The CISSP Glossary

The confidentiality-only security model behind CISSP Domain 3: No Read Up (Simple Security Property) and No Write Down (Star Property) keep classified data from leaking downward.

The integrity counterpart to Bell-LaPadula: No Read Down and No Write Up stop trusted data from being contaminated by less trustworthy sources. Confidentiality is out of scope.

The Chinese Wall model: access rights change dynamically based on what a user has already accessed, blocking conflicts of interest between competing clients' data.

A commercial integrity model built on well-formed transactions and separation of duties: users change data only through certified programs, never directly. Access triple: subject, program, object.

Layering physical, technical, and administrative controls so no single control failure exposes an asset; every layer assumes the layer in front of it can be breached.

A failure mode where a control defaults to denying access when it loses power or malfunctions, protecting the asset; contrast fail safe, which defaults to protecting people.

A security model defining eight primitive protection rights: how subjects and objects are securely created and deleted, and how access rights are granted, transferred, and revoked.

The Bell-LaPadula rule that a subject cannot read data classified above their clearance. Confidentiality's ceiling: a Secret clearance never opens a Top Secret file.

The Bell-LaPadula rule that a subject cannot write to a lower classification level, stopping cleared users from leaking secrets into documents that lower clearances can read.

A dedicated hardware chip that stores cryptographic keys, measures boot integrity, and seals secrets to a known-good platform state, anchoring full-disk encryption and secure boot.

A Clark-Wilson concept: data may only be changed by vetted procedures that move it from one consistent state to another, never by direct edits, preserving internal and external consistency.

A security model granting no implicit trust from network location: every request is authenticated, authorised, and continuously verified, wherever it originates.

Access control model that evaluates attributes of the subject, object, action, and environment (time, location, device) against policy for the most granular, context-aware decisions.

Access controlled at the owner's discretion: whoever owns a resource decides who else may use it. Flexible, but permissions can spread in ways no central policy intended.

Trust between organisations that lets one domain's identities access another's systems, with an identity provider asserting authentication to service providers via SAML, OAuth, or OIDC.

Forging Kerberos TGTs with the stolen KRBTGT password hash, giving an attacker any identity and any group membership in the domain, with a validity period the attacker chooses.

Verifying that a person is who they claim to be before credentials are issued, using evidence such as documents or biometrics; the registration step that authentication later relies on.

Privilege model granting elevated rights only for the duration of a task and revoking them afterwards, eliminating the standing privileges that attackers harvest through credential theft.

An attack where any authenticated domain user requests service tickets for accounts with SPNs, then cracks them offline to recover service account passwords. No admin rights needed.

The ticket-based network authentication protocol tested in CISSP Domain 5: a trusted KDC issues a TGT, then service tickets, using symmetric encryption so passwords never cross the wire.

The trusted third party at the heart of Kerberos, combining the Authentication Service and Ticket Granting Service. In Active Directory every domain controller runs a KDC.

The built-in Active Directory account whose password hash encrypts and signs every TGT in the domain. Stealing it enables golden tickets; remediation is a careful double password reset.

Granting each user, process, or account only the access its task requires, and no more. Limits the damage from mistakes, malware, and compromised credentials alike.

Access decided by the system comparing security labels against clearances, under a policy users cannot override. Not even a file's owner can share it outside policy.

Authentication requiring two or more different factor types (something you know, have, or are); two instances of the same type, such as two passwords, remain single-factor.

Both parties verify each other's identity before communicating: the client proves itself to the server and the server proves itself back. A defining property of Kerberos.

Stealing valid Kerberos tickets from a compromised machine's memory and replaying them from another system, authenticating as the victim without knowing any password or hash.

Access control model where permissions attach to roles and users receive roles matching their job function, simplifying administration and limiting privilege creep at scale.

Access control applying one global set of rules to every subject, as in firewall ACLs or time-of-day limits; distinct from role-based access control despite sharing the RBAC initials.

The unique identifier that ties a Kerberos-enabled service to the account that runs it. Accounts with SPNs can be requested as service tickets, which makes them Kerberoasting targets.

Forging a Kerberos service ticket with a stolen service account password hash. Scope is limited to that one service, but the attack never touches the KDC, so it leaves almost no logs.

Authenticate once, then access multiple systems without re-entering credentials. Improves usability and centralises control, but a compromised session unlocks everything at once.

The KDC component that exchanges a valid TGT for service tickets. Each service ticket is encrypted with the target service account's key, which is the property Kerberoasting exploits.

The Kerberos credential issued at logon that proves a user already authenticated. Presented to the TGS to obtain service tickets without re-entering a password. Forged TGTs are golden tickets.

