11. Glossary

Terms are defined in exam-relevant context with cross-references to the guide section where each concept is covered in depth. Use this as a quick-lookup reference during review — if a definition doesn't immediately make sense, revisit the referenced section for the full first-principles explanation.

Access Control List (ACL) — An ordered list of rules specifying which subjects can access which objects and what operations they can perform. See 6.2.2.

AES (Advanced Encryption Standard) — Symmetric block cipher. Key sizes: 128, 192, or 256 bits. Block size: 128 bits. Modes: CBC (legacy, no authentication), GCM (authenticated encryption, preferred). See 4.2.1.

ALE (Annual Loss Expectancy) — ALE = SLE × ARO. The expected annual financial loss from a specific threat. A control is cost-effective when (ALE_before − ALE_after) > annual control cost. See 2.3.1.

ARO (Annualized Rate of Occurrence) — The estimated frequency of a specific threat occurring within one year. An event expected once every four years has ARO = 0.25. See 2.3.1.

ASLR (Address Space Layout Randomization) — OS security feature that randomizes memory addresses of stack, heap, and libraries, making buffer overflow exploitation significantly harder. See 9.1.2.

Asymmetric Cryptography — Encryption using mathematically related key pairs: public key (freely shared) and private key (secret). Examples: RSA, ECDSA. Used for key exchange and digital signatures. See 4.2.1.

ABAC (Attribute-Based Access Control) — Access control model where authorization decisions evaluate multiple attributes: user, resource, and environmental (time, device posture, location). Most flexible model; underpins zero trust. See 6.2.2.

Availability — The assurance that authorized users can access information and systems when needed. One of the CIA triad. See 1.1.

BCP (Business Continuity Planning) — The process of creating systems and procedures to ensure critical business functions continue during and after a disruption. Focused on keeping the business running; distinct from DR (restoring IT). See 8.2.

BIA (Business Impact Analysis) — Analysis identifying critical business functions, their dependencies, and the financial/operational impact of disruption. Outputs: MTD, RTO, RPO for each critical function. See 8.2.1.

Bell-LaPadula Model — Formal security model for confidentiality. Rules: No Read Up (subject cannot read above clearance), No Write Down (subject cannot write below clearance). See 4.1.2.

Biba Model — Formal security model for integrity. Rules: No Read Down (subject cannot read below integrity level), No Write Up (subject cannot write above integrity level). Opposite of Bell-LaPadula. See 4.1.2.

Buffer Overflow — Vulnerability where more data is written to a buffer than it can hold, overwriting adjacent memory. Prevented by: memory-safe languages, ASLR, DEP, stack canaries. See 9.1.2.

CA (Certificate Authority) — A trusted third party that issues digital certificates binding a public key to an identity. The root CA's trustworthiness anchors the PKI trust hierarchy. See 4.2.2.

CER / EER (Crossover Error Rate / Equal Error Rate) — The point where a biometric system's FAR equals its FRR. The primary metric for comparing biometric accuracy. Lower CER = more accurate. See 6.2.1.

CIA Triad — Confidentiality, Integrity, and Availability — the three core security properties. All security controls map to preserving one or more of these properties. See 1.1.

Clark-Wilson Model — Integrity model for commercial environments. Uses Constrained Data Items (CDIs), transformation procedures (TPs). Ensures CDIs are modified only through authorized TPs with audit trails. See 4.1.2.

Cold Site — A disaster recovery facility that provides only space and power — no equipment or pre-loaded data. Recovery time: days to weeks. Lowest cost; highest RTO. See 8.2.1.

CSRF (Cross-Site Request Forgery) — Attack where a malicious site tricks an authenticated user's browser into sending requests to a trusted site. Prevention: CSRF tokens, SameSite cookie attribute. See 6.3.2.

CVE (Common Vulnerabilities and Exposures) — A publicly disclosed cybersecurity vulnerability with a standardized identifier (CVE-YYYY-NNNNN). See 7.1.1.

CVSS (Common Vulnerability Scoring System) — Framework for rating vulnerability severity. Base Score (0–10): intrinsic characteristics; Temporal Score: current exploitation state; Environmental Score: organizational context. See 7.1.1.

