scanning
  • Runtime security monitoring
  • Network policies and segmentation
  • Least privilege container configuration
Detection Methods
  • Container behavior monitoring
  • Image vulnerability assessment
  • Runtime anomaly detection
  • Network traffic analysis
Mitigation Strategies
  • Image scanning
  • Runtime protection
  • Network policies
  • Access controls
Notable Real-World Cases
Tesla Kubernetes cluster cryptojacking attack
Docker Hub malicious image discoveries
Kubernetes privilege escalation vulnerabilities
Common Targets
Container images Orchestration platforms Container registries Runtime environments
Related Terms
Docker Kubernetes Microservices Cloud Native
Industry Standards & Frameworks
CIS Kubernetes Benchmark NIST SP 800-190 OWASP Container Security

API Security

Practice of protecting Application Programming Interfaces (APIs) from attacks and ensuring secure data exchange.

High Technology High
Technical Overview: Protects APIs from unauthorized access, injection attacks, and data breaches
Real-World Examples
  • OAuth 2.0 and OpenID Connect implementation
  • API gateway security controls
  • Rate limiting and throttling
  • API key management and rotation
Prevention Methods
  • API authentication and authorization
  • Input validation and sanitization
  • Rate limiting and DDoS protection
  • API security testing and monitoring
Detection Methods
  • API traffic monitoring and analysis
  • Anomalous usage pattern detection
  • Authentication failure tracking
  • API vulnerability scanning
Mitigation Strategies
  • Authentication controls
  • Input validation
  • Rate limiting
  • Security testing
Notable Real-World Cases
Facebook Cambridge Analytica API data misuse
Twitter API vulnerabilities exposing user data
Instagram API bug allowing private photo access
Common Targets
Web APIs Mobile app APIs Third-party integrations Microservices
Related Terms
REST Security OAuth API Gateway Microservices Security
Industry Standards & Frameworks
OWASP API Security Top 10 OpenAPI Security Scheme OAuth 2.0 RFC

Privileged Access Management (PAM)

Cybersecurity strategies and technologies for exerting control over elevated access and permissions for users, accounts, processes, and systems.

Critical Management Critical
Technical Overview: Controls and monitors access to critical systems and sensitive data through privileged accounts
Real-World Examples
  • CyberArk Privileged Access Security
  • BeyondTrust Password Safe
  • HashiCorp Vault secrets management
  • AWS IAM privileged access controls
Prevention Methods
  • Privileged account discovery and inventory
  • Password vaulting and rotation
  • Session monitoring and recording
  • Just-in-time access provisioning
Detection Methods
  • Privileged session monitoring
  • Access pattern analysis
  • Credential usage tracking
  • Anomalous privilege escalation detection
Mitigation Strategies
  • Credential vaulting
  • Session monitoring
  • Access approval
  • Regular rotation
Notable Real-World Cases
SolarWinds attack exploiting privileged credentials
Capital One breach via privileged access misconfiguration
Insider threats using elevated privileges
Common Targets
Administrative accounts Service accounts Emergency access Third-party access
Related Terms
Privileged Accounts Password Management Session Monitoring Access Control
Industry Standards & Frameworks
NIST SP 800-63 CIS Controls ISO 27001

Security Information Sharing

Practice of exchanging cybersecurity threat intelligence and best practices between organizations and agencies.

Medium Collaboration Medium
Technical Overview: Enables collective defense through shared threat intelligence and best practices
Real-World Examples
  • Information Sharing and Analysis Centers (ISACs)
  • CISA threat intelligence sharing
  • Private sector threat intelligence feeds
  • International cybersecurity cooperation
Prevention Methods
  • Threat intelligence platform integration
  • Automated sharing mechanisms
  • Trust relationships establishment
  • Legal and privacy frameworks
Detection Methods
  • Threat intelligence feeds
  • Collaborative detection platforms
  • Shared indicators analysis
  • Community threat hunting
Mitigation Strategies
  • Community participation
  • Intelligence sharing
  • Collaborative defense
  • Trust building
Notable Real-World Cases
WannaCry global response and information sharing
SolarWinds attack coordination and intelligence
COVID-19 cyber threat information sharing
Common Targets
Critical infrastructure Financial services Government agencies Healthcare
Related Terms
Threat Intelligence ISAC Collaboration Information Sharing
Industry Standards & Frameworks
STIX/TAXII Traffic Light Protocol NIST Cybersecurity Framework

Cyber Insurance

Insurance coverage designed to protect individuals and organizations from internet-based risks and computer-related risks.

Medium Risk Management Medium
Technical Overview: Transfers financial risk of cyber incidents while requiring security best practices
Real-World Examples
  • Data breach response coverage
  • Business interruption protection
  • Cyber extortion and ransomware coverage
  • Third-party liability protection
Prevention Methods
  • Risk assessment and mitigation
  • Security controls implementation
  • Regular policy review and updates
  • Incident response preparation
Detection Methods
  • Risk evaluation frameworks
  • Security posture assessment
  • Claims analysis and trends
  • Coverage gap identification
Mitigation Strategies
  • Risk assessment
  • Policy selection
  • Security improvement
  • Claims preparation
Notable Real-World Cases
Maersk NotPetya insurance claim disputes
CNA Financial ransomware insurance claim
Colonial Pipeline cyber insurance coverage
Common Targets
Data breaches System outages Ransomware attacks Third-party claims
Related Terms
Risk Transfer Business Continuity Financial Protection Incident Response
Industry Standards & Frameworks
NIST Risk Management Framework ISO 31000 Insurance industry guidelines

Red Team vs Blue Team

Cybersecurity training methodology where Red Team simulates attacks while Blue Team defends and responds.

Medium Exercise Medium
Technical Overview: Improves organizational security through adversarial training and capability testing
Real-World Examples
  • Simulated APT attack scenarios
  • Red team penetration testing
  • Blue team incident response drills
  • Purple team collaborative exercises
Prevention Methods
  • Regular exercise planning and execution
  • Realistic attack scenario development
  • Team training and skill development
  • Lessons learned integration
Detection Methods
  • Attack simulation frameworks
  • Defense capability assessment
  • Response time measurement
  • Detection accuracy evaluation
Mitigation Strategies
  • Regular exercises
  • Team development
  • Process improvement
  • Technology enhancement
Notable Real-World Cases
SANS NetWars cybersecurity competitions
Military cyber warfare training exercises
Corporate security awareness programs
Common Targets
Security teams Infrastructure Processes Detection capabilities
Related Terms
Penetration Testing Incident Response Security Training Threat Simulation
Industry Standards & Frameworks
NIST Cybersecurity Framework MITRE ATT&CK Red Team Guidelines

Cyber Kill Chain

Framework developed by Lockheed Martin that identifies phases of cyber attacks and provides defensive strategies.

