🔐 Cybersecurity Glossary

A structured methodology and set of procedures for detecting, analyzing, containing, eradicating, and recovering from cybersecurity incidents to minimize impact and restore normal operations. Under SAMA CSF and NCA ECC frameworks, organizations must establish documented incident response capabilities including detection mechanisms, escalation procedures, communication protocols, and post-incident analysis to meet regulatory requirements for operational resilience.

A network security technology that monitors network traffic and system activities for malicious behavior or policy violations, and can automatically take action to block or prevent detected threats. IDPS combines intrusion detection (IDS) capabilities that identify and alert on threats with intrusion prevention (IPS) capabilities that actively block attacks in real-time using signature-based detection, anomaly detection, and behavioral analysis.

A comprehensive framework of policies, procedures, and technical controls for the secure generation, distribution, storage, rotation, revocation, and destruction of cryptographic keys throughout their lifecycle. Effective key management is critical for maintaining the security of encrypted data and is explicitly required by SAMA CSF, NCA ECC, and international standards including ISO/IEC 27001:2022 and PCI DSS 4.0. A robust KMS addresses key separation of duties, implements hardware security modules (HSMs) for key protection, enforces regular key rotation schedules, maintains detailed audit logs, and ensures business continuity through secure key backup and recovery procedures. For Saudi organizations, proper key management is essential for maintaining data sovereignty and meeting regulatory requirements, particularly when using cloud services or managing encryption across hybrid environments.

A comprehensive regulatory framework issued by the Saudi Central Bank (SAMA) that establishes mandatory cybersecurity controls and requirements for all financial institutions operating in Saudi Arabia. The framework addresses governance, risk management, technical controls, incident response, and third-party risk management, aligned with international standards while reflecting Saudi Arabia's regulatory environment and Vision 2030 digital transformation objectives.

The behavioral patterns and methods used by threat actors to conduct cyberattacks. Tactics represent the adversary's objectives (what they want to achieve), techniques describe how they achieve those objectives, and procedures are the specific implementation details. Understanding TTPs enables organizations to develop effective detection and prevention strategies aligned with MITRE ATT&CK framework and required by NCA ECC threat management controls for defending against sophisticated attacks targeting Saudi critical infrastructure and financial sectors.

A security framework that eliminates implicit trust and requires continuous verification of every user and device attempting to access network resources, regardless of their location inside or outside the network perimeter. ZTNA operates on the principle of 'never trust, always verify' and grants least-privilege access based on identity, context, and policy compliance.