DAC (Discretionary Access Control) — Access control model where resource owners control access to their own resources. Flexible but susceptible to user error. See 6.2.2.

DAST (Dynamic Application Security Testing) — Tests a running application from the outside without source code access. Finds runtime issues. Cannot find source-level flaws or insecure algorithm choices. See 7.2.2, 9.2.2.

Data Custodian — The IT role responsible for implementing and maintaining security controls for data as directed by the data owner. See 3.1.1.

Data Owner — The business manager accountable for data — defines classification, access policy, and retention requirements. Not an IT role. See 3.1.1.

Defense in Depth — Security strategy employing multiple layers of controls so failure of any single control does not compromise the system. See 1.2, 4.1.1.

DEP (Data Execution Prevention) / NX Bit — Hardware/OS feature marking memory regions as non-executable. Prevents shellcode injected via buffer overflow from executing in data memory regions. See 9.1.2.

Digital Signature — Asymmetric cryptographic construct providing integrity, authentication, and non-repudiation. Signed with private key; verified with public key. Does not provide confidentiality. See 4.2.1.

DLP (Data Loss Prevention) — Technology detecting and preventing unauthorized transmission of sensitive data. Channel-centric: monitors email, web, USB, cloud uploads. See 3.2.3.

DR (Disaster Recovery) — The process of restoring IT systems and data after a major disruption. Focused on restoring technology; distinct from BCP (which keeps the business running). See 8.2.

Due Care — The actions taken by an organization to protect assets and demonstrate responsibility. "Doing what a reasonable person would do." Ongoing operational security. See 2.1.2.

Due Diligence — The investigation and assessment performed before making a decision (vendor selection, merger). Contrasts with due care (ongoing operations after the decision). See 2.1.2.

ECDSA / ECDHE — Elliptic Curve Digital Signature Algorithm / Diffie-Hellman Ephemeral. 256-bit ECDSA ≈ 3072-bit RSA in security strength. ECDHE provides forward secrecy. See 4.2.1.

EPSS (Exploit Prediction Scoring System) — A probability score (0–1) predicting likelihood a CVE will be exploited in the wild within 30 days. Complements CVSS for vulnerability prioritization. See 7.1.1.

FAR (False Acceptance Rate) — Biometric metric measuring how often unauthorized users are incorrectly accepted. Trades off against FRR. See 6.2.1.

Fail Secure / Fail Closed — The principle that on failure, a system should deny access by default, not grant it. Contrasts with fail-safe (physical safety context: doors open on failure). See 4.1.1, 9.2.1.

FIDO2 / WebAuthn — Passwordless authentication standard using asymmetric key pairs. Phishing-resistant (keys are domain-bound). See 6.1.2, 6.2.1.

Firewall — Network security device filtering traffic based on rules. Generations: packet filter (L3-L4, stateless), stateful inspection, application-layer proxy, NGFW. See 5.2.1.

Forensics, Digital — The process of collecting, preserving, analyzing, and presenting digital evidence in a legally admissible manner. Requires chain of custody, write-blockers, forensic imaging with hash verification. See 8.1.2.

Forward Secrecy (PFS) — Property where session keys are generated ephemerally and not derivable from the long-term private key. If the private key is later compromised, past sessions cannot be decrypted. Provided by DHE and ECDHE. See 4.2.1.

FRR (False Rejection Rate) — Biometric metric measuring how often authorized users are incorrectly rejected. Trades off against FAR. See 6.2.1.

Golden Ticket — A Kerberos attack forging a TGT using the KRBTGT account's password hash. Valid indefinitely; grants access as any user. Defense: protect DCs, rotate KRBTGT twice. See 6.1.2.

Hash Function — A one-way mathematical function producing a fixed-length digest from arbitrary input. Broken: MD5, SHA-1. Current: SHA-256, SHA-3. See 4.2.1.

HMAC (Hash-based Message Authentication Code) — Combines a cryptographic hash with a shared secret key. Provides integrity and authentication but not non-repudiation (shared key, not private key). See 4.2.1.