Medium Framework Medium
Technical Overview: Provides structured approach to understanding and defending against cyber attacks
Real-World Examples
  • Reconnaissance phase detection
  • Weaponization stage analysis
  • Delivery mechanism identification
  • Command and control disruption
Prevention Methods
  • Phase-specific security controls
  • Early stage threat detection
  • Attack chain disruption
  • Defensive strategy development
Detection Methods
  • Multi-stage attack correlation
  • Indicator mapping to kill chain
  • Pattern recognition systems
  • Threat intelligence integration
Mitigation Strategies
  • Phase-based defenses
  • Early detection
  • Attack disruption
  • Intelligence integration
Notable Real-World Cases
APT attack analysis using kill chain model
SolarWinds attack mapping to kill chain phases
Targeted phishing campaign breakdown
Common Targets
All attack phases Defense strategies Threat analysis Security controls
Related Terms
MITRE ATT&CK Threat Analysis Attack Stages Defense Strategy
Industry Standards & Frameworks
Lockheed Martin Cyber Kill Chain MITRE ATT&CK Framework

Serverless Security

Security practices and controls for serverless computing environments and function-as-a-service platforms.

Medium Technology Medium
Technical Overview: Addresses unique security challenges of ephemeral, event-driven computing functions
Real-World Examples
  • AWS Lambda function security
  • Azure Functions protection
  • Google Cloud Functions monitoring
  • Serverless application security testing
Prevention Methods
  • Function-level access controls
  • Secure coding practices
  • Environment variable protection
  • Dependency vulnerability management
Detection Methods
  • Function execution monitoring
  • Runtime security analysis
  • Anomalous behavior detection
  • Code vulnerability scanning
Mitigation Strategies
  • Secure coding
  • Access controls
  • Monitoring
  • Vulnerability management
Notable Real-World Cases
Capital One breach involving serverless misconfiguration
AWS Lambda cryptojacking incidents
Serverless function privilege escalation
Common Targets
Function code Event triggers Data access Third-party integrations
Related Terms
FaaS Cloud Security Microservices Event-driven Architecture
Industry Standards & Frameworks
OWASP Serverless Top 10 NIST Cloud Security CSA Cloud Controls

Cyber Resilience

Ability of an organization to prepare for, respond to, and recover from cyber attacks while maintaining operations.

High Strategy High
Technical Overview: Combines technical and organizational capabilities to maintain operations during cyber incidents
Real-World Examples
  • Business continuity planning
  • Disaster recovery procedures
  • Incident response capabilities
  • Adaptive security architectures
Prevention Methods
  • Redundant system design
  • Regular backup and recovery testing
  • Cross-training and succession planning
  • Continuous improvement processes
Detection Methods
  • Resilience metrics and KPIs
  • Recovery time measurement
  • System availability monitoring
  • Stakeholder impact assessment
Mitigation Strategies
  • Resilience planning
  • Regular testing
  • Capability building
  • Continuous improvement
Notable Real-World Cases
Maersk recovery from NotPetya ransomware
Financial services maintaining operations during attacks
Healthcare systems cyber resilience during COVID-19
Common Targets
Critical operations Essential services Customer data Business processes
Related Terms
Business Continuity Disaster Recovery Incident Response Adaptive Security
Industry Standards & Frameworks
NIST Cybersecurity Framework ISO 22301 Business Continuity Institute

Cybersecurity Mesh

Distributed architectural approach that enables any device to securely access any digital asset regardless of location.

Medium Architecture Medium
Technical Overview: Enables flexible, scalable security architecture for modern distributed environments
Real-World Examples
  • Distributed identity verification
  • Edge-based security services
  • Composable security infrastructure
  • Perimeter-less security models
Prevention Methods
  • Distributed security controls
  • Identity-centric security
  • Composable architecture design
  • Edge security deployment
Detection Methods
  • Distributed monitoring systems
  • Cross-platform correlation
  • Edge-based threat detection
  • Behavioral analytics mesh
Mitigation Strategies
  • Mesh architecture
  • Distributed controls
  • Identity management
  • Edge security
Notable Real-World Cases
Remote work security architecture evolution
Multi-cloud security integration
IoT device security in distributed environments
Common Targets
Distributed workforces Multi-cloud environments IoT ecosystems Edge computing
Related Terms
Zero Trust Distributed Security Edge Computing Identity-Centric Security
Industry Standards & Frameworks
Gartner Cybersecurity Mesh NIST Zero Trust Architecture

Security Automation

Use of technology to perform security tasks with minimal human intervention to improve efficiency and response times.

High Automation High
Technical Overview: Reduces manual effort and improves response times through automated security processes
Real-World Examples
  • Automated patch management
  • Security orchestration workflows
  • Threat response automation
  • Compliance monitoring automation
Prevention Methods
  • Workflow automation design
  • Security tool integration
  • Playbook development
  • Human oversight mechanisms
Detection Methods
  • Automated monitoring systems
  • Machine learning algorithms
  • Rule-based detection engines
  • Behavioral analysis automation
Mitigation Strategies
  • Process automation
  • Tool integration
  • Workflow optimization
  • Human oversight
Notable Real-World Cases
Netflix's automated security remediation
Financial institutions automated fraud detection
Cloud providers automated threat response
Common Targets
Repetitive tasks Response workflows Monitoring processes Compliance checks
Related Terms
SOAR Security Orchestration Workflow Automation Machine Learning
Industry Standards & Frameworks
NIST Cybersecurity Framework SOAR best practices

Network Access Control (NAC)

Security solution that enforces policy on devices seeking to access network resources, ensuring only compliant devices can connect.

High Network Security High
Technical Overview: Combines authentication, authorization, and accounting to control network access
Real-World Examples
  • Cisco Identity Services Engine (ISE)
  • Aruba ClearPass Policy Manager
  • ForeScout CounterACT platform
  • 802.1X authentication systems
Prevention Methods
  • Device discovery and profiling
  • Policy-based access control
  • Guest network isolation
  • Compliance verification
Detection Methods
  • Device fingerprinting
  • Behavioral analysis
  • Policy violation monitoring
  • Network scanning detection
Mitigation Strategies
  • Policy enforcement
  • Device compliance
  • Network segmentation
  • Monitoring
Notable Real-World Cases
Hospital networks protecting medical devices
University campus network access control
Corporate BYOD policy enforcement
Common Targets
Wireless networks Wired LANs Guest access IoT devices
Related Terms
802.1X Device Management Network Security Identity Management
Industry Standards & Frameworks
IEEE 802.1X NIST SP 800-115 RADIUS/TACACS+

Cross-Site Scripting (XSS)

Web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.

Medium Vulnerability Medium
Technical Overview: Injects client-side scripts to steal data, hijack sessions, or deface websites
Real-World Examples
  • Reflected XSS via URL parameters
  • Stored XSS in user comments
  • DOM-based XSS manipulation
  • Blind XSS in admin panels
Prevention Methods
  • Input validation and output encoding
  • Content Security Policy (CSP)
  • HTTP-only cookies
  • Web application firewalls
Detection Methods
  • Automated web vulnerability scanners
  • Manual penetration testing
  • Code review and static analysis
  • Runtime application security testing
Mitigation Strategies
  • Input sanitization
  • CSP headers
  • Secure coding
  • Regular testing
Notable Real-World Cases
MySpace XSS worm 2005 (Samy worm)
TweetDeck XSS vulnerability 2014
eBay XSS attacks targeting user sessions
Common Targets
Web applications User sessions Personal data Authentication tokens
Related Terms
Web Security Input Validation OWASP Top 10 Session Hijacking
Industry Standards & Frameworks
OWASP XSS Prevention CWE-79 W3C CSP Specification

Darkweb Monitoring

Practice of monitoring dark web marketplaces and forums for stolen data, threats, and criminal activities related to an organization.

