documentation and access control

standard and access control

access control and cryptography 

authentication and access control

document, prevent, and report

prevent, detect, recover

detect, recover, and remove

detect, prevent, and report

Any circumstance or event with the potential to adversely impact organizational operations

A set of criteria for the provision of security services

A measure of the extent to which an entity is threatened by a potential circumstance or event

Weakness in an information system, system security procedures

the object can lack integrity but maintan complete authenticity 

integrity means that the object can be changed by small amount

authenticity means that the object is the same as it claims

the object can lack authenticity but maintain integrity 

traffic analysis 

replay attack 

modefication of messages 

denial of service 

only weak operating system 

only open network

systems that have strong security  

reachable and exploitable vulnerabilities in a system

files 

data

attack surface  

threats 

nonrepudiation 

recovery

backup 

authenticity 

1.     contingency plan

security plan 

disaster plan

recovery plan