🔐Core Security Concepts
Asset – Any data, device, or system that has value to an organization.
Threat – Any potential danger that can exploit a vulnerability.
Risk – The potential for loss or damage when a threat exploits a vulnerability.
Vulnerability – A weakness in a system that can be exploited.
Exploit – A method used to take advantage of a vulnerability.
Attack Vector – The path or means by which a hacker gains access.
Attack Surface – The total exposure a system has to potential attacks.
Mitigation – Steps taken to reduce the severity of a risk or threat.
Defense in Depth – A layered approach to security.
Security Posture – The overall security status of an organization’s networks and systems.
CIA Triad – Confidentiality, Integrity, Availability – core principles of cybersecurity.
Confidentiality – Ensuring information is not accessed by unauthorized individuals.
Integrity – Ensuring information is not altered or tampered with.
Availability – Ensuring systems and data are accessible when needed.
Non-repudiation – Assurance that someone cannot deny the validity of their signature or a message.
Least Privilege – Granting the minimum access needed to perform a task.
Zero Trust – Security model assuming no trust for anyone inside or outside the network.
Security Policy – A formal set of rules for system protection.
Security Control – Safeguards to reduce risk (administrative, technical, physical).
Compensating Control – Alternative measures used to satisfy a security requirement.
Risk Assessment – Evaluating threats, vulnerabilities, and potential impacts.
Security Audit – A systematic evaluation of security policies and controls.
Security Baseline – Minimum security configuration standards.
Security Metrics – Measurements used to assess the effectiveness of security controls.
Governance – Establishing policies and processes for managing cybersecurity.
🛡️ Common Threats & Attacks
Phishing – Fraudulent attempts to obtain sensitive info by pretending to be trustworthy.
Spear Phishing – Targeted phishing attack aimed at a specific individual.
Whaling – Phishing attack targeting high-level executives.
Smishing – Phishing via SMS messages.
Vishing – Phishing via voice calls.
Spoofing – Impersonating a trusted source to deceive victims.
Man-in-the-Middle (MITM) – Intercepting and altering communication between two parties.
DDoS (Distributed Denial of Service) – Overwhelming a system with traffic from multiple sources.
DoS (Denial of Service) – Making a system unavailable by flooding it with traffic.
Ransomware – Malware that encrypts data and demands payment for its release.
Spyware – Malware that secretly collects user information.
Adware – Software that displays unwanted ads.
Trojan Horse – Malicious software disguised as legitimate.
Worm – Self-replicating malware that spreads without user action.
Rootkit – Malware designed to gain unauthorized root/admin-level control.
Keylogger – Software or hardware that records keystrokes.
Credential Stuffing – Using leaked credentials to attempt logins on other platforms.
SQL Injection – Injecting malicious SQL code to manipulate databases.
XSS (Cross-Site Scripting) – Injecting malicious scripts into webpages.
Command Injection – Running arbitrary commands on a host operating system.
Privilege Escalation – Gaining higher-level permissions than intended.
Buffer Overflow – Overwriting memory to execute malicious code.
Brute Force Attack – Trying many passwords or keys to gain unauthorized access.
Dictionary Attack – Using a list of common passwords to attempt logins.
Session Hijacking – Taking over a user’s session after they log in.
Drive-by Download – Automatic download of malware from a compromised website.
Logic Bomb – Malicious code triggered by a specific event.
Watering Hole Attack – Compromising websites commonly visited by a target.
Backdoor – Hidden access point that bypasses security.
Malvertising – Distributing malware through online ads.
Typosquatting – Registering misspelled domains to trick users.
Rogue Software – Fake software posing as legitimate security software.
Social Engineering – Manipulating individuals to gain confidential info.
Tailgating – Following someone into a restricted area.
Baiting – Offering something enticing to trick victims into revealing data.
Quishing – QR code phishing.
Bluejacking – Sending unsolicited messages via Bluetooth.
Bluesnarfing – Unauthorized access via Bluetooth.
Eavesdropping – Intercepting private communication.
Session Replay Attack – Capturing and reusing a valid data transmission.
🧰 Tools & Technologies
Firewall – Blocks unauthorized network traffic.
IDS (Intrusion Detection System) – Monitors network for malicious activity.
IPS (Intrusion Prevention System) – Blocks detected threats automatically.