Medium Intelligence Medium
Technical Overview: Uses specialized tools to access and monitor hidden services on the dark web
Real-World Examples
  • Stolen credential marketplace monitoring
  • Ransomware group communications tracking
  • Corporate data leak detection
  • Threat actor intelligence gathering
Prevention Methods
  • Automated dark web scanning
  • Threat intelligence integration
  • Employee monitoring and alerting
  • Proactive threat hunting
Detection Methods
  • Dark web crawling and indexing
  • Keyword and hash monitoring
  • Forum and marketplace surveillance
  • Automated alert systems
Mitigation Strategies
  • Continuous monitoring
  • Rapid response
  • Law enforcement cooperation
  • Preventive measures
Notable Real-World Cases
Equifax breach data found on dark web markets
COVID-19 vaccine formula theft monitoring
Financial institutions monitoring card fraud
Common Targets
Stolen credentials Corporate data Personal information Intellectual property
Related Terms
Threat Intelligence Data Breach Criminal Marketplaces Digital Risk
Industry Standards & Frameworks
Threat intelligence frameworks Digital forensics standards

Certificate Pinning

Security technique that binds a host with their expected X.509 certificate or public key to prevent man-in-the-middle attacks.

Medium Cryptography Medium
Technical Overview: Validates specific certificates or public keys to prevent certificate substitution attacks
Real-World Examples
  • Mobile app SSL certificate pinning
  • API endpoint certificate validation
  • Public key pinning implementation
  • Certificate transparency monitoring
Prevention Methods
  • Certificate pinning implementation
  • Public key infrastructure management
  • Certificate rotation procedures
  • Backup certificate planning
Detection Methods
  • Certificate validation monitoring
  • TLS connection analysis
  • Pinning failure alerts
  • Certificate transparency logs
Mitigation Strategies
  • Certificate validation
  • PKI management
  • Monitoring systems
  • Recovery procedures
Notable Real-World Cases
Banking apps preventing certificate spoofing
Social media platforms protecting user communications
E-commerce sites securing payment transactions
Common Targets
Mobile applications Web services API communications Payment systems
Related Terms
TLS/SSL PKI Man-in-the-Middle Certificate Authority
Industry Standards & Frameworks
RFC 7469 (HPKP) OWASP Certificate Pinning TLS 1.3

USB Security

Security measures to protect against threats introduced through USB devices and ports.

Medium Physical Security Medium
Technical Overview: Controls USB ports and devices to prevent malware introduction and data theft
Real-World Examples
  • USB port blocking and whitelisting
  • Malware scanning for removable media
  • Encrypted USB device management
  • USB device access logging
Prevention Methods
  • USB port control and monitoring
  • Device whitelisting policies
  • Encrypted storage requirements
  • User training and awareness
Detection Methods
  • USB device activity monitoring
  • Malware scanning systems
  • Data exfiltration detection
  • Unauthorized device alerts
Mitigation Strategies
  • Port control
  • Device scanning
  • Policy enforcement
  • User education
Notable Real-World Cases
Stuxnet malware spread via USB drives
Target breach initial infection through USB
Government agencies banning personal USB devices
Common Targets
Workstations Servers Industrial systems Sensitive environments
Related Terms
Removable Media Data Exfiltration Malware Delivery Physical Security
Industry Standards & Frameworks
NIST SP 800-111 DoD USB Security Guidelines

Steganography

Practice of concealing information within other non-secret text or data to hide the existence of the secret information.

Low Cryptography Low
Technical Overview: Hides information in digital media using various mathematical and algorithmic techniques
Real-World Examples
  • Hiding data in image files
  • Text steganography in documents
  • Audio file information hiding
  • Network steganography in protocols
Prevention Methods
  • Steganographic analysis tools
  • File format validation
  • Content inspection systems
  • Network traffic analysis
Detection Methods
  • Statistical analysis techniques
  • Steganographic detection software
  • Visual and spectral analysis
  • Machine learning algorithms
Mitigation Strategies
  • Detection tools
  • Content analysis
  • Policy enforcement
  • Monitoring systems
Notable Real-World Cases
Cybercriminals hiding malware in images
Covert communication channels
Intellectual property protection
Common Targets
Image files Audio files Video content Network protocols
Related Terms
Cryptography Covert Channels Data Hiding Digital Forensics
Industry Standards & Frameworks
Digital forensics methodologies Cryptographic research standards

Password Security

Practices and technologies for creating, managing, and protecting passwords to prevent unauthorized access.

High Authentication High
Technical Overview: Combines password policies, storage security, and alternative authentication methods
Real-World Examples
  • Password complexity requirements
  • Password manager implementations
  • Multi-factor authentication integration
  • Password rotation policies
Prevention Methods
  • Strong password policy enforcement
  • Password manager deployment
  • Regular password auditing
  • Multi-factor authentication implementation
Detection Methods
  • Weak password scanning
  • Breach monitoring services
  • Password reuse detection
  • Brute force attack monitoring
Mitigation Strategies
  • Strong policies
  • Password managers
  • MFA implementation
  • Regular auditing
Notable Real-World Cases
LinkedIn password breach exposing 164 million accounts
Yahoo data breaches affecting billions of passwords
RockYou password database analysis revealing common patterns
Common Targets
User accounts Administrative access Service accounts Database systems
Related Terms
Authentication Credential Management Password Managers Access Control
Industry Standards & Frameworks
NIST SP 800-63B OWASP Authentication Guidelines ISO 27001

Wireless Security

Security measures and protocols designed to protect wireless networks and communications from unauthorized access and attacks.

Medium Network Security Medium
Technical Overview: Implements encryption, authentication, and monitoring for wireless communications
Real-World Examples
  • WPA3 enterprise security implementation
  • Wireless intrusion detection systems
  • Rogue access point detection
  • Guest network isolation
Prevention Methods
  • Strong encryption protocols (WPA3)
  • Network access control implementation
  • Regular security assessments
  • Wireless security policy enforcement
Detection Methods
  • Wireless monitoring systems
  • Rogue device detection
  • Traffic analysis tools
  • Intrusion detection systems
Mitigation Strategies
  • Strong encryption
  • Access control
  • Monitoring systems
  • Policy enforcement
Notable Real-World Cases
KRACK attack against WPA2 protocol 2017
Corporate wireless network breaches
Public WiFi security vulnerabilities
Common Targets
Wireless networks Mobile devices IoT connections Guest access
Related Terms
WiFi Security WPA3 Network Access Control Wireless Monitoring
Industry Standards & Frameworks
IEEE 802.11 WPA3 Specification NIST Wireless Security

Data Classification

Process of organizing data by relevant categories so it can be used and protected more efficiently and effectively.

