Cybersecurity Knowledge Base

Access Rights & Permissions Matrix

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Ad-hoc, undocumented\naccess grants"] -- "Need for auditability\nand least privilege" --> B["Formal Access Rights &\nPermissions Matrix"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An Access Rights & Permissions Matrix is a structured inventory that maps who (users, roles, or groups) can access which systems, applications, or data at what level of privilege.

Features:
( Ownership ) Maintained jointly by system/application owners and the security or IAM (identity and access management) team, and reviewed by managers who approve access for their staff.
( Audit Readiness ) Lets organizations answer basic audit questions, such as who has admin rights or whether access matches job function.
( Departure Control ) Confirms whether departed employees still hold active accounts instead of leaving that question unanswered.
( Baseline Control ) Functions as a baseline control for least privilege and segregation of duties.

Data Breach Notification Log

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Informal incident notes\nscattered across email"] -- "Need to prove regulatory\nnotification timelines" --> B["Centralized Data Breach\nNotification Log"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Data Breach Notification Log is the authoritative record of confirmed data breaches: what happened, who was affected, which regulators or individuals were notified, and when.

Features:
( Ownership ) Owned by the CISO or incident response lead, with input from legal/privacy counsel who determine notification obligations.
( Regulatory Window ) Many breach notification regulations require disclosure to a supervisory authority within a tight window, commonly cited as 72 hours from confirmed discovery.
( Compliance Evidence ) Exists to prove that timeline was met, or to explain any deviation, during a regulatory inquiry.

Data Classification Register

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Uniform handling of all\ndata regardless of sensitivity"] -- "Need for proportionate,\nrisk-based controls" --> B["Formal Data\nClassification Register"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Data Classification Register catalogs an organization’s data assets and assigns each a sensitivity tier — such as public, internal, confidential, and restricted — based on the confidentiality impact of unauthorized disclosure.

Features:
( Ownership ) Maintained by data owners with guidance from the security team.
( Control Foundation ) Underpins nearly every other control, since access rights, encryption requirements, retention periods, and breach notification scope all key off the classification assigned here.
( Proportionate Risk ) Keeps controls proportionate to actual risk instead of applied uniformly, either too loose on sensitive data or too costly on trivial data.

Data Loss Prevention (DLP) Incident Log

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["DLP alerts triaged ad hoc,\nno pattern tracking"] -- "Need to distinguish noise\nfrom real exfiltration risk" --> B["Structured DLP\nIncident Log"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DLP (Data Loss Prevention) Incident Log records every event flagged by DLP tooling or manual detection where classified data moved, or attempted to move, outside approved boundaries.

Features:
( Ownership ) Maintained by the security operations team, with escalation paths to HR and legal for policy violations involving insiders.
( Event Coverage ) Spans email exfiltration, unauthorized uploads, removable media transfers, and similar policy violations.
( Noise Filtering ) Separates routine noise, since most DLP alerts are false positives or minor mistakes rather than breaches, from patterns that indicate a genuine control gap.
( Insider Risk ) Surfaces patterns that indicate malicious insider activity.

Document Retention & Disposal Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Indefinite retention\nof records by default"] -- "Need to limit breach exposure\nand meet legal minimums/maximums" --> B["Formal Retention &\nDisposal Tracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Document Retention & Disposal Tracker specifies how long each category of record must be kept to satisfy legal, contractual, or operational needs, and how it must be securely disposed of once that period expires.

Security KPI Dashboard

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Security activity scattered\nacross disconnected logs"] -- "Need for trend visibility\nand leadership accountability" --> B["Consolidated Security\nKPI Dashboard"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Security KPI Dashboard aggregates recurring metrics into a single reporting view that tracks the health of the security program over time.

Features:
( Ownership ) Owned by the CISO and compiled by the security team from underlying logs, tickets, and trackers, then presented to executive leadership and the board on a fixed cadence.
( Metric Coverage ) Spans patch latency, phishing test results, incident counts, access recertification completion, and similar indicators.
( Governance Answer ) Answers the governance question individual logs and registers cannot on their own: is the security posture improving, stable, or degrading.
( Investment Guidance ) Indicates where security investment should go next.

Asymmetric-Key Cryptography

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Symmetric keys\nrequire pre-sharing"] -- "Using a public/private key pair" --> B["Key distribution\nproblem solved"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A cryptographic scheme that uses a pair of keys — a public key and a private key — generated from a hard mathematical problem such as integer factorization or the discrete logarithm problem.

Features:
( Easy Key Distribution ) The public key can be distributed openly, making key management far simpler than with symmetric-key cryptography
( Confidentiality and Non-repudiation ) Alongside confidentiality through data encryption, it provides non-repudiation via digital signatures
( Computational Complexity ) Because it relies on complex operations grounded in hard mathematical problems, it is relatively slower than symmetric-key cryptography

Combined Security Model: Digital Signature + Digital Envelope

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Authentication, integrity,\nand confidentiality handled separately"] -- "Combining digital signature + digital envelope" --> B["End-to-end\nintegrated security model"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A mechanism that combines the authentication, integrity, and non-repudiation functions of a digital signature with the confidentiality function of a digital envelope to secure the entire transmission path.

Necessity:
( End-to-End Integrated Security ) Authentication, integrity, non-repudiation, and confidentiality are all secured simultaneously, completing protection across the full path
( Defense Against Sender Impersonation ) The digital signature verifies the sender’s identity, blocking impersonation by others at the source
( Prevention of Replay Attacks ) Combining a one-time session key with the signature defends against message reuse and tampering

Database Encryption Techniques (API, Plug-in, TDE)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Plaintext data\nexposure"] -- "API / Plug-in / TDE encryption" --> B["Strengthened\ndata asset protection"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A technique that uses encryption algorithms to store sensitive fields within a database (such as resident registration numbers or passwords) in a form unreadable by unauthorized parties.

Necessity:
( Asset Protection ) Encrypting sensitive information within the database blocks access by unauthorized parties
( Compliance ) Meets legal and regulatory requirements such as personal data protection laws and prepares the organization for security audits
( Preventing Administrative Misuse ) Restricts even privileged administrators from directly accessing encrypted data, preventing leakage

Diffie-Hellman Key Exchange

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Public channel\n(insecure channel)"] -- "Key derivation via discrete logarithm" --> B["Shared secret key"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A cryptographic algorithm that, based on the computational difficulty of the discrete logarithm problem, allows communicating parties to derive a common secret key over a public channel without ever sharing their private keys.

Key Features:
( Solves the Key Distribution Problem ) A session key can be derived securely without needing to share a key in advance
( The First Public-Key-Based Scheme ) Published in 1976, it was the first public-key cryptographic algorithm and the starting point of modern cryptography
( Based on the Discrete Logarithm ) Relies on the mathematical principle that reversing exponentiation over a finite field is computationally hard

Digital Envelope

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Threat of\nsymmetric key exposure"] -- "Encrypt key with recipient's public key" --> B["Secure key\ndelivery environment"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The core mechanism of a hybrid cryptographic system that combines a symmetric key — for quickly processing large volumes of data — with asymmetric-key (public-key) cryptography for safely distributing that key.

Features:
( Confidentiality Assured ) Data can only be recovered via a session key encrypted with the recipient’s public key
( Key Management Efficiency ) Using a one-time session key reduces the risk of key exposure and improves management convenience
( Hybrid Structure ) Combines the speed of symmetric-key cryptography with the safe key distribution of asymmetric-key cryptography

Digital Signature

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Electronic\ndocument"] -- "Signed with sender's private key" --> B["Integrity and\nnon-repudiation secured"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A technique in which the sender encrypts the hash value of an electronic document with their own private key and attaches it to the document, serving as an electronic equivalent of a personal seal.

Core Value:
( Integrity ) Proves that data has not been forged or altered in transit
( Authentication ) Confirms and guarantees the signer’s identity
( Non-repudiation ) Provides legal and technical evidence so the signer cannot later deny having signed

Hash Function

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Message of\narbitrary length"] -- "One-way compression function" --> B["Fixed-length\ndigest"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A one-way function that takes a message of arbitrary length as input and converts it into a fixed-length bit string (hash value).

Features:
( One-Way ) Computing the hash value from the input is easy, but recovering the input from the hash value is infeasible
( Avalanche Effect ) Even a tiny change to the input produces a completely different output hash value
( Compression ) Regardless of the length of the input, the function always produces a hash value of a fixed, predetermined length

Homomorphic Encryption

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Encrypted\ndata"] -- "Direct computation without decryption" --> B["Privacy-preserving\nanalysis"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A cryptographic system in which the result of performing an operation on ciphertext Enc(m) of plaintext m remains equivalent to the result of performing the operation on the plaintext and then encrypting it.

Core Value:
( Privacy Preservation ) Computation can be performed on data while it remains encrypted, without ever decrypting it to plaintext
( Maximized Data Utility ) Enables data analysis using external resources such as the cloud while protecting sensitive information
( Mathematical Safety ) Can simultaneously achieve quantum-resistant security by relying on techniques such as lattice-based cryptography

Hybrid Cryptography

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Symmetric key (speed) +\nasymmetric key (security)"] -- "Using session key and digital envelope" --> B["Efficiency and security\nachieved together"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An integrated cryptographic scheme that encrypts large volumes of data using symmetric-key cryptography, while protecting and delivering the symmetric key used in that process with asymmetric-key (public-key) cryptography.

Features:
( Solves the Key Distribution Problem ) Asymmetric-key cryptography resolves the key distribution problem, which is the main drawback of symmetric-key cryptography
( Computational Efficiency ) Bulk data is encrypted with the symmetric key, overcoming the speed penalty of asymmetric-key cryptography
( Strengthened Security ) Combines data encryption with a key-exchange method, achieving overall security and efficiency at the same time

PKI (Public Key Infrastructure)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Threats in\npublic key distribution"] -- "Built on trust in a Certificate Authority (CA)" --> B["Hierarchical\ntrust structure"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A hierarchical trust structure that performs user identification, and certificate issuance, storage, distribution, and revocation, so that public-key cryptography can be used safely.

