🔐 Cybersecurity Glossary

The total sum of all vulnerabilities and entry points that an attacker could potentially exploit.

The phase of incident response focused on limiting the scope and damage of a security incident.

One of the five primary organizational categories within the NCA ECC framework that groups related cybersecurity controls: Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, Third-Party and Cloud Computing Cybersecurity, and Industrial Control Systems Cybersecurity. Each domain addresses specific aspects of an organization's cybersecurity program and contains multiple control categories with detailed implementation requirements.

A cybersecurity strategy that uses multiple layers of security controls to protect information assets, so if one layer fails, another is in place.

The phase of incident response where the root cause and artifacts of the security incident are removed from the environment.

An open authentication standard that enables passwordless login using public key cryptography and biometrics.

A structured methodology and set of procedures for detecting, analyzing, containing, eradicating, and recovering from cybersecurity incidents to minimize impact and restore normal operations. Under SAMA CSF and NCA ECC frameworks, organizations must establish documented incident response capabilities including detection mechanisms, escalation procedures, communication protocols, and post-incident analysis to meet regulatory requirements for operational resilience.

A documented, structured approach with detailed procedures for detecting, responding to, and recovering from cybersecurity incidents. It defines roles, responsibilities, communication protocols, and step-by-step actions to minimize damage and restore normal operations efficiently.

Forensic artifacts that identify potentially malicious activity on a system or network.

A network security technology that monitors network traffic and system activities for malicious behavior or policy violations, and can automatically take action to block or prevent detected threats. IDPS combines intrusion detection (IDS) capabilities that identify and alert on threats with intrusion prevention (IPS) capabilities that actively block attacks in real-time using signature-based detection, anomaly detection, and behavioral analysis.

A comprehensive framework of policies, procedures, and technical controls for the secure generation, distribution, storage, rotation, revocation, and destruction of cryptographic keys throughout their lifecycle. Effective key management is critical for maintaining the security of encrypted data and is explicitly required by SAMA CSF, NCA ECC, and international standards including ISO/IEC 27001:2022 and PCI DSS 4.0. A robust KMS addresses key separation of duties, implements hardware security modules (HSMs) for key protection, enforces regular key rotation schedules, maintains detailed audit logs, and ensures business continuity through secure key backup and recovery procedures. For Saudi organizations, proper key management is essential for maintaining data sovereignty and meeting regulatory requirements, particularly when using cloud services or managing encryption across hybrid environments.

A key performance indicator that measures the average time it takes for a SOC team to discover a security incident or breach from the moment it occurs. MTTD is critical for assessing the effectiveness of security monitoring capabilities and detection controls, with lower values indicating more mature security operations.

A security technique that divides a network into isolated segments down to the individual workload level.

Authentication methods that verify user identity without traditional passwords, using biometrics, tokens, or cryptographic keys.

A predefined set of actions and procedures for responding to a specific type of security incident.

A comprehensive regulatory framework issued by the Saudi Central Bank (SAMA) that establishes mandatory cybersecurity controls and requirements for all financial institutions operating in Saudi Arabia. The framework addresses governance, risk management, technical controls, incident response, and third-party risk management, aligned with international standards while reflecting Saudi Arabia's regulatory environment and Vision 2030 digital transformation objectives.

A unified security design that addresses the necessities and potential risks involved in a certain scenario and specifies when and where to apply security controls.

An email authentication protocol that allows domain owners to specify which mail servers are authorized to send emails on behalf of their domain. SPF helps prevent email spoofing by enabling receiving servers to verify that incoming mail from a domain comes from an authorized IP address.

An attack that targets the less-secure elements in a supply chain to compromise the final target.

The behavioral patterns and methods used by threat actors to conduct cyberattacks. Tactics represent the adversary's objectives (what they want to achieve), techniques describe how they achieve those objectives, and procedures are the specific implementation details. Understanding TTPs enables organizations to develop effective detection and prevention strategies aligned with MITRE ATT&CK framework and required by NCA ECC threat management controls for defending against sophisticated attacks targeting Saudi critical infrastructure and financial sectors.

A structured approach for identifying and prioritizing potential threats to a system and determining countermeasures.

A security framework that eliminates implicit trust and requires continuous verification of every user and device attempting to access network resources, regardless of their location inside or outside the network perimeter. ZTNA operates on the principle of 'never trust, always verify' and grants least-privilege access based on identity, context, and policy compliance.