Security Governance & Risk curriculum

Confidentiality keeps information from people not authorized to see it, integrity guards against improper change or destruction, and availability means timely, reliable access. To classify a failure, ask which of the three was lost. A leaked file, an altered record and an outage are different harms, and each is rated separately.

Authentication proves an identity, authorization decides what that identity may do, and accounting records what it actually did. The order matters: access rules and audit trails both depend on the system first telling users apart. A shared account therefore leaves the log unable to tie an action to one person.

Non-repudiation means a third party can check who originated data, so the signer cannot credibly deny it. A digital signature supports this because only the signer holds the private key. A shared-key code does not, since either key holder could have made it. Audit logs add evidence of who did what, but only while they stay protected from tampering.

You grant each user or process the minimum access its assigned tasks require. Doing so means a compromised ordinary account does not carry administrator power with it. The common failure is privilege set once and never revisited, which CISA places at the traditional end of its maturity model, the stage to move away from.

You split a sensitive task so that no one person holds enough privilege to misuse it alone; the person who authorizes a paycheck should not also prepare it. The control targets abuse of authorized access, so it lowers risk unless people collude. A split can be static, through conflicting roles, or dynamic, enforced at access time; a two-person rule is one dynamic example.

Need-to-know asks whether a person requires specific information to carry out their duties, and an authorized holder of the information makes that call. Seniority does not answer the question. A senior manager can lack any job reason to see a file while the junior analyst assigned to it has one, so access follows the task rather than the title.

You layer administrative, technical and physical defenses so that one failed control does not end your protection. Policies, firewalls and guards fail in different ways, which is the reason to mix them. Layers do more than slow an attacker: they can also tell you close to real time that an attack is underway.

Zero trust drops the idea that being inside the network earns trust. No actor, system or network is trusted, whether outside or inside the perimeter, and any component is assumed open to compromise, including your monitoring tools. A single login check at the perimeter fails the test, because verification has to continue for each user, device, application and transaction.

Risk cannot be eliminated, so you balance protection against how usable a system stays. Too few controls leave it exposed, while unnecessary ones waste resources and make it harder to use and maintain. A burdensome control can also backfire: OMB warns that if outdated password rules push staff to reuse passwords or store them insecurely, attackers get in more easily.

Policy states management's direction at a broad level. A standard makes a technology or parameter uniform and is normally compulsory; a guideline advises and can be met correctly in more than one way; a procedure gives the detailed steps for a task. Manuals often mix all four, so keep policy distinct from how it is carried out, which leaves room for other ways to reach the same goal.

The information owner, which NIST treats as the same role as steward, sets the rules for using and protecting specific information. The system owner answers for buying, running and disposing of a system, the administrator sets it up and manages its accounts, and the user must follow acceptable-use rules. Whoever looks after data for someone else applies the owner's rules without gaining the right to set them.

A CISO manages the organization-wide security program and links the CIO with authorizing officials and system owners; in a federal agency the role carries out the CIO's security duties under FISMA. Banking supervisors describe three lines of defense: frontline units where risk is created, a separate risk function that oversees them, and internal audit, which gives independent assurance on both.

An acceptable-use rule is an issue-specific policy: it states the organization's position on a topic such as internet access or personal devices, says to whom it applies, and names who approves exceptions. Enforcement belongs in it too, with penalties consistent with personnel policy. Review it often, since technology changes outdate these policies faster than high-level program policy.

Federal practice rates information by the harm its loss would cause, as low, moderate or high, and judges confidentiality, integrity and availability separately. Public does not mean unprotected: a public website can have no confidentiality impact and still a moderate integrity and availability impact. Markings then carry the result to people, stating distribution limits and handling caveats.

Keep personal information only as long as its purpose requires, then dispose of it so it cannot be read or rebuilt. NIST defines three sanitization methods: clear resists simple recovery through the normal interface, purge defeats laboratory recovery, and destroy does too while leaving the media unusable. Federal records can be destroyed only under records-law procedures.

Users are often called the weakest link because they do not see how their actions affect security, so training aims to change behavior rather than only inform. It also underpins accountability: people who do not know the required measures cannot truly be held to them. NIST lists no-notice exercises such as simulated spear phishing, and CISA pairs training before system access with at least annual sessions.

An incident count alone says little about a program. NIST sorts measures into four types: implementation shows a control's progress, effectiveness how well it works, efficiency how quickly, and impact what security means for the organization. A high patch percentage is an implementation measure, so it does not by itself show that risk went down.

A vulnerability is a weakness, and a threat source is what could exploit it; it need not be hostile, since disasters and honest errors count. Risk combines the harm that would follow with the likelihood it happens. Keep the words apart, because a weakness with little or no threat behind it may not deserve the spending.

A qualitative assessment uses nonnumerical levels, often combined in a table of likelihood against impact; it communicates easily but makes close risks hard to rank. A quantitative one uses numbers that keep their meaning outside the assessment and supports cost-benefit analysis, though its results may need their assumptions explained. Bins or scores that mean nothing elsewhere are semi-quantitative.