Necessity:
( Establishing a Trust Model ) A framework is needed to guarantee the trustworthiness of a public key within an asymmetric-key cryptographic system
( Preventing MITM Attacks ) Blocks the man-in-the-middle attacks that can occur during public key distribution
( Integrated Management System ) Requires infrastructure to manage the full lifecycle of a certificate — issuance, storage, distribution, and revocation

Post-Quantum Cryptography (PQC)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Existing\npublic-key cryptography"] -- "Hard problems such as lattice-based math" --> B["Resistance to\nquantum computers"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Next-generation cryptographic algorithms designed around complex mathematical problems that remain difficult to solve even with the immense computing power of a quantum computer.

Necessity:
( Responding to the Quantum Threat ) Preparing for the collapse of existing cryptographic systems due to the immense computing power of quantum computers
( Achieving Crypto-Agility ) A flexible cryptographic architecture is required so that new security threats can be responded to quickly
( Long-Term Security ) Proactively strengthens security for critical national infrastructure — public, financial, and defense sectors — in preparation for a future Q-Day

Quantum Security

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Quantum computing\nthreat"] -- "Quantum resistance and physical security" --> B["Security readiness\nfor Q-Day"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Security technologies developed to counter the threat that quantum computers’ immense computing power (such as Shor’s algorithm) poses to modern asymmetric-key cryptographic systems.

Features:
( Physical Security ) Blocks physical eavesdropping by exploiting the properties of quantum mechanics through Quantum Key Distribution (QKD)
( Use of Hard Mathematical Problems ) Strengthens security by using complex algorithms (PQC) that remain hard to solve even with a quantum computer
( Forward-Looking Response ) Protects existing cryptographic systems from quantum threats such as Shor’s algorithm

RSA Encryption

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Multiplying two large\nprimes is easy"] -- "Factoring the product back out is hard" --> B["Public-key\ntrust scheme"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A public-key algorithm built on the fact that multiplying two prime numbers together is easy, but recovering the original primes from that product is hard.

Features: In addition to confidentiality, RSA provides authentication and non-repudiation through digital signatures, and a key length of 2048 bits or more is recommended depending on the data.

Sign-then-Encrypt

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Sign the\nplaintext"] -- "Encrypt the whole package after signing" --> B["Signer identity protected\nand confidentiality assured"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A method in which the sender generates a digital signature over the plaintext message using their own private key, attaches it, and then encrypts the entire combination with the recipient’s public key (or a session key) before transmission.

Symmetric-Key Cryptography

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Plaintext"] -- "High-speed computation with a single secret key" --> B["Ciphertext"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A cryptographic scheme in which sender and receiver use a pre-shared “single secret key” to transform plaintext into ciphertext, and back again into plaintext.

Features:
( High-Speed Computation ) Computation is far faster than asymmetric-key cryptography
( Simple Structure ) The algorithm structure is simple, making software and hardware implementation easy
( Efficiency ) High computational efficiency makes it well suited to processing large volumes of data and real-time encryption

CIA Triad

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Information asset\n(raw data)"] -- "Security controls (applying CIA)" --> B["Secure\nstate"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The state achieved by putting physical, technical, and administrative measures in place to preserve the confidentiality, integrity, and availability of information assets.

Core Security Elements:
( Confidentiality ) Preventing eavesdropping and leakage so that only authorized users can access information
( Integrity ) The state in which information is guaranteed to be accurate and complete, unaltered by unauthorized parties
( Availability ) The state in which authorized users can access information and services whenever they need them

Endpoint Security

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Perimeter\nsecurity"] -- "Direct protection of the end device" --> B["Endpoint\nsecurity (node)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A host-based security strategy that detects, blocks, and responds to threats that have penetrated the network and reached an end-user device.

Why It Is Needed:
( Perimeter Collapse ) The traditional network perimeter security model has been undermined by the shift to cloud and the spread of remote work
( Spread of BYOD ) Increasing use of personal devices for work (BYOD) exposes unauthorized devices and endpoint vulnerabilities
( Advancing Threats ) Advanced persistent threats (APT) and ransomware increasingly use end-user devices as their primary attack foothold

Systematic Server Defense Strategy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Vulnerable server\n(default configuration)"] -- "Hardening / secure OS" --> B["Hardened\nserver (hardened host)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Security activities that remove vulnerabilities in server components — the operating system, applications, database, and more — and block unauthorized access, thereby securing the confidentiality, integrity, and availability of the service.

Key Defense Strategies:
( Host Fortification ) Hardening: Minimizing the attack surface by removing unnecessary services and accounts and applying the latest security patches
( Kernel-Level Hardening ) Secure OS: Implementing strong access control through a reference monitor and MAC (Mandatory Access Control)
( Layered Defense ) Defense in Depth: Layering security controls across the physical, network, system, application, and data tiers

DDoS Attack Mitigation Plan Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Reactive, undocumented\nfirewall changes"] -- "Need for pre-validated,\nauditable DDoS defense" --> B["Formal DDoS Mitigation\nPlan Tracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DDoS (Distributed Denial of Service) Attack Mitigation Plan Tracker is the document that inventories which attack vectors a network is prepared to withstand, and which controls, thresholds, and escalation paths cover each one.

Features:
( Ownership ) Owned by the network security engineering team and operated jointly with the NOC and SOC during live incidents.
( Vector Coverage ) Spans volumetric floods, protocol exhaustion, reflection/amplification, and application-layer floods in a single inventory.
( Pre-Validated Response ) Replaces reactive, ad hoc rule changes made mid-attack with controls and thresholds validated before an incident.
( Traceability ) Preserves a record of what was tried, what worked, and what capacity limits were confirmed for future incidents.

IP Whitelist–Blacklist Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Undocumented ACL entries\nscattered across firewalls"] -- "Need for a centralized,\njustified, expiring allow/deny list" --> B["IP Whitelist–Blacklist\nTracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An IP (Internet Protocol) Whitelist–Blacklist Tracker records every address or subnet explicitly permitted or denied at the firewall, WAF, or reverse proxy, along with who requested the entry, why, and when it expires.

Network Access Control Log

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Access events visible only\nin live device sessions"] -- "Need for a persistent,\nreviewable trail of network access" --> B["Formal Network Access\nControl Log"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Network Access Control Log records connection events into network zones and segments and whether each event matched an authorized policy.

Features:
( Ownership ) Maintained by the NOC for raw capture and reviewed by the SOC for anomaly detection.
( Event Coverage ) Spans VPN logins, 802.1X port authentications, VLAN assignments, and remote access sessions.
( Investigative Trail ) Without it, access decisions made only at the moment of connection leave no record for later investigation.
( Use Case ) Supports investigating lateral movement, policy violations, and unauthorized devices after the fact.

Network Device Inventory

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Tribal knowledge of what\ndevices exist on the network"] -- "Need for a verified,\npatchable, auditable device catalog" --> B["Formal Network Device\nInventory"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Network Device Inventory is the authoritative list of every physical and virtual network device, with its location, firmware version, and configuration baseline.

Features:
( Ownership ) Owned and maintained by the network security engineering team, typically backed by a discovery or CMDB (Configuration Management Database) tool.
( Device Coverage ) Spans routers, switches, firewalls, load balancers, wireless access points, and VPN concentrators.
( Shadow Device Risk ) Unpatched or unknown (“shadow”) devices are a leading source of breaches when no inventory exists.
( Dependency ) Neither vulnerability management nor incident response can function without knowing what is actually on the network.

Network Security Risk Mitigation

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Network risks known informally,\naddressed only after incidents"] -- "Need for a prioritized,\nowned, and tracked mitigation plan" --> B["Formal Network Security\nRisk Mitigation register"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Network Security Risk Mitigation register catalogs identified network risks and pairs each with a likelihood, impact, and a concrete mitigation plan with an owner and target date.

Network Traffic Monitoring Dashboard

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Traffic visibility siloed\nper device, checked only reactively"] -- "Need for continuous,\ncentralized traffic visibility" --> B["Network Traffic Monitoring\nDashboard"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Network Traffic Monitoring Dashboard consolidates flow data, packet captures, and IDS/IPS alerts into a single operational view of what is moving across the network and whether any of it deviates from baseline.

DDoS (Distributed Denial of Service)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Distributed attack\nsources (Botnet)"] -- "Flood of massive abnormal traffic" --> B["Service outage\n(Denial of Service)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An attack technique that mobilizes numerous distributed attack points ( Botnet ) to exhaust the resources of a target system or network, making normal service impossible.

Features:
( Availability Breach ) Induces service response delays and system downtime, directly attacking availability ( Availability ), one of the three core elements of information security.
( Large-Scale Distribution ) Leverages zombie PCs and IoT devices distributed worldwide, making defense by blocking a single attack source difficult.
( Attack Complexity ) Evolves into multi-vector ( Multi-vector ) attacks that combine simple traffic flooding with application-vulnerability exploitation.

DRDoS (Distributed Reflective Denial of Service)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Attacker\n(Spoofed IP)"] -- "Small request packet" --> B["Reflector Servers"]
 B -- "Amplified response packet" --> C["Target Server\n(Victim)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#fff9c4,stroke:#fbc02d,stroke-width:3px
 style C fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An attack technique in which the attacker spoofs its own IP address as the victim’s IP ( Spoofing ), sends requests to numerous reflector servers ( Reflector ), and has those servers concentrate amplified responses onto the victim, overwhelming it.

Network Separation & Integration

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Single, unified\nnetwork"] -- "Physical / logical isolation" --> B["Internet threats\nblocked"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A collective term for network separation, which isolates the internal business network from the external internet to block outside attacks, and network integration, which ensures the safe movement of data between the separated networks.

Features:
( APT Response ) Protects internal network assets from Advanced Persistent Threats ( APT ) and blocks the spread of an attack.
( Data Leak Prevention ) Isolates the outbound path for sensitive information and personal data at the source.
( Compliance ) Satisfies requirements of the Network Act, the Personal Information Protection Act, and ISMS-P certification.

SASE (Secure Access Service Edge)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Network + security\n(managed separately)"] -- "Cloud-native convergence" --> B["SASE\n(single platform)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A cloud-native architecture that delivers networking functions such as SD-WAN together with security services such as next-generation firewall, CASB, and ZTNA from a single cloud platform.

