Glossary

126 terms from Security Controls and Change Management, in plain words, each with the chapter that teaches it.

Search the glossary

A

AAA (authentication, authorization and accounting): The three steps every access request goes through, in order: prove who you are, decide what you may do, and record what you did. When Priya logs in, approves the phone prompt and issues a refund, all three steps run.
Acceptable use policy: A written rule that tells staff how they may and may not use company systems, for example that they may not install their own software. It is a managerial control of the directive type.
Access review: A regular check of who has access to what, so that rights nobody needs any more can be removed. It fixes privilege creep. It is an operational control when staff do it as a routine.
Accounting: The third step of AAA. It records what a subject did and when, such as the log line showing that Priya refunded order 4471 at 9:15. It records that an account acted, but it does not prove which person typed the password.
Adaptive identity: A Zero Trust idea where login checks change with the risk, such as the place, the device or unusual behavior. An odd login gets an extra check instead of every login getting the same treatment.
Allow list: A list of what is permitted. Anything not on the list is blocked (default deny). The shop server's outbound allow list lets it connect only to the payment provider and the maker's update server.
Approval process: The steps a change request follows to get a yes or no. At Kettle & Crane they are submit, check, classify, review, decide and schedule.
Assume breach: A Zero Trust principle: act as if an attacker is already inside, so watch activity all the time and keep resources apart. Then one stolen account reaches very little.
Authentication: Proving that a claimed identity is real, for example with Priya's password plus a prompt on her phone. It can also prove a system is genuine, as when the order server shows a certificate.
Authorization: Deciding what an authenticated subject may do, such as letting Priya's customer service group issue refunds up to $50 but not change prices. It happens again for every action.
Availability: The CIA goal that systems and data are there when people need them. A shop showing a blank page all morning is an availability failure.
Availability target: The percentage of time a system is meant to be up, such as 99.9%. Multiply 8,760 hours by the fraction allowed down to get the downtime allowed per year, which is 8.76 hours at 99.9%.

B

Backout plan: Written steps, agreed before a change, for undoing it and returning to the last known good state; it names a trigger, a decide-by time, who decides, the steps and how to check the result. Alex's plan for KC-CHG-014 restores the 1:00 a.m. backup in 22 minutes.
Backup: A copy of data kept so it can be restored after loss or damage, such as Kettle & Crane's nightly backup to a second site. A backup is only the copy; a backout plan is the full set of steps that uses it to undo a change.

C

Certificate: A signed digital ID card that proves a system is genuine. The order server shows one to the shop so the shop knows it reached the real server. The next book covers certificates in full.
Chain (nftables): An ordered group of firewall rules in nftables that traffic is checked against. The shop has an inbound chain for traffic coming in and an outbound chain for traffic going out.
Change: Anything added to, removed from or altered in a system, such as a software update, a new firewall rule, a new server or a settings tweak. Changes go through change management so they can be reviewed, approved and recorded, like Kettle & Crane's upgrade of its online shop from version 4 to version 5.
Change advisory board (CAB): The group that reviews change requests and approves them, rejects them or sends them back. At Kettle & Crane it is Alex, Sam, Jo and Morgan. A smaller emergency CAB can approve urgent changes fast.
Change freeze: A period when only emergency changes are allowed. Kettle & Crane freezes the shop from Thanksgiving to New Year, its busiest weeks.
Change management: The process for proposing, reviewing, approving, carrying out and recording changes. It is a security control because it stops changes from breaking things or opening holes, and it makes unapproved changes stand out.
Change owner: The one named person who is accountable for a change from request to close. Alex owns KC-CHG-014. The owner presents the change but does not approve it.
Change request: A short form that starts every change. It says what will change, why, who is responsible and what could go wrong, as in KC-CHG-014. It is not the same thing as an internet Request for Comments.
CIA triad: The three goals that every security control protects: confidentiality, integrity and availability. It has nothing to do with the spy agency.
Compensating control: An alternative control used when the normal one cannot be, giving comparable protection. For example, the unpatchable label printer is moved to its own network that only the shipping computer can reach.
Confidentiality: The CIA goal that only the right people can read data. A customer list emailed to the wrong person is a confidentiality failure.
Continuous monitoring: In Zero Trust, checking again and again during a session instead of only at login. It supports the principle of assuming a breach.
Control category: A label that says how a control is carried out: technical, managerial, operational or physical. To find it, ask who or what makes the control happen.
Control plane and data plane: In Zero Trust, the control plane is where access decisions are made and the data plane is where the traffic itself flows. They match the decision point and the enforcement point.
Control type: A label that says what a control does about an attack and when it acts: preventive, deterrent, detective, corrective, compensating or directive. To find it, ask what the control does.
Corrective control: A control that repairs damage after an incident and returns things to normal. Restoring Thursday night's backup after ransomware is an example.
Custodian: The person who runs a system day to day and applies the controls the owner chooses, but does not own its risks. The web contractor is the custodian of the shop.

