The quality or state of being secure to be free from danger or harm

A model designed to guide policies for information security within an organization.

Whole, complete, and uncorrupted

Enables authorized users—people or computer systems—to access information without interference or obstruction and to receive it in the required format.

Ensures that only users with the rights, privileges, and need to access information are able to do so.

It places the responsibility of successful information security on a single staff member or security department.

It is initiated by upper management who issue policy, procedures, and processes, dictate goals and expected outcomes of project.

A methodological approach to the development of software that seeks to build security into the development life cycle rather than address it at later stages

It adopted a simplified SLDC for their approach, based on five phases: initiation, development/acquisition/implementation/assessment, operation/maintenance, and disposal.

The senior technology officer responsible for advising senior executives on strategic planning

Primarily responsible for assessment, management, and implementation of IS in the organization.

A number of individuals who are experienced in one or more facets of required technical and nontechnical areas.

Responsible for the security and use of a particular set of information.

Responsible for storage, maintenance, and protection of information

End users who work with information to perform their daily jobs supporting the mission of the organization.

It is based on the way individuals perceive systems technologists since computers became commonplace.

A website hosted by Mitre that serves as a tool that security professionals can use to understand attacks.

The unauthorized duplication, installation, or distribution of copyrighted computer software, which is a violation of intellectual property.

When an unauthorized person gains access to information an organization is trying to protect.

A person who stealthily manipulates a maze of computer networks, systems, and data to find information.

Master of several programming languages, networking protocols, and operating systems, and exhibits a mastery of the technical environment of the chosen targeted system.

Commonly associated with software copyright bypassing and password decryption.

The application of computing and network resources to try every possible password combination.

A variation of the brute force attack that narrows the field by using a dictionary of common passwords and includes information related to the target user.

Hash values are used to gain access to an encrypted password file

Human error or failure is used as a mechanism to gain password information

It is called “acts of God” as it presents the most dangerous threats that occur with little warning and beyond control of people.

Acts performed without intent or malicious purpose or in ignorance by an authorized user.

It is called cyberextortion and common in the theft pf credit card numbers.

to destroy an asset or damage the image of an organization

Accessing systems and damaging destroying critical data.

Unlawful attacks and threats of attacks against computers, networks and the information stored therein when done to intimidate or coerce a government or its people in furtherance of political or social objectives.

Leveraging social media to perform fundraising, raise awareness of social issues, gather support for legitimate causes, and promote involvement.

It consists of specially crafted software that attackers trick users into installing on their systems to overwhelm the processing capabilities of online systems or to gain access to protected systems by hidden means.

Occur when a manufacturer distributes equipment containing defects that can cause the system to perform outside of expected parameters, resulting in unreliable service or lack of availability.

Purposeful shortcuts perceived as bugs or errors left by programmers for benign or malign reasons.

The legal obligation of an entity extending beyond criminal or contract law; includes the legal obligation to make restitution.

The legal standard requiring a prudent organization to act legally and ethically and know the consequences of actions.

The court’s right to hear a case if the wrong was committed in its territory or involved its citizenry.

Strongly promotes education and provides discounts for student members.

Focuses on the development and implementation of information security certifications and credentials.

Professional research and education cooperative organization that offers a set of certifications called the Global Information Assurance Certification (GIAC).

Provides IT control practices and standards, and includes many information security components within its areas of concentration.

Its primary mission is to bring together qualified information security practitioners for information exchange and educational development.

It sets the long-term direction to be taken by the organization and each of its component parts.

It focuses on short-term undertakings that will be completed within one or two years.

It is derived from tactical planning to organize the ongoing, day-to-day performance of tasks.

According to Information Technology Governance Institute (ITGI), it includes all of the accountabilities and methods undertaken by the board of directors and executive management.

Oversee overall corporate security posture

Standards in actuality, are adopted widely by an industry and its customers.

Standards that are according to law and endorsed by a formal standards organization.

also known as general security policy, organizational security policy, IT security policy, or information security policy.

It requires frequent updates, and contains a statement about the organization’s position on a specific issue.

It functions as standards or procedures to be used when configuring or maintaining systems.

It is the responsibility of the CISO and is a control measure designed to reduce incidents of accidental security breaches by employees

It provides strategic planning to assure the continuous availability of information systems and in preparation for adverse events that become incidents or disasters.

A systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency.

The process of preparing an organization to handle a disaster and recover from it, whether the disaster is natural or man-made.

prepares an organization to reestablish or relocate critical business operations during a disaster that affects operations at the primary site.

It focuses first and foremost on the people involved.

Determination of the extent to which the organization’s information assets are exposed or at risk.

Application of controls to reduce the risks to an organization’s data and information systems.

Describes an assessment of the likelihood of an attack combined with its expected probability of success if it targets your organization (attack success probability).

Determining how much of an information asset could be lost in a successful attack.

Sometimes enforced in civil courts, where large damages can be awarded to plaintiffs who bring suits against organizations.