High Data Protection High
Technical Overview: Categorizes data based on sensitivity, value, and regulatory requirements
Real-World Examples
  • Public, Internal, Confidential, Restricted levels
  • GDPR personal data classification
  • Healthcare PHI classification
  • Financial data sensitivity levels
Prevention Methods
  • Automated data discovery and classification
  • Data labeling and tagging systems
  • Access control based on classification
  • Data handling procedure development
Detection Methods
  • Data discovery and scanning tools
  • Content classification engines
  • Policy compliance monitoring
  • Data usage pattern analysis
Mitigation Strategies
  • Classification policies
  • Automated tools
  • Access controls
  • Regular reviews
Notable Real-World Cases
Government classified information systems
Banking customer data protection programs
Healthcare HIPAA compliance implementations
Common Targets
Personal data Financial records Intellectual property Operational data
Related Terms
Data Loss Prevention Information Governance Privacy Protection Compliance
Industry Standards & Frameworks
ISO 27001 GDPR HIPAA NIST Data Classification

Security Token

Physical device or software application that generates authentication codes for secure access to computer services.

Medium Authentication Medium
Technical Overview: Generates time-based or event-based one-time passwords for authentication
Real-World Examples
  • Hardware tokens (YubiKey, RSA SecurID)
  • Software-based TOTP applications
  • SMS-based authentication codes
  • Push notification tokens
Prevention Methods
  • Token lifecycle management
  • Secure token distribution
  • Regular token replacement
  • Backup authentication methods
Detection Methods
  • Token usage monitoring
  • Authentication failure tracking
  • Anomalous access pattern detection
  • Token compromise indicators
Mitigation Strategies
  • Token management
  • Backup methods
  • User training
  • Regular replacement
Notable Real-World Cases
Banking industry two-factor authentication
Government secure access implementations
Enterprise VPN access control
Common Targets
High-value accounts Administrative access Financial transactions Remote access
Related Terms
Two-Factor Authentication Hardware Security TOTP Multi-Factor Authentication
Industry Standards & Frameworks
OATH TOTP/HOTP FIDO2 NIST SP 800-63B

Cyber Warfare

Use of digital attacks by one country to disrupt the vital computer systems of another with the intent of creating damage, death or destruction.

Critical Warfare Critical
Technical Overview: Involves sophisticated, state-sponsored cyber operations targeting national security interests
Real-World Examples
  • Stuxnet attacks on Iranian nuclear facilities
  • NotPetya attributed to Russian state actors
  • Chinese APT groups targeting intellectual property
  • North Korean cryptocurrency theft operations
Prevention Methods
  • Critical infrastructure protection
  • International cybersecurity cooperation
  • Defense-in-depth strategies
  • Cyber deterrence policies
Detection Methods
  • Advanced persistent threat detection
  • Nation-state attribution analysis
  • Critical infrastructure monitoring
  • International intelligence sharing
Mitigation Strategies
  • International cooperation
  • Defense modernization
  • Deterrence policies
  • Resilience building
Notable Real-World Cases
Estonia cyberattacks 2007 paralyzing digital infrastructure
Ukrainian power grid attacks 2015-2016
SolarWinds Orion supply chain compromise
Common Targets
Critical infrastructure Government systems Military networks Economic systems
Related Terms
Nation-State Actors Critical Infrastructure APT Cyber Deterrence
Industry Standards & Frameworks
Tallinn Manual on Cyber Warfare UN Cyber Norms NATO Article 5

Biometric Security

Authentication method that uses unique biological characteristics to verify identity and grant access to systems or facilities.

Medium Authentication Medium
Technical Overview: Uses mathematical algorithms to analyze unique biological characteristics for authentication
Real-World Examples
  • Fingerprint recognition systems
  • Facial recognition technology
  • Iris and retinal scanning
  • Voice recognition authentication
Prevention Methods
  • Template protection and encryption
  • Liveness detection implementation
  • Multi-modal biometric systems
  • Fallback authentication methods
Detection Methods
  • Spoofing attempt detection
  • Template quality assessment
  • Behavioral pattern analysis
  • Anti-counterfeiting measures
Mitigation Strategies
  • Template protection
  • Liveness detection
  • Multi-factor authentication
  • Privacy controls
Notable Real-World Cases
iPhone Touch ID and Face ID implementation
Airport immigration biometric systems
Banking biometric authentication adoption
Common Targets
Physical access Device authentication Identity verification Financial transactions
Related Terms
Identity Verification Access Control Behavioral Analytics Privacy Protection
Industry Standards & Frameworks
ISO/IEC 19794 NIST Biometric Standards Common Criteria

Honeypot

Security mechanism designed to attract and detect unauthorized attempts to access information systems by mimicking legitimate systems.

Medium Deception Medium
Technical Overview: Creates decoy systems to distract attackers and gather intelligence about attack methods
Real-World Examples
  • Network honeypots mimicking servers
  • Database honeypots with fake data
  • Web application honeypots
  • IoT device honeypots
Prevention Methods
  • Isolated network deployment
  • Realistic system emulation
  • Comprehensive logging and monitoring
  • Legal and ethical considerations
Detection Methods
  • Attack pattern analysis
  • Malware sample collection
  • Attacker behavior profiling
  • Threat intelligence generation
Mitigation Strategies
  • Proper isolation
  • Legal compliance
  • Monitoring systems
  • Intelligence sharing
Notable Real-World Cases
Georgia Tech Honeynet Project research
Cybersecurity researchers tracking botnets
Financial institutions detecting fraud attempts
Common Targets
Network services Web applications Database systems IoT devices
Related Terms
Deception Technology Threat Intelligence Intrusion Detection Security Research
Industry Standards & Frameworks
NIST Guidelines Honeynet Project Standards Research Ethics

Security Baseline

Minimum level of security that must be implemented across an organization's systems and applications.

High Standard High
Technical Overview: Establishes consistent security configurations across organizational systems
Real-World Examples
  • CIS Security Controls implementation
  • NIST Cybersecurity Framework baseline
  • Operating system hardening standards
  • Application security requirements
Prevention Methods
  • Security configuration management
  • Regular compliance assessments
  • Automated baseline scanning
  • Exception management processes
Detection Methods
  • Configuration compliance monitoring
  • Vulnerability assessment tools
  • Security posture measurement
  • Deviation detection systems
Mitigation Strategies
  • Configuration management
  • Regular assessment
  • Automated tools
  • Continuous monitoring
Notable Real-World Cases
Government security baseline mandates
Financial services regulatory baselines
Healthcare HIPAA security baselines
Common Targets
Operating systems Network devices Applications Cloud services
Related Terms
Security Configuration Compliance Risk Management Security Standards
Industry Standards & Frameworks
CIS Controls NIST SP 800-53 ISO 27001 SANS Security Policy

Digital Rights Management (DRM)

Set of access control technologies used to restrict the use of proprietary software, hardware, or content.

Medium Content Protection Medium
Technical Overview: Uses encryption, authentication, and authorization to control access to digital content
Real-World Examples
  • Media streaming platform protection
  • Software license enforcement
  • E-book copy protection
  • Enterprise document protection
Prevention Methods
  • Content encryption and watermarking
  • License validation systems
  • Usage monitoring and auditing
  • Legal enforcement mechanisms
Detection Methods
  • Piracy detection systems
  • License compliance monitoring
  • Content fingerprinting
  • Usage pattern analysis
Mitigation Strategies
  • Content encryption
  • License enforcement
  • Legal measures
  • User education
Notable Real-World Cases
Netflix content protection systems
Microsoft Office document rights management
Adobe Digital Editions e-book DRM
Common Targets
Digital media Software applications Documents Streaming content
Related Terms
Intellectual Property Content Protection Copyright License Management
Industry Standards & Frameworks
DMCA WIPO Copyright Treaty Industry-specific DRM standards

Cyber Threat Hunting

Proactive approach to searching for cyber threats that may be present in an environment but have not yet been detected by automated systems.