D

Decide-by time: The last moment to choose to back out so that the backout still finishes inside the window: the window's end, minus the tested backout time, minus a safety margin. For KC-CHG-014 it is 2:28 a.m.
Default allow: The rule behind a deny list: anything not listed is allowed.
Default deny: The rule behind an allow list: anything not listed is blocked, so new and unknown threats are stopped.
Defense in depth: Using several layers of different controls so that one failure does not expose everything. At Kettle & Crane the layers around the order server include locks, the firewall, logins, permissions, encryption and staff training.
Deny list: A list of what is not permitted. Anything not on it is allowed (default allow). Alex adds an attacking address to the shop's blocked set, but a deny list cannot stop threats nobody knows about yet.
Detective control: A control that finds and records an incident during it or afterward but does not stop it, such as an alert for 300 failed logins or a recording camera.
Deterrent control: A control that discourages an attacker from trying but that a determined attacker could ignore, such as a warning sign, bright lights or a login banner.
Digital signature: A mark made with a private key that anyone can check with the matching public key. It proves who signed and that nothing changed afterward, which gives non-repudiation.
Directive control: A control that tells people what they should or must do and relies on them following it, such as Alex's rule not to email card details or a "Badge must be worn" sign.
DNS (Domain Name System): The system that turns names into network addresses. It uses port 53 over both UDP and TCP, so the shop's outbound rules allow name lookups to the office DNS server only.
Downtime: Time when a system is not available to its users. Planned downtime is announced and happens in a window. Unplanned downtime is an unexpected outage, such as a crash or a failed change.

E

Emergency change: A change that must happen now to stop serious harm, such as patching a flaw attackers are using. It still gets a fast approval, for example from Morgan by phone, and the full records are completed afterward.
Encryption: Scrambling data with a secret key so it looks like nonsense to anyone without that key, as with Kettle & Crane's encrypted customer database.

F

Fail forward: Keeping a change that has a problem and applying a further fix, instead of undoing it. Use it when going back is impossible, would lose data or would reopen a flaw under attack, and give the fix a quick approval, a time box and a retest.

G

Get-Service: A PowerShell command that shows a Windows service and its status, for example whether the Spooler print service is Running. Run it before and after a restart.

H

Hashing: Making a fingerprint of data that changes if even one character changes. It shows whether data changed but not who sent it.

I

Identification: Claiming an identity, as Priya does by typing her username or as someone does by showing a badge ID. A claim proves nothing until authentication checks it.
Impact analysis: Working out, before approval, what a change will affect and what could go wrong, then rating each risk and planning what reduces it. Alex's analysis found that version 5 resets security settings to their defaults.
Implementer: The person who does the hands-on work of a change. For KC-CHG-014 that is the web contractor, while Alex is the owner.
Implicit deny: An unseen last rule in a firewall rule table that drops anything no earlier rule matched.
Implicit trust zone: An area where anything inside is trusted automatically, like the office network in the old model. Zero Trust removes it.
Incident: Any event that harms or threatens confidentiality, integrity or availability. Control types are placed on a timeline before, during and after one.
Integrity: The CIA goal that data is correct and has not been changed by anyone who should not change it. A price quietly edited from $55 to $5 is an integrity failure.
IPv4 and IPv6: The two versions of the Internet Protocol (IP), which gives devices their network addresses. The shop's nftables sets and ip rules match only IPv4, so a server with an IPv6 address would also need ip6 rules, or IPv6 traffic would bypass the lists.
ITIL: A widely used guide to running IT services. The three change types (standard, normal and emergency) come from its terms.

J

Job rotation: Moving staff between duties so that misuse comes to light.
Just-in-time (JIT) access: Granting rights only for a set time, like the contractor's account that expires when the holiday sale starts.

L

Last known good: The last state in which you know the system worked. A backout plan returns the system to it.
Least privilege: Giving each subject only the access its job needs and no more. The web contractor gets upload rights to the theme folder for two weeks instead of full admin rights.
lo (loopback): The network interface a server uses to talk to itself. The shop's rules accept it so the shop can reach its own database.

