Availability

Part of the CIA triad. Ensures authorized users have reliable, timely access to information and systems, and protects against disruption (e.g. DDoS attacks, hardware failures) through redundancy/failover, regular backups and disaster recovery plans.

Confidentiality

Part of the CIA triad. Ensures information is accessible only to authorized individuals and prevents unauthorized access or disclosure, e.g. through encryption, access controls and multi-factor authentication.

Integrity

Part of the CIA triad. Ensures data is accurate, consistent and has not been altered in an unauthorized way, detecting/preventing tampering through checksums and hashes, digital signatures and version control.

Asset

What the organisation wants to protect from harm. Assets span many categories — financials, people, personal data, intangible assets (e.g. intellectual property) and technical assets like devices, servers or cloud services. Since “you can’t protect what you don’t know you have”, it is important to maintain an asset inventory and processes to register, protect and securely dispose of assets. An asset’s importance is evaluated through a business impact analysis.

Control

A technical or organisational measure put in place in a process or system to reduce risk.

Risk

An unwanted event that affects an asset, caused by a threat that exploits a vulnerability. This generally represents damage the organisation wants to prevent, but can also be framed as an opportunity cost (missing out on potential gains). Formula: a risk is a threat to an asset that makes use of a specific vulnerability the asset has (or might have).

Stakeholder

A party that has an interest in the protection of the organisation's assets.

Threat

A potential for damage to an asset, caused by a threat agent — answers the question of who or what is causing the risk. linkyard's threat catalogue is based on the BSI's catalogue of elementary threats (IT-Grundschutz-Kompendium).

Threat Agent

An individual, group, organisation, or even a process that takes advantage of a vulnerability to carry out a threat (also called a threat actor). For naturally occurring elementary threats, “nature” can be considered the threat agent. Threat agents have intent (malicious or accidental) and the capability to exploit vulnerabilities. Common types: cybercriminals, nation-state actors, hacktivists, insiders, and automated scripts/bots.

Vulnerability

A real or possible/feasible flaw or weakness in an asset's design, implementation, operation or management that could be exploited by a threat.

Attack surface

The sum of all the points where a system interacts with the outside world (e.g. web service interfaces, users) that could be a point of attack for a threat agent to exploit a vulnerability. The attack surface can be reduced by hardening systems or placing firewalls in front of exposed services.

Attack tree

A hierarchical breakdown of the methods and variants an attacker could use to execute a threat against an asset, built for a subset of high-value risks to help identify overlooked risks. Every branch could technically be its own risk, but attack vectors that share the same mitigating controls (e.g. enforcing 2FA) are usually grouped into a single risk.

Attack vector

The method or pathway an attacker uses to gain unauthorized access to a system, network or data — i.e. how a threat actor exploits a vulnerability to carry out an attack (e.g. phishing, malware, social engineering, unpatched software, drive-by downloads, insider misuse).

Blue team

Blue team or blue teaming refers to a group of cyber security employees responsible for defending an organisation against attack.

CIA triad

A foundational information security model representing the three core principles for protecting data: Confidentiality, Integrity and Availability.

Data protection

The additional legal obligations to protect sensitive personal data. It is a subcomponent of information security, alongside other legal/self-governing obligations such as FINMA circular letters, the EU AI Act or TISAX. In Swiss government projects the term is always named explicitly alongside “information security” (e.g. “ISDS”); for other customers linkyard uses “information security” as the all-encompassing term.

Exception management

The process of managing approved deviations from a control — e.g. when a stakeholder allows an exception because an application can't support a required control like 2FA, or because supporting it would require an economically unviable paid add-on. An exception typically creates a known vulnerability, so it must be reviewed periodically (every one to two years) to confirm the reason is still valid: the technical or economic feasibility may have changed, or the underlying risk may have increased — for example because the asset has become more valuable. Having an exception management process is itself a control.

Information security

The need to protect the confidentiality, integrity and availability of a system in general.

Inherent risk

The relevance of a risk (potential damage × likelihood of occurrence) evaluated before mitigations/controls are put in place.

Non-repudiation

A property (bindingness) that ensures actions performed, or messages sent/received, cannot be denied without justification. Distinguishes repudiation of origin (denying having sent a message) from repudiation of receipt (denying having received it) — relevant e.g. in disputed orders or invoices. (BSI ID G 0.37)

Red team

Red team or red teaming refers to the practice of simulating an attacker during an intrusion test. The red team reports its findings to the customer after the test is conducted.

Residual risk

The relevance of a risk (potential damage × likelihood of occurrence) evaluated after mitigations/controls have been applied.

Sensitive personal data

Data relating to religious, ideological, political or trade union views/activities, health, privacy or racial origin, social assistance measures, and administrative or criminal prosecutions and sanctions concerning identified or identifiable persons.