🔐 Cybersecurity Glossary

A symmetric block cipher chosen by the US government to protect classified information, using key sizes of 128, 192, or 256 bits.

A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period.

AI Regulatory Intelligence Advisor — CISO Consulting's enterprise Virtual CISO (vCISO) module. ARIA provides AI-powered cybersecurity advisory services including policy generation, risk assessment, compliance gap analysis, board reports, and document generation in Word, Excel, PowerPoint, and PDF formats. Specialized in Saudi regulatory frameworks: SAMA CSF, NCA ECC, PDPL, and international standards including ISO 27001, NIST CSF, and PCI DSS.

A documented plan that outlines how an organization will continue operating during and after a disruptive event.

Senior executive responsible for establishing and maintaining the enterprise cybersecurity vision, strategy, and program to ensure information assets and technologies are adequately protected.

A publicly disclosed list of cybersecurity vulnerabilities, each assigned a unique identifier for tracking and reference.

An open framework for communicating the characteristics and severity of software vulnerabilities using a numerical score from 0 to 10.

A team of IT security experts responsible for managing and responding to cybersecurity incidents.

A structured set of guidelines and best practices designed to help organizations manage and reduce cybersecurity risk.

A security incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen by an unauthorized party.

The process of organizing data by relevant categories so that it can be protected and used more efficiently according to its sensitivity level.

A set of tools and processes to ensure sensitive data is not lost, misused, or accessed by unauthorized users.

The practice of integrating security testing and protection at every stage of the software development lifecycle.

Combination of digital forensics (evidence collection and analysis) and incident response (containment, eradication, recovery) disciplines. DFIR is required by SAMA CSF TM domain and Saudi CERT recommends DFIR-trained personnel for regulated entities.

A documented process for recovering IT infrastructure and systems following a natural or man-made disaster.

An attack that overwhelms a target system with traffic from multiple sources, making it unavailable to legitimate users.

NCA's baseline cybersecurity controls that all Saudi government and critical infrastructure entities must implement.

A unified security solution that integrates multiple security products into a cohesive system for improved threat detection and response.

A network security device that monitors and filters incoming and outgoing network traffic based on predetermined security rules.

Integrated framework for managing an organization's governance policies, enterprise risk management, and regulatory compliance. GRC platforms automate control assessment, risk tracking, and audit management across multiple frameworks simultaneously.

A documented plan that outlines the procedures and responsibilities for detecting, responding to, and recovering from cybersecurity incidents.

A system that monitors network or system activities for malicious activities or policy violations and produces alerts.

Software specifically designed to disrupt, damage, or gain unauthorized access to a computer system.

A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations of cyberattacks.

An authentication method requiring two or more verification factors: something you know, something you have, or something you are.

The Saudi government entity responsible for cybersecurity regulation, setting national cybersecurity policies, standards, and controls.

Mandatory cybersecurity controls issued by the National Cybersecurity Authority of Saudi Arabia, applicable to government entities and critical national infrastructure operators. The 2024 version contains 114 controls across 7 domains.

The practice of splitting a network into sub-networks to improve security and performance.

An authorized simulated cyberattack on a computer system to evaluate its security and identify vulnerabilities.

A social engineering attack that uses deceptive emails, websites, or messages to trick individuals into revealing sensitive information.

A set of cybersecurity strategies and technologies for exerting control over elevated access and permissions for users, accounts, and systems.

Malicious software that encrypts victim's files and demands payment for the decryption key.

The maximum acceptable amount of data loss measured in time, determining the frequency of data backups.

The maximum acceptable time that a system, application, or function can be offline after a disaster before business impact becomes unacceptable.

The process of identifying, analyzing, and evaluating risks to determine their likelihood and potential impact on the organization.

An approach to software development that integrates security activities at every phase of the development lifecycle.

A solution that provides real-time analysis of security alerts generated by applications and network hardware through centralized log collection and correlation.

A centralized unit that deals with security issues on an organizational and technical level, providing 24/7 monitoring and threat detection.

The psychological manipulation of people into performing actions or divulging confidential information.

Any circumstance or event with the potential to adversely impact organizational operations through unauthorized access, destruction, disclosure, or modification of information.

The proactive practice of searching through networks and datasets to detect threats that evade existing security solutions.

Evidence-based knowledge about existing or emerging threats that helps organizations make informed security decisions.

A cryptographic protocol designed to provide communications security over a computer network, used to secure web traffic.

Fractional or part-time CISO service providing experienced cybersecurity executive leadership to organizations that cannot justify a full-time hire. Ideal for Saudi SMEs, startups, and organizations bridging a CISO vacancy while achieving SAMA or NCA compliance.

A technology that creates an encrypted connection over a less secure network, providing secure remote access to organizational resources.

A weakness in a system, application, or process that could be exploited by a threat to gain unauthorized access or cause harm.

A security model based on the principle of never trust, always verify, requiring strict identity verification for every person and device attempting to access resources.

Security model based on the principle "never trust, always verify" — every user, device, and application must be continuously authenticated regardless of network location. Key pillars: strong identity, device validation, least-privilege access, microsegmentation, and continuous monitoring.

A software security vulnerability that is unknown to the vendor and for which no patch or fix is available.