Hot Site — A disaster recovery facility that is fully operational with real-time or near-real-time data replication. Recovery time: minutes to hours. Highest cost. See 8.2.1.

IAM (Identity and Access Management) — The discipline managing digital identities and their access to resources. Encompasses: provisioning/deprovisioning, authentication, authorization, accountability. See Phase 6.

IDS (Intrusion Detection System) — Monitors network traffic or host activity for suspicious patterns and generates alerts. Out-of-band (cannot block traffic). See 5.2.2.

IPS (Intrusion Prevention System) — Inline version of IDS that can block detected threats in addition to alerting. Higher risk: false positives block legitimate traffic. See 5.2.2.

Integrity — The assurance that information has not been altered in an unauthorized manner. One of the CIA triad. Protected by: hashing, digital signatures, access controls, audit trails. See 1.1.

IPsec — Suite of protocols for securing IP communications. AH (Protocol 51): integrity + authentication, no encryption, no NAT traversal. ESP (Protocol 50): encryption + integrity + authentication. See 5.2.3.

ISO 27001 — International standard specifying requirements for an Information Security Management System (ISMS). Third-party certification available. See 2.1.2, 7.2.1.

Kerberos — Network authentication protocol using trusted third party (KDC). Key concepts: TGT, service tickets, 5-minute clock skew tolerance, KRBTGT account. Golden Ticket attack: forge TGT using KRBTGT hash. See 6.1.2.

Least Privilege — The principle that every subject should have only the minimum permissions required to perform its authorized function. Limits blast radius if compromised. See 4.1.1, 6.2.2, 9.2.1.

Legal Hold — A directive to preserve all potentially relevant ESI when litigation is "reasonably anticipated." Failure to preserve after duty arises = spoliation. See 3.2.2, 8.1.2.

MAC (Mandatory Access Control) — Access control model where the system enforces access based on classification labels and subject clearances. Implements Bell-LaPadula (confidentiality) or Biba (integrity). See 6.2.2.

MFA (Multi-Factor Authentication) — Authentication requiring two or more independent factors from different categories (know/have/are). Independence is the critical requirement. See 6.2.1.

MITRE ATT&CK — A knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. See 7.1.2.

MTD (Maximum Tolerable Downtime) — The longest period a critical business function can be unavailable before impact becomes unacceptable. The ceiling that RTO must be below. Set by business owners. See 8.2.1.

Need-to-Know — The principle that access to information should be granted only when the subject requires that specific information to perform their authorized function. See 1.2, 6.2.2.

NIST RMF (Risk Management Framework) — A six-step process: Categorize, Select, Implement, Assess, Authorize, Monitor. Mandatory for US federal systems. See 2.3.1.

Non-repudiation — The assurance that a party cannot deny having performed an action. Provided by asymmetric digital signatures (private key). HMAC does not provide non-repudiation. See 1.1, 4.2.1.

OAuth 2.0 — An authorization framework (not authentication) enabling resource owners to grant third parties limited access without sharing credentials. Does not authenticate the user; use OIDC for that. See 6.1.2.

OIDC (OpenID Connect) — Authentication layer built on OAuth 2.0. Adds an ID Token (JWT) containing user identity claims. OIDC = OAuth 2.0 + identity. See 6.1.2.

Order of Volatility — The sequence for forensic evidence collection based on how quickly evidence disappears. Most volatile first: CPU registers → RAM → network connections → running processes → disk → remote logs. See 8.1.2.

OWASP Top 10 — A list of the 10 most critical web application security risks. 2021: Broken Access Control (#1), Cryptographic Failures (#2), Injection (#3). See 9.1.2.

PAM (Privileged Access Management) — Controls, monitoring, and auditing of privileged accounts. Key components: just-in-time access, session recording, credential vaulting. See 6.2.2.

Parameterized Query — A SQL query technique where the structure of the query is defined separately from user-supplied data. The primary prevention for SQL injection. See 9.1.2.

PASTA (Process for Attack Simulation and Threat Analysis) — A seven-stage, risk-centric threat modeling methodology. Focuses on attacker perspective and business impact. See 2.3.3, 9.1.1.