Multiply the estimated dollar loss from one event by how many times a year you expect it, and a rare costly event can match a frequent cheap one. Both inputs are estimates, so the result is for comparing risks and safeguard costs rather than forecasting. A 1979 federal guideline, withdrawn in 1995, set out the method, and NIST's 1995 handbook, withdrawn in 2017, kept single-occurrence and annualized loss as separate measures.

You can accept a risk, avoid the activity, mitigate it with controls, or share or transfer it, choosing among alternatives within your risk tolerance. Transfer has a limit. A bank using a third party keeps the same responsibility as if it did the work in-house, so handing off an activity does not hand off accountability.

Risk appetite is the broad amount of risk an organization will accept in pursuit of its mission, and its most senior leaders set it. Risk tolerance is the acceptable variance around objectives, usually set lower down at program level and aligned to the appetite. In banks, directors use reports to check that exposure stays within the board's appetite.

A risk register is a complete inventory of risks; OMB contrasts it with a risk profile, the prioritized list of the most significant ones. OMB's sample profile shows what an entry needs: impact and likelihood before and after response, the action and an owner. It is a working tool, since NIST and CISA both use registers to track progress on closing gaps and responding to risk.

Inherent risk is the exposure before any action beyond normal operations, and residual risk is what remains after action is taken, judged by the same standards. Since risk can never be fully removed, residual risk is not zero, and someone must decide it is acceptable. In federal systems that falls to a senior manager who authorizes the system to operate.

Vendor risk runs through the whole relationship, from planning and due diligence to contract and ongoing monitoring. US banking guidance says contracts can state which audit reports you receive and reserve your right to audit, and CISA adds service-level terms requiring vendors to report incidents. Check that a report's scope fits the activity you are buying, since a report on something else tells you little.

A flaw or attack upstream can reach you through something you bought, so you manage it as a risk of its own rather than a purchasing detail. The exposure covers design, manufacture, distribution, installation and maintenance, not only delivery. NIST's CSF 2.0 places supply chain risk management under Govern, alongside strategy and roles.

Sort controls here by the form they take. HIPAA's security rule uses administrative, physical and technical safeguards. NIST's older split is management, operational and technical, where operational controls are run mostly by people and technical ones by the system. A written procedure stays administrative even when the thing it governs is a firewall.

A preventive control aims to stop an unintended event before it happens, and a detective control finds it afterward, so timing is the difference. Corrective action then fixes the event or its cause, and GAO ties detection's value to how fast that follows. A deterrent aims to discourage the attempt. A compensating control replaces a baseline one with comparable protection, as when segmentation covers a device you cannot patch.

The framework names outcomes rather than how to reach them, so two organizations can meet the same outcome differently. Govern sits at the center because it shapes how you carry out the other five. The functions are not a sequence or a ranking: address them concurrently, with respond and recover ready at all times instead of waiting their turn.

ISO/IEC 27001 is one of the standards NIST lists as an informative reference for its framework, and using those references is optional. A certificate against such a standard is evidence from outside your organization, not a finding about your own risk. US banking agencies say you may review third-party certifications, but should ask whether their scope and results fit the activity at hand.

SOC reports cover a service provider's controls. SOC 1 concerns controls relevant to clients' financial reporting, while SOC 2 covers security, availability, processing integrity, confidentiality or privacy. The type matters as much: type 2 addresses whether controls operated effectively across a period, and type 1 does not, which is why banks covered by SOX usually do not accept it.

The dividing line is objectivity. Staff assessing their own system know it well and may find hidden problems, but they have little incentive to report that it was badly designed. An independent auditor has no professional stake in the system and is organizationally separate from it. Both can produce useful findings, so choose by the question you need answered.

A gap analysis compares where you are with where you chose to be. In CSF terms, a Current Profile states the outcomes you are achieving and a Target Profile the outcomes you selected and prioritized, and the differences feed an action plan. You set the target against your own risk, so a gap is not automatically a defect and closing every one may not come first.

Each regime covers a different domain. HIPAA protects the privacy and security of health information, and SOX guards the public against accounting errors and fraud in financial systems. PCI DSS is the card industry's own standard, with audits required by major card companies for high-volume businesses. GDPR is the EU's comprehensive privacy regime and reaches outside the EU. Educational only, not legal advice.

PII is information that can distinguish or trace a person, alone or when combined with other linkable data, so a harmless-looking field can become PII in combination. PHI is individually identifiable health information under HIPAA, and context matters: employment records a covered entity holds as an employer are excluded, and properly de-identified data falls outside it. Educational only, not legal advice.

OMB's version of the Fair Information Practice Principles, written for federal agencies, says you collect personal data only with authority to do so, keep what is directly relevant and necessary, hold it no longer than the purpose needs, and seek consent where practicable. So a lawful collection can still fail if the data outlives its purpose. Educational only, not legal advice.

Start by asking which laws apply, since every state has a notification law and federal rules add to them. Under HIPAA, an impermissible disclosure is presumed a breach unless a risk assessment shows low probability of compromise. Notice is due without unreasonable delay, and 60 days is the outer limit rather than the target. The clock starts when you knew or reasonably should have known. Educational only, not legal advice.

