​>> As we get through the content on the security, ​there are a number of terms that we're going to see, and ​these terms come up time and again as we go through the content. ​Keep an eye out for where these appear later in the course. ​So the first thing we're going to talk about is the CIA triad. ​Often, you'll see it stacked like a triangle where you have confidentiality, ​integrity, and availability. ​These topics come up time and again throughout cybersecurity. ​In fact, we're going to see this when we dive into looking at how do we calculate ​the impact of a particular vulnerability? ​So in the CIA triad, we have confidentiality.

​This is basically just keeping secret things secret. ​You don't want some third party having access to the content and so ​you encrypt it or you keep that secret. ​We use encryption to protect confidentiality and ​we're going to see this more later on. ​We also have integrity. ​Integrity is making sure that the data does not change. ​Whether or not you wanted it to be changed, ​you're protecting it from unauthorized changes or accidental changes. ​You're on the lookout for if that information has changed, ​that is protecting the integrity of data.

​And then the third part of the CIA triad is availability. ​Availability on the CIA triad is all about making sure that the data is ​there when you need it or the service is available when you need it. ​The information and ​the service is available to you whenever you're ready for it. ​This is the CIA triad, and ​it largely undermines a lot of what we do in cybersecurity. ​In fact, whenever you go to the news and ​you read about some new cyber-attack that comes out, check out and ​see that there has been a failure of at least one of these three topics. ​Sometimes it's two, could be all three, but keep a lookout for it. ​Every cybersecurity incident is a failure of at least one side of the CIA triad.

​The next topic we're looking at is AAA. ​And this one I like to joke around, say that the I in AAA is silent. ​Whenever we look at AAA, you've got I for identification. ​That's where you state your identity. ​I'm saying this is who I am. ​To the computer, you're nothing more than a username, or you could be a user number ​or something along those lines, but that is your identity. ​Then getting into the triple a, we have authentication.

​Authentication is where you prove your identity, and we're going ​to talk more about proving your identity through multi factor authentication. ​But generally, traditionally, historically, ​we've done authentication through the use of passwords, pin numbers, etc. ​Once you've been authenticated, you've proven your identity. ​Then you get into doing authorization. ​Authorization is gaining access to those things that you would normally have ​access to. ​So this could be the files and folders that you've got access to or ​whatever computer you're logging into. ​That is the role of authentication.

​The third A in AAA is accounting. ​Accounting is making sure that those users that need accounts have accounts. ​But we're also tracking who did what and when or ​who attempted to authenticate on a system. ​This is all done through accounting, and essentially, ​it's just logging the activity on the system. ​This is the third A in AAA. ​AAA is also a very important aspect of cybersecurity. ​Our next topic is looking at the three states of data.

​Data can exist in our network, on our computers, within our organization, ​in one of three states, data-in-transit, data-at-rest, and data-in-use. ​Data in transit, that's pretty easy to wrap your head around. ​That's going through a network or through some distance. ​That's data in transit, data at rest. ​This is where we store our information. ​How do we keep our data safe when it's being stored, if it's on the computer or ​on a file server somewhere? ​How do we keep that information safe and secure?

​We generally encrypt that. ​The third one that we see on here is data in use. ​For a long time, I struggled with how do I keep data in use safe? ​What does it mean to have data in use? ​And my go to example for this is Formula E racing, not too long ago, ​had somewhat of a scandal where one of the race cars in Formula E racing was ​found to be sniffing the network traffic of the other cars that were by it. ​Reading the information coming off of the tires, ​specifically where the rubber meets the road in racing, and ​the information that was coming off of the other cars, the competition's cars. ​That information was being hoovered up by the team that was found to have this ​issue, and then they were then collecting that information.

​So, they knew the tactics and strategy of the other teams. ​They were fined by Formula E for unsportsmanlike competition. ​But in data and use, it's kind of on the other teams, too. ​You look, you're generating all this information coming off of your car. ​You should be protecting that, too. ​So even if that data is being, as that data is being generated, ​make sure you're encrypting that information as well. ​Keep your data safe on all three states of data.

