Skip to content

Published on Leave a comment on Term of the Week: Integrity

What is it?

An assurance that information remains unaltered from its intended state as it is produced, transmitted, stored, and received. Ensuring integrity may include ensuring the non-repudiation and authenticity of information as well.

Why is it important?

Integrity is considered by many to be the most important element of the confidentiality, integrity, and availability (CIA) security triad. Any system that is otherwise available and confidential can still be rendered useless if a user cannot be confident that the information it contains is trustworthy, accurate, and complete.

...continue reading "Term of the Week: Integrity"

Published on Leave a comment on Term of the Week: Confidentiality

What is it?

The safeguarding of data from unauthorized access or disclosure.

Why is it important?

Confidentiality is part of the confidentiality, integrity, and availability (CIA) security triad. In the CIA security model, the objective of confidentiality is to prevent the disclosure of information to unauthorized entities.

...continue reading "Term of the Week: Confidentiality"

Published on Leave a comment on Term of the Week: Penetration Testing

What is it?

Authorized testing of a computer system or network with the intention of finding vulnerabilities. Also called pen testing.

Why is it important?

A cyberattack can harm not only your organization, but also customers, partners, employees, and vendors. Penetration testing can reveal vulnerabilities, suggest improvements to your systems, and reduce risk for your organization. In addition, penetration testing is encouraged and even required by certain industry standards.

...continue reading "Term of the Week: Penetration Testing"

2

Published on 2 Comments on Term of the Week: Static Application Security Testing

What is it?

A test for security vulnerabilities that looks at the source code or binary of an application without running it.

Why is it important?

Static Application Security Testing (SAST) can be used before an application is executable, enabling early and regular tests for security vulnerabilities. SAST allows developers to fix problems during the development phase of an application and at a much lower cost than when the code is in quality assurance (QA) or production.

...continue reading "Term of the Week: Static Application Security Testing"

Published on Leave a comment on Term of the Week: Threat Modeling

What is it?

A formal method to identify, characterize, and prioritize risks and threats, typically with the goal of reducing them, also known as threat analysis or risk analysis.

Why is it important?

Most software is riddled with vulnerabilities, and software is pervasive in devices such as phones, cars, voting machines, etc. Threat modeling is one of the most effective ways to avoid and find vulnerabilities.

...continue reading "Term of the Week: Threat Modeling"

Published on Leave a comment on Term of the Week: Audit

What is it?

A systematic investigation of network and system activities and events.

Why is it important?

Auditing evaluates the who, what, where, and when of events on a network, which helps managers identify critical events that may have an impact on their organization.

...continue reading "Term of the Week: Audit"

Published on Leave a comment on Term of the Week: Metrics

What is it?

A quantifiable measurement used to help organizations evaluate performance.

Why is it important?

Metrics provide a standard for measuring the performance of governance programs and controls established to protect an organization’s assets, interests, and resources.

...continue reading "Term of the Week: Metrics"

Published on Leave a comment on Term of the Week: Risk Register

What is it?

A tool to capture and quantify information about the risks associated with a project or activity, including the potential impact, likelihood of occurrence, mitigation measures, responses, and response triggers.

Why is it important?

A risk register increases the chances of successful execution of a project or activity by helping managers identify and evaluate risks, assess their potential impact, and create contingency plans.

...continue reading "Term of the Week: Risk Register"

Published on Leave a comment on Term of the Week: CISO

What is it?

Chief Information Security Officer. The most senior individual responsible for protecting an organization’s information assets.

Why is it important?

The CISO has overall responsibility for the information security program for an organization. The CISO works closely with executive management and business stakeholders to protect information assets.

...continue reading "Term of the Week: CISO"

Published on Leave a comment on Term of the Week: Incident Response Plan

What is it?

A comprehensive, step-by-step series of actions to be followed by an organization’s computer security incident response team (CSIRT) and business operations personnel following a verified cybersecurity incident to reduce the overall impact of the incident.

Why is it important?

When properly implemented, an incident response plan can help ensure an effective response to security incidents and help mitigate the effects of a potentially serious event. The presence of a well-rehearsed plan has proven to reduce the financial impact of security incidents.

...continue reading "Term of the Week: Incident Response Plan"