Antivirus – Detects and removes known malware.
EDR (Endpoint Detection & Response) – Monitors endpoint behavior and responds to threats.
SIEM (Security Information and Event Management) – Aggregates and analyzes logs.
MFA (Multi-Factor Authentication) – Multiple methods to verify identity.
VPN (Virtual Private Network) – Encrypts internet traffic and hides user location.
Proxy Server – Intermediary for requests to other servers.
NAC (Network Access Control) – Enforces security policy on devices accessing the network.
Data Loss Prevention (DLP) – Protects sensitive data from unauthorized access.
Honey Pot – Decoy system to lure attackers.
Sandbox – Isolated environment for running suspicious code.
PKI (Public Key Infrastructure) – Manages encryption keys and digital certificates.
SSL/TLS – Encrypts data between web server and browser.
Hashing – Converts data to a fixed-length value to protect integrity.
Public Key – Used to encrypt data.
Private Key – Used to decrypt data.
Symmetric Encryption – Uses the same key for encryption and decryption.
Asymmetric Encryption – Uses public/private key pairs.
HMAC – Hash-based Message Authentication Code.
Tokenization – Replacing sensitive data with unique identifiers.
Federated Identity – Shared authentication across multiple systems.
Single Sign-On (SSO) – One login provides access to multiple systems.
Security Token – Device or software used to prove identity.
Biometric Authentication – Using physical traits for authentication.
Access Control List (ACL) – List defining access rights to resources.
Digital Certificate – Proves ownership of a public key.
Certificate Authority (CA) – Issues and verifies digital certificates.
Browser Isolation – Keeps browser activity separated from the main OS.
Threat Intelligence Platform – Aggregates and analyzes threat data.
SOAR (Security Orchestration, Automation, and Response) – Automates incident response.
Bastion Host – Hardened server used as a gateway.
Syslog – Standard for system log messaging.
SIEM Correlation Rules – Define patterns that indicate a threat.
Forensics Tool – Used for digital investigations.
Incident Management System – Tracks and manages security incidents.
IAM (Identity and Access Management) – Manages user identities and access.
UEBA (User and Entity Behavior Analytics) – Detects anomalies in user behavior.
Red Team – Simulates attacks to test defenses.
Blue Team – Defends against simulated attacks.
Purple Team – Collaborates between Red and Blue teams.
Security Awareness Training – Educates users on threats and safe practices.
Patch Management – Regularly updating software to fix vulnerabilities.
Configuration Management – Maintaining secure settings and baselines.
Regulations & Standards
GDPR (General Data Protection Regulation) – EU regulation for data privacy and protection.
HIPAA (Health Insurance Portability and Accountability Act) – U.S. regulation protecting health data.
PCI-DSS (Payment Card Industry Data Security Standard) – Standard for secure handling of credit card data.
SOX (Sarbanes-Oxley Act) – U.S. law aimed at corporate financial transparency.
FISMA (Federal Information Security Management Act) – U.S. law for protecting federal systems.
FERPA (Family Educational Rights and Privacy Act) – U.S. law protecting student education records.
NIST (National Institute of Standards and Technology) – U.S. agency that provides cybersecurity standards.
NIST CSF (Cybersecurity Framework) – Set of guidelines for improving cybersecurity.
NIST 800-53 – Controls for federal information systems.
NIST 800-171 – Standards for protecting controlled unclassified information (CUI).
ISO/IEC 27001 – International standard for information security management systems (ISMS).
ISO/IEC 27002 – Provides guidelines for implementing security controls.
COBIT – Framework for managing and governing enterprise IT.
CIS Controls – Best practices for securing IT systems and data.
CSA CCM (Cloud Controls Matrix) – Framework for securing cloud computing environments.
SOC 2 (System and Organization Controls) – Auditing procedure for service providers.
ITIL (Information Technology Infrastructure Library) – Framework for IT service management.
Basel III – Banking regulation affecting risk management.
GLBA (Gramm-Leach-Bliley Act) – U.S. regulation for financial privacy.
CCPA (California Consumer Privacy Act) – U.S. law giving consumers control over personal data.
NYDFS 500 – New York Department of Financial Services cybersecurity regulation.
CMMC (Cybersecurity Maturity Model Certification) – DoD framework for contractor security.
Cyber Essentials – UK cybersecurity certification scheme.
