D5Protection of Information Assets

Protection of Information Assets: Glossary

AAA (Authentication, Authorization, Accounting)
A security framework that controls resource access. Authentication verifies identity, authorization grants permissions, and accounting tracks user activity.
Access Control List (ACL)
A list of permissions attached to an object that specifies which users or system processes are granted access and what operations are allowed.
Advanced Persistent Threat (APT)
A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period to steal data.
Asymmetric Encryption
A cryptographic method that uses a pair of keys (public and private) for encryption and decryption. Examples include RSA and Elliptic Curve Cryptography.
Biometric Authentication
An authentication method that verifies identity based on unique physical or behavioral characteristics such as fingerprints, retinal patterns, or voice recognition.
CIA Triad
The three core principles of information security: Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring timely access).
Data Classification
The process of categorizing data based on its sensitivity and the impact of unauthorized disclosure. Common levels include public, internal, confidential, and restricted.
Data Loss Prevention (DLP)
Technologies and processes designed to detect and prevent unauthorized transmission or leakage of sensitive data outside the organization.
Digital Certificate
An electronic document issued by a Certificate Authority (CA) that binds a public key to an entity's identity, enabling secure communications and authentication.
Digital Signature
A cryptographic mechanism that uses the sender's private key to provide authentication, integrity, and nonrepudiation for electronic documents and messages.
Firewall
A network security device that monitors and controls incoming and outgoing traffic based on predetermined security rules. Types include packet filtering, stateful inspection, and application proxy.
Hashing
A one-way cryptographic function that converts data into a fixed-length value (digest). Used to verify data integrity; common algorithms include SHA-256 and MD5.
Intrusion Detection System (IDS)
A system that monitors network traffic or system activities for malicious activity or policy violations and generates alerts. It operates in a passive, detection-only mode.
Intrusion Prevention System (IPS)
A system that monitors network traffic and can automatically take action to block or prevent detected threats, operating inline with network traffic.
Least Privilege
A security principle that grants users and processes only the minimum level of access rights necessary to perform their authorized tasks.
Multi-Factor Authentication (MFA)
An authentication method requiring two or more independent credentials from different categories: something you know, something you have, or something you are.
Network Segmentation
The practice of dividing a network into separate zones or segments to limit the spread of attacks and control traffic flow between segments.
Nonrepudiation
The assurance that a party in a communication cannot deny the authenticity of their signature or the sending of a message. Achieved through digital signatures and audit logs.
Penetration Testing
A simulated cyberattack performed by authorized testers to identify exploitable vulnerabilities in systems, networks, or applications before malicious attackers can exploit them.
Public Key Infrastructure (PKI)
A framework of policies, procedures, hardware, software, and digital certificates used to manage the creation, distribution, and revocation of public keys.
RBAC (Role-Based Access Control)
An access control method that assigns permissions to defined roles rather than individual users. Users are then assigned to roles based on their job functions.
Single Sign-On (SSO)
An authentication mechanism that allows a user to log in once and gain access to multiple related but independent software systems without re-entering credentials.
Social Engineering
A manipulation technique that exploits human psychology to trick individuals into divulging confidential information or performing actions that compromise security.
Symmetric Encryption
A cryptographic method that uses the same key for both encryption and decryption. Examples include AES, DES, and 3DES. It is faster but requires secure key distribution.
Virtual Private Network (VPN)
A technology that creates an encrypted tunnel over a public network to provide secure, private communication between remote users or sites.
Vulnerability Assessment
A systematic examination of systems and networks to identify, quantify, and prioritize security weaknesses. It differs from penetration testing in that it does not exploit vulnerabilities.
Zero Trust Architecture
A security model based on the principle of 'never trust, always verify.' It requires strict identity verification for every user and device, regardless of network location.