Features:
( Perimeter Collapse ) The spread of cloud adoption and remote work has exposed the limits of the traditional perimeter-based security model.
( Network Bottlenecks ) Backhauling traffic through the data center increases latency and degrades performance.
( Management Complexity ) Fragmented, individual security solutions make unified policy management and visibility difficult.

SDP (Software Defined Perimeter)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Visible\nattack surface"] -- "Cloaking (Black Cloud)" --> B["Trust-based\nconnection (Drop-all)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A software-defined security architecture that cloaks infrastructure from the outside world ( Black Cloud ) until device authentication and user trust have been verified.

Features:
( Trust-Based ) A core technology for implementing Zero Trust, applying an authenticate-first, connect-second mechanism.
( Concealment ) Implements a “Black Cloud” that exposes no resources to unauthenticated users.
( Minimized Attack Surface ) Blocks unauthenticated traffic at the source, defending against scanning and distributed denial-of-service ( DDoS ) attacks.

Spoofing

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Attacker"] -- "Impersonates trusted\nidentification info" --> B["Target\n(Target / System)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An attack technique that forges network identification information such as IP addresses, MAC addresses, and DNS names to masquerade as an authorized user, gaining system access or intercepting data.

Features:
( Exploiting Trust Relationships ) Exploits the trust relationship ( Trust Relationship ) between systems to bypass authentication procedures or hijack privileges.
( Basis for Man-in-the-Middle Attacks ) Redirects the flow of data packets to the attacker, serving as the core mechanism for eavesdropping ( Sniffing ) and tampering in man-in-the-middle attacks ( MITM ).
( Occurs Across Multiple Layers ) Occurs at every layer, from the data link layer ( ARP ) to the network layer ( IP ) to the application layer ( DNS / Email ).

Zero Trust

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Perimeter-centric\nsecurity"] -- "Redefining trust\n(continuous verification)" --> B["Resource-centric\nsecurity"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security model that eliminates the distinction between internal and external, trusting nothing that accesses a resource — user, device, or network — and continuously verifying it instead.

Features:
( Perimeter Collapse ) The spread of cloud adoption and remote work has blurred the traditional network perimeter.
( Insider Threats ) Data leakage and misuse by trusted internal users are increasing.
( APT Response ) Detecting intrusions and blocking lateral movement is required to counter advanced persistent threats.

IPSec

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Untrusted\nIP network"] -- "Establishes a secure channel (ESP/AH)" --> B["Secure tunnel\n(VPN)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A protocol suite that establishes a security channel at the network layer ( L3 ) through encryption and authentication between communicating parties when transmitting data over an IP network.

Features:
( Confidentiality ) Encrypts data via ESP ( Encapsulating Security Payload ).
( Integrity ) Prevents tampering via AH ( Authentication Header ) and ESP authentication.
( Authentication ) Confirms the identity of communicating entities and exchanges keys via the IKE ( Internet Key Exchange ) protocol.
( Availability ) Uses sequence numbers ( Sequence Number ) to prevent replay attacks ( Replay Attack ).

OSI 7-Layer Security

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Single, undifferentiated\nsecurity control"] -- "Layer-specific security applied" --> B["Defense-in-depth\nsystem built"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A framework that analyzes the security threats specific to each of the seven network layers defined by the International Organization for Standardization ( ISO ) and applies matching security technologies and solutions to counter them.

Features:
( Layered Security ) Implements a multi-layer defense system in which a threat is still blocked at another layer even if a specific layer is compromised.
( Visibility ) Provides fine-grained control over network traffic through protocol analysis at each layer.
( Accountability ) Enables precise identification of where a fault or security incident occurred, allowing for rapid response.

OSI 7-Layer Security Threats

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Fragmented security policy\nfocused on one layer"] -- "Threat ID and defense-in-depth\nacross every layer" --> B["Layered security posture\nbuilt on the OSI 7 layers"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The set of security vulnerabilities unique to each layer of the OSI 7 Layer standard model — which divides the network communication process into seven layers — and the technical defense systems that counter them.

TLS (Transport Layer Security)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Plaintext comms and\nweak legacy SSL"] -- "Confidentiality, integrity, and\nhandshake overhead optimized" --> B["Hardened, high-performance\nTLS (especially 1.3)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A transport-layer security protocol ( RFC 8446 ) that establishes an encrypted channel between a client and a server to guarantee the confidentiality, integrity, and authentication of data in internet communications.

Features:
( Hybrid Cryptosystem ) Uses public-key cryptography ( Asymmetric ) to safely exchange a symmetric key, then transmits the actual data using fast symmetric-key encryption ( Symmetric ).
( Integrity Assurance ) Uses a message authentication code ( MAC ) or HMAC to verify in real time whether data has been tampered with in transit.
( Strong Authentication ) Uses digital certificates ( X.509 ) and the PKI system to verify the identity of the communicating party and prevent man-in-the-middle attacks ( MITM ).
( Performance Optimization ) The latest TLS 1.3 shortens the handshake ( 1-RTT, 0-RTT ), achieving both security and speed.

Cloud Access Control Matrix

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Manually tracked, drifting\ncloud accounts"] -- "Need for continuous\nposture visibility" --> B["Formal Cloud Access\nControl Matrix"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Cloud Access Control Matrix is a structured inventory of every identity — human user, group, or service account — with access to a cloud account, subscription, or project, together with the role, permission scope, and resource boundary each identity holds.

Cloud Asset Inventory Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Unknown or shadow\ncloud resources"] -- "Need for continuous\ndiscovery and ownership" --> B["Formal Cloud Asset\nInventory Tracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Cloud Asset Inventory Tracker is a continuously updated register of every resource running across an organization’s cloud accounts — virtual machines, containers, storage buckets, managed databases, serverless functions, and PaaS/SaaS subscriptions — along with its owner, environment, and data sensitivity.

Cloud Backup & Recovery Testing Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Backups configured but\nnever restore-tested"] -- "Need for verified\nrecovery assurance" --> B["Formal Cloud Backup &\nRecovery Testing Tracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Cloud Backup & Recovery Testing Tracker records what is backed up in cloud environments, how, and — critically — when the restore was last tested and whether it succeeded.

Features:
( Ownership ) Maintained by the cloud platform or disaster recovery team, with sign-off from workload owners on recovery results.
( Verified Assurance ) Treats a backup that has never been restored as an unverified assumption, not a control.
( Objective Validation ) Demonstrates recovery point and recovery time objectives against real restore attempts rather than a backup job’s success status.

Cloud Incident Response Log

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Cloud alerts handled\nad hoc across teams"] -- "Need for consistent tracking\nand root-cause closure" --> B["Formal Cloud Incident\nResponse Log"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Cloud Incident Response Log is the chronological record of security incidents detected in cloud environments — exposed storage, compromised credentials, misused service accounts, or compromised workloads — tracked from detection through containment, root cause, and remediation.

Cloud Security Configuration Baseline

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Inconsistent, per-team\ncloud configurations"] -- "Need for a single\nenforceable hardening standard" --> B["Formal Cloud Security\nConfiguration Baseline"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Cloud Security Configuration Baseline defines the approved secure settings — IAM policy limits, storage access defaults, network exposure rules, logging requirements — that every cloud resource of a given type must meet, expressed as controls a CSPM tool or policy engine can check automatically.

CASB (Cloud Access Security Broker)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Shadow IT\nproliferation"] -- "Unified cloud\nsecurity policy" --> B["Visibility and\nthreat defense"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A CASB is a security solution or service placed between an organization’s on-premises infrastructure and its cloud services that applies security policy consistently and provides visibility across that boundary.

Features:
( Shadow IT Control ) Identifies and manages the risk of unauthorized cloud services used outside organizational control.
( Data Leakage Prevention ) Blocks the exfiltration of sensitive information through DLP capabilities optimized for cloud environments.
( Account Protection ) Detects abnormal logins and applies access control to counter cloud account takeover attacks.

CNAPP (Cloud Native Application Protection Platform)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Fragmented\nsecurity tooling"] -- "Integrated CSPM +\nCWPP platform" --> B["Unified cloud\nvisibility"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: CNAPP is a cloud-native security platform that unifies the configuration management of cloud assets, such as virtual machines, containers, and serverless functions (CSPM), with workload protection (CWPP) into a single system.

Features:
( Resolving Fragmentation ) Integrates individual solutions such as CSPM and CWPP to eliminate security blind spots and reduce management complexity.
( Enhanced Correlation ) Combines analysis of infrastructure configuration and workload threats to prioritize protection of assets with genuinely high risk.
( Lifecycle Protection ) Provides security visibility across the entire cloud lifecycle, from development (artifact scanning) to operations (runtime).

The Two Pillars of Cloud Security (CSPM and CWPP)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Cloud\nmisconfiguration"] -- "Configuration monitoring\nand workload protection" --> B["Cloud infrastructure\nstability"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An integrated security framework combining CSPM, which checks cloud infrastructure for configuration errors, and CWPP, which protects workloads such as virtual machines (VMs) and containers.

Features:
( Preventing Misconfiguration ) Continuous monitoring is needed to prevent data breaches caused by cloud misconfigurations.
( Workload Protection ) Requires real-time threat response for dynamic cloud execution environments such as containers and serverless functions.
( Compliance Response ) Requires ongoing verification of technical security standards and regulatory compliance for dynamic cloud assets.

DSPM (Data Security Posture Management)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Fragmented\ndata"] -- "Data-centric\nrisk management" --> B["Shadow data\nidentification & protection"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security technology that automatically discovers the location of structured and unstructured data within cloud infrastructure and provides visibility by analyzing the data’s sensitivity and security risk.

Features:
( Shadow Data Identification ) Automatically detects hidden data assets — such as copies and test databases — that fall outside IT department control.
( Sensitivity-Based Protection ) Classifies data itself by sensitivity (e.g. personal information) and applies differentiated security based on importance.
( Compliance Evidence ) Provides ongoing visibility to meet strengthened data protection regulations such as GDPR and ISMS-P.

Integrated Cloud-Native Security Architecture

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Individual\nsecurity solutions"] -- "Layered security\nstack integration" --> B["Cloud-native\nsecurity"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A defense-in-depth framework spanning cloud service configuration (control plane), actual data processing (data plane), and user access points.