M

Maintenance window: An agreed, scheduled period when changes may be made, chosen to disturb as few people as possible. It must hold the change, its tests and a full backout. KC-CHG-014's window is Tuesday from 1:00 to 3:00 a.m.
Malware: Software written to do harm, such as damaging systems, locking files or stealing data. Ransomware is one kind.
Managerial control: A control made of decisions and documents that direct how security is managed, such as a security policy or a yearly risk assessment.
MFA (multi-factor authentication): A login method that asks for more than one kind of proof of identity, such as Priya's password plus approving a prompt on her phone. A stolen password alone is then not enough to get in.
Microsegmentation: Splitting a network into small zones so that one breach reaches very little. In Zero Trust it supports the principle of assuming a breach.

N

Need-to-know: Limiting access to particular data so people see it only when a particular task requires it.
Network namespace: A private copy of a computer's network stack with its own firewall. The optional lab uses the ip netns commands to load the shop rules into one called lab, so the real firewall is not touched.
nftables: The Linux firewall used on the Kettle & Crane shop server. Its command, nft, lists chains and sets and adds entries, for example nft add element to add the update server to out_allowed.
nginx: The web server software that runs the shop. It supports a reload, which starts new workers before the old ones finish, so no requests are dropped.
nginx -t: A command that tests nginx's settings file without changing anything. It reports success or the exact line with the error, so run it before every reload or restart.
NIST (National Institute of Standards and Technology): The US government body that publishes security standards, such as SP 800-207 on Zero Trust and SP 800-53 on security controls.
NIST SP 800-207: The NIST publication Zero Trust Architecture, which describes the Zero Trust model.
NIST SP 800-53: NIST's main catalog of security controls. Its control CM-3 covers approving, testing and recording changes, and CM-4 requires analyzing a change's security impact before it is made.
Non-repudiation: Proof strong enough that someone cannot believably deny an action, such as Bloom Café placing an order. It usually comes from a digital signature, not from a log or a shared password.
Normal change: Any change that is neither standard nor an emergency, including anything new to the team. It goes to the full CAB for review, as KC-CHG-014 did.

O

Operational control: A control carried out by people as part of their regular routine, such as Alex checking the backup report every morning or a monthly access review.
Organizational unit (OU): A container in a directory that holds accounts; Kettle & Crane has one per team. Alex lets Priya reset passwords only within the Customer Service OU.

P

Phishing: An attack that uses a fake email or web page to trick someone into giving away a password or other information, like the fake login page that fooled Sam.
Physical control: A control that protects buildings, rooms and equipment, such as the server-closet lock, cameras and fences. It also covers environmental protections such as air conditioning and fire suppression.
PKI (public key infrastructure): The system of keys and certificates behind digital signatures. It is taught in the next book.
Policy: A document that states what must happen and why, such as "staff laptops must receive security updates within 14 days". An SOP gives the steps for how.
Policy decision point: In NIST's Zero Trust model, the decision point decides each request: the policy engine decides and the policy administrator passes the decision on. The enforcement point allows or blocks the request in the traffic path.
Policy drop: The default setting on an nftables chain that blocks anything no rule matched, which turns the chain into an allow list. Changing it to accept would let everything through.
Policy-driven access control: A Zero Trust idea where written rules about the user, the device and the data decide each access request.
Port: A number that says which service traffic is for. Port 22 is remote login, 80 is web traffic, 443 is secure web traffic and 53 is DNS.
PowerShell: The Windows command shell, used to run commands and scripts that manage a Windows computer. For example, `Get-Service` shows a service's status and `Restart-Service` restarts a Windows service.
Preventive control: A control that stops an incident from happening: a barrier that cannot be passed without breaking it, such as a firewall rule or a locked closet.
Private key: A secret key that only its owner holds and that is used to make a digital signature. The matching public key lets anyone check that signature.
Privilege: A right to do something, such as read a file, change a price or create users.
Privilege creep: Access piling up as a person changes jobs. Regular access reviews fix it, as when Alex removed Sam's label-printer access after Sam moved to sales.
Production: The real system that customers use, as opposed to a test copy.

Q

Quarantine: A locked folder where antivirus moves a harmful file so it cannot run. Doing this is a corrective control.