Localization rules require organizations to store data on local servers, and cross-border rules limit where it may go. As of a 2020 federal report, the EU's limits rest on privacy and China's on security. US banking guidance judges a vendor as foreign by where its servicing operations sit, not its headquarters, since those operations answer to local law. Educational only, not legal advice.

When litigation is under way or pending, counsel can issue a hold, and the records officer suspends the normal disposition cycle for the records named, so a hold outranks the retention schedule. In federal practice, records stored off-site at a records center need a separate freeze request or they can still reach disposal on schedule. Educational only, not legal advice.

Access should change when a person's job does: provision on joining, adjust on moving, remove on leaving. Leaving is the sharp edge. CISA's goals call for revoking all access and collecting badges and tokens, since attackers can exploit a former employee's idle accounts. Moves are quieter, so identity data must stay current when someone changes position or old access lingers.

A review asks whether each person's access is still justified, catching what provisioning and offboarding missed. CISA's maturity model treats permanent access with periodic review as the starting point. More mature programs grant need-based access that expires, with automated review. Include ordinary accounts, because the model applies review to unprivileged accounts as well as privileged ones.

RBAC assigns permissions through predefined roles, which are static and simple to reason about. ABAC decides at access time from attributes, such as whether the device is known and patched, so permissions can be more granular and dynamic. The two can work together: OMB describes fine-grained access within an application based on role alongside checks on device and environment.

Administrator power is what attackers want, so keep it off everyday accounts and have admins use a separate one for ordinary work. A privileged access management tool sits between the admin and the system and can add password vaulting, session recording and just-in-time access. It has limits: OMB warns against treating its short-lived single-factor credentials as a substitute for MFA.

Factors come from different classes, such as a secret you remember, an object you hold or a physical trait, so two passwords are still one factor. Not all MFA is equal, because a user can be fooled into giving up a one-time code or answering a security prompt. Phishing-resistant methods are built to block disclosure to a fake site, which is why OMB requires them for agency staff, though any MFA beats none.

Federal guidance favors length over complexity and forced change. OMB told agencies to drop rules requiring special characters and regular rotation, warning that outdated rules can push staff toward weak or reused passwords. CISA's 2023 goals called length more important than complexity or rotation, and its current goals set a long minimum. Passwords stay a factor in MFA, so a weak one still weakens that login.

Single sign-on centralizes authentication across multiple applications, passing the result through an identity assertion protocol. Federation goes further, accepting identities and credentials managed by another agency. Centralizing gives you one place to enforce MFA and log logins, but it concentrates trust: applications inherently trust the assertion signing keys, which makes them a single point of failure.

Motive shapes what an attacker does, and so which defenses matter. Criminal groups want money through fraud and extortion, foreign intelligence services gather information and can disrupt infrastructure, and some attackers break in for thrill or bragging rights. Insiders differ because they start with familiarity and access. Threat sources can also be accidental, like everyday errors.

Social engineering works on the person rather than the system. Phishing arrives by email, vishing by voice calls where caller ID can be spoofed, and smishing by text message. A pretext can be as plain as claiming to be an existing customer to get a company to reveal that customer's details. The defense is to verify through a contact you already have, never one the requester supplies.

Look for pressure plus a mismatch. Common tells are a sender address altered by a few characters, a generic greeting, a link whose destination differs from its text, and an unsolicited attachment pushed with false urgency. These are indicators rather than proof, so a clean-looking message can still be fake. When unsure, contact the company through details you already hold.

An insider is anyone with authorized access to your resources, or knowledge of them, now or in the past, so contractors and vendors count as well as staff. Harm can be malicious, complacent or unintentional, which means a program cannot only hunt for bad intent. Response has to be quick at the edges: disable a terminated employee's access at once, since termination can trigger sabotage.

Sort malware by how it spreads and what it does. A virus copies itself into a program and runs when that program runs, a worm spreads with no host or user action, and a Trojan does a useful job while hiding an unwanted one. Ransomware is defined by its goal: blocking access until payment, with no guarantee you get anything back.

Your attack surface is every point on a system's boundary where an attacker could get in, affect it or pull data out. You cannot shrink what you have not counted, so start with a regularly updated asset inventory. Then minimize what faces the public internet, and where an exposed asset cannot be updated, remove it or put compensating controls around it.

Raw indicators are information; intelligence is that information analyzed and enriched so it supports a decision. Sharing raises its value, since CISA's Automated Indicator Sharing exchanges machine-readable indicators between public and private organizations, and sector ISACs warn their members. A feed helps only once it reaches your detection and your decisions.

Logs help only if you can trust and read them. Collect administrative and security-focused logs for detection and response, protect them from tampering, keep them for a period set by risk or regulation, and get alerted when a critical log function stops. Storage is not review: periodic review or automated analysis is what turns records into findings, such as access attempts at unusual hours.

A SIEM brings logs from many sources into one place so you can correlate and analyze them and alert on what they show together. Its value depends on the input: OMB's logging memo calls for consistent timestamps and unique event identifiers because correlating events relies on them. A central store is not analysis, so you still need rules and people to act on the alerts.

