Transforming plaintext into ciphertext using a key so only authorized parties can read it.
Encryption protects confidentiality both at rest (full-disk, database, file) and in transit (TLS, IPsec, VPN). Symmetric ciphers like AES are fast and used for bulk data; asymmetric ciphers like RSA and ECC are slower but solve key exchange and enable digital signatures — so real systems typically use asymmetric crypto to exchange a symmetric session key, then encrypt the data itself symmetrically.
A one-way function that produces a fixed-length digest from any input.
Hashing provides integrity (verifying data hasn’t changed) and underpins digital signatures, but it is one-way and gives no confidentiality. Use SHA-256 or stronger; MD5 and SHA-1 are broken by collision attacks. For password storage a plain hash is insufficient — combine a unique per-user salt with a deliberately slow key-derivation function such as bcrypt, scrypt, or Argon2 to defeat rainbow tables and brute force.
Replacing sensitive data with a non-sensitive token that has no mathematical relationship to the original.
Tokenization swaps sensitive data for a token with no mathematical relationship to the original, reversible only by looking it up in a secure vault — so a stolen token is worthless on its own. Unlike encryption, where ciphertext is derived from the data and a key, the token carries no recoverable value, which is why payment systems use it to keep actual card numbers out of application databases and shrink PCI-DSS scope.
Hiding part of sensitive data — for example, showing only the last four digits of a card.
Masking hides part of a value at the presentation layer — showing only the last four digits of a card or SSN — while the data underneath is unchanged. Static masking permanently obscures data in non-production copies; dynamic masking applies role-based rules at query time so different users see different levels of detail.
Making information harder to understand without removing it.
Obfuscation raises the effort an attacker needs to understand information without removing access to it — code minification, packing, and steganography (hiding data inside other data) are examples. It is “security through obscurity” and must never replace encryption or access control; it only slows an adversary, it does not stop one.
The practice and study of techniques for securing communication in the presence of adversaries.
Cryptography delivers confidentiality (encryption), integrity (hashing), authentication, and non-repudiation (digital signatures) — the building blocks under nearly every other control. Per Kerckhoffs’s principle, security must rest on key secrecy, not algorithm secrecy. Quantum-resistant (post-quantum) algorithms are the next frontier; NIST has standardized initial PQC schemes to survive future quantum attacks against RSA and ECC.
Random data added to input before hashing to defeat precomputed (rainbow) attacks.
A salt is random data added to a password before hashing, so two users with the same password get different digests and precomputed rainbow tables become useless. The salt does not need to be secret — it’s stored alongside the hash; uniqueness per password is what matters. A pepper adds a separate, server-wide secret kept outside the database for an extra layer.
Public Key Infrastructure — the system of CAs, certificates, and keys that binds identities to keys.
PKI binds identities to public keys through certificates issued by Certificate Authorities; trust flows from a self-signed root CA, through intermediate CAs, down to end-entity certificates — the chain of trust. When a key is compromised or a certificate must be retired early, revocation is published via Certificate Revocation Lists (CRLs) or checked in real time with OCSP.
Direction and oversight of security through policies, roles, and accountability structures.
Governance sets direction and accountability through policies, standards, and defined roles; management then executes within that framework — keeping the “what” and the “how” in separate hands preserves oversight. Boards and security steering committees provide enterprise governance, increasingly driven by regulatory regimes (SOX, GDPR, HIPAA) that hold leadership directly accountable for security outcomes.
A model in which no user, device, or network is trusted by default — verify everything, always.
Zero Trust discards the old “trusted internal network” perimeter and verifies every request as though it originates from an open network — authenticate, authorize, and continuously validate based on identity, device posture, and context. NIST SP 800-207 defines the architecture; in practice it relies on micro-segmentation, least-privilege access, and the operating assumption that a breach has already occurred.
Separation of duties — splitting responsibilities so no one person can complete a sensitive task alone.
Separation (segregation) of duties splits a sensitive process so no single person can complete it alone, deterring fraud and catching error. Classic pairs include developer/operator, requestor/approver, and custodian/auditor; pairing it with mandatory vacation and job rotation exposes long-running schemes that depend on one person controlling every step.
A foundational guideline — least privilege, defense-in-depth, fail-secure, separation of duties.
Security principles are technology-independent guidelines: least privilege (grant only the access a role needs), defense-in-depth (layer controls so no single failure is fatal), fail-secure (default to denied on error), and separation of duties. Least privilege and defense-in-depth appear on nearly every Security+ exam and outlast any specific product or platform.