Features:
( Unified Visibility ) Combines fragmented security solutions into a single architecture to gain visibility across the entire cloud estate.
( Data-Centric Security ) A risk management framework focused on the “data itself” that must be protected, rather than infrastructure or the network.
( Automated Response ) Maximizes the efficiency and speed of security operations through policy-based real-time monitoring and automated remediation.

Shadow IT

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Unauthorized\nservice use"] -- "Detection and\ngovernance adoption" --> B["Transparent asset\nmanagement"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Information assets and services used for business purposes that violate an organization’s information security policy or bypass its formal asset management process.

Features:
( Reduced Security Visibility ) Falls outside the organization’s formal asset management framework, making it impossible for the security team to monitor or control.
( Data Leakage Path ) Poses a persistent risk of sensitive corporate information leaking externally through personal cloud storage or collaboration tools.
( Compliance Violation ) Using services that have not received security certification can result in violations of legal and regulatory compliance requirements.

Kubernetes Security

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Complex attack\nsurface (MSA)"] -- "Applying the 4C\nlayered defense model" --> B["Hardened cluster\n(secure K8s)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A multi-faceted set of security mechanisms that protects cluster components (the control plane) and workloads (worker nodes) in a container orchestration environment from external threats and internal misconfiguration.

Features:
( Growing Attack Surface ) The spread of microservices architecture (MSA) increases the number of complex communication paths and exposure points.
( Defending Against Lateral Movement ) Once a container is compromised, blocking its spread to neighboring containers or hosts (lateral movement) is essential.
( Preventing Misconfiguration ) Weak security in declarative configuration (YAML) can lead to permission abuse and data leakage incidents that must be prevented.

Amdahl's Law

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Work that depends\non sequential execution"] -- "Deriving the limit of\nspeedup under parallel processing" --> B["Overall system\nspeedup"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A principle stating that the maximum speedup achievable by parallelizing a given task is limited by the proportion of that task which must inevitably run sequentially.

Features:
( Bottleneck of Sequential Processing ) No matter how many processors are added, the portion of a system that must run sequentially (serial) gains no benefit from parallel processing.
( Upper Bound on Speedup ) The higher the proportion of work that cannot participate in parallel processing, the more the overall system speedup diminishes.
( Importance of Architectural Design ) Implies that designing an architecture favorable to parallel processing (MSA, distributed systems) is the key to scaling performance.
( Proposed by Gene Amdahl ) Proposed in 1967 by Gene Amdahl, this theory remains the foundation for predicting parallel computing performance.

Patch & Update Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Patches applied reactively,\nonly after exploitation or audits"] -- "Need for proactive,\ndeadline-driven remediation" --> B["Formal Patch &\nUpdate Tracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Patch & Update Tracker is the document that inventories every application, framework, and third-party library a team owns, alongside the patches or version updates available for each, their severity, and the deadline by which they must be applied.

Secure Coding Checklist

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Vulnerabilities found only\nlate, in production"] -- "Need to shift security\nleft in the SDLC" --> B["Formal Secure\nCoding Checklist"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Secure Coding Checklist is the standardized set of requirements developers verify before code is merged or released — covering input validation, output encoding, authentication and session handling, and safe use of database and file-system APIs.

Secure Mobile App Testing Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Mobile releases shipped with\nfunctional QA, not security testing"] -- "Need for platform-specific\nsecurity validation" --> B["Formal Secure Mobile\nApp Testing Tracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Secure Mobile App Testing Tracker records which security tests have been run against a mobile application build — insecure storage checks, transport security validation, reverse-engineering resistance, and platform-specific permission review — and the status of any findings.

Security Misconfiguration Log

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Hardening gaps discovered ad hoc,\nper incident, with no shared record"] -- "Need for a centralized,\nreusable hardening baseline" --> B["Formal Security\nMisconfiguration Log"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Security Misconfiguration Log tracks hardening gaps in how an application, its framework, and its supporting infrastructure are configured — default credentials left in place, verbose error messages exposing stack traces, unnecessary services or ports left open, and permissive CORS (Cross-Origin Resource Sharing) or cloud storage policies.

Static Code Analysis Log

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["SAST findings generated\nbut left untriaged in CI output"] -- "Need for tracked, accountable\nremediation of static findings" --> B["Formal Static Code\nAnalysis Log"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Static Code Analysis Log records the findings produced by SAST (Static Application Security Testing) tools scanning source code before it runs — insecure API usage, hardcoded secrets, and syntax patterns known to cause injection or memory-safety issues — along with each finding’s disposition.

Web Application Vulnerability Tracker

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Pentest and scan findings\ndelivered as a report, then forgotten"] -- "Need for tracked, verifiable\nremediation of runtime findings" --> B["Formal Web Application\nVulnerability Tracker"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Web Application Vulnerability Tracker records findings from dynamic testing against a running application — DAST (Dynamic Application Security Testing) scans, penetration tests, and bug bounty reports — covering classes like SQL injection, XSS, CSRF, and broken access control.

Application Threat Modeling

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Security controls bolted on\nafter architecture is fixed"] -- "Need to identify attacker\nscenarios during design" --> B["Formal Application Threat\nModeling process"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An Application Threat Modeling document captures the structured analysis of a system’s attack surface — its trust boundaries, data flows, and the ways an attacker could abuse each one — performed before or during design, rather than after the code is written.

CSRF (Cross-Site Request Forgery)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Authenticated user session"] -- "Forged Request" --> B["Unintended action\non the server"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: CSRF (Cross-Site Request Forgery) is an attack technique that makes a user’s browser send a request an attacker has designed — to modify, delete, or register data — to a specific website, without the user’s knowledge or intent.

SQL Injection

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Unauthorized input\n(Malicious SQL)"] -- "Missing validation and\naltered query structure" --> B["DB privilege takeover and\ndata exfiltration"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: SQL Injection is an attack technique in which user input, treated as a parameter that determines the structure of a database query, is manipulated to make the application execute unintended SQL statements.

Features:
( Data Exfiltration ) An unauthorized user can query or steal sensitive information stored in the database.
( Authentication Bypass ) Neutralizes login queries to attempt access to the system with administrator privileges.
( Integrity Destruction ) Arbitrarily modifies or deletes data in the database, or executes system commands (e.g. via xp_cmdshell).

XSS (Cross-Site Scripting)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Malicious script injection"] -- "Execution in the browser and\nsession hijacking" --> B["Abuse of user privileges\n(Session Hijacking)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: XSS (Cross-Site Scripting) is a security vulnerability in which an attacker injects a malicious script into a web application so that the script executes in the browser of any user who views the page.

API Security (OWASP API Top 10 and BOLA)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Exposed endpoints"] -- "OWASP API Top 10\nmanagement" --> B["Secure data\nconnectivity"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: API security refers to the technologies and processes that protect the API interfaces supporting interaction between applications from unauthorized access, data leakage, and availability breaches.

Features:
( Data-Centric Communication ) Unlike traditional web (HTML), interaction is centered on structured data such as JSON and XML.
( Broad Attack Surface ) Numerous endpoints are exposed externally, requiring sophisticated authorization control and business-logic protection.
( Statelessness ) Because each request is processed independently, strong token-based authentication and authorization mechanisms are required.

Code Security (SAST, DAST, and Secure Coding)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Source code vulnerabilities"] -- "SAST / DAST /\nSecure Coding" --> B["Sound, defect-free\nsoftware"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Code security is the practice of analyzing the security weaknesses that can arise during software development and applying safe coding standards to build software free of vulnerabilities.

Features:
( Cost Reduction ) Removing security weaknesses at the early development stage minimizes the cost of fixing them after release.
( Proactive Defense ) Preemptively blocks well-known major vulnerabilities and attack techniques such as the OWASP Top 10.
( Software Trustworthiness ) Builds security into the software itself through adherence to safe coding standards.

DevSecOps Pipeline

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Post-development,\nafter-the-fact security review"] -- "Shift-Left security and\nautomatic CI/CD pipeline integration" --> B["A DevSecOps pipeline\nwith security built in"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DevSecOps pipeline is a CI/CD pipeline that automates and integrates security activities across the entire software development lifecycle ( SDLC ) — a modern development framework that secures both speed and security at the same time.

DevSecOps

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["After-the-fact\nsecurity review"] -- "Security automation and\nShift-Left" --> B["Fast, secure\nservice delivery"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: DevSecOps is a culture and methodology that treats security as a shared responsibility by automating and integrating security activities across the entire software development lifecycle (SDLC).

Features:
( Early Detection ) Moves security review to the early stage of development to identify defects early (Shift-Left).
( Automation Integration ) Integrates security scanning and validation into the CI/CD pipeline to prevent human error.
( Shared Responsibility ) Shifts security from being the job of a specific team to a shared responsibility across the Development / Operations / Security teams.

Software Supply Chain Security (SBOM and SLSA)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Open-source threats"] -- "SBOM and SLSA\nframeworks" --> B["Assured software\ntrustworthiness"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Software supply chain security refers to the activities that manage security threats and ensure trustworthiness across the entire process — design, development, build, and deployment — by which software is produced and delivered to users.

Features:
( Responding to Surging Threats ) The need for a proactive defense system against supply chain attacks such as the Log4j and SolarWinds incidents.
( Ensuring Transparency ) Securing visibility into software components (SBOM) to enable rapid response when a vulnerability arises.
( Ensuring Trustworthiness ) Verifying integrity across the entire process, from development to deployment, to prevent the distribution of tampered software.

Acceptable Use of Assets Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Unwritten, assumed norms\nfor using company devices"] -- "Need for an enforceable,\nsigned baseline" --> B["Formal Acceptable Use\nof Assets Policy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An Acceptable Use of Assets Policy (AUP) is the document that sets the rules for how employees, contractors, and third parties may use company-owned IT assets — laptops, mobile devices, email accounts, cloud storage, and network access.

Password Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Informal, unwritten\npassword expectations"] -- "Need for enforceable,\nauditable minimum standards" --> B["Formal Password\nPolicy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Password Policy is the document that defines the minimum authentication standards employees and systems must meet — length, complexity, rotation, reuse restrictions, and where multi-factor authentication (MFA) is mandatory.