You scan for weaknesses, rank them, fix them, then scan again. CVSS expresses a vulnerability's impact, which is not the same as whether anyone is exploiting it, so CISA publishes a catalog of known exploited vulnerabilities as an input to your ranking. It also warns that attackers favor unpatched internet-facing systems. Where a fix is not possible, compensating controls carry the load.

You face opposite risks. Attackers keep targeting flaws for months or years after a fix exists, while an untested change can break compatibility. So test before installing, and move fastest on what is being exploited. Where patching would compromise availability or safety, as on some operational technology, apply compensating controls such as segmentation and monitoring.

A vulnerability scan is automated and reports weaknesses a tool can recognize. A penetration test goes beyond that, with skilled people copying an adversary's actions to find what can actually be exploited, and it can use social engineering or target lax procedures a scanner cannot see. All parties agree to rules of engagement beforehand, which separates the test from an attack.

Change control tracks and approves changes so that none unintentionally or unknowingly weakens security. The goal is knowledge rather than a ban: an authorizing official can accept less security for mission reasons, as long as the added risk is monitored. Changes also have to flow into documents such as the contingency plan, and a major one may mean re-analyzing security.

A baseline is a formally reviewed set of specifications that changes only through change control, and later builds are measured against it. Without one you cannot tell whether a running system has wandered from what was approved. Configuration management provides that assurance by checking the system against organizational standards and reviewing each change for security implications.

Physical security covers the facility, its location and the utilities that keep it running, not only the doors. Badges and guards limit entry to authorized people, logs and video record it, visitors are escorted and recorded, and asset tracking follows equipment. Failure can also come from the building side: a power or air-conditioning fault can stop a system or damage stored data with no intruder involved.

CISA's federal playbook runs preparation, detection and analysis, containment, eradication and recovery, then post-incident activities, with coordination throughout. It is a loop rather than a line: new signs of compromise during containment send you back to analysis to re-scope. Preparation comes first because plans, trained staff and evidence collection must already exist when an incident starts.

Decide who leads before an incident. Plans should designate a coordination lead, assign roles for surge support, and cover escalation and evidence sharing with law enforcement. Train and exercise staff from in-house and third-party teams alike. Prepared steps and pre-tested courses of action mean you are not designing containment options while the attacker is active.

Containment aims to stop further damage by removing the adversary's access, but each option has a cost. Weigh the effect on mission and services, how long it takes, and what it does to evidence. Moving too soon can tip off an adversary who is watching, while waiting lets them persist until you know the scope. Isolating systems and rotating credentials are common moves.

Chain of custody records who handled evidence, when and why, across collection, safeguarding and analysis. Build the capability before you need it: secure storage and a way to capture disk and memory images. Cleanup is where evidence gets lost, so the FTC advises taking affected machines offline but leaving them powered on until forensic experts arrive.

Each audience has its own rules: leadership, law enforcement, regulators and the people affected. Timing can conflict, so the FTC recommends consulting your law enforcement contact on when to notify, so the notice does not impede the investigation. Set up out-of-band channels in advance, since adversaries may be monitoring your response and ordinary channels may not be safe.

The review exists to change something. Capture root cause and what went wrong in the response, confirm the root cause is gone, add detections for what the attacker did, and fix blind spots, policies and training. CISA calls the session a hotwash. Closing the ticket without these steps leaves the same conditions in place for next time.

A business impact analysis predicts what a disruption would cost you, in lost income, added expense, fines and penalties, and gathers what you need to plan recovery. It feeds later decisions, since recovery priorities and time objectives for IT come out of it. It differs from a risk assessment, which identifies the loss scenarios; the BIA sizes their consequences.

RTO is your target for how soon a function or system must be back, and RPO is the point in time to which data is restored, counted backward from the disruption. They measure different losses: time offline versus data missing. Frequent backups improve RPO without shortening a restore, so compare actual restoration times with the objective and refine both through recovery tests.

A business continuity plan covers how the business keeps going or resumes after a disruption, while an IT disaster recovery plan focuses on restoring the systems and data that support it. The IT plan sits inside the larger one, and its priorities should match those of the business functions it supports. Restoring servers on time helps little if the processes that use them have no plan.

Under the 3-2-1 rule you keep three copies, use two different storage types, and hold one copy away from your site, so a single fire or failure cannot take them all. Ransomware adds another need: keep copies offline or isolated from network connections so an intruder cannot reach them. A backup is only a claim until tested, so practice restoring both fully and partially.

The difference is what is already there. A hot site is fully operational with hardware and software in place, a warm site is partly equipped but its systems lack the software and data to resume, and a cold site has the electrical and physical components but waits for computers. The intervention needed to activate a site drives both its cost and how long you take to resume.

Exercises rise in realism and effort. Walkthroughs teach the plan, tabletops talk through a scenario in a room, functional exercises have people perform their duties in a simulated environment, and full-scale ones use real equipment and staff on location. Start low and build, because a tabletop checks roles and plans, not whether failover actually works.

Symmetric cryptography uses one secret key to encrypt and decrypt, so you must get that key to the other party safely. Asymmetric cryptography uses a pair: anyone can encrypt with the public key, and only the private key's holder can decrypt. Not every public key algorithm encrypts, and the same idea enables signatures, where the private key signs and the public key verifies.