R

RADIUS (Remote Authentication Dial-In User Service): A common protocol for handing logins to one central AAA server, which authenticates, authorizes and keeps accounting records. TACACS+ does the same job.
Ransomware: Malware that locks files until a ransom is paid. Many attackers copy the files first, so it can hit both availability and confidentiality.
Reload: Telling a running service to read its settings again without stopping. On nginx it dropped 0 requests, and if the new settings file is bad, nginx keeps running on its old settings.
Restart-Service: A PowerShell command that stops a Windows service and starts it again, such as the Spooler print service.
Restricted activities: Actions that are not allowed while a change is being made, such as extra changes, access to data beyond the task or work outside the window. The contractor's "support2" admin account broke these rules.
Risk acceptance: Agreeing to live with a known weakness that cannot be fixed yet. Only the system's business owner can do this, as Sam does for the shop's old theme.
Risk score: A rating found by multiplying likelihood (1 to 3) by impact (1 to 3). At Kettle & Crane, 6 to 9 is High, 3 to 5 is Medium and 1 or 2 is Low.

S

Security control: Anything put in place to lower a security risk, such as a lock, a password rule, a firewall, a backup or a training class.
Security header: A line the web server adds to its replies that tells browsers how to behave more safely. The one Alex adds tells browsers to use only secure connections, and it is applied with a reload instead of a restart.
Security operations: The day-to-day work of keeping systems safe. The exam objective groups the change steps under "business processes impacting security operations".
Security regression: A change that quietly brings back a weakness that was fixed before, as when version 5 turned the login lockout off again.
Separation of duties: Making sure no one person can complete a sensitive task alone, such as both creating a supplier and paying it.
Service: A program that runs in the background without anyone sitting at it, such as the web server, the database or the log collector.
Service restart: Stopping a service and starting it again so it reads new settings or runs a new version. It causes a short outage and may fail to start if the settings are bad, so test the configuration first and restart inside the window.
Session recording: Logging a remote session so that every command can be reviewed later; it is a detective control. Reviewing the KC-CHG-014 session log revealed the contractor's unapproved "support2" account.
Set (nftables): A named list of addresses that nftables rules can use. The shop has three: admins (allowed to log in remotely), blocked (a deny list) and out_allowed (the outbound allow list).
SLA (service level agreement): A contract promise about the level of service, such as "the shop will be available 99.9% of the time, outside announced windows".
SOP (standard operating procedure): Written step-by-step instructions for doing a routine task the same, correct way every time, like KC-SOP-03 for monthly laptop updates. A tested SOP lets a task run as a standard change.
SSH (Secure Shell): The remote login service, on port 22. It reads its settings when it starts, so a change such as forbidding passwords does not take effect until the service is restarted or reloaded.
Stakeholder: Anyone affected by a change or interested in how it turns out, such as Sam, Priya, Jo, the payment provider and the cafés. They must be identified, consulted and informed.
Standard change: A low-risk, routine change with tested written steps that is approved once and does not go to the CAB each time, such as adding a new staff member to the customer service group.
Subject: Whoever asks for access: a person, a device or a program.
sudo: A Linux command prefix that runs a command with administrator rights.
SY0-801: The exam code for the CompTIA Security+ certification, an entry-level IT security exam expected to launch in November 2026. Its objectives start with security concepts and controls (1.1) and the impact of change management on security (1.2).
System owner: The person responsible for a system and its data. Sam owns the online shop as a business system and must agree to any change in how it behaves.
systemctl: The Linux command for managing services. systemctl restart <service> stops and starts a service, and systemctl reload <service> makes it reread its settings.

T

TCP and UDP: The two common ways network traffic is carried. DNS uses both, with TCP for large answers.
Technical control: A control carried out by hardware or software, which the system enforces automatically once it is set up, such as a firewall rule or disk encryption.
Test environment: A copy of the real system that customers do not use, where changes are tried first. The contractor tested version 5 on the shop's staging copy.
Test results: Evidence from trying a change in a test environment that it works and does not weaken security. One failed security test, such as the login lockout, is enough to stop approval until the change is fixed and retested.
Time box: A fixed time limit for a fix during fail forward, for example "if it is not fixed in 20 minutes, we take the shop offline".

U

Unauthorized change: Any change made without approval, or outside its approved scope or window, even if the content was approved. Examples are the unexplained firewall rule and the contractor's "support2" admin account; both should be treated as possible attacks.

Z

Zero Trust: An approach that gives no trust based on network location and verifies every request. It grants the least access for the shortest time and acts as if an attacker may already be inside, so Jo's office laptop is checked like any other.