High Investigation High
Technical Overview: Combines human analysis with advanced tools to proactively identify threats
Real-World Examples
  • Hypothesis-driven threat hunting
  • IoC-based investigations
  • Behavioral anomaly hunting
  • Threat intelligence-driven hunts
Prevention Methods
  • Threat hunting team establishment
  • Advanced analytics platform deployment
  • Threat intelligence integration
  • Hunting methodology development
Detection Methods
  • Statistical analysis techniques
  • Machine learning algorithms
  • Pattern recognition systems
  • Timeline and correlation analysis
Mitigation Strategies
  • Proactive hunting
  • Team training
  • Tool integration
  • Continuous improvement
Notable Real-World Cases
APT detection through network analysis
Insider threat discovery via behavioral hunting
Zero-day exploit identification
Common Targets
Advanced persistent threats Insider threats Zero-day exploits Lateral movement
Related Terms
Threat Intelligence SIEM Incident Response Behavioral Analytics
Industry Standards & Frameworks
MITRE ATT&CK Framework Threat Hunting Maturity Model NIST Guidelines

Secure Coding

Practice of developing software that is protected from security vulnerabilities by applying security principles throughout the development process.

High Development High
Technical Overview: Integrates security considerations into every phase of software development
Real-World Examples
  • Input validation and sanitization
  • Secure authentication implementation
  • Proper error handling
  • Code review and static analysis
Prevention Methods
  • Security training for developers
  • Secure coding standards implementation
  • Code review processes
  • Static and dynamic testing
Detection Methods
  • Static application security testing
  • Dynamic application security testing
  • Interactive application security testing
  • Code review and audit processes
Mitigation Strategies
  • Developer training
  • Security testing
  • Code review
  • Standards compliance
Notable Real-World Cases
Microsoft Security Development Lifecycle
OWASP secure coding practices adoption
Banking application security requirements
Common Targets
Web applications Mobile apps API services Desktop software
Related Terms
Application Security OWASP DevSecOps Code Review
Industry Standards & Frameworks
OWASP Secure Coding Practices CWE/SANS Top 25 ISO 27034

Digital Signature

Mathematical scheme for verifying the authenticity and integrity of digital messages or documents.

Medium Cryptography Medium
Technical Overview: Uses public key cryptography to provide authentication, integrity, and non-repudiation
Real-World Examples
  • PDF document digital signatures
  • Software code signing certificates
  • Email message signing (S/MIME)
  • Blockchain transaction signatures
Prevention Methods
  • PKI infrastructure implementation
  • Certificate lifecycle management
  • Secure key storage practices
  • Signature validation processes
Detection Methods
  • Certificate validation systems
  • Signature verification tools
  • Timestamp authority verification
  • Revocation status checking
Mitigation Strategies
  • PKI implementation
  • Certificate management
  • Validation processes
  • Legal compliance
Notable Real-World Cases
Adobe PDF digital signature adoption
Microsoft code signing for software distribution
Government document authentication systems
Common Targets
Legal documents Software distributions Email communications Financial transactions
Related Terms
PKI Certificate Authority Non-repudiation Document Integrity
Industry Standards & Frameworks
PKCS standards X.509 certificates RFC 3852 (CMS)

Security Architecture

Design and structure of security controls within an IT system to protect the confidentiality, integrity, and availability of data.

High Architecture High
Technical Overview: Integrates security requirements into system design and architecture decisions
Real-World Examples
  • Zero Trust architecture design
  • Defense-in-depth layered security
  • Secure network segmentation
  • Identity-centric security models
Prevention Methods
  • Threat modeling and risk assessment
  • Security design principles application
  • Architecture review processes
  • Security control integration
Detection Methods
  • Architecture compliance assessment
  • Security gap analysis
  • Control effectiveness evaluation
  • Risk posture measurement
Mitigation Strategies
  • Design review
  • Risk assessment
  • Control integration
  • Continuous improvement
Notable Real-World Cases
Google BeyondCorp zero trust implementation
Financial services multi-layered security
Government classified system architectures
Common Targets
Enterprise systems Cloud environments Network infrastructure Application platforms
Related Terms
Enterprise Architecture Risk Management Security Controls System Design
Industry Standards & Frameworks
TOGAF Security Architecture SABSA Framework NIST SP 800-160

Social Media Security

Practices and technologies used to protect individuals and organizations from security threats associated with social media platforms.

Medium Digital Safety Medium
Technical Overview: Addresses privacy, authentication, and content security across social platforms
Real-World Examples
  • Privacy settings configuration
  • Social engineering attack prevention
  • Brand protection and monitoring
  • Employee social media policies
Prevention Methods
  • Privacy settings education
  • Social media monitoring tools
  • Employee training programs
  • Brand protection services
Detection Methods
  • Social media monitoring platforms
  • Fake account detection
  • Brand mention tracking
  • Threat intelligence from social sources
Mitigation Strategies
  • Privacy controls
  • Monitoring tools
  • User education
  • Policy enforcement
Notable Real-World Cases
Twitter high-profile account hacks 2020
Facebook Cambridge Analytica data scandal
Corporate executives targeted via LinkedIn
Common Targets
Personal accounts Corporate profiles Executive accounts Brand reputation
Related Terms
Digital Privacy Brand Protection Social Engineering Online Reputation
Industry Standards & Frameworks
Platform security guidelines Privacy regulations (GDPR) Corporate policies

Quantum Computing Threats

Potential security risks posed by quantum computers to current cryptographic systems and the measures to address them.

Future Critical Emerging Threat Future Critical
Technical Overview: Quantum computers could break current public key cryptography using specialized algorithms
Real-World Examples
  • Shor's algorithm breaking RSA encryption
  • Grover's algorithm weakening symmetric crypto
  • Post-quantum cryptography development
  • Quantum key distribution systems
Prevention Methods
  • Post-quantum algorithm implementation
  • Cryptographic agility planning
  • Quantum threat timeline monitoring
  • Hybrid security approaches
Detection Methods
  • Quantum computing advancement tracking
  • Cryptographic vulnerability assessment
  • Algorithm lifecycle monitoring
  • Research development surveillance
Mitigation Strategies
  • Algorithm transition
  • Hybrid systems
  • Timeline monitoring
  • Standards adoption
Notable Real-World Cases
NIST post-quantum cryptography standardization
IBM and Google quantum computing advances
National security agency quantum preparation
Common Targets
Public key cryptography Digital signatures Key exchange protocols Secure communications
Related Terms
Post-Quantum Cryptography Cryptographic Agility Quantum Key Distribution
Industry Standards & Frameworks
NIST PQC Standards Quantum-safe cryptography Migration guidelines

Information Security Governance

Framework for managing and controlling information security at an organizational level through policies, procedures, and oversight.