A hash turns any input into a fixed-length digest, and you compare digests to detect change. It is designed to be one-way, so unlike encryption there is no practical way back to the input. A good one is also collision-resistant: finding two inputs with the same digest should be infeasible. A salt is a non-secret value mixed in with a password so that one password can yield a large set of keys.

Encryption at rest protects stored data, and encryption in transit protects it on the way, often through a protocol such as TLS. You need both, because outside your system's boundary cryptography may be your only protection. Internal traffic counts too under the federal zero trust strategy. Either way the problem moves to the keys, since protection depends on how you guard them.

A certificate binds a public key to its owner, and a certification authority signs it so others can rely on that binding. Trust then runs back through a chain of certificates to a root CA you already trust. It can also be withdrawn, since a CA revokes as well as issues, and an expired signing certificate can stop single sign-on from working.

Cryptography rests on its keys, so policy covers their whole life: generation, distribution, storage, use, archiving and destruction, plus key escrow and recovery. A cryptoperiod limits how long a key stays in use, which limits both what an attacker can analyze and the exposure if one key is compromised. Keep each key to one purpose, since mixing uses can weaken the protection and widens the damage.

The signer applies a private key to a hash of the data, and anyone can verify the result with the public key. A valid signature shows the data was not changed after signing and that the key's owner signed it, which supports non-repudiation. A scanned image of a handwritten signature gives none of this, because it can be copied onto any document.

An approved-algorithm policy names what you may use and plans the exits, because algorithms and key lengths age. NIST's status terms show the path: acceptable, deprecated (usable, with some accepted risk), legacy use (only to process data already protected, such as decrypting old files), and disallowed. Legacy use is the easy one to misread, since it never permits protecting new data.

Segmenting divides a network into zones, often with firewalls between them, so a breach in one part stays limited. A DMZ is the buffer segment between internal and external networks. The walls only count if they hold: leaving credentials for the sensitive side reachable from the ordinary side undoes the design.

Deny traffic by default and allow it by exception, in both directions, so every rule traces to a legitimate business need. A firewall is only as effective as those rules, so review them periodically: in a CISA red team assessment, rules permitting one protocol to servers at all other sites gave the team access to those sites.

Remote access makes your network only as strong as the weakest computer connecting to it. Split tunneling lets a remote device reach your system and an external network at once, so NIST's control catalog says to prevent it unless securely provisioned. US federal zero trust policy goes further, aiming to make applications safely reachable over the internet without relying on a VPN.

Enterprise Wi-Fi should not rest on one shared password: CISA advises multi-factor or certificate-based authentication for the whole exchange. Policy also assigns the duty to look for unauthorized access points. Wireless intrusion detection flags them, wireless prevention deploys countermeasures, and detection has to work whatever authentication or encryption the rogue device uses.

Detection watches and alerts; prevention also tries to stop what it finds, and that decides placement. An inline sensor sits in the traffic path so it can block, while a passive sensor sees only a copy and usually has no reliable way to stop anything. Neither is fully accurate, and tuning to miss fewer attacks usually means more false alarms to analyze.

SPF lists the servers allowed to send for your domain, DKIM signs outgoing mail so receivers can check it was not altered, and DMARC tells receivers what you would like done with mail that fails, such as quarantine or reject, and can report it to you. These checks authenticate your own domain; filtering attachments and links in arriving mail is a separate layer.

Data moves through stages often described as creation or collection, processing, dissemination, use, storage and disposition, and its protection has to follow it through each one. Disposal is a control too: keep sensitive data only while a business need lasts, because data no longer in your system cannot be stolen from it.

Data loss prevention looks at what is leaving: tools can flag unexpectedly large transfers to an unknown destination, and stronger setups stop them. A system that watches only inbound traffic misses this, as in an FTC example where sensitive files left for an unknown foreign address. Noisy rules need calibrating, not switching off, which is the FTC's advice for a filter raising hundreds of false positives a day.

De-identification removes, masks or alters identifiers so data can be used with less risk to the people in it. A pseudonym or code keeps a link back to the person, so guard it: HIPAA's re-identification rule says the code must not derive from the person's details and the mechanism must stay undisclosed. Terms vary, and in some health settings “anonymization” means that mapping has been erased.

NIST's 2014 media guide, withdrawn in 2025 and replaced, ranks methods by recovery effort: Clear defeats simple recovery through the normal interface, Purge defeats state-of-the-art lab techniques, and Destroy also leaves the media unusable. Media type decides the method: degaussing no longer applies to most flash storage, and overwriting can miss unmapped areas.

A backup is a recovery path only if an attacker cannot ruin it too, and ransomware actors increasingly delete backups. Store copies separately from source systems, encrypt them and limit who can reach them. Test them on a recurring schedule, at least yearly in CISA's baseline, because a test is how you learn whether a copy actually restores.

Security is most effective when planned across a system's life, from initial planning through design, implementation, operation and disposal, rather than added at the end. Gates make that concrete: threat modeling catches design-level flaws, while automated scans and tests catch code bugs before release. Scanners read code, so they do not replace the design review.

