Concept Maps

Account

An account is a digital identity or container used to access systems, cloud resources, applications, or services.

AES

The Advanced Encryption Standard, the most widely used symmetric encryption algorithm, meaning the same key encrypts and decrypts data. It protects data at rest and in transit and is considered secure when used correctly with key sizes of 128, 192, or 256 bits.

Assets

Assets are systems, data, accounts, applications, devices, or services that an organization needs to protect.

Attack Surface

Attack surface is the set of places where an attacker could try to enter, influence, or abuse a system.

Attributes

In identity and access management, the pieces of information describing a user or entity, such as department, role, location, or clearance. Attributes drive modern authorization decisions and must be kept accurate to be trusted.

Authenticated Encryption

Authenticated encryption protects data confidentiality while also verifying that the ciphertext has not been changed.

Authenticity

Authenticity is confidence that data, users, systems, or messages are genuine and not impersonated or altered.

Availability

Availability means systems and information remain reachable and usable when people or services need them.

Block Ciphers

Symmetric encryption algorithms that encrypt data in fixed-size blocks, such as AES with its 128-bit blocks. They are a fundamental building block of modern encryption when combined with a mode of operation.

CIA Triad

The CIA triad is a model for thinking about confidentiality, integrity, and availability.

CIDR Notation

A compact way to write an IP address range and its network size, such as 192.168.1.0/24, where the number after the slash says how many leading bits define the network. It replaced rigid address classes with flexible subnetting.

CIS Benchmarks

Detailed, consensus-developed configuration guides from the Center for Internet Security that specify how to securely configure operating systems, applications, and devices. They turn 'harden this system' into concrete, checkable settings.

Cloud Audit Log

A cloud platform's record of control-plane activity, who called which API, on what resource, when, and from where. It is the foundational telemetry for detecting, investigating, and auditing actions in a cloud environment.

Compensating Controls

Compensating controls are alternative safeguards used when the preferred control cannot be implemented exactly as required.

Confidentiality

Confidentiality means information is only accessible to people, systems, or services that are authorized to see it.

Cryptography

The science of protecting information using mathematical techniques, providing confidentiality through encryption, integrity through hashing, and authenticity and non-repudiation through signatures. It underpins nearly all modern security.

Cybersecurity

The practice of protecting systems, networks, and data from digital attack, unauthorized access, and damage, by preserving the confidentiality, integrity, and availability of information. It is the overarching discipline this whole field sits within.

Data at Rest

Data stored on disk, in databases, backups, or other storage systems.

Data Classification

Labeling data based on sensitivity, value, or handling requirements.

Data in Transit

Data moving across a network, between systems, services, or users, where it is exposed to interception and tampering. Protecting it, primarily with encryption like TLS, is one of the core states of data protection.

Data in Use

Data actively being processed in memory or by an application, where it is typically decrypted and therefore exposed. It is the hardest of the three data states to protect, addressed by emerging techniques like confidential computing.

Defender

Anyone whose role is to protect systems, networks, and data from attack, spanning SOC analysts, incident responders, detection engineers, and security architects. The defender's perspective frames how security work is approached.

Defense in Depth

Defense in depth uses multiple layers of controls so one failure does not leave an asset fully exposed.

Deprovisioning

Removing a user's or entity's access when it is no longer needed, such as when an employee leaves or changes roles, by disabling accounts and revoking permissions. Prompt deprovisioning prevents orphaned access from becoming a security gap.

Detection Engineering

The practice of designing, testing, and improving logic that identifies suspicious activity.

Drift Detection

Identifying when a system's actual configuration has drifted away from its intended secure baseline, so the deviation can be investigated and corrected before it becomes a vulnerability or compliance gap.

Encapsulation

Wrapping data with protocol headers as it moves through network layers.

Frame

The unit of data at the data-link layer of a network, wrapping a packet with addressing (MAC addresses) for delivery across a local network segment. It is the lowest-level container in the common networking models.