Features:
( Ownership ) Maintained by the CISO or IT security team and technically enforced through identity and access management (IAM) tooling and directory services.
( Breach Prevention ) Closes off weak or reused credentials, one of the most common initial-access vectors in breaches.
( Regulatory Baseline ) Gives regulators and auditors a documented baseline rather than per-system, ad hoc rules.
( MFA Requirements ) Specifies where multi-factor authentication is mandatory alongside password strength rules.

Backup and Recovery Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Ad-hoc, unverified\nsystem backups"] -- "Need for guaranteed recovery\nwithin defined limits" --> B["Formal Backup\nand Recovery Policy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Backup and Recovery Policy is the document that defines what data must be backed up, how often, where copies are stored, and how restoration is tested and executed.

Features:
( Ownership ) Jointly owned by IT operations, who run the backups, and the CISO or GRC team, who set the risk-driven requirements.
( Coverage Assurance ) Prevents backup coverage from drifting, where some systems end up backed up inconsistently or not at all.
( Early Discovery ) Surfaces gaps before an actual incident, rather than after it is too late to correct.
( Restoration Testing ) Requires that restoration procedures are tested and executed, not just that backups are taken.

Compliance Management

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Scattered, reactive responses\nto individual audits"] -- "Need for a continuous,\nmapped compliance program" --> B["Formal Compliance\nManagement program"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Compliance Management is the ongoing program that maps applicable laws, regulations, industry standards, and contractual obligations to internal controls, and tracks whether those controls are actually operating.

Features:
( Ownership ) Owned by the CISO or a dedicated GRC function, with input from legal counsel on regulatory interpretation.
( Regulatory Scope ) Spans obligations such as ISO/IEC 27001, ISMS-P, GDPR, and sector-specific rules across jurisdictions and customer contracts.
( Central Tracking ) Replaces scattered awareness with a central mechanism that tracks whether controls are actually operating.
( Early Detection ) Surfaces gaps before an audit finding or regulatory inquiry exposes them.

Disposal and Destruction Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Retired hardware and records\ndiscarded without controls"] -- "Need for verifiable,\nsecure end-of-life handling" --> B["Formal Disposal\nand Destruction Policy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Disposal and Destruction Policy is the document that defines how data-bearing assets — hard drives, backup tapes, mobile devices, printed records — must be sanitized or physically destroyed once they are no longer needed.

Information Classification Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Data treated uniformly\nregardless of sensitivity"] -- "Need for tiered handling\nrules matched to risk" --> B["Formal Information\nClassification Policy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An Information Classification Policy is the document that defines a small set of sensitivity tiers — such as public, internal, confidential, and restricted — and the handling rules attached to each.

Features:
( Ownership ) Owned by data owners in partnership with the CISO or security team, pairing business-impact judgment with technical control design.
( Handling Rules ) Attaches access, storage, transmission, and disposal rules to each sensitivity tier.
( Foundational Role ) Underpins most of the rest of the security program, since access rights, encryption, and transfer restrictions all depend on it.
( Consistent Basis ) Gives every other control a consistent basis to apply against, rather than ad hoc judgment calls.

Information Transfer Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Ad-hoc email and\nfile-sharing of sensitive data"] -- "Need for controlled,\nclassification-aware transfer channels" --> B["Formal Information\nTransfer Policy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An Information Transfer Policy is the document that defines the approved methods, controls, and authorization steps for moving data between people, systems, or organizations, matched to the data’s classification tier.

Features:
( Ownership ) Maintained by the CISO or GRC team and applied by everyone who sends or receives organizational data.
( Channel Coverage ) Spans email, file transfer, physical media, and API integration.
( Technical Enforcement ) Enforces heavier controls through IT tooling such as encrypted transfer gateways or data loss prevention (DLP) systems.
( Control Continuity ) Protects the point where data most often leaves the organization’s direct control, preserving classification and access controls set elsewhere.

ISMS Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Isolated, project-based\nsecurity initiatives"] -- "Need for a continual,\ngoverned management system" --> B["Formal ISMS\nPolicy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The ISMS (Information Security Management System) Policy is the top-level charter document that establishes the scope, objectives, and governance structure for how an organization manages information security on an ongoing basis.

Features:
( Ownership ) Owned by the CISO and formally approved by executive leadership or the board.
( Governance Commitment ) Commits the organization to resourcing and accountability for security at the governance level.
( Continual Improvement ) Follows a plan-do-check-act cycle rather than isolated, project-based security efforts.
( Standards Alignment ) Provides the structure expected by standards such as ISO/IEC 27001 and required for many certification and regulatory regimes.

COBIT-Based Security Governance

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["No unified\nIT governance"] -- "separating governance\nfrom management" --> B["Business value-optimized\nsecurity controls"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: COBIT-based security management is a control framework that clearly separates security activities into governance and management, so that security risk is evaluated from a business perspective and security investment is aligned with enterprise objectives.

Features:
( Structured Governance ) Security activities are clearly divided into Governance and Management and controlled separately.
( Business Alignment ) Security risk is evaluated from a business standpoint so that security investment is aligned with the achievement of enterprise goals.
( Optimized Risk Management ) Precise, framework-based diagnostics keep security risk managed at an acceptable level.

ISMS-P

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Separate\nsecurity management"] -- "integrating information security\nand personal information protection" --> B["Enterprise-wide\nsecurity governance"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: ISMS-P integrates the information security management system ( ISMS ) and the personal information management system ( PIMS ) into a single management system, and is Korea’s most comprehensive certification scheme, designed to let organizations respond to security threats on their own.

ISO 27001

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Fragmented\nsecurity activities"] -- "PDCA-based\ninternational standard" --> B["Continuous security\nimprovement system"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: ISO 27001 is an international standard for an information security management system that sets out a systematic management process to maintain the confidentiality, integrity, and availability (CIA) of information assets through continuous improvement.

Features:
( Securing the CIA triad ) A systematic management process for maintaining the confidentiality, integrity, and availability (CIA) of information assets.
( Continuous improvement ) The information security management system is constantly upgraded through the PDCA (Plan-Do-Check-Act) model.
( Global credibility ) International certification raises external trust in security and strengthens business competitiveness.

Privacy Impact Assessment (PIA)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Building or changing\na system"] -- "analyzing and remediating\nrisk factors" --> B["Preventing personal\ninformation breaches"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Privacy Impact Assessment (PIA) is an institutional procedure that analyzes personal-information risk factors and derives improvements whenever a system operating personal information files is built or changed.

Features:
( Privacy by Design ) Personal-information protection considerations are reflected in the design from the earliest stage of system development.
( Breach prevention ) Potential personal-information exposure risks are analyzed in advance to prevent breaches at the source.
( Legal safety ) Compliance with the Personal Information Protection Act and related legislation resolves legal risk and improves organizational trust.

Korea's Data 3 Acts

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Data protection\n(Regulation)"] -- "introducing pseudonymized data\n(safe reuse)" --> B["Data economy\n(Innovation)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Data 3 Acts are a body of law, created by amending the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization, and the Credit Information Use and Protection Act, that clearly defines the scope of pseudonymizing and using personal information and unifies the surrounding legal framework.

Differential Privacy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Individual record\nincluded (Data D)"] -- "injecting mathematical\nnoise (ε)" --> B["Statistically similar\nresult (Data D')"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Differential privacy is a privacy-protection mechanism that injects mathematical noise into a probability distribution so that a statistical analysis result is nearly identical regardless of whether any one individual’s data is included in the dataset.

Core principle and features:
( Defense against background-knowledge attacks ) Mathematically proves that a specific individual cannot be identified even if an attacker holds external (background) information.
( Privacy budget ) The smaller the value of ε ( Privacy Budget ), the stronger the privacy protection — but the lower the utility of the data, creating a trade-off.
( Mathematical rigor ) The degree of privacy exposure is quantitatively controlled through a formula such as Pr[M(D) ∈ S] ≤ e^ε × Pr[M(D') ∈ S].

EU AI Act

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Autonomous\nAI operation"] -- "risk-based\nregulatory framework" --> B["Trustworthy\nAI ecosystem"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The EU AI Act is the EU’s legal framework that sets out obligations by risk level so that AI systems do not infringe on human safety, health, and fundamental rights.

Features:
( Risk-based regulation ) Classifies AI systems into 4 risk tiers and imposes differentiated obligations accordingly.
( Human-centered design ) Requires strict oversight of high-risk AI to protect human safety, health, and fundamental rights.
( Aiming for a global standard ) Presents a model standard for AI governance and ethical guidelines worldwide, beyond Europe.

5 Pseudonymization Techniques

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Identifiable\ninformation"] -- "applying the 5 core\npseudonymization techniques" --> B["Pseudonymized\n(de-identified) data"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Pseudonymization techniques are technical methods that delete or substitute part of personal information so that a specific individual cannot be identified without additional information.

Core value and purpose:
( Data Utility ) Preserves the data’s statistical properties and quality ( Utility ) so it still fits the intended analysis purpose.
( Privacy Protection ) Minimizes re-identification risk to safeguard data subjects’ privacy rights.
( Risk Management ) Secures legal compliance through technical measures and cuts off the risk of a security incident (re-identification) at the source.

CSAP Tiered Certification

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Uniform\ncertification standard"] -- "differentiating by\ndata sensitivity" --> B["3-tier system\n(High / Medium / Low)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Cloud Security Assurance Program ( CSAP ) is a certification scheme that applies differentiated security criteria in 3 tiers, “High, Medium, and Low,” according to the sensitivity of the data handled by the cloud service a public agency intends to adopt.

Incident Management Policy

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["No shared definition of\nwhat counts as an incident"] -- "Need for consistent classification and accountability" --> B["Formal Incident\nManagement Policy"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Incident Management Policy is the top-level governance document that defines what qualifies as an incident, establishes severity tiers, assigns accountability, and sets mandatory response and notification timelines.

Features:
( Ownership ) Owned by the CISO’s office for security incidents, in coordination with HR and facilities leadership for physical and personnel incidents.
( Approval ) Approved by executive management or the board before it takes effect.
( Consistency ) Without it, incident classification and escalation become inconsistent and response times unpredictable.
( Regulatory Compliance ) Prevents missed regulatory notification deadlines, such as breach disclosure laws.

