Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
5.1.4. Security Terminology and Compliance
Key Terms:
| Term | Definition |
|---|---|
| Vulnerability | A weakness that could be exploited |
| Threat | Potential source of harm (attacker, disaster) |
| Exploit | Method of taking advantage of vulnerability |
| Risk | Probability of threat exploiting vulnerability × impact |
| Vulnerability scan | Automated tool that identifies and reports known weaknesses (e.g., missing patches) without exploiting them |
| Penetration test | Authorized testers actively exploit weaknesses using real attacker techniques to prove impact |
Risk Management:
- Avoidance: Eliminate the risk (don't do the risky activity)
- Mitigation: Reduce impact or likelihood (implement controls)
- Acceptance: Acknowledge and live with the risk
- Transfer: Shift risk to another party (insurance, outsourcing)
Inherent vs. Residual Risk: Inherent risk is the exposure before any controls; residual risk is what remains after controls are applied. Residual risk is never zero—it is accepted or treated further.
Compensating Control: An alternative safeguard used when the primary fix isn't possible yet—for example, isolating an unpatchable device on its own segment with tight firewall rules and IDS monitoring until the vendor patch arrives.
Compliance Frameworks:
- PCI DSS: Payment card industry security standards
- HIPAA: Healthcare data protection
- GDPR: EU data privacy regulations
Organizational Security Policies:
- Acceptable Use Policy (AUP): Defines permitted use of company network resources; violations are documented and handled through the organization's defined disciplinary (HR) process
- BYOD (Bring Your Own Device): Personal devices are allowed when enrolled in MDM (Mobile Device Management), which enforces device policy (passcode, encryption, remote wipe) and containerizes corporate apps and data apart from personal data
- Onboarding/Offboarding: Grant only the access a role needs at hire; when employment ends—immediately for a termination—disable all network and system access, then recover equipment
- Password policy: Favor length (passphrases) over forced composition rules and frequent expiration (NIST SP 800-63B); enforce password history to block reuse; set an account lockout threshold that auto-unlocks after a timeout to slow guessing without permanently locking users out
Enroll to unlock the 6 flashcards for this section and review them on a spaced-repetition schedule.
Written byAlvin Varughese
Founder•20 professional certifications