Items of fact collected by an organization. It includes raw numbers, facts, and words. Student quiz scores is a simple example.

Data that has been organized, structured, and presented to provide additional insight into its context, worth, and usefulness. For example, a student’s class average can be presented in the context of its value, as in “90 ¼ A.”

The focus of information security; information that has value to the organization, and the systems that store, process, and transmit the information.

As a subset of information assets, the systems and networks that store, process, and transmit information.

Commonly used as a surrogate for information security, data security is the focus of protecting data or information in its various states—at rest (in storage), in processing, and in transmission (over networks).

A collection of related data stored in a structured form and usually managed by a database management system.

A subset of information security that focuses on the assessment and protection of information stored in data repositories like database management systems and storage media.

An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it.

Attacks can be active or passive and direct or indirect.

A technique used to compromise a system.

A potential weakness in an asset or its defensive control system(s).

The creation, ownership, and control of original ideas as well as the representation of those ideas.

The unauthorized duplication, installation, or distribution of copyrighted computer software, which is a violation of intellectual property.

​An interruption in service, usually from a service provider, which causes an adverse event within an organization.

The percentage of time a particular service is not available;

The percentage of time a particular service is available

A long-term interruption (outage) in electrical power availability

A long-term decrease in electrical power availability.

A short-term interruption in electrical power availability.

The presence of additional and disruptive signals in network communications or electrical power delivery.

A short-term decrease in electrical power availability.

A short-term increase in electrical power availability, also known as a swell.

A long-term increase in electrical power availability.

The collection and analysis of information about an organization’s business competitors through legal and ethical means to gain business intelligence and competitive advantage.

The collection and analysis of information about an organization’s business competitors, often through illegal or unethical means, to gain an unfair competitive advantage. Also known as corporate spying.

The direct, covert observation of individual information or system use.

A hacker who uses extensive knowledge of the inner workings of computer hardware and software to gain unauthorized access to systems and information. Also known as elite hackers, often create automated exploits, scripts, and tools used by other hackers.

A person who accesses systems and information without authorization and often illegally.

A hacker who intentionally removes or bypasses software copyright protection designed to prevent unauthorized duplication or use.

A hacker who manipulates the public telephone system to make free calls or disrupt services.

An attempt to guess a password by attempting every possible combination of characters and numbers in it.

Attempting to reverse-engineer, remove, or bypass a password or other access control protection, such as the copyright protection on software

A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system’s encrypted password file.

An industry recommendation for password structure and strength that specifies passwords should be at least 10 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.

Inexperience, improper training, and incorrect assumptions are just a few things that can cause_______________________

To make sound decisions about information security, management must be informed about threats to its people, applications, data, and information systems and the attacks they face.

A wide range of natural events can overwhelm control systems and preparations to cause losses to data and availability.

Stolen or inactivated assets may be held hostage to extract payment of ransom.

Asset losses may result when electronic and human activities breach the confidentiality of information.

Theft of information can result from a limited variety of attacks.

Antiquated or outdated infrastructure can lead to unreliable and untrustworthy systems that may result in loss of availability or unauthorized access to information.

The threat of theft is a constant.

Guidelines that dictate certain behavior within the organization.

Rules that mandate or prohibit certain behavior and are enforced by the state.

The unauthorized taking of personally identifiable information with the intent of committing fraud and abuse of a person’s financial and personal reputation, purchasing goods and services without authorization, and generally impersonating the victim for illegal or unethical purposes.

Information about a person’s history, background, and attributes that can be used to commit identity theft. This information typically includes a person’s name, address, Social Security number, family information, employment history, and financial information.

Collective data that relates to a group or category of people and that has been altered to remove characteristics or components that make it possible to identify individuals within the group.

Measures that an organization takes to ensure every employee knows what is acceptable and what is not.

Reasonable steps taken by people or organizations to meet the obligations imposed by laws or regulations.

The ability of a legal entity to exercise its influence beyond its normal boundaries by asserting a connection between an out-of-jurisdiction entity and a local legal case.