Incident Management Process

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Ad-hoc verbal\nincident handoffs"] -- "Need for consistent triage and accountability" --> B["Formal Incident\nManagement Process"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Incident Management Process is the operational runbook that translates the Incident Management Policy into concrete, repeatable steps: how an event is detected, logged, triaged, escalated, contained, and closed out.

Features:
( Ownership ) Owned and executed by the SOC / incident response team.
( Telemetry ) SIEM and EDR platforms provide the detection and telemetry that feed the process.
( Consistency ) Replaces inconsistent, memory-based handling that extends dwell time and loses forensic evidence.
( Audit Readiness ) Produces incident records detailed enough to support root-cause analysis and compliance audits.

Intern Incident Report

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Supervisor handles intern\nincidents informally, undocumented"] -- "Need for consistent HR record and liability protection" --> B["Formal Intern\nIncident Report"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Intern Incident Report is a structured template for documenting any incident involving an intern or temporary staff member — policy violations, safety events, conduct issues, or accidental data exposure.

Features:
( Ownership ) Owned by HR, typically in coordination with the intern’s direct supervisor.
( IT Security Involvement ) IT security is looped in wherever the incident touches systems or data.
( Scope ) Covers interns, who often sit outside standard onboarding and access-control assumptions.
( Liability Protection ) Unrecorded incidents involving temporary staff create liability exposure and gaps in the intern program’s safety record.

Major Incident Report Template

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Informal notes scattered\nacross chat and email"] -- "Need for a defensible, auditable incident record" --> B["Formal Major Incident\nReport Template"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Major Incident Report Template captures the full lifecycle of a critical or high-severity security incident: detection source, impact, timeline, containment actions, root cause, and corrective actions.

Features:
( Ownership ) Owned by the SOC / incident response team.
( Sign-Off ) Requires sign-off from the incident commander and CISO before closure.
( Detection Sources ) Documents how the incident was detected, via SIEM correlation or EDR behavioral alerting.
( Defensibility ) Provides the defensible, evidence-backed account that regulators, auditors, and executive leadership expect — informal notes are not sufficient for legal or compliance review.

Structural Damage Incident Report

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Facilities damage handled\nverbally with no paper trail"] -- "Need for insurance, safety, and IT-impact documentation" --> B["Formal Structural Damage\nIncident Report"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Structural Damage Incident Report documents physical damage to a building, data center, or piece of infrastructure — from a leak or fire to storm or equipment-related damage — and the immediate and corrective actions taken.

Workplace Violence Report

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Verbal handling of threats\nwith no formal record"] -- "Need for safety response and legal accountability" --> B["Formal Workplace\nViolence Report"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Workplace Violence Report documents any threat, altercation, or act of violence involving employees, contractors, or visitors, capturing what happened, who was involved, and what immediate and follow-up action was taken.

The Core of Endpoint Visibility, EDR

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Blind Spot\n(Unknown Threat)"] -- "Visibility gained through behavior-log analysis" --> B["Breach Tracking\n(Visibility)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security platform that continuously monitors and records activity occurring on an endpoint, such as processes, files, network connections, and registry changes, in order to detect and respond to unknown threats.

Features:
( Visibility ) Under the assumption that “the breach has already happened” ( Assume Breach ), records a full timeline of all activity on the endpoint
( Active Response ) When a threat is detected in real time, immediately isolates the endpoint and terminates the process to block the damage from spreading
( Threat Hunting ) Proactively traces potential attack traces by mapping activity against the MITRE ATT&CK framework

The Integrated Control Tower for Threat Detection and Analysis, SIEM

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Distributed Log Sources\n(servers, firewalls, apps, etc.)"] -- "Unified collection and analysis" --> B["Security Events\n(Real-Time Detection)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security operations system that collects, analyzes, and stores the security logs and events generated across an organization’s various IT resources (servers, network equipment, applications, and more) in real time in order to detect and respond to threats.

Digital Forensics

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Digital Data\n(Raw Data)"] -- "Scientific investigation and proof of integrity" --> B["Legal Evidence\n(Admissible in Court)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A scientific investigation and examination technique that collects, recovers, and analyzes electronic data stored on digital devices such as computers, smartphones, and cloud services in order to use it as legal evidence.

Features:
( Integrity ) Proves through means such as hash ( Hash ) values that collected evidence has not been altered or forged during the analysis process
( Chain of Custody ) Chain of Custody: maintains a record of every path and person responsible, from evidence collection through submission to the court
( Reproducibility ) Ensures the objectivity that analyzing with the same tools and procedures must yield the same results
( Legitimacy ) Preserves the legal admissibility ( Admissibility ) of evidence by complying with due process and the principle of judicial warrants

Known Error (KE) Record Template

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Same fault re-diagnosed from scratch\neach time it recurs"] -- "Need a reusable, discoverable workaround" --> B["Published Known Error\nRecord"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Known Error (KE) Record documents a problem for which the root cause has been diagnosed and a workaround identified, even though a permanent fix has not yet been implemented.

Features:
( Ownership ) Owned and maintained by the problem manager or a designated technical lead.
( Publication ) Published so service desk and incident responders can apply the workaround immediately instead of re-diagnosing the same fault.
( Operational Role ) Complements incident response, which restores service fast using whatever workaround is on file.
( Discoverability ) Makes the workaround discoverable and consistent across every recurrence of the fault.

Major Problem Report Template

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Major problem closed\nwith no formal review"] -- "Need to capture cost, cause, and lessons for leadership" --> B["Major Problem\nReport"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Major Problem Report is the formal, executive-facing review produced after a high-impact or high-recurrence problem has been resolved (or requires escalated attention).

Features:
( Ownership ) Owned by the problem manager, typically with sign-off from service owners and, for security-rooted problems, the CISO.
( Root-Cause Focus ) Explains why the fault existed in the first place, where an incident report explains only how service was restored.
( Cost Accounting ) Captures what the problem cost across every recurrence, not just the final incident.
( Structural Change ) Documents what structural changes prevent the problem happening again, turning a technical fix into an organizational lesson.

Problem Management Process

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Ad-hoc, inconsistent handling\nof recurring incidents"] -- "Need a repeatable path from symptom to root-cause fix" --> B["Documented Problem\nManagement Process"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The Problem Management Process defines how an organization moves from a pattern of incidents to a diagnosed root cause to a permanent fix, in a repeatable, auditable way.

Features:
( Ownership ) Owned by the problem manager as a process document.
( Reference Use ) Referenced by service desk, incident response, and engineering teams whenever incidents recur or a single incident warrants investigation.
( ITIL Distinction ) Enforces the ITIL split between incident management, optimized for speed of restoration, and problem management, optimized for permanence of resolution.
( Trade-off ) Deliberately trades immediate closure for durable prevention of the root cause.

Problem Record Template

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Multiple closed incidents\nwith the same unresolved cause"] -- "Need one record to track the cause to elimination" --> B["Formal Problem\nRecord"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A Problem Record is the individual working document that tracks one problem’s investigation, from initial suspicion of a common root cause through diagnosis, workaround, and permanent resolution.

Features:
( Ownership ) Opened and maintained by the problem manager, with technical input from the engineering or security teams best placed to diagnose the fault.
( Lifecycle ) Stays open until the underlying cause is eliminated, unlike an incident ticket that closes once service is restored.
( Single Source ) Gives the organization a single place to track that longer-running investigation effort.
( Investigation Trail ) Records the path from initial suspicion of a common root cause through diagnosis, workaround, and permanent resolution.

DR Approach Document

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Recovery strategy improvised\nduring each past incident"] -- "Need a documented,\nleadership-endorsed recovery approach" --> B["Formal DR Approach\nDocument"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DR Approach Document is the strategic layer of disaster recovery: it states which systems are in scope, which recovery strategy tiers apply, the governance model, and the target bands for RTO (Recovery Time Objective) and RPO (Recovery Point Objective) before any system-level plan is written.

DR Asset Register

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Recovery plan referencing an\nuntracked, stale system list"] -- "Need accurate mapping of\nassets to recovery priority" --> B["Maintained DR Asset\nRegister"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DR Asset Register is the current, validated inventory of every system, application, and piece of infrastructure in scope for disaster recovery, mapped to its business owner, dependencies, criticality tier, and per-asset RTO/RPO targets.

DR Closure Report

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Exercises and activations end\nwith no formal outcome record"] -- "Need auditable evidence recovery\nworked and lessons captured" --> B["Formal DR Closure\nReport"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DR Closure Report is produced after a disaster recovery exercise or a real disaster activation is stood down, documenting what was actually recovered, the actual RTO and RPO achieved against target, gaps encountered, and the corrective actions assigned to close them.

DR Communications Plan

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Ad hoc, inconsistent messaging\nduring past outages"] -- "Need a pre-approved,\nrole-based communication protocol" --> B["Formal DR Communications\nPlan"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DR Communications Plan defines, in advance, who notifies which stakeholder group during a declared disaster, through which channel, using which pre-approved message templates, and under what escalation timing.

Features:
( Ownership ) Owned by the DR coordinator working with corporate communications and legal, and exercised alongside the DR Plan Template.
( Distinct Failure Mode ) Without it, teams improvise messaging under pressure while racing against RTO targets.
( Stakeholder Reach ) Covers inconsistent or premature statements to staff, customers, or regulators.
( Comparable Damage ) A messaging failure is a failure mode distinct from, but as damaging as, missing a recovery deadline.

DR Plan Template

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["No documented recovery strategy\nfor critical systems"] -- "Need to meet defined\nRTO and RPO targets" --> B["Formal DR Plan\nTemplate"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A DR Plan Template is the operational runbook invoked once a disaster is declared: it lays out, per system or service, the recovery team, activation criteria, and the exact step-by-step procedure to restore operation within its target RTO (Recovery Time Objective) and RPO (Recovery Point Objective).

MAC vs. DAC vs. RBAC: Access Control Models Compared

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Discretionary\nprivilege grants"] -- "Mandatory / role-based models" --> B["Security policy &\nseparation of duties"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A policy framework that restricts access rights to resources within a system according to a subject’s identity, security clearance, or role, in order to block unauthorized access.

