Cyber Wiki Topic 01
Cybersecurity Foundations
Core models, principles, terminology, and ways of thinking that support every cybersecurity role.
Topic Directory
38 entries
Accountability
Accountability makes people, roles, services, and organizations answerable for security decisions and actions by assigning ownership and preserving reliable evidence.
Adversary analysis · FoundationalAttack Paths
An attack path is a sequence of reachable systems, identities, trust relationships, weaknesses, and actions that could let an adversary move from an initial foothold to a valuable objective.
Threat terminology · FoundationalAttack Vectors
An attack vector is the route, method, or mechanism an adversary uses to reach a target and attempt an unauthorized action.
Security objective · FoundationalAuthenticity
Authenticity provides confidence that an identity, message, device, document, or software artifact is genuine and comes from the claimed source.
NIST CSF Category profile · IntermediateAwareness and Training (PR.AT) — NIST CSF 2.0 Category
Use PR.AT to manage general awareness, role-specific knowledge, behavior, responsibilities, and task readiness within the Protect Function.
Security model · BeginnerCIA Triad
The CIA triad is a foundational model for describing what security is trying to preserve: authorized access, trustworthy information, and dependable service.
Secure design principle · IntermediateComplete Mediation
Complete mediation requires every security-relevant access request to be checked against current authorization rules rather than relying indefinitely on an earlier decision.
Control design · FoundationalControl Objectives
A control objective states the security or risk outcome a control or group of controls is intended to achieve, providing a basis for design, implementation, and assessment.
Core terminology · FoundationalCybersecurity and Information Security
Cybersecurity and information security overlap substantially, but information security centers on protecting information while cybersecurity emphasizes risks arising from connected digital systems and cyberspace.
Professional responsibility · IntermediateDue Care and Due Diligence
Due care means taking reasonable protective action, while due diligence means continually understanding risk and verifying that those actions remain appropriate.
Threat terminology · FoundationalExploits
An exploit is code, a technique, or a sequence of actions that takes advantage of a vulnerability or unsafe condition to produce unintended behavior.
Risk terminology · FoundationalExposure
Exposure is the condition of being reachable, visible, accessible, or otherwise subject to loss or attack because assets, identities, data, or services are presented to a threat.
Detection terminology · FoundationalFalse Positives and False Negatives
False positives are benign events incorrectly classified as malicious, while false negatives are harmful events that a control or analytic fails to detect.
NIST CSF Subcategory profile · IntermediateGeneral Cybersecurity Awareness and Training (PR.AT-01) — NIST CSF 2.0 Subcategory
Apply PR.AT-01 to achieve this CSF 2.0 outcome: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.
Secure design principle · FoundationalLeast Functionality
Least functionality limits systems to the services, features, protocols, software, accounts, and permissions required for their intended purpose.
Framework learning hub · All levelsMITRE ATT&CK® Educational Learning Center
A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.
Framework methodology · IntermediateMITRE ATT&CK® Tactics, Techniques, Sub-techniques, and Procedures
How ATT&CK separates adversary goals, general behaviors, more specific behavior variants, and the observed procedures used in real operations.
Framework comparison · IntermediateMITRE ATT&CK®, the Cyber Kill Chain, and the Diamond Model
How three complementary models answer different questions about adversary behavior, operation progression, relationships, and analytic context.
Operating model · FoundationalPeople, Process, and Technology
People, process, and technology form an interdependent security system: skilled people make decisions, repeatable processes coordinate work, and technology implements or supports controls.
Governance foundation · BeginnerPolicies, Standards, and Procedures
Policies state organizational intent, standards define required conditions, and procedures explain how people perform specific work.
Core terminology · FoundationalPrivacy and Security
Privacy governs appropriate processing of personal information and effects on people, while security protects information and systems from unauthorized access, change, disclosure, loss, and disruption.
Core terminology · FoundationalSafety and Security
Security limits unauthorized or harmful actions, while safety limits unacceptable harm to people, property, the environment, or mission when systems operate or fail.
Secure design principle · FoundationalSecure by Default
Secure by default means a product or service begins in a protective configuration and requires deliberate action to enable riskier access, features, or trust.
Security architecture · FoundationalSecurity Assumptions
Security assumptions are conditions believed to be true about users, systems, threats, dependencies, and controls; they must be stated and tested because designs fail when hidden assumptions are wrong.
Security practice · BeginnerSecurity Awareness Training
Security awareness training helps people recognize risk, make safer decisions, and know how to report suspicious activity before a small mistake becomes an incident.
Control practice · BeginnerSecurity Baselines
A security baseline defines the minimum approved configuration and protection level for a class of systems, services, accounts, or devices.
Operations terminology · FoundationalSecurity Events, Alerts, and Incidents
A security event is an observable occurrence, an alert is a notification that selected activity may need attention, and an incident is an event or series of events that meets defined criteria for harmful or policy-violating impact.
Security objective · FoundationalSecurity Objectives
Security objectives describe the properties and outcomes a system or organization must preserve, including confidentiality, integrity, availability, authenticity, accountability, and resilience.
Security decision-making · FoundationalSecurity Trade-Offs
Security trade-offs balance protection with usability, cost, performance, speed, privacy, safety, resilience, and mission needs rather than treating maximum restriction as the only goal.
Security principle · BeginnerSeparation of Duties
Separation of duties divides sensitive work so one person cannot complete, approve, and conceal a high-risk action alone.
Resilience engineering · FoundationalSingle Points of Failure
A single point of failure is a component, person, service, dependency, or process whose loss can stop a critical function because no effective alternative exists.
NIST CSF Subcategory profile · IntermediateSpecialized Role Training (PR.AT-02) — NIST CSF 2.0 Subcategory
Apply PR.AT-02 to achieve this CSF 2.0 outcome: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind.
Operational method · BeginnerTechnical Troubleshooting Methodology
A troubleshooting methodology provides a disciplined sequence for identifying a problem, testing likely causes, implementing a fix, and verifying the outcome.
Framework structure · IntermediateThe MITRE ATT&CK® Data Model
How ATT&CK represents tactics, techniques, sub-techniques, relationships, detections, mitigations, groups, software, campaigns, and supporting references as connected objects.
Framework structure · IntermediateThe MITRE ATT&CK® Enterprise Matrix
How the Enterprise matrix organizes observed adversary behaviors by tactical objective without turning the matrix into a checklist of products.
Core concept · BeginnerThreats, Risks, and Vulnerabilities
A vulnerability is a weakness, a threat is something capable of exploiting or harming, and risk reflects the potential effect of that interaction on an objective or asset.
Security architecture · FoundationalTrust Decisions
A trust decision determines whether an identity, device, service, data source, network, or organization receives access or influence under defined evidence and conditions.
ATT&CK mitigation profile · IntermediateUser Training (M1017)
Prepare people to recognize, avoid, report, and respond to adversary actions relevant to their role, systems, data, and authority. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.