Cybersecurity: Module 1

In the early days of computers, this term specified the need to secure the physical location of computer technology from outside threats. This term later came to represent all actions taken to preserve computer systems from losses. It has evolved into the current concept of information security as the scope of protecting information in an organization has expanded.

A state of being secure and free from danger or harm. Also, the actions taken to make someone or something secure.

Protection of the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission, via the application of policy, education, training and awareness, and technology.

A subset of communications security ; the protection of voice and data networking components, connections, and content.

The industry standard for computer security since the development of the mainframe. The standard is based on three characteristics that describe the utility of information: confidentiality, integrity, and availability.

A subject or object’s ability to use, manipulate, modify, or affect another subject or object. Authorized users have legal access to a system, whereas hackers must gain illegal access to a system.

The organizational resource that is being protected.

An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it.

Security mechanisms, policies, or procedures that can successfully counter attacks, reduce risk, resolve vulnerabilities, and otherwise improve security within an organization.

A technique used to compromise a system.

A condition or state of being exposed, exists when a vulnerability is known to an attacker

A single instance of an information asset suffering damage or destruction, unintended or unauthorized modification or disclosure, or denial of use

The entire set of controls and safeguards, including policy, education, training and awareness, and technology, that the organization implements to protect the asset

The probability of an unwanted occurrence, such as an adverse event or loss

A computer can be either the subject of an attack—an agent entity used to conduct the attack—or the object of an attack: the target entity

Any event or circumstance that has the potential to adversely affect operations and assets.

The specific instance or a component of a threat.

An occurrence of an event caused by a threat agent.

A category of objects, people, or other entities that represents the origin of danger to an asset

An attribute of information that describes how data is accessible and correctly formatted for use without interference or obstruction.

An attribute of information that describes how data is free of errors and has the value that the user expects.

An attribute of information that describes how data is genuine or original rather than reproduced or fabricated.

An attribute of information that describes how data is protected from disclosure or exposure to unauthorized individuals or systems.

Information about a person’s history, background, and attributes that can be used to commit identity theft. This information typically includes a person’s name, address, Social Security number, family information, employment history, and financial information.

An attribute of information that describes how data is whole, complete, and uncorrupted.

An attribute of information that describes how data has value or usefulness for an end purpose.

An attribute of information that describes how the data’s ownership or control is legitimate or authorized.

A graphical representation of the architectural approach widely used in computer and information security; commonly shown as a cube composed of 3×3×3 cells, similar to a Rubik’s Cube.

The protection of physical items, objects, or areas from unauthorized access and misuse.

A method of establishing security policies and/or practices that begins as a grassroots effort in which systems administrators attempt to improve the security of their systems.

A methodology of establishing security policies and/or practices that is initiated by upper management.

A methodology for the design and implementation of an information system. The SDLC contains different phases depending on the methodology deployed, but generally the phases address the investigation, analysis, design, implementation, and maintenance of an information system.

A formal approach to solving a problem based on a structured sequence of procedures.

A type of SDLC in which each phase of the process “flows from” the information gained in the previous phase, with multiple opportunities to return to previous phases and make adjustments.

A methodological approach to the development of software that seeks to build security into the development life cycle rather than address it at later stages. SA attempts to intentionally create software free of vulnerabilities and provide effective, efficient software that users can deploy with confidence.

An executive-level position that oversees the organization’s computing technology and strives to create efficiency in the processing and access of the organization’s information.

Typically considered the top information security officer in an organization. The CISO is usually not an executive-level position, and frequently the person in this role reports to the CIO.

A small functional team of people who are experienced in one or multiple facets of the required technical and nontechnical areas for the project to which they are assigned.

Individuals who control, and are therefore responsible for, the security and use of a particular set of information, may rely on custodians for the practical aspects of protecting their information, specifying which users are authorized to access it, but they are ultimately responsible for it.

Individuals who work directly with data owners and are responsible for storage, maintenance, and protection of information.

Internal and external stakeholders (customers, suppliers, and employees) who interact with information in support of their organization’s planning and operations.

A group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives.