the risk of bad things happening (e.g. fines) as a result of a failure to comply with regulations

An attack where there are no known patches and no knowledge of that attack type prior to the attack occurring – there are zero-days in which to prepare for it.

Threat patterns capture knowledge of known attack techniques and existing weaknesses in a domain.

A model of all the relevant knowledge, all the relevant types of assets, all the possible relationships between them, and all the security controls which can be applied to them within a specific context.

A detailed understanding of all the possible threats, attacks or vulnerabilities which could affect a system and the security controls and mitigation strategies available to counter them.

The set of pre-determined rules defining the nature of the relationships between assets and their associated threats.

The potential for a misbehaving asset to increase the likelihood of misbehaviour in another connected asset.

The sending of malicious emails appearing to be from a known or trusted sender in order to induce targeted individuals to reveal confidential information.

Broadly means gaining and exploiting the trust of people by a misuse of authority or power.

In cybersecurity, understood as attempts to manipulate users into taking harmful action or disclosing private information – usually for fraudulent or damaging purposes.

The General Data Protection Regulation (2016), introduced into UK law under the Data Protection Act 2018 (DPA). Provides legal requirements for data protection and citizen privacy within the European Union (EU) and for data transferred outside the EU.

The magnitude of the importance of a threat or misbehaving asset (very low risk to very high risk). It is a calculation based on likelihood, impact and controls.

A set of controls (security measures) which address one or more threats.

An individual security measure to protect or modify an asset so that it can resist a threat.

The propensity of an asset to avoid or resist threats (there are multiple types of trustworthiness). It is the inverse of likelihood. 

The costs if something goes wrong. Includes:

• damage to organisations, networks, assets, reputation, image, and goodwill;
• the financial costs for investigation and repair, lost working time, lost opportunity, and health and safety changes.