Injection happens when user input ends up inside a database query or operating system command; cross-site scripting arises when a product fails to validate, sanitize or escape input. The names matter for governance because you can ask about a whole class: CISA and the FBI press manufacturers to prevent them systematically, and default passwords and products without multi-factor support sit on the same list.

Static analysis (SAST) works from the code itself, while dynamic testing (DAST for web services) runs the software and examines the outputs. Each covers gaps in the other: dynamic testing gives few false positives but is unlikely to find hardcoded secrets, which code-level tools can flag. That is why a release gate names both.

CISA classes hardcoded credentials in source code as a dangerous practice and points to a secret manager instead. Heuristic tools can find them at review, since dynamic testing is unlikely to. Limit the blast radius as well: in one action the FTC alleged a single cloud access key for all programs and engineers, where distinct and regularly rotated keys would have helped.

An SBOM is a nested inventory of the components in your software, covering first- and third-party dependencies. It is a starting point, not a finding: components must be monitored continually against known-vulnerability databases, because a new flaw can be reported in existing code at any time. Composition analysis tools help identify which open-source pieces you actually use.

The split depends on the service model: securing SaaS relies heavily on the provider, while under IaaS much responsibility falls on you and the rest is shared or the provider's. Relying more on a provider also means placing more trust in it. Some duties stay joint, such as API connections into a SaaS environment, so write down who owns what.

Exposure does not need an exploit: in one case the FTC described a company putting data on a server with its firewall disabled, leaving it open to anyone with an internet connection. Cloud security posture management tools monitor continuously and help find misconfigurations that can lead to data leakage. Scan infrastructure code as well, since it can carry the same mistakes.

Cloud access still runs on least privilege, but it has to be checked at scale, so audit regularly for over-privileged accounts. Decide where your identity provider will live, especially across several clouds, since some SaaS products cannot integrate and keep their own identity realm. Give people and programs distinct access keys rather than a shared one.

Shadow IT is close to what NIST calls unofficial software: tools the organization never approved, screened or manages. An issue-specific policy can define it and name who may grant approval, which gives staff a legitimate path. Onboarding review should ask about sign-in early, because some SaaS tools cannot integrate with your identity provider and keep their own accounts.

Vendor lock-in occurs when you depend on services and resources specific to one cloud provider. It is not automatically wrong, because those services can bring real advantages, so decide system by system. Where you might need to move, design so the solution can be redeployed across services with minimal configuration changes.

Proportion starts with access: the FTC points background checks at people who will handle sensitive data, and NIST has the security office help managers judge whether a position needs one. In the US, using a background-reporting company brings legal steps, such as written permission and notice before an adverse decision, and everyone must be treated equally.

A signed agreement puts expectations on record before access begins. NIST lists access agreements among personnel controls, and the FTC advises that each new hire sign on to confidentiality and security standards, with discipline for violations. A signature fades, though, so pair it with recurring training on what acceptable use means.

Former staff keep their knowledge of your operations, so the danger grows if access is not cut promptly, and NIST notes that sabotage is often set off by knowledge or threat of termination. Terminate passwords and collect keys and ID cards at check-out. Transfers need the same step, since someone changing roles should lose access the new role does not need.

Most frauds and embezzlements depend on someone being continually present, so time away can expose them. Federal Reserve guidance for banks treats a two-consecutive-week absence from sensitive roles as a basic control, and it includes electronic access, since logging in from home defeats the point. Rotating duties, ideally unannounced, applies the same pressure without waiting for leave.

Insiders cause harm intentionally or by accident, so CISA's guidance covers negligent and accidental staff alongside malicious ones, and it pairs detection with a culture of reporting, protected civil liberties and confidentiality. Set the legal basis first: US guidance says to establish authority to monitor before monitoring begins, and monitoring beyond cybersecurity needs its own basis.

A security operations center monitors and triages alerts and logs. US federal policy gives the highest-level enterprise SOC centralized visibility while component SOCs triage some feeds, such as DNS logs, and CISA advises managing SOC systems separately from general IT as an operations-security step. Regular testing inside the SOC shows whether those procedures still work.

A key risk indicator measures risk, while a key performance indicator measures progress toward intended results, and leading indicators try to predict what lagging ones record afterward. Numbers earn their place when reports compare them with set targets and risk limits. Prefer precise measures: mean time to remediate says more than a yearly count of patches.

Continuous monitoring keeps an ongoing view of security, vulnerabilities and threats so risk decisions rest on current facts, not the last assessment. In federal systems it continues after authorization, and CISA's CDM program supplies tools and dashboards. Telemetry alone protects nothing: the FTC warns that leaving alerts unwatched raises the risk a breach goes undetected.

A penetration test tries to defeat security features; a red team exercise goes further, simulating an adversary to examine whether your defenses actually work. Results can humble you: in one CISA assessment, an organization with a mature posture never detected the team, even when it tried to trigger a response. Independent assessors add objectivity that self-assessment lacks.

SP 800-53 is a catalog of security and privacy controls, not a checklist to apply whole. You start from a baseline tied to system impact (low, moderate or high), then tailor it by removing or adding controls. Any deviation should rest on an assessment of the associated risk, or a dropped control quietly becomes unmanaged risk.