Encryption using linked key pairs where what the public key encrypts only the private key can decrypt; slow, so used for key exchange and signatures rather than bulk data.

Hardcoding which certificate or public key a client will accept for a service, so a fraudulent certificate from a compromised CA is rejected even though it validates normally.

A message hash encrypted with the sender's private key, proving integrity, authenticity, and nonrepudiation to anyone with the matching public key; it provides no confidentiality.

A one-way function condensing any input into a fixed-length digest used to verify integrity; computationally infeasible to reverse, and secure only while collisions stay impractical.

Holding copies of cryptographic keys with a trusted third party so they can be recovered for continuity or produced for lawful access, trading confidentiality risk for availability.

An attack where the adversary secretly relays, and can alter, traffic between two parties who believe they communicate directly; defeated by mutual authentication and certificate validation.

Authenticating with a stolen password hash instead of the password itself, exploiting NTLM's use of the hash as the credential; no cracking needed, the hash is the secret.

The CAs, registration authorities, certificates, and revocation services (CRLs, OCSP) that bind identities to public keys and let strangers trust asymmetric cryptography at scale.

Capturing a valid authentication exchange and retransmitting it later to impersonate the original party. Defeated by timestamps, nonces, and sequence numbers that make each exchange unique.

An attack recovering secrets from an implementation's physical leakage (timing, power draw, emanations, cache behaviour) rather than from any weakness in the algorithm itself.

Encryption where one shared secret key both encrypts and decrypts: fast enough for bulk data, but burdened by the key distribution problem and n(n-1)/2 keys for n parties.

The process that identifies critical business functions and the impact of their disruption over time, producing the recovery metrics (RTO, RPO, MTD) that drive continuity planning.

Documented, unbroken record of who collected, handled, transferred, and stored evidence, with times and locations, proving it was not altered between collection and court.

Formal process taking every change through request, approval, testing, and rollback planning before implementation, so changes are deliberate, documented, and reversible.

A policy enforcement point between users and cloud services that delivers visibility, compliance, data security, and threat protection, including discovery of shadow IT.

Alternate facility providing only space, power, and environmental support; hardware and data arrive after the disaster, so activation takes weeks, at the lowest standing cost.

Content-inspection technology that identifies sensitive data and enforces policy to stop it leaving the organisation, deployed at the network edge, on endpoints, or as discovery scans.

The residual data that remains on storage media after deletion or formatting, recoverable until the media is properly cleared, purged, or destroyed.

The three conditions data occupies (at rest in storage, in transit across networks, in use during processing), each demanding its own distinct protection mechanisms.

Watching traffic that leaves the network for signs of data exfiltration, command-and-control beacons, and policy violations; the outbound counterpart to inbound-facing defences.

Decoy system with no production value, deployed to attract attackers so their tools and methods can be observed; any interaction with it is suspicious by definition.

Fully equipped alternate facility with hardware, software, and near-real-time data replication in place, able to take over within hours; the fastest and most expensive option.

Managed lifecycle for handling security incidents: detection, response, mitigation, reporting, recovery, remediation, and lessons learned, limiting damage and preventing recurrence.

Monitoring control that inspects network traffic or host activity for signs of attack and raises alerts without blocking; detection is signature-based or anomaly-based.

A forward-looking metric that warns risk exposure is approaching an unacceptable level, triggering management action before loss occurs, unlike a KPI, which measures achieved performance.

The longest a business process can be unavailable before the damage becomes unacceptable. The outer boundary every other recovery metric must fit inside: RTO plus WRT.

Testing that verifies what a system must not allow, inverting use cases into abuse scenarios to prove that invalid, malicious, or out-of-sequence actions are rejected.

An authorised simulated attack, run under written rules of engagement, that proves whether weaknesses are actually exploitable rather than merely listing them.

The maximum data loss a business can tolerate, measured as a time window backwards from a disruption. RPO drives backup frequency: a one-hour RPO needs backups at least hourly.

The maximum time a business process can be down before recovery must complete. A CISSP Domain 7 metric: RTO plus WRT must fit inside the Maximum Tolerable Downtime (MTD).

Running untrusted code in an isolated environment so its behaviour can be observed and contained without risk to production; the basis of malware detonation and browser isolation.

A formal, evidence-based evaluation of controls against a defined standard, performed by internal, external, or third-party auditors whose independence determines its credibility.

Centralised platform that aggregates logs from across the estate, normalises them, correlates events from multiple sources in near real time, and raises alerts for investigation.

Scripted, pre-built transactions run against live systems to verify functionality, availability, and response times proactively, catching failures before real users hit them.

Discussion-based walkthrough in which the response team talks through a disaster scenario against the plan, validating roles and decisions without touching any production system.

