Concept List¶

Cybersecurity: Foundations, Practice, and Professional Responsibility — a list of 320 foundational concepts for the learning graph. Each concept is a learnable entity (not a question), in Title Case, and 32 characters or less.

Cybersecurity
Information Security
Confidentiality
Integrity
Availability
CIA Triad
Authentication
Authorization
Accounting
Non-Repudiation
AAA Framework
Adversarial Thinking
Systems Thinking
Threat Modeling
STRIDE
PASTA
Attack Trees
Risk
Likelihood
Impact
Risk Assessment
Defense in Depth
Least Privilege
Separation of Duties
Fail Secure Default
Complete Mediation
Open Design Principle
Economy of Mechanism
Psychological Acceptability
Security Economics
Threat
Vulnerability
Exploit
Threat Actor
Attack Surface
Blast Radius
Trust Boundary
Asset
Security Requirement
CVE
CVSS
TTP
Indicator of Compromise
Indicator of Attack
Zero Day
Kill Chain
Cyber Kill Chain
Diamond Model
Security Control
Preventive Control
Detective Control
Corrective Control
Compensating Control
Administrative Control
Technical Control
Physical Control
Cryptography
Plaintext
Ciphertext
Encryption
Decryption
Cryptographic Key
Symmetric Cryptography
Block Cipher
Stream Cipher
AES
DES
3DES
Block Cipher Modes
ECB Mode
CBC Mode
CTR Mode
GCM Mode
Initialization Vector
Padding Scheme
Asymmetric Cryptography
Public Key
Private Key
RSA
Elliptic Curve Cryptography
Diffie-Hellman
Key Exchange
Hash Function
SHA-2
SHA-3
MD5
Collision Resistance
Preimage Resistance
Message Authentication Code
HMAC
Digital Signature
Certificate Authority
PKI
X.509 Certificate
Certificate Chain
Certificate Revocation
OCSP
Key Management
Key Rotation
Key Derivation Function
Password Hashing
Bcrypt
Argon2
Salting
TLS
TLS Handshake
HTTPS
Perfect Forward Secrecy
Data at Rest
Data in Transit
Data in Use
Database Encryption
Data Loss Prevention
Homomorphic Encryption
Secure Computation
Differential Privacy
Zero-Knowledge Proof
Secure SDLC
Secure Design
Secure Coding
OWASP Top Ten
CWE Top 25
Buffer Overflow
Stack Overflow
Heap Overflow
Integer Overflow
Format String Bug
Injection Attack
SQL Injection
Command Injection
Cross-Site Scripting
Stored XSS
Reflected XSS
DOM-Based XSS
CSRF
SSRF
Insecure Deserialization
Race Condition
TOCTOU
Broken Access Control
Broken Authentication
Security Misconfiguration
Sensitive Data Exposure
Input Validation
Output Encoding
Parameterized Query
Static Analysis
Dynamic Analysis
Fuzzing
Software Composition Analysis
Dependency Scanning
Software Supply Chain
SBOM
Code Signing
Secure Code Review
Hardware Security
Trusted Platform Module
Hardware Security Module
Secure Enclave
Trusted Execution Env
Firmware Security
Secure Boot
Measured Boot
UEFI Security
Side-Channel Attack
Timing Attack
Power Analysis Attack
Cache Side-Channel
Rowhammer
Hardware Supply Chain
Embedded Security
IoT Security
Device Attestation
Hardware Root of Trust
Network Security
OSI Model
TCP/IP Model
TCP
UDP
IP Protocol
ICMP
ARP Spoofing
DHCP Snooping
Man-in-the-Middle
Packet Sniffing
Firewall
Stateful Firewall
Next-Gen Firewall
Web Application Firewall
Intrusion Detection
Intrusion Prevention
Signature-Based Detection
Anomaly-Based Detection
Network Segmentation
VLAN
DMZ
VPN
IPsec
WireGuard
Wireless Security
WPA3
802.1X
Rogue Access Point
DNS Security
DNSSEC
DNS Tunneling
BGP Security
RPKI
DDoS Attack
Volumetric Attack
Application-Layer DDoS
DDoS Mitigation
Zero Trust Architecture
Micro-Segmentation
SSH
Port Scanning
Network Access Control
Proxy Server
Reverse Proxy
Packet Capture
NetFlow Analysis
Operating System Security
Kernel Security
Process Isolation
Memory Protection
ASLR
Stack Canary
DEP
Access Control
DAC
MAC
RBAC
ABAC
File Permissions
SELinux
AppArmor
Virtualization Security
Hypervisor Security
Container Security
Docker Security
Kubernetes Security
Cloud Security
Shared Responsibility Model
IaaS Security
PaaS Security
SaaS Security
Cloud IAM
Security Monitoring
Log Management
SIEM
SOAR
Security Operations Center
EDR
XDR
Antivirus
Host-Based IDS
Patch Management
Configuration Management
System Hardening
Baseline Configuration
CIS Benchmarks
Audit Logging
Identity Management
Access Management
IAM System
Single Sign-On
Federated Identity
Password Authentication
Password Policy
Multi-Factor Authentication
Biometric Authentication
FIDO2
Passkey
OAuth 2.0
OIDC
SAML
Social Engineering
Phishing
Spear Phishing
Pretexting
Baiting
Usable Security
Security Awareness Training
Insider Threat
Privilege Creep
Just-in-Time Access
Privacy Engineering
Privacy by Design
Data Minimization
User Behavior Analytics
Governance Risk Compliance
Security Policy
Acceptable Use Policy
Security Standard
Security Procedure
NIST CSF
ISO 27001
SOC 2
PCI-DSS
HIPAA Compliance
Security Program Mgmt
CISO Role
Business Continuity
Disaster Recovery
Business Impact Analysis
RTO
RPO
Vendor Risk Management
Third-Party Risk
Supply Chain Risk
Security Metrics
Risk Register
Risk Mitigation
Risk Transfer
Risk Acceptance
Risk Avoidance
Security Audit
Cyber Law
CFAA
ECPA
GDPR
CCPA
HIPAA Law
GLBA
FERPA
NIS2 Directive
Cybercrime
Digital Forensics
Chain of Custody
Forensic Imaging
Memory Forensics
Mobile Forensics
Network Forensics
Cyber Ethics
Responsible Disclosure
ACM Code of Ethics
Cyber Policy
Critical Infrastructure
ICS Security
SCADA Security
Data Breach Notification
Penetration Testing
Red Team
Blue Team
Purple Team
MITRE ATT&CK
Threat Intelligence
OSINT
Threat Hunting
Vulnerability Management
Vulnerability Scanning
Incident Response
PICERL Lifecycle
Incident Preparation
Incident Identification
Incident Containment
Incident Eradication
Incident Recovery
Lessons Learned
Malware Analysis
Privilege Escalation
Lateral Movement
Command and Control
Data Exfiltration
Persistence Mechanism
Bug Bounty Program
Capture the Flag
Incident Response Plan
Runbook
Tabletop Exercise
Detection Engineering
AI Security
Adversarial ML
Model Theft
Prompt Injection
Data Poisoning
Model Evasion
Quantum Threat
Post-Quantum Cryptography
Lattice-Based Crypto
Confidential Computing
Operational Technology
OT Security
Smart Grid Security
Blockchain Security
Capstone Secure System
Capstone Security Program
Capstone Applied Research
Technical Communication
Team Collaboration