In Treasury's rules for federal agencies, scope follows the card data: PCI DSS applies to any agency that processes, stores or transmits card transactions, and network scans cover external addresses touching the cardholder data environment. Agencies at the default level also file a yearly self-assessment and use an approved vendor for quarterly scans. These rules bind federal agencies only, so treat them as one worked example.

Privacy by design builds privacy into a system from the plan phase onward instead of retrofitting it. NIST explains why security alone falls short: problems such as embarrassment or discrimination can come from authorized processing, with no breach at all. Its voluntary Privacy Framework therefore makes harm to individuals, not just lost data, the thing you assess.

A maturity score describes how developed a practice is, not whether you are safe. CISA's zero trust model runs Traditional, Initial, Advanced, Optimal. NIST's framework Tiers, Partial to Adaptive, describe the rigor of risk practices, and NIST encourages climbing when risks, mandates or cost-benefit analysis justify it, so the top level is not automatically the right target.

Courts need proof that an item is what you claim, and that shapes collection. A forensic image is an exact bit-for-bit copy preserving the system's state at that moment. Keep a contemporaneous written record of every step, and choose responders whose methods do not taint evidence. US rules also let data copies be certified through digital identification. Counsel decides how this applies.

Once litigation is anticipated, US federal rules expect reasonable steps to preserve electronically stored information, so routine deletion may need to pause. If data is lost, courts may order cures for prejudice; the harshest sanctions need intent to deprive. In production, sources that are not reasonably accessible may be excused unless good cause is shown. Counsel decides how this applies.

Build the relationship before you need it: DOJ advises knowing your local federal offices long before an incident, and naming who decides when to call. In the US, the FBI and Secret Service are the principal investigators of computer fraud. Do not hack back: it may violate federal law, can undermine their investigation and can invite retaliation against you.

A contract sets the floor, and oversight does the rest. How much control you hold over a provider comes from the contract or service-level agreement, so security terms belong there. The FTC's Safeguards Rule also requires covered financial institutions to assess providers periodically. Breach terms need numbers: HIPAA's outer limit for a business associate to notify is 60 calendar days, with no unreasonable delay.

Cyber insurance helps offset the cost of responding to and recovering from attacks, but NIST notes that transferring risk reduces neither the likelihood of harm nor its consequences. Read the wording closely: GAO reported in 2021 that key terms such as “cyberterrorism” lack standard definitions, which blurs what is covered, and that insurers, by industry accounts, had cut limits for some sectors.

The Cyber Kill Chain, from Lockheed Martin, breaks an intrusion into reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on the objective. DHS has used it to dissect real campaigns. Its use is a shared sequence for analysis: CISA's vulnerability triage, for instance, asks whether the first four steps can be reliably automated.

ATT&CK organizes adversary behavior into named tactics and techniques. Its value is shared vocabulary: CISA red team advisories map each observed activity to it, so defenders can compare it with their own detection. Where a kill chain gives you a sequence, ATT&CK catalogs behaviors, so a mapped technique tells you what was done, not what comes next.

Settle who decides before an attack. The US government strongly discourages paying, and paying guarantees nothing. It can also carry sanctions risk, though OFAC treats prompt reporting to law enforcement and cooperation as significant mitigating factors. The FTC notes that the choice still rests with the victim, and it is a legal question as well as a technical one.

Business email compromise aims at a transfer of funds, often by taking over a legitimate account through social engineering or intrusion, so the request can look real. Verify any change in account details through a second channel. Speed then decides recovery: contact your bank as soon as fraud is recognized to request a recall, then file with IC3.

A traditional brute-force attack hammers one account and soon trips a lockout. Password spraying tries one password across many accounts, then moves on, which keeps it under that limit. Stuffing uses stolen credentials from other breaches, so a strong password offers no help once reused. MFA and blocking known-compromised passwords help against both.

Both attacks reach you through something you trust. A watering hole is a legitimate site your people visit, altered to carry malicious content; a 2018 DHS and FBI alert found about half the known ones in a single campaign were trade publications and information sites in the targets' field. A software supply chain attack infiltrates a vendor and tampers with software before it ships, for example by hijacking an update.

The threat comes less from the technology than from people's inclination to believe what they see. For financial institutions, FinCEN's 2024 alert points to multifactor authentication and live audio or video checks. Criminals can fake those responses too, though fakes may show inconsistencies, and avoiding live checks by claiming technical glitches is a warning sign. No single red flag proves fraud.

Antivirus relies mostly on signatures of known malware, so new variants can slip past. EDR adds real-time monitoring and collection of endpoint data with rules-based automated response and analysis, part of a federal shift from reactive to proactive defense. It is no guarantee: in one CISA assessment, the endpoint platform, like the other tools, did not surface a red team's lateral movement.

Signature scanning blocks what is known to be bad; allowlisting applies deny-all, permit-by-exception to execution, so unknown malware is refused too. Rollout usually starts in learning mode, which records what the system uses, before blocking mode enforces the list. Check that list carefully first, or pre-existing malware gets approved along with everything else. It complements signature scanning rather than replacing it.