Features:
( Least Privilege ) Grants only the minimum privileges truly required for a duty or role, preventing insider threats and containing the spread of incidents
( Separation of Duties ) Separates the execution of key tasks from the authority to approve them, cutting off fraud and misuse at the source
( Centralized Control ) Verifies and approves access to every resource from a single point under a consistent security policy

Access Control

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Unrestricted\naccess"] -- "Identification / authentication / authorization policy" --> B["Resource protection &\nmisuse prevention"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: The set of policies and technical means that check whether a subject has the appropriate privileges when it attempts to access an object, and that allow or deny the attempt accordingly.

Features:
( Confidentiality ) Blocks access by unauthorized subjects, preventing information from leaking outside
( Integrity ) Restricts unauthorized users from modifying or deleting data, protecting the accuracy of information
( Availability ) Ensures that users with legitimate privileges can always access resources whenever they need to

Authentication vs. Authorization

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["A single\nuser request"] -- "Identity verification, then privilege granting" --> B["Trust-based\naccess control"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Authentication verifies who a subject claims to be, while authorization determines what an authenticated subject is permitted to do — two distinct but sequential steps in access control.

Features:
( Identity Verification (Authentication) ) Confirms whether a subject’s claimed identity is genuine, establishing trust at the system’s entry point
( Privilege Control (Authorization) ) Defines the scope of an authenticated user’s actions and grants resource access under the principle of least privilege
( Security Visibility ) Authentication and authorization logs trace a subject’s activity and provide accountability when incidents occur

FIDO (Fast IDentity Online)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Password-based\nauthentication"] -- "Biometrics and public-key cryptography" --> B["Convenient, strong\nauthentication"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: FIDO (Fast IDentity Online) is an authentication standard that replaces password-based login with device-held biometric verification and public-key cryptography.

Features:
( Stronger Security ) Replaces passwords, which risk exposure, with biometric-based, public-key authentication — cutting off phishing and account-takeover attacks at the source
( Privacy Protection ) Biometric data is never sent to the server; it stays only within the device’s secure storage area, preventing leakage
( User Convenience ) Authenticates quickly through a simple action such as a fingerprint or facial scan, with no complex password to type

Identity Provider (IdP)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Each service manages\nuser identity separately"] -- "Centralized identity management and\nunified security policy" --> B["Unified identity management\ncentered on the IdP"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A trusted authority that manages user authentication information and, once a user is successfully authenticated, issues a security token (an assertion or token) that a relying service provider (SP) can trust.

JWT (JSON Web Token)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Session-based\nauthentication (stateful)"] -- "Removing server scalability limits and\nsession-management overhead" --> B["JWT-based\nauthentication (stateless)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An open standard (RFC 7519) for securely representing information in JSON form using a digital signature or encryption, used mainly for SSO (Single Sign-On) and exchanging authentication data in web environments.

Features:
( Stateless Authentication ) The server can authenticate a user and verify their information from the JWT alone, without storing any client state
( Compact Structure ) A lightweight JSON format that is easy to transmit — for example, through HTTP headers — making it well suited to web environments
( Extensibility ) Follows a standardized structure (Header, Payload, Signature) and can carry a wide variety of claims flexibly
( Security ) A digital signature authenticates the issuer and prevents tampering with the token’s contents

Kerberos

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Untrusted network,\nrepeated credential exposure"] -- "Encrypted ticket exchange via a trusted KDC" --> B["Mutual trust between\nclient and service"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A network authentication protocol developed at MIT that uses cryptographic tickets to securely verify the identities of a user (client) and a service (server) within a mutually trusted environment.

Features:
( Encryption-Based Authentication ) Encrypts tickets (TGT, ST) to prevent user information and session keys from being exposed during communication
( Single Sign-On (SSO) ) A single authentication grants access to multiple services without repeated logins, improving user convenience
( Delegated Trust ) Builds mutual trust between users and services through a trusted third party called the KDC (Key Distribution Center)
( Security Foundation ) As the default authentication method for Active Directory, Kerberos raises the overall security level of the network environment

OAuth 2.0

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Sharing your password\ndirectly with third parties"] -- "Delegated, scoped access tokens" --> B["Secure delegated access\nwithout exposing credentials"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An open authorization framework that lets a user securely delegate access to their own resources (data, functionality, etc.) to a third-party application (the client).

Features:
( Delegated Authorization ) Lets a client obtain resource-access privileges securely without ever sharing the user’s ID/password
( Easy Integration ) Designed around RESTful APIs, making integration across different applications straightforward
( Multiple Flows ) Supports several grant types tailored to different client environments — web, mobile, desktop, and more
( Security Standard ) Standardized by the IETF and used as the underlying protocol for OpenID Connect (OIDC), extending it to support authentication as well

OAuth 2.0 and OIDC

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Sharing\npasswords"] -- "Token-based delegated authorization" --> B["Secure third-party\nservice integration"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An open standard protocol that lets a third-party application access a resource on a user’s behalf — through delegation — without ever exposing the user’s password.

Features:
( Password Protection ) Delegates only safe resource-access privileges to third-party apps, without ever exposing the user’s password
( Fine-Grained Authorization ) Scope-based privilege control allows access to only the minimum data required
( Standardized Authentication ) Builds a unified identity-verification system via OIDC, ensuring interoperable user authentication across services

OpenID Connect (OIDC)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Incomplete authentication with\nOAuth 2.0 alone (authorization only)"] -- "A standardized identity layer with\nthe ID Token (JWT)" --> B["Standard, unified\nauthentication via OIDC"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An OpenID-based authentication protocol, built on top of OAuth 2.0, for securely sharing a user’s authentication information with a mutually trusted service (SP).

Features:
( Simplified SSO ) Gives users a unified login experience across multiple services while easing the account-management burden on IT administrators
( Standardized Identity Information ) Delivers consistent user profile information (name, email, profile photo, etc.) through a JWT-based ID Token
( Compatibility ) Being built on OAuth 2.0, it can be applied easily across web, mobile, desktop, and other client environments
( Authentication Plus Authorization ) OAuth 2.0 focuses on granting authorization; OIDC adds authentication on top, supporting user identification and SSO

Passkey

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Tied to\na single device"] -- "Cloud-synced FIDO2" --> B["A complete passwordless\nexperience"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A passkey is a FIDO2-based credential that syncs across a user’s devices via the cloud, completing the shift to a fully passwordless authentication experience.

Features:
( Passwordless ) Eliminates passwords, which are hard to remember and easy to steal, fundamentally strengthening the authentication process
( Multi-Device Sync ) Cloud-based credential sync provides continuity across a device change with no re-registration required
( Phishing Cut Off at the Source ) Domain-binding technology automatically and technically rejects authentication requests from fake sites

SAML (Security Assertion Markup Language)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Fragmented authentication\nper individual service"] -- "Standardized SSO and\ncross-domain trust federation" --> B["SAML-based\nidentity federation"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An XML-based open standard protocol for securely exchanging user authentication information in web-based distributed environments.

Features:
( XML-Based ) Represents a user’s identity, attributes, and privileges as an XML-formatted assertion for exchange
( Web SSO Standard ) SAML 2.0 has become the de facto standard for implementing SSO (Single Sign-On) in browser-based environments
( Federated Identity ) Establishes a trust relationship between an IdP and an SP in different security domains, enabling them to share user authentication information
( Industry Standard ) Standardized under the leadership of OASIS (Organization for the Advancement of Structured Information Standards)

Single Sign-On (SSO)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Multiple applications\n(App1, App2, App3...)"] -- "Single authentication (1st login)" --> B["SSO service\n(Identity Provider)"]
 B -- "Issues authentication ticket" --> A
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An authentication method that lets a user log into multiple applications and services using a single ID and password.

Features:
( Greater User Convenience ) Eliminates repeated login steps, significantly improving the user experience and boosting productivity
( Stronger Security ) Reduces the burden of managing complex passwords and makes it easier to apply strong, centralized authentication such as MFA
( Management Efficiency ) Centralizes account creation, deletion, and privilege management, reducing the overall IT administration burden
( Improved Accessibility ) Delivers a consistent user experience across mobile devices and other device environments

Active Directory (AD)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Distributed users\nand resources"] -- "Central management (AD)" --> B["Unified authentication\nand policy enforcement"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A directory service developed by Microsoft that centrally manages information about the users, computers, groups, and resources on a network, and that serves as the core infrastructure for controlling authentication and access rights.

Features:
( Centralized Management ) Provides a unified management environment for IT resources such as user accounts, password policies, and computer settings
( Single Sign-On (SSO) ) A single authentication grants access to multiple applications and resources, increasing both convenience and security
( Access Control ) Applies RBAC (Role-Based Access Control)-based security policy through fine-grained, per-resource permission settings
( Authentication Protocol ) Uses a strong Kerberos-based authentication mechanism to guarantee secure communication

LDAP (Lightweight Directory Access Protocol)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Distributed information\n(users, devices, services)"] -- "Access via the LDAP protocol" --> B["Central directory service\n(Directory Information Base)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A standard communication protocol for accessing a directory service, used to store and search information about network resources — users, devices, services, and more — in a hierarchical structure.

Features:
( Standard Protocol ) Based on the X.500 standard but simplified, and widely used to implement a variety of directory services
( Hierarchical Structure ) Organizes information as a tree using a DN (Distinguished Name), enabling efficient search and management
( Optimized for Lookups ) Optimized for read operations, making it effective for tasks such as user authentication and address-book lookups
( Extensibility ) Schema extensions allow it to store and manage many different types of information (supported in LDAPv3)

Systematic Classification of Attack Techniques

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Scattered, Fragmented\nThreats"] -- "Framework-based classification\n(Cyber Kill Chain)" --> B["Systematic, Structured\nDefense"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security analysis framework that systematizes cyberattacks by stage, layer, and objective in order to optimize defense strategy development and the use of threat intelligence.

Features:
( Threat Visibility ) Classifies an attacker’s tactics, techniques, and procedures ( TTPs ) using a standardized language, enabling the creation of sophisticated detection rules.
( Proactive Defense ) Enables a staged blocking strategy based on the Cyber Kill Chain, which cuts the chain of an attack at any link.
( Collaboration Optimization ) Maximizes the efficiency of security operations ( SecOps ) by sharing threat information and standardizing the incident response process.