​Our next term that we're going to see come up in a number of different topics ​here is non-repudiation. ​This is a term that a long time, for a long time, I was like, ​you never hear this term outside of computing. ​I was listening to the radio one day, and in the news, they were talking about some ​diplomats, and they were using the word non repudiation. ​I almost had to pull the car over in tears. ​I was like, ​finally I hear non-repudiation being used in a context other than in cybersecurity. ​Non-repudiation is someone sending information to another person, ​and the recipient knowing the source of that original information. ​I know it came from this person.

​I know it came from this host or this computer. ​I know this information came from them. ​And I, that other group cannot deny having ever sent it. ​Think about if you were to send a contract over a computer, ​someone might receive that contract, act on that contract, thinking, ​I'm going to get paid for this work. ​And then when they come back to get paid for the work they've performed, ​the sender going, I didn't send that, that wasn't from me. ​Well, no, I have the contract here. ​Yeah, that wasn't from me.

​Non-repudiation would have protected that activity. ​That non-repudiation would be like, okay, well, it says it came from you, and ​I know it came from you. ​You were the one that signed this. ​I know this is from you. ​That recipient has non repudiation on that data. ​That data cannot deny having been sent. ​And then the next term, we're going to be looking at is gap analysis.

​We'll see this whenever we start looking at different vulnerabilities and ​how organizations protect themselves. ​With gap analysis, we're looking at what are we doing and ​what should we be doing and looking at where do the gaps exist? ​As I'm collecting information about our organization, we're looking at and ​performing gap analysis. ​Do we have any gaps in our security posture? ​Are there things we can be doing that we're not doing, ​that's performing a gap analysis? ​And then one of the other things that I want to talk about as we get started with ​this content is the difference between vulnerabilities, threats, and risks. ​With vulnerabilities, threats, and risks, sometimes in casual conversation, ​people will use these terms interchangeably.

​But with vulnerabilities, threats, and risks, ​there's actually a distinction to be made between them. ​So, a vulnerability, at its essence, is just a weakness. ​In either a system or some process that an organization has, ​there's a weakness, some inherent point that could cause a problem. ​Think about how your computer, for example, needs electricity to operate. ​Well, that's a vulnerability. ​There are problems that could happen if you did not have electricity with your ​computer. ​The next topic is a threat.

​What is a threat? ​Well, a threat is some vulnerability that could be acted upon ​by either a threat actor or through natural causes. ​So, it can be either natural or manmade. ​This is the concept of a threat. ​It's an actualized vulnerability or some vulnerability that could come to ​pass through the actions of either mother nature or some threat actor. ​And then thirdly, we have risks, and ​a risk is basically a threat that is measured with either the impact, ​or I should say measured impact and the probability of that risk coming to pass. ​So how would this particular threat impact us?

​How likely is it that it's going to happen to us? ​Whenever you start to measure that, that's whenever you have risk. ​So even though in conversation we might use these terms interchangeably, ​they do carry particular meanings, specific meanings with them. ​Data sovereignty is our last topic on here, ​and data sovereignty is one of these terms that really encapsulates how a lot ​of organizations will structure their security apparatus. ​What are we required to do, and how do we focus on protecting that information? ​Whenever we're talking about the data of users, those users have data sovereignty. ​It doesn't matter where that data gets collected from.

​The rights of the individual about whom that data refers is protected. ​Generally, we're going to see this under GDPR, ​the General Data Protection Regulation, out of the European Union. ​But data sovereignty says, look, ​even if you're collecting information about European Union citizens and ​you're in a non eu country, our laws still protect that data. ​That data is sovereign to that, to that citizen, and ​belongs under the jurisdiction of their host parent country. ​So, data sovereignty is about protecting information, ​it doesn't matter where that data exists. ​The rights of that data user or about the data subject still applies. ​So, these are just a collection of different terms that we will see used ​throughout the rest of the course.

​These are our cybersecurity vocabulary, topics to be aware of.