High Governance High
Technical Overview: Provides organizational structure and accountability for information security management
Real-World Examples
  • Board-level security oversight
  • Security policy framework development
  • Risk management governance
  • Compliance and audit programs
Prevention Methods
  • Governance framework establishment
  • Policy and procedure development
  • Risk management integration
  • Performance measurement systems
Detection Methods
  • Governance maturity assessments
  • Compliance monitoring systems
  • Risk indicator tracking
  • Audit and review processes
Mitigation Strategies
  • Framework implementation
  • Regular assessment
  • Continuous improvement
  • Stakeholder engagement
Notable Real-World Cases
Sarbanes-Oxley Act compliance programs
GDPR governance implementations
Financial services regulatory oversight
Common Targets
Organizational processes Strategic planning Risk management Compliance programs
Related Terms
Risk Management Compliance Board Governance Security Policy
Industry Standards & Frameworks
ISO 27001 COBIT 5 NIST Cybersecurity Framework COSO Framework

Cyber Insurance

Insurance coverage designed to protect businesses and individuals from internet-based risks and computer-related risks.

Medium Risk Management Medium
Technical Overview: Transfers financial risk of cyber incidents while incentivizing security improvements
Real-World Examples
  • Data breach response coverage
  • Business interruption protection
  • Cyber extortion coverage
  • Third-party liability insurance
Prevention Methods
  • Risk assessment and mitigation
  • Security controls implementation
  • Policy terms negotiation
  • Regular coverage review
Detection Methods
  • Risk evaluation frameworks
  • Security posture assessment
  • Claims trend analysis
  • Coverage gap identification
Mitigation Strategies
  • Risk assessment
  • Policy selection
  • Security improvement
  • Claims preparation
Notable Real-World Cases
Maersk NotPetya insurance claims
CNA Financial ransomware coverage
Merck cyber insurance disputes
Common Targets
Business operations Financial assets Legal liabilities Recovery costs
Related Terms
Risk Transfer Business Continuity Financial Protection Risk Assessment
Industry Standards & Frameworks
Insurance industry guidelines Risk assessment frameworks Regulatory requirements

Email Security

Protection of email accounts and communications from unauthorized access, loss, or compromise.

High Communication Security High
Technical Overview: Protects email systems using encryption, authentication, and filtering technologies
Real-World Examples
  • Email encryption (PGP/S-MIME)
  • Anti-phishing and anti-spam filters
  • DMARC authentication implementation
  • Secure email gateways
Prevention Methods
  • Email authentication protocols
  • End-to-end encryption implementation
  • Security awareness training
  • Gateway security solutions
Detection Methods
  • Email security gateways
  • Threat detection algorithms
  • User reporting mechanisms
  • Authentication monitoring
Mitigation Strategies
  • Authentication protocols
  • Encryption
  • Security training
  • Gateway protection
Notable Real-World Cases
Democratic National Committee email hack
Sony Pictures email breach and exposure
Business email compromise fraud schemes
Common Targets
Email communications User credentials Sensitive information Business processes
Related Terms
DMARC Email Encryption Phishing Protection Communication Security
Industry Standards & Frameworks
DMARC/SPF/DKIM S/MIME PGP RFC email security standards

Backup Security

Practices and technologies for protecting backup data and systems from unauthorized access, corruption, or destruction.

High Data Protection High
Technical Overview: Ensures backup data confidentiality, integrity, and availability for disaster recovery
Real-World Examples
  • Encrypted backup storage
  • Air-gapped backup systems
  • Immutable backup implementations
  • Backup integrity verification
Prevention Methods
  • Backup encryption implementation
  • Access control and authentication
  • Air-gap and immutable storage
  • Regular backup testing
Detection Methods
  • Backup integrity monitoring
  • Access audit logging
  • Corruption detection systems
  • Recovery testing validation
Mitigation Strategies
  • Encryption
  • Access controls
  • Testing procedures
  • Multiple copies
Notable Real-World Cases
Ransomware targeting backup systems
Cloud backup security breaches
Critical data recovery operations
Common Targets
Backup data Recovery systems Storage infrastructure Recovery processes
Related Terms
Data Recovery Business Continuity Disaster Recovery Ransomware Protection
Industry Standards & Frameworks
ISO 27001 NIST SP 800-34 Backup best practices

Network Router

A networking device that forwards data packets between computer networks, operating at the network layer of the OSI model.

High Network Infrastructure High
Technical Overview: Uses routing tables and protocols to determine optimal paths for data transmission
Real-World Examples
  • Cisco ISR routers for enterprise networks
  • Juniper MX series for service providers
  • MikroTik routers for small businesses
  • Home broadband routers
Prevention Methods
  • Router access control and authentication
  • Firmware updates and security patches
  • Network segmentation and VLANs
  • Traffic filtering and monitoring
Detection Methods
  • Router log monitoring and analysis
  • Traffic pattern analysis
  • Configuration change detection
  • Performance monitoring
Mitigation Strategies
  • Access controls
  • Regular updates
  • Monitoring
  • Configuration management
Notable Real-World Cases
Internet backbone routing infrastructure
Enterprise network segmentation using routers
ISP routing table management and BGP
Common Targets
Network traffic Routing protocols Configuration data Management interfaces
Related Terms
Switch Network Security BGP VLAN
Industry Standards & Frameworks
RFC 4271 (BGP) IEEE 802.1Q NIST Network Security

Network Switch

A networking device that connects devices on a computer network by using packet switching to receive and forward data.

High Network Infrastructure High
Technical Overview: Operates at the data link layer, using MAC addresses to forward frames between ports
Real-World Examples
  • Cisco Catalyst switches for enterprise
  • HP ProCurve managed switches
  • Unmanaged switches for home networks
  • PoE switches for power over Ethernet
Prevention Methods
  • Port security and access control
  • VLAN segmentation
  • Storm control and traffic shaping
  • Regular firmware updates
Detection Methods
  • Port monitoring and traffic analysis
  • MAC address tracking
  • Broadcast storm detection
  • Configuration change alerts
Mitigation Strategies
  • Port security
  • VLAN isolation
  • Traffic monitoring
  • Access controls
Notable Real-World Cases
Data center network fabric using switches
Enterprise LAN infrastructure
Industrial control system networks
Common Targets
Network segments Device connections Traffic flow Port configurations
Related Terms
Router VLAN Port Security Network Segmentation
Industry Standards & Frameworks
IEEE 802.1D IEEE 802.1Q IEEE 802.1X

Data Center

A facility used to house computer systems and associated components, such as telecommunications and storage systems.