Host

In a URL, the part identifying the server to connect to, typically a domain name or IP address. It tells the browser where to send the request and is key context when judging whether a request goes where expected.

HTTP

HTTP is the protocol browsers and applications use to request and transfer web content.

HTTP Method

The verb in an HTTP request, such as GET, POST, PUT, or DELETE, that indicates the action the client wants to perform. Methods carry security meaning, since some change data and access control must account for which are allowed.

Identifier

A value that uniquely names an identity within a system, such as a username, email, employee ID, or account number, used to reference and distinguish one identity from another.

Identity

The digital representation of a person, service, or device in a system, the set of attributes and credentials that distinguishes one actor from another and to which access and accountability are tied. It is the foundation of access control.

Identity Lifecycle

The full arc of an identity from creation to removal, joining, moving (role changes), and leaving, during which access must be provisioned, adjusted, and revoked so it always matches the person's current legitimate needs.

Identity Source of Truth

The authoritative system that holds the definitive record of identities, often an HR system for people, from which other systems derive accounts and access, so identity data stays consistent and lifecycle changes propagate reliably.

Inherence Factor

An authentication factor based on something you are, a biometric trait like a fingerprint, face, or iris, used to verify identity. It is one of the three classic factor categories alongside knowledge and possession.

Integrity

Integrity means information or systems remain accurate, complete, and protected from unauthorized change.

IP Addresses

Numeric labels assigned to devices on a network that identify them and enable routing of traffic to and from them. They are fundamental to networking and a key data point in detection, investigation, and access control.

IPv4

Internet Protocol version 4: the long-dominant IP addressing scheme using 32-bit addresses written as four numbers (like 192.168.1.1). Its limited address space led to NAT and the development of IPv6.

IPv6

Internet Protocol version 6: the newer IP addressing scheme using 128-bit addresses to vastly expand address space beyond IPv4. Defenders must account for it because it is often enabled by default and can create overlooked attack surface.

Joiner-Mover-Leaver

The model describing the three key transitions in the identity lifecycle, joining (onboarding and provisioning access), moving (role changes and access adjustment), and leaving (deprovisioning), that access management must handle reliably.

Key

In cryptography, the secret (or paired secret/public) value that controls an algorithm's operation, determining how data is encrypted, decrypted, signed, or verified. The security of cryptography rests on protecting keys, not on hiding the algorithm.

Knowledge Factor

An authentication factor based on something you know, such as a password, PIN, or answer to a security question, used to verify identity. It is one of the three classic factor categories alongside possession and inherence.

MAC Addresses

Hardware addresses assigned to network interfaces that identify devices on a local network segment, used for delivery at the data-link layer. They are local in scope, unlike IP addresses, which route across networks.

Network

The interconnected systems and the paths between them over which data flows. Understanding what a network is, its devices, protocols, and connections, is foundational to defending it, monitoring it, and reasoning about attacks.

NIST Cybersecurity Framework

A framework for organizing cybersecurity outcomes across identify, protect, detect, respond, and recover functions.

Non-Repudiation

The property that a party cannot credibly deny having performed an action, since cryptographic or audit evidence ties them to it. It supports accountability alongside the CIA triad's other properties.

Operational Intelligence

Threat intelligence about specific campaigns, operations, or imminent threats, more detailed than strategic intelligence but broader than individual indicators, helping defenders prepare for and respond to active threat activity.

OSI Model

A conceptual model that organizes network communication into layers.

Packet

The unit of data routed across networks at the network layer, carrying a payload plus addressing (IP) so it can travel from source to destination. Packets are fundamental units defenders inspect and analyze.

Path

The part of a URL that identifies a specific resource on a server, the portion after the host. Defenders read it to understand what is being requested and to recognize attacks like path traversal or forced browsing.

Permission Boundaries

A cloud IAM feature that sets the maximum permissions an identity can have, capping effective access even if broader permissions are granted, used to safely delegate administration without risking over-permissioning.

Port

A port is a numbered communication endpoint used by network protocols to identify which service should receive traffic.

