Glossary

Classification is a method of categorizing assets or vulnerabilities based on their potential impact, exploitability, the likelihood of a breach, and other factors. Classification enables businesses to prioritize remediation efforts, addressing the vulnerabilities and risks that present the most serious potential risks to the organization before addressing vulnerabilities with lesser potential impacts.

A cloud asset refers to any IT element used for cloud computing, such as virtual or physical servers and storage, databases, and SaaS applications. Most IT assets can be cloud assets depending on whether it contributes to operations in the cloud.

Common Vulnerabilities and Exposures (CVE) is a database of publicly disclosed IT security flaws and issues. It provides a central point of reference for entities to exchange information about vulnerabilities and exposures that might impact others. This database contains only publicly reported CVEs, however, and therefore isn’t a complete reference of all vulnerabilities and exposures in existence. It’s maintained by the National Cybersecurity FFRDC (Federally Funded Research and Development Center) and operated by the MITRE Corporation. CVE is sponsored by the U.S. Government with funding from the US Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA).

Continuous discovery is the process of constantly scanning the digital supply chain to identify previously unknown assets and vulnerabilities. It’s a necessary component of effective attack surface management.

Credential theft occurs when malicious actors steal login details and use them to access services or applications. Threat actors then steadily elevate their privileges or access bank accounts, e-commerce websites, and other platforms as a customer. Credential theft can cause significant financial losses for victims (both companies and the affected customers). When used in the healthcare industry, it can result in the loss of Protected Health Information (PHI). Hackers leverage several techniques to credential access, including brute force attacks, phishing, site spoofing, or injecting malicious code onto a login or checkout page.

Cyber risk is the potential exposure to harm through an enterprise’s online presence, which can be anything from a web service to communication tools to social media accounts. While cyber security includes the prevention of data breaches, it also protects the organization from monetary, intellectual, and reputational loss.

A cyber risk assessment evaluates an asset, vulnerability, or system as a whole to determine the likelihood of a breach and the potential consequences of an exploit.

Cyber risk quantification refers to the calculations and methods used to gauge the potential consequences of a data breach targeting a particular asset. It can be expressed in several ways, such as potential financial loss, business disruption, or severity of the risk, as long as it’s in relevant terms that both internal and external stakeholders understand.