Network behavior analysis studies traffic flows, meaning sessions between hosts, to spot unusual patterns such as denial-of-service floods, some malware and policy violations. NIST's 2007 guide notes it most often watches internal networks and updates its baselines automatically. CISA's red team advice rests on the same idea: establish a baseline of normal activity, then tune tools to flag anomalies.

A honeypot serves no business function, so any activity aimed at it is suspicious. CISA also suggests decoy service accounts to catch attempts to crack account hashes, and the FTC describes “canaries” that reveal intruders without risking the real network. Treat these as a supplement to, not a replacement for, other detection.

Layers catch different things. Sandboxing or detonation chambers safely isolate malicious links, and warning banners flag outside mail with links or attachments, with familiar domains allowlisted to cut needless warnings. A DMARC quarantine policy sends unauthenticated messages to junk. Blocking risky file types and oversized attachments helps too, within what legitimate work needs.

Browser isolation assumes all web traffic is untrustworthy and puts a barrier between the browser and the rest of the system. Local isolation uses a sandbox or virtual machine on the user's computer; remote isolation moves processing off it. CISA treats it as a strategic architecture decision, more complex to run than simpler measures, though it may save money over its life.

An exception records a risk you chose to accept, which separates it from quiet non-compliance. NIST's framework expects exceptions to be managed, assessed for risk impact, recorded and tracked. OMB's waiver rule is a useful template: state the reasons, the duration and a plan back to full compliance. The FTC's Safeguards Rule requires written approval for alternatives to MFA.

Policies do not age at one speed: NIST says issue-specific ones need regular review because technology changes often, unlike program policies. Reviews should respond to changes in requirements, threats, technology and mission, not just the calendar. Assign roles and responsibilities in the policy itself, and keep old versions where rules demand it, such as six years under HIPAA's Security Rule.

A tabletop talks a team through a scenario, so design starts from objectives, then picks a scenario and discussion questions that test them. CISA's packages separate roles for planners, facilitators or evaluators, and participants, and they include a post-exercise feedback form and an after-action report. The write-up is what turns the talk into changes.

A blameless review hunts for causes rather than culprits. The NTSB offers a useful parallel from transportation: it treats fault and liability as irrelevant to its fact-finding, because the mission is safety. CISA's incident playbook asks for a hotwash covering lessons learned, root cause, problems executing and missing policies, then feeds the fixes back into detection.

Spending should follow risk, not last year's budget or the loudest request. NIST's framework gets there by comparing Current and Target Profiles, and the differences yield a prioritized action plan. Compare each fix with the loss it would prevent, as a business impact analysis does, and expect resources to match the risk strategy.

HIPAA's right of access is one worked US example of a request process: a covered entity generally has 30 days to act and may take only one extension. Other laws set their own rules. The hard part is often finding the data, and NIST warns that data distributed or encrypted in ways you cannot access may be impossible to produce.

Consent has to be provable and revocable, so keep records of what was authorized and act when it ends. NIST's Privacy Framework pairs authorizing processing with revoking authorizations and lists consent withdrawal as a mitigation. HIPAA shows the mechanics: an authorization carries an expiration and can generally be revoked in writing.

A privacy impact assessment analyzes how personal data is handled, the risks that creates and ways to reduce them. In US federal practice it is both an analysis and a formal document, and it comes before developing or procuring covered systems. It is not one-and-done: agencies must update it when a system change creates new privacy risks.

Minimizing data and preserving it pull in opposite directions. For customer information, the FTC's Safeguards Rule sets disposal within two years of last use, with exceptions including retention required by law. Once litigation is anticipated, US court rules expect reasonable steps to preserve relevant data. Deletion schedules therefore need a way to pause, and counsel settles conflicts.

Some laws classify organizations as data controllers or processors, and NIST's Privacy Framework lets you build profiles by role. HIPAA offers a rough parallel: a business associate acts on behalf of a covered entity under a contract that sets permitted uses, requires reporting breaches, and passes the same restrictions to subcontractors. With narrow exceptions, the contract cannot permit what the entity itself could not do.

Decide who speaks before the crisis: name a point person for releasing information and prepare talking points. Pre-approved message templates buy time, and you should anticipate the questions people will ask. Never make misleading statements. Keep response discussions off any system suspected of compromise, since many intruders try to regain access.

Recovery plans assume someone is available to carry them out. A continuity plan should set out roles, lines of authority, succession of management and delegation of authority, with logistics for moving to alternate worksites. The federal Ready.gov template also asks you to document manual workarounds, since staff may have to work without their usual systems.

You can only protect what you know you rely on. NIST's framework asks you to understand and communicate both the services you depend on and those others expect from you. A business impact analysis surveys managers on what breaks when a process stops, including supplier failure, and that ranking sets the order for restoring functions.

Eradicate before you reconnect, because intruders often hold several backdoors and can hop back into “clean” areas. CISA's federal playbook reimages affected systems from clean sources, rebuilds hardware when rootkits are involved, and then reconnects rebuilt systems. Check backup integrity before restoring, then keep watching for signs of re-entry.