A systematic scan that identifies, quantifies, and ranks weaknesses across systems without exploiting them, trading depth for breadth and requiring validation of false positives.

Alternate facility with hardware and connectivity in place but no current data; backups must be restored on activation, giving recovery in days at a fraction of hot-site cost.

The time after a system is technically restored spent verifying data, reconciling records, and resuming normal processing. RTO plus WRT must fit inside the MTD.

The expected yearly cost of a risk: Single Loss Expectancy multiplied by Annualized Rate of Occurrence (ALE = SLE x ARO), the figure that justifies control spending in quantitative analysis.

An alternative control adopted when the primary control is impractical or too costly. It must meet the intent and rigour of the original requirement, not merely gesture at it.

The classification of security controls by the function they perform: preventive, detective, corrective, deterrent, recovery, and directive. One control can serve several functions at once.

The process of assigning sensitivity labels to information so that handling, storage, and access requirements follow from the label, and controls are selected to match it.

The technical role that implements data protection on the owner's behalf: backups, access permissions, patching, and secure storage. Responsible for the work, never accountable for the data.

The senior business role accountable for a data set: the owner classifies the data, approves access, and sets protection requirements, and that accountability cannot be delegated.

Doing what a reasonable, prudent person would do to protect the organisation's interests. The ongoing act of implementing and maintaining reasonable safeguards. The do part.

The investigation and ongoing assessment that informs prudent decisions: researching risks, vetting vendors, verifying controls. The homework that precedes due care's action.

The risk that remains after controls are applied. It can never reach zero, so leadership must formally accept whatever remains within the organisation's risk appetite.

The amount and type of risk leadership is willing to accept in pursuit of organisational objectives, set at board level and cascaded down as the boundary for every risk decision.

The decision on how to respond to an identified risk using one of four options: avoid it, transfer it, mitigate it, or accept it. Every identified risk gets exactly one deliberate response.

The binary decision about whether a baseline control applies to your environment at all. A control for a technology you do not run is scoped out. Applicability, not customisation.

The top of the governance document hierarchy: a mandatory, high-level statement of management intent, implemented through standards and procedures and advised by guidelines.

Splitting a critical process across multiple people so no individual can complete it alone, forcing collusion to commit fraud. A core control in Clark-Wilson and Domain 1 alike.

The monetary loss from one occurrence of a risk event: asset value multiplied by exposure factor (SLE = AV x EF), the per-incident building block of quantitative risk analysis.

Microsoft's threat categorisation model: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege, each violating one security property.

Identifying and reducing the risks inherited from suppliers, vendors, and service providers: tampered hardware, counterfeit components, malicious implants, and compromised updates.

Customising how the controls that apply to your environment are implemented: adjusting parameters, adding compensating controls, or refining assumptions to fit organisational reality.

Systematic identification and rating of the threats a system faces, performed during design so weaknesses are engineered out before deployment rather than discovered in production.

Layer 3 protocol suite securing IP traffic: AH gives integrity and origin authentication only, ESP adds confidentiality, and tunnel mode wraps the whole original packet for VPNs.

Admission control that authenticates devices and checks their security posture before granting network access, typically via 802.1X, shunting failures to a quarantine VLAN.

Dividing a network into isolated zones so compromise of one cannot spread laterally; spans physical separation, logical VLANs and firewalls, and workload micro-segmentation.

Seven-layer reference model, physical to application, used to place every protocol, device, and attack at the layer where it operates; the exam's favourite classification framework.

Architecture separating the control plane from the data plane: a centralised programmable controller sets forwarding policy network-wide, and becomes its highest-value target.

Protocol encrypting sessions above the transport layer: an asymmetric handshake authenticates the server and agrees symmetric session keys; the deprecated predecessor is SSL.

Layer 2 logical segmentation that splits one physical switch fabric into isolated broadcast domains via 802.1Q tags; separation without new hardware, subverted by VLAN hopping.

Encrypted tunnel carrying private traffic across untrusted networks; site-to-site links join whole networks through gateways, remote access serves single users, over IPsec or TLS.

A practice that makes security a shared responsibility across development and operations by automating security checks into the CI/CD pipeline instead of a bolt-on review at release.

Black-box testing that probes a running application from the outside, finding runtime and configuration flaws without source access, but unable to point to the offending line of code.

Automated inventory of the third-party and open-source components inside an application, mapping each to known vulnerabilities and licence obligations via a software bill of materials.

The phased process for building and retiring software, from requirements through design, development, testing, operation, and disposal, with security built into every phase from the start.

White-box testing that analyses source code or bytecode without executing the program, catching code-level flaws early in development but missing runtime and configuration issues.