Critical Infrastructure Critical
Technical Overview: Provides centralized computing, storage, and networking resources with high availability and security
Real-World Examples
  • Amazon Web Services data centers
  • Google Cloud Platform facilities
  • Microsoft Azure data centers
  • Enterprise on-premises data centers
Prevention Methods
  • Physical security controls and access management
  • Environmental monitoring and controls
  • Redundant power and cooling systems
  • Network security and segmentation
Detection Methods
  • Environmental monitoring systems
  • Security camera surveillance
  • Access control logging
  • Infrastructure monitoring tools
Mitigation Strategies
  • Physical security
  • Redundancy
  • Monitoring
  • Disaster recovery
Notable Real-World Cases
AWS global infrastructure with 25+ regions
Google's energy-efficient data center design
Facebook's Open Compute Project
Common Targets
IT infrastructure Data storage Network connectivity Power systems
Related Terms
Cloud Computing Infrastructure Security Disaster Recovery Network Security
Industry Standards & Frameworks
TIA-942 Uptime Institute Tier Standards ISO 27001

Data Warehouse

A large, centralized repository of data that is used for reporting and data analysis, designed for query and analysis rather than transaction processing.

High Data Management High
Technical Overview: Uses structured data models optimized for analytical queries and reporting
Real-World Examples
  • Amazon Redshift cloud data warehouse
  • Snowflake data warehouse platform
  • Google BigQuery serverless data warehouse
  • Teradata enterprise data warehouse
Prevention Methods
  • Data encryption at rest and in transit
  • Access control and role-based permissions
  • Data masking and anonymization
  • Regular security audits and monitoring
Detection Methods
  • Query monitoring and anomaly detection
  • Access pattern analysis
  • Data lineage tracking
  • Performance monitoring
Mitigation Strategies
  • Data encryption
  • Access controls
  • Monitoring
  • Compliance
Notable Real-World Cases
Netflix using data warehouse for content recommendations
Walmart's retail analytics data warehouse
Financial services risk analysis platforms
Common Targets
Business data Analytics workloads Reporting systems Decision support
Related Terms
Data Lake Business Intelligence ETL Data Analytics
Industry Standards & Frameworks
ISO 27001 GDPR SOX Data governance frameworks

Data Lake

A storage repository that holds a vast amount of raw data in its native format until it is needed for analytics and machine learning.

High Data Management High
Technical Overview: Stores structured, semi-structured, and unstructured data in native format for flexible analytics
Real-World Examples
  • Amazon S3 data lake implementation
  • Azure Data Lake Storage
  • Google Cloud Storage data lakes
  • Hadoop Distributed File System (HDFS)
Prevention Methods
  • Data governance and cataloging
  • Access control and data classification
  • Data quality monitoring
  • Security and compliance controls
Detection Methods
  • Data access monitoring and auditing
  • Data quality assessment tools
  • Usage pattern analysis
  • Compliance reporting
Mitigation Strategies
  • Data governance
  • Access controls
  • Monitoring
  • Quality management
Notable Real-World Cases
Netflix data lake for content analytics
Uber's big data platform for ride optimization
Healthcare organizations for patient data analysis
Common Targets
Raw data Analytics workloads Machine learning models Business intelligence
Related Terms
Data Warehouse Big Data Data Governance Machine Learning
Industry Standards & Frameworks
ISO 27001 GDPR Data governance frameworks Cloud security standards

Data Engineering

The practice of designing, building, and maintaining data infrastructure and systems for collecting, processing, and analyzing data.

Medium Data Management Medium
Technical Overview: Involves data ingestion, transformation, storage, and serving layers for analytics and applications
Real-World Examples
  • ETL pipeline development
  • Real-time data streaming with Apache Kafka
  • Data pipeline orchestration with Apache Airflow
  • Data quality monitoring and validation
Prevention Methods
  • Data pipeline security and access controls
  • Data quality validation and monitoring
  • Error handling and alerting systems
  • Documentation and version control
Detection Methods
  • Pipeline monitoring and alerting
  • Data quality metrics tracking
  • Performance monitoring and optimization
  • Error rate analysis
Mitigation Strategies
  • Quality monitoring
  • Error handling
  • Documentation
  • Testing
Notable Real-World Cases
Netflix data engineering for content recommendations
Uber's real-time data processing platform
Financial services risk calculation pipelines
Common Targets
Data pipelines Processing systems Storage infrastructure Analytics platforms
Related Terms
ETL Data Pipeline Big Data Data Quality
Industry Standards & Frameworks
DataOps practices Data governance frameworks Software engineering best practices

ETL (Extract, Transform, Load)

A data integration process that extracts data from source systems, transforms it into a consistent format, and loads it into a target system.

Medium Data Processing Medium
Technical Overview: Three-phase process: extract from sources, transform for consistency, load into target systems
Real-World Examples
  • Apache Airflow for workflow orchestration
  • Talend data integration platform
  • Informatica PowerCenter
  • Custom Python ETL scripts
Prevention Methods
  • Data validation and quality checks
  • Error handling and retry mechanisms
  • Data lineage tracking and documentation
  • Security and access controls
Detection Methods
  • Data quality monitoring and alerting
  • Pipeline performance tracking
  • Error rate monitoring
  • Data lineage visualization
Mitigation Strategies
  • Quality validation
  • Error handling
  • Monitoring
  • Documentation
Notable Real-World Cases
Financial institutions data warehousing
E-commerce customer data integration
Healthcare patient data consolidation
Common Targets
Source systems Data warehouses Analytics platforms Reporting systems
Related Terms
Data Pipeline Data Warehouse Data Quality Data Integration
Industry Standards & Frameworks
DataOps practices Data governance frameworks ETL best practices

Big Data

Extremely large datasets that may be analyzed computationally to reveal patterns, trends, and associations, especially relating to human behavior and interactions.

Medium Data Management Medium
Technical Overview: Characterized by volume, velocity, variety, and veracity of data requiring specialized processing
Real-World Examples
  • Apache Hadoop ecosystem
  • Apache Spark for data processing
  • NoSQL databases (MongoDB, Cassandra)
  • Real-time streaming with Apache Kafka
Prevention Methods
  • Data governance and privacy controls
  • Scalable infrastructure design
  • Data quality and validation processes
  • Security and access management
Detection Methods
  • Data quality monitoring and metrics
  • Performance monitoring and optimization
  • Usage pattern analysis
  • Anomaly detection in data processing
Mitigation Strategies
  • Governance
  • Quality management
  • Security controls
  • Performance optimization
Notable Real-World Cases
Google's search engine processing petabytes of data
Facebook's social media analytics
Netflix's recommendation engine
Common Targets
Large datasets Analytics workloads Machine learning models Business intelligence
Related Terms
Data Lake Machine Learning Data Analytics Distributed Computing
Industry Standards & Frameworks
Data governance frameworks Privacy regulations (GDPR) Industry-specific standards

Data Governance

The overall management of the availability, usability, integrity, and security of data used in an enterprise.

High Data Management High
Technical Overview: Establishes policies, procedures, and controls for data management across the organization
Real-World Examples
  • Data classification and labeling
  • Data lineage tracking and documentation
  • Data quality standards and monitoring
  • Privacy and compliance frameworks
Prevention Methods
  • Data governance framework establishment
  • Policy development and enforcement
  • Data stewardship and ownership
  • Regular audits and assessments
Detection Methods
  • Data quality monitoring and reporting
  • Compliance tracking and alerting
  • Data usage analytics and auditing
  • Policy violation detection
Mitigation Strategies
  • Framework implementation
  • Policy enforcement
  • Monitoring
  • Regular assessment
Notable Real-World Cases
GDPR compliance implementations
Financial services regulatory compliance
Healthcare HIPAA data governance
Common Targets
Organizational data Compliance requirements Data quality Privacy protection
Related Terms
Data Quality Compliance Data Classification Privacy Protection
Industry Standards & Frameworks
ISO 8000 DAMA-DMBOK GDPR Industry-specific regulations

Data Quality

The degree to which data meets the requirements for its intended use in terms of accuracy, completeness, consistency, and reliability.

