Direct book connectionAttack Vectors
An attack vector is the route, method, or mechanism an adversary uses to reach a target and attempt an unauthorized action.
Open article →Direct book connectionControl Objectives
A control objective states the security or risk outcome a control or group of controls is intended to achieve, providing a basis for design, implementation, and assessment.
Open article →Direct book connectionDefense in Depth
Defense in depth uses overlapping controls across people, process, technology, and physical environments to reduce the impact of any single weakness.
Open article →Direct book connectionFalse Positives and False Negatives
False positives are benign events incorrectly classified as malicious, while false negatives are harmful events that a control or analytic fails to detect.
Open article →Direct book connectionHITRUST CSF
The HITRUST CSF combines requirements from multiple sources into a structured control framework used for risk management and assurance.
Open article →Direct book connectionMAC Addresses
A media access control address is a link-layer identifier used by network interfaces and local network technologies to deliver frames within a broadcast domain.
Open article →Direct book connectionNIST SP 800-53
NIST SP 800-53 provides a broad catalog of security and privacy controls that organizations can select, tailor, implement, assess, and monitor according to risk and requirements.
Open article →Direct book connectionPeople, Process, and Technology
People, process, and technology form an interdependent security system: skilled people make decisions, repeatable processes coordinate work, and technology implements or supports controls.
Open article →Direct book connectionQualitative and Quantitative Risk Analysis
Qualitative risk analysis uses descriptive judgments and ordered scales, while quantitative analysis uses numeric estimates, ranges, distributions, or monetary values to support decisions.
Open article →Direct book connectionSafety and Security
Security limits unauthorized or harmful actions, while safety limits unacceptable harm to people, property, the environment, or mission when systems operate or fail.
Open article →Direct book connectionSAML
Security Assertion Markup Language is an XML-based standard used to exchange authentication and authorization assertions between an identity provider and a service provider.
Open article →Direct book connectionSecurity Assumptions
Security assumptions are conditions believed to be true about users, systems, threats, dependencies, and controls; they must be stated and tested because designs fail when hidden assumptions are wrong.
Open article →
