Distinguish among these concepts:

Information, System, and Network Security

Confidentiality
Integrity
Availability
Authentication
Authorization
Attestation
Non-Repudiation of Origin/Destination (Digital Signatures)

Threat: potential security vulnerability
Attack: exploit vulnerability
Adversary: who makes the attack (attacker)

Different Attack Types
Disclosure: breaching confidentiality
Deception: breaching integrity
Disruption: breaching availability
Usurpation: non authenticated access control
Eavesdropping (snooping or interception)
Spoofing/Masquerade
Replay
Modification, Man-in-the-Middle (mitm)
Fabrication
Interruption (suspension), Delay
Denial-of-Service (DoS), Distributed DoS

Threat Model: defines exploit capabilities by adversary
-> defines vulnerabilities, security goals -> mitigation

Mitigation: define & implement security policy/mechanisms
Avoidance: use cryptography/firewall (easier to implement