Medium Data Management Medium
Technical Overview: Ensures data meets defined standards for accuracy, completeness, consistency, and timeliness
Real-World Examples
  • Data validation and cleansing processes
  • Duplicate detection and removal
  • Data profiling and analysis
  • Quality scoring and monitoring
Prevention Methods
  • Data validation rules and constraints
  • Quality monitoring and alerting
  • Data cleansing and enrichment processes
  • Quality metrics and reporting
Detection Methods
  • Data profiling and analysis tools
  • Quality metrics calculation and tracking
  • Anomaly detection in data patterns
  • Quality score monitoring and alerting
Mitigation Strategies
  • Validation rules
  • Quality monitoring
  • Cleansing processes
  • Metrics tracking
Notable Real-World Cases
Financial services data quality for risk assessment
Healthcare patient data accuracy requirements
E-commerce customer data quality for personalization
Common Targets
Business data Analytics systems Reporting platforms Decision making
Related Terms
Data Governance Data Validation Data Cleansing Data Profiling
Industry Standards & Frameworks
ISO 8000 DAMA-DMBOK Industry-specific quality standards

Data Privacy

The protection of personal information and ensuring that data is collected, used, and shared in accordance with privacy laws and regulations.

High Privacy Protection High
Technical Overview: Implements technical and organizational measures to protect personal data and privacy rights
Real-World Examples
  • GDPR compliance implementations
  • Data anonymization and pseudonymization
  • Privacy by design principles
  • Consent management systems
Prevention Methods
  • Privacy by design implementation
  • Data minimization and purpose limitation
  • Consent management and user control
  • Regular privacy impact assessments
Detection Methods
  • Privacy compliance monitoring
  • Data usage tracking and auditing
  • Consent verification systems
  • Privacy violation detection
Mitigation Strategies
  • Privacy controls
  • Consent management
  • Data minimization
  • Regular assessment
Notable Real-World Cases
Facebook Cambridge Analytica privacy scandal
Google GDPR compliance and data protection
Healthcare HIPAA privacy implementations
Common Targets
Personal data Customer information Employee data Sensitive information
Related Terms
GDPR Data Protection Privacy by Design Consent Management
Industry Standards & Frameworks
GDPR CCPA ISO 27701 Privacy Shield

Data Encryption

The process of converting data into a code to prevent unauthorized access, ensuring confidentiality and integrity of information.

Critical Data Protection Critical
Technical Overview: Uses mathematical algorithms to transform plaintext into ciphertext using encryption keys
Real-World Examples
  • AES-256 encryption for data at rest
  • TLS/SSL for data in transit
  • Database encryption (TDE)
  • File-level encryption
Prevention Methods
  • Encryption key management and rotation
  • Strong encryption algorithms implementation
  • Encryption at rest and in transit
  • Regular encryption audits and testing
Detection Methods
  • Encryption compliance monitoring
  • Key usage and rotation tracking
  • Encryption strength assessment
  • Vulnerability scanning for weak encryption
Mitigation Strategies
  • Strong algorithms
  • Key management
  • Regular updates
  • Compliance monitoring
Notable Real-World Cases
Apple's end-to-end encryption for iMessage
Banking industry data encryption standards
Healthcare HIPAA encryption requirements
Common Targets
Sensitive data Communications Storage systems Applications
Related Terms
Cryptography Key Management Data Protection TLS/SSL
Industry Standards & Frameworks
FIPS 140-2 AES RSA Industry-specific encryption standards

Data Backup

The process of creating copies of data to protect against data loss, corruption, or disaster scenarios.

High Data Protection High
Technical Overview: Creates point-in-time copies of data for recovery and business continuity purposes
Real-World Examples
  • Automated backup systems
  • Cloud backup services
  • Incremental and differential backups
  • Disaster recovery backups
Prevention Methods
  • Regular automated backup scheduling
  • Multiple backup locations and redundancy
  • Backup testing and validation
  • Encryption and access controls
Detection Methods
  • Backup success monitoring and alerting
  • Backup integrity verification
  • Recovery time testing
  • Backup storage monitoring
Mitigation Strategies
  • Regular backups
  • Multiple locations
  • Testing procedures
  • Access controls
Notable Real-World Cases
Ransomware recovery using backups
Natural disaster data recovery
System failure data restoration
Common Targets
Critical data Business systems Applications Databases
Related Terms
Disaster Recovery Data Recovery Business Continuity Ransomware Protection
Industry Standards & Frameworks
ISO 27001 NIST SP 800-34 Backup best practices

Data Classification

The process of organizing data by relevant categories so it can be used and protected more efficiently and effectively.

High Data Management High
Technical Overview: Categorizes data based on sensitivity, value, and regulatory requirements
Real-World Examples
  • Public, Internal, Confidential, Restricted levels
  • GDPR personal data classification
  • Healthcare PHI classification
  • Financial data sensitivity levels
Prevention Methods
  • Automated data discovery and classification
  • Data labeling and tagging systems
  • Access control based on classification
  • Data handling procedure development
Detection Methods
  • Data discovery and scanning tools
  • Content classification engines
  • Policy compliance monitoring
  • Data usage pattern analysis
Mitigation Strategies
  • Classification policies
  • Automated tools
  • Access controls
  • Regular reviews
Notable Real-World Cases
Government classified information systems
Banking customer data protection programs
Healthcare HIPAA compliance implementations
Common Targets
Personal data Financial records Intellectual property Operational data
Related Terms
Data Loss Prevention Information Governance Privacy Protection Compliance
Industry Standards & Frameworks
ISO 27001 GDPR HIPAA NIST Data Classification

Data Loss Prevention (DLP)

Set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users.

High Data Protection High
Technical Overview: Uses content analysis, context analysis, and statistical analysis to identify sensitive data
Real-World Examples
  • Email DLP preventing sensitive data transmission
  • Endpoint DLP monitoring file transfers
  • Network DLP scanning traffic for data leaks
  • Cloud DLP protecting cloud-stored data
Prevention Methods
  • Data classification and labeling
  • Content inspection and analysis
  • User activity monitoring
  • Encryption and rights management
Detection Methods
  • Pattern matching and fingerprinting
  • Machine learning classification
  • Behavioral analytics
  • Policy violation alerting
Mitigation Strategies
  • Data discovery
  • Policy enforcement
  • User training
  • Encryption
Notable Real-World Cases
Edward Snowden NSA data exfiltration highlighting DLP gaps
Healthcare organizations using DLP for HIPAA compliance
Financial services implementing DLP for PCI DSS
Common Targets
Customer data Intellectual property Financial records Personal information
Related Terms
Data Classification Information Rights Management Data Governance Privacy Protection
Industry Standards & Frameworks
ISO 27001 GDPR HIPAA PCI DSS
Show terminologies per page