Red Flag Rules – Requires organizations to detect and prevent identity theft.
Privacy Impact Assessment (PIA) – Analysis of how data is collected, used, and protected.
Risk Register – A document listing identified risks and mitigation strategies.
Audit Trail – A record of system activity.
Due Diligence – Ongoing monitoring to ensure compliance.
Data Classification – Categorizing data based on sensitivity.
Data Retention Policy – Rules for storing and deleting data.
Security Controls Assessment (SCA) – Evaluation of security controls’ effectiveness.
Compliance – Adherence to laws, regulations, and standards.
Governance, Risk, and Compliance (GRC) – Integrated approach to managing risk and ensuring compliance.
Policy Exception – Documented approval to bypass standard policy under specific conditions.
Security Gap Analysis – Comparison between current security posture and desired state.
👥 Cybersecurity Roles
CISO (Chief Information Security Officer) – Senior executive responsible for security strategy.
Security Analyst – Monitors and analyzes security threats.
Security Engineer – Designs and implements secure network solutions.
Security Architect – Builds comprehensive security structures and models.
Incident Responder – Handles and mitigates security incidents.
Penetration Tester (Ethical Hacker) – Simulates attacks to identify vulnerabilities.
Red Teamer – Tests defenses through simulated attacks.
Blue Teamer – Detects and defends against threats.
Purple Teamer – Facilitates collaboration between red and blue teams.
SOC Analyst – Operates in a Security Operations Center to monitor and respond to threats.
Risk Analyst – Assesses and mitigates risks.
Compliance Officer – Ensures compliance with laws and regulations.
IT Auditor – Evaluates and audits IT systems for compliance and security.
Threat Hunter – Proactively searches for signs of compromise.
Vulnerability Assessor – Identifies and evaluates system vulnerabilities.
IAM Specialist – Manages identity and access controls.
Forensics Analyst – Investigates security breaches and gathers digital evidence.
DevSecOps Engineer – Integrates security into development and operations.
Cloud Security Engineer – Secures cloud platforms and services.
Malware Analyst – Studies malware to understand and neutralize it.
Privacy Officer – Oversees data privacy initiatives and regulations.
Application Security Engineer – Secures software throughout its development lifecycle.
Security Trainer – Educates employees on cybersecurity awareness.
Bug Bounty Hunter – Finds and reports vulnerabilities for rewards.
Security Researcher – Studies emerging threats and technologies.
🚀 Emerging Tech & Concepts
Zero-Day Exploit – A vulnerability exploited before the developer is aware of it.
AI in Cybersecurity – Use of artificial intelligence for threat detection.
Machine Learning (ML) – Enables systems to learn from data and improve detection.
Quantum Cryptography – Uses quantum mechanics to secure data.
Blockchain Security – Applying distributed ledger technology for data integrity.
Homomorphic Encryption – Encrypts data while allowing computations on it.
Confidential Computing – Protects data in use by performing computation in a secure enclave.
Edge Security – Securing devices and data at the edge of networks.
5G Security – Addressing new threats in high-speed mobile networks.
IoT Security – Securing Internet of Things devices and networks.
Supply Chain Attack – Compromising a third-party provider to breach a target.
Deepfake – AI-generated media that can be used for social engineering.
Cyber Resilience – The ability to recover from cyberattacks.
Threat Modeling – Identifying and assessing potential threats during design.
Secure SDLC – Integrating security in the software development life cycle.
Security by Design – Building security into system architecture from the start.
Container Security – Securing applications in containers like Docker.
API Security – Protecting APIs from threats and abuse.
Mobile Security – Securing smartphones and tablets.
BYOD Security – Managing security for employee-owned devices.
Shadow IT – IT systems used without organizational approval.
Deception Technology – Lures attackers into fake environments to detect threats.
Cyber Hygiene – Routine practices for maintaining system health.
Bug Bounty Program – Rewarding ethical hackers for finding vulnerabilities.
Threat Landscape – Overview of current and emerging cyber threats.
Kill Chain – Model describing the stages of a cyberattack.
MITRE ATT&CK – Framework for classifying attacker behaviors and tactics.
Cyber Threat Intelligence (CTI) – Information about threats used to make security decisions.
Digital Risk Protection (DRP) – Monitoring and defending against digital threats.
Security Champion – Developer or team member who promotes security practices.