PKI (Public Key Infrastructure) — The system for creating, managing, distributing, and revoking digital certificates. Components: CA, RA, CRL, OCSP, certificate repository. See 4.2.2.

RPO (Recovery Point Objective) — The maximum acceptable amount of data loss measured in time. An RPO of 4 hours means backups must run at least every 4 hours. See 8.2.1.

RBAC (Role-Based Access Control) — Access control model where permissions are assigned to roles, and users are assigned to roles. Reduces administration overhead. See 6.2.2.

Risk — The potential for loss or harm related to a threat exploiting a vulnerability. Risk management options: avoid, mitigate/reduce, transfer, accept. "Ignore" and "reject" are not valid options. See 1.3, 2.3.

RTO (Recovery Time Objective) — The target time for restoring a business function after a disruption. Must be less than MTD. See 8.2.1.

SAML (Security Assertion Markup Language) — XML-based federation protocol for SSO to web applications. Used for enterprise SSO to cloud services. See 6.1.2.

SBOM (Software Bill of Materials) — Machine-readable inventory of all software components and their versions. Enables rapid identification of affected systems when a component vulnerability is disclosed. See 2.5.3, 9.2.2.

SAST (Static Application Security Testing) — Analyzes source code without executing it. Finds injection patterns, hardcoded secrets, insecure function calls. Cannot find runtime issues. See 7.2.2, 9.2.2.

SIEM (Security Information and Event Management) — Platform that aggregates, normalizes, and correlates logs from multiple sources. Enables detection of attack patterns that span multiple systems. See 5.4.2, 7.3.1.

SLE (Single Loss Expectancy) — The expected financial loss from a single occurrence of a specific threat to a specific asset. SLE = Asset Value × Exposure Factor. See 2.3.1.

SOC 2 — Service Organization Control 2 report. Type I: controls designed appropriately at a point in time. Type II: controls operated effectively over a period (6–12 months). Type II is substantially more valuable. See 7.2.1.

Separation of Duties (SoD) — The principle that no single individual should control all aspects of a sensitive transaction or process. See 2.4.1, 4.1.1.

SSRF (Server-Side Request Forgery) — Attack where an attacker causes the server to make requests to internal or external resources. Ranked #10 in OWASP Top 10 (2021). See 9.1.2.

STRIDE — A threat modeling framework: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. See 2.3.3, 9.1.1.

TCB (Trusted Computing Base) — The hardware, firmware, and software that enforces the security policy. Must be minimal, isolated, and verifiable. See 4.1.1.

TLS (Transport Layer Security) — Protocol securing communications over networks. TLS 1.0/1.1 deprecated. TLS 1.2 acceptable. TLS 1.3 required for new deployments. See 4.2.2.

TPM (Trusted Platform Module) — Hardware chip storing cryptographic keys, performing cryptographic operations, and recording system boot measurements. Enables Secure Boot and disk encryption key protection. See 9.2.2.

Threat Modeling — A structured process for identifying threats to a system during design. STRIDE categorizes threat types; PASTA provides a comprehensive methodology. See 2.3.3, 9.1.1.

TOCTOU (Time of Check to Time of Use) — A race condition vulnerability where system state changes between check and use. Prevention: atomic operations, file locking, database transactions. See 9.1.2.

VPN (Virtual Private Network) — Encrypted tunnel extending a private network over a public network. Types: site-to-site, remote access. Protocols: IPsec, TLS, WireGuard. See 5.2.3.

Warm Site — A disaster recovery facility with infrastructure and software installed but requiring data restoration from backup. Recovery time: hours to days. Moderate cost. See 8.2.1.

XSS (Cross-Site Scripting) — Attack where malicious JavaScript is injected into a web application and executed in other users' browsers. Types: Reflected, Stored, DOM-based. Prevention: output encoding, Content Security Policy. See 9.1.2.

Zero Trust — A security architecture principle asserting "never trust, always verify." No implicit trust based on network location. Implemented via ABAC, micro-segmentation, strong authentication. See 4.1.1, 6.2.2.