Penetration Testing Methodology

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["One-off, unstructured\nsecurity checks"] -- "Demand for standardized process\nand systematic threat modeling" --> B["Framework-based\npenetration testing (PTES/OSSTMM)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A standardized set of procedures and a technical execution framework for attempting to penetrate an organization’s information systems from an attacker’s perspective in order to discover security vulnerabilities and assess the resulting risk.

Features:
( Procedural Validity ) Applies proven frameworks such as PTES, OWASP, and OSSTMM to prevent gaps in assessment coverage and secure the reliability of results.
( Risk Prioritization ) Assesses the real business impact of discovered vulnerabilities to support the efficient allocation of available resources.
( Regulatory Compliance ) A required item for meeting major domestic and international security certifications and legal requirements such as ISMS-P and PCI-DSS.
( Defense Strategy Development ) Goes beyond simply listing vulnerabilities, using penetration scenario analysis to strengthen the organization’s Defense in Depth.

OSINT (Open Source Intelligence)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Scattered\nOpen Data"] -- "Systematic collection and\nmulti-angle correlation" --> B["Strategic Threat\nIntelligence (OSINT Insight)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A set of activities that collects and analyzes data from legally accessible public sources ( Open Source ) to derive meaningful information ( Intelligence ) that serves a specific purpose.

Features:
( Non-intrusive Collection ) Gathers externally exposed information without directly probing the target system, so the risk of detection is low.
( Attack Surface Mapping ) Identifies an organization’s externally exposed assets ( Attack Surface ) and predicts penetration paths, from an attacker’s viewpoint.
( Decision Support ) Used across multiple security strategies, including reputation management, threat-actor tracking, and supply chain risk management.
( Economy and Efficiency ) Enables in-depth preliminary research using the vast amount of data available on the internet, without expensive equipment.

OSSTMM (Open Source Security Testing Methodology Manual)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Qualitative security assessment\nreliant on assessor judgment"] -- "Demand for a scientific method and\na quantitative security metric (RAV)" --> B["A measurable security\nstandard (OSSTMM)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security testing standard developed by ISECOM (Institute for Security and Open Methodologies) that scientifically and quantitatively measures the effectiveness of security controls in order to assess an organization’s security maturity.

PTES (Penetration Testing Execution Standard)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Unstructured penetration testing\nreliant on individual assessor skill"] -- "Standardizing execution stages and\nproviding technical guidelines" --> B["Procedurally complete\nPTES-based penetration testing"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A seven-stage technical execution standard, defined to guarantee consistent quality and systematic results across the entire penetration testing process, from pre-engagement through reporting.

Features:
( Standardized Execution ) Minimizes quality variance driven by an assessor’s subjective judgment and guarantees thorough coverage of every test area.
( Technical Depth ) Provides concrete technical guidelines for each stage, rather than merely listing procedures.
( Business Alignment ) Uses threat modeling to focus on discovering real vulnerabilities that are directly tied to the organization’s business risk.
( Transparency ) Prevents legal and operational risk by establishing a clear ROE (Rules of Engagement) between the client and the assessor.

RAV (Risk Assessment Value)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Subjective, experience-based\nrisk judgment (Qualitative)"] -- "Statistical reliability and\nobjective security visibility" --> B["Quantitative security\nmeasurement metric (RAV)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A quantitative security measurement metric used in the OSSTMM methodology, which mathematically calculates the real effectiveness of the security controls within a given operational channel and expresses it as a value between 0 and 100.

Fuzzing

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Limits of security testing\nbased on fixed scenarios"] -- "Need to detect zero-day\nvulnerabilities and abnormal exceptions" --> B["Automated fuzzing based on\nrandom input (Fuzzing)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An automated software testing technique that continuously injects random or malformed abnormal input ( Fuzz ) into a target program and monitors for the exceptions ( Crash ) that occur, in order to discover security vulnerabilities.

CTF Categories

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Unstructured, fragmented\nhacking skill learning"] -- "Scenario-based, domain-specific\nhands-on skill validation" --> B["Domain-organized\nCTF problem solving (CTF)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: CTF (Capture The Flag) is a hacking and defense competition in which participants solve information security challenges to find a hidden string called a flag ( Flag ) and earn points — a contest that comprehensively evaluates security skill across multiple domains.

Red Teaming

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["A passive defense posture\ncentered on vulnerability assessment"] -- "Need for real-world response\ncapability against APTs" --> B["Realistic simulation from an\nattacker's perspective (Red Team)"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A specialized group or activity that, in order to validate the effectiveness of an organization’s security defenses ( Blue Team ), mimics the strategies, techniques, and procedures ( TTPs ) of a real attacker to carry out an unannounced, realistic attack.

AI System Security

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Traditional IT systems\nStructured data, predictable"] -- "Adoption of AI models\nUnstructured data, probabilistic output" --> B["New attack vectors\nAdversarial attacks, data poisoning"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security framework and set of techniques for ensuring the confidentiality, integrity, and availability ( CIA ) of artificial intelligence ( AI ) models and the systems built around them.

Deepfake

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Source media\nOriginal video / image"] -- "GAN-based generative model" --> B["Synthesized content\nDeepfake output"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: Realistic fake video or audio content that uses deep learning — particularly GANs (Generative Adversarial Networks) — to synthesize or edit a specific person’s face or voice.

Features:
( Realistic manipulation ) Achieves a level of realism that is difficult to distinguish from genuine content, beyond what conventional image or video editing can produce.
( Malicious use ) Increasingly used to spread fake news, commit defamation, carry out financial fraud ( voice phishing ), and fuel political disinformation, raising the risk of social disruption.
( Identity theft ) A specific person’s voice or face can be misappropriated without authorization and abused in impersonation crimes.

LLM Security (OWASP Top 10 for LLM)

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Untrusted prompt\nUnauthorized input"] -- "LLM guardrails\nFiltering" --> B["Trusted response\nSafe output"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A multi-layered defense framework for detecting and blocking vulnerabilities specific to large language model ( LLM ) applications, such as prompt injection and data disclosure.

Features:
( Non-deterministic threats ) Bypass attacks, such as prompt injection, exploit the model’s characteristic of producing variable output depending on the input.
( Expanded attack surface ) Integration with external data ( RAG ) and plugins increases the threat of indirect prompt injection ( Indirect Injection ).
( Data protection ) Defenses are needed against disclosure, where sensitive information embedded in training data is exposed externally through the generation process.

OT/ICS Security and the Purdue Model

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Air-gapped network\nClosed network"] -- "Growing IT/OT convergence\nand connectivity" --> B["Layered defense\nPurdue Model"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A security framework for protecting the operational technology ( OT ) and industrial control systems ( ICS ) that run national infrastructure and industrial processes — manufacturing, energy, transportation, and more — from cyber threats.

Features:
( Availability first ) Unlike IT security, which prioritizes confidentiality, OT security’s top priority is uninterrupted, 24/7 operation and service continuity ( Availability ).
( Safety-centric ) Because a cyberattack can translate directly into a physical accident, ensuring the safety ( Safety ) of people and equipment is essential.
( Limits of the air gap ) To respond to the breakdown of air-gapped environments, layered network segmentation and control based on the Purdue model is applied.

Blockchain

Tue, 18 Aug 2026 00:00:00 +0000

I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
 A["Centralized\nSingle authority"] -- "Distributed consensus\nand chaining" --> B["Distributed ledger\nShared across participants"]
 style A fill:#f9f9f9,stroke:#333,stroke-width:3px
 style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A distributed ledger technology in which every network participant shares and cross-checks the transaction ledger, guaranteeing the transparency and integrity of the data.

Features:
( Decentralization ) Transactions take place directly over a P2P network with no central administrator, eliminating any single point of failure ( No SPoF ) and ensuring availability.
( Integrity ) Block chaining via hash functions and the Merkle Root prevent data tampering and forgery.
( Visibility ) The ledger is open to every participant, maximizing the transparency and traceability of transactions.
( Irreversibility ) Once recorded, information cannot be modified or deleted without distributed consensus, giving it strong evidentiary value after the fact.

Cybersecurity Knowledge Base

Access Rights & Permissions Matrix

I. Overview link

Data Breach Notification Log

I. Overview link

Data Classification Register

I. Overview link

Data Loss Prevention (DLP) Incident Log

I. Overview link

Document Retention & Disposal Tracker

I. Overview link

Security KPI Dashboard

I. Overview link

Asymmetric-Key Cryptography

I. Overview link

Combined Security Model: Digital Signature + Digital Envelope

I. Overview link

Database Encryption Techniques (API, Plug-in, TDE)

I. Overview link

Diffie-Hellman Key Exchange

I. Overview link

Digital Envelope

I. Overview link

Digital Signature

I. Overview link

Hash Function

I. Overview link

Homomorphic Encryption

I. Overview link

Hybrid Cryptography

I. Overview link

PKI (Public Key Infrastructure)

I. Overview link

Post-Quantum Cryptography (PQC)

I. Overview link

Quantum Security

I. Overview link

RSA Encryption

I. Overview link

Sign-then-Encrypt

I. Overview link

Symmetric-Key Cryptography

I. Overview link

CIA Triad

I. Overview link

Endpoint Security

I. Overview link

Systematic Server Defense Strategy

I. Overview link

DDoS Attack Mitigation Plan Tracker

I. Overview link

IP Whitelist–Blacklist Tracker

I. Overview link

Network Access Control Log

I. Overview link

Network Device Inventory

I. Overview link

Network Security Risk Mitigation

I. Overview link

Network Traffic Monitoring Dashboard

I. Overview link

DDoS (Distributed Denial of Service)

I. Overview link

DRDoS (Distributed Reflective Denial of Service)

I. Overview link

Network Separation & Integration

I. Overview link

SASE (Secure Access Service Edge)

I. Overview link

SDP (Software Defined Perimeter)

I. Overview link

Spoofing

I. Overview link

Zero Trust

I. Overview link

IPSec

I. Overview link

OSI 7-Layer Security

I. Overview link

OSI 7-Layer Security Threats

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview

I. Overview