Possession Factor

An authentication factor based on something you have, a hardware key, phone, smart card, that demonstrates possession to verify identity. One of the three classic factor types alongside knowledge and inherence.

Protocol

A protocol is a set of rules that systems follow to communicate.

Provisioning

Creating and granting accounts and access to identities, the joining-and-onboarding side of the identity lifecycle. Done well, provisioning is automated, timely, and grants only the access actually needed.

Request

An HTTP message sent by a client to a server asking for a resource or to perform an action. Defenders read requests to understand what users and attackers are doing on web applications.

Response

An HTTP message returned by a server to a client, carrying a status, headers, and content. Defenders read responses to understand application behavior and to spot leakage or anomalies in server replies.

Risk Appetite

The amount and type of risk an organization is willing to tolerate.

Risk Assessment

The structured analysis that identifies risks, evaluates their likelihood and impact, and produces input for treatment decisions. Risk assessment is foundational across security governance, analyst work, and GRC.

Risk Identification

The step of finding and naming the risks an organization faces, through workshops, scans, threat modeling, and other sources, so they can then be analyzed and treated rather than missed entirely.

Risk Register

A record of identified risks, owners, ratings, decisions, and follow-up actions.

Risk Treatment

Deciding what to do about each identified risk, mitigate, transfer, accept, or avoid, the formal step that turns analysis into action and ties risk to controls and decisions.

Scheme

The portion of a URL that names the protocol used (http, https, ftp, etc.), the first piece that tells the browser how to fetch the resource. Foundational to reading URLs and understanding web requests.

Security Incident

An event that compromises, or could compromise, the confidentiality, integrity, or availability of information or systems. The foundational category that incident response is organized around.

Security Posture

The overall state of an organization's security at a point in time, controls in place, exposures, maturity, performance, that summarizes how well-defended it is and where it needs to improve.

Service Accounts

Non-human accounts used by applications, scripts, and services to authenticate and access resources. Numerous, often privileged, and frequently neglected, they are a major identity-security focus.

Stateless Protocol

A protocol where each request is independent and the server keeps no memory of previous requests, like HTTP, which is why applications layer sessions on top to keep users logged in.

Status Code

A three-digit number in an HTTP response indicating outcome, 200 OK, 401 Unauthorized, 500 Internal Server Error, that defenders read to understand application behavior and detect abuse.

Strategic Intelligence

Big-picture threat intelligence about trends, actors, and risks at the level of months and years, that informs leadership decisions and strategy rather than day-to-day operations.

Stream Ciphers

Symmetric encryption algorithms that encrypt data one bit or byte at a time, useful for streaming use cases like real-time audio/video, contrasted with block ciphers that encrypt fixed-size chunks.

Subnet

A subnet is a smaller range of IP addresses carved out of a larger network.

Symmetric Encryption

Encryption that uses the same shared key to encrypt and decrypt data.

Sysmon

Microsoft Sysinternals' Sysmon: a Windows service that emits detailed process, network, and file events, vastly richer than default Windows logging. A go-to source for endpoint detection and hunting.

TCP/IP Model

The layered conceptual model behind internet networking, network access, internet, transport, and application layers, that organizes how data moves end to end across networks.

Threat Intelligence

Information about adversaries, their motivations, capabilities, and behaviors, that defenders consume to make better decisions about detection, response, and investment. Foundational to modern defense.

URL

Uniform Resource Locator: the structured address identifying a resource on the web. Reading URLs precisely (scheme, host, path, query) is foundational to web defense and threat investigation.

Web Application

A program delivered over HTTP/HTTPS that runs in browsers (client) and on servers, the dominant application form on the internet and the primary attack surface for defensive-web work.

Web Client

The software that consumes a web service or page, typically a browser, but also mobile apps, scripts, or bots. Defenders treat all clients as untrusted because anything can speak HTTP.

Web Server

Software that receives HTTP requests and serves responses, Apache, Nginx, IIS, or an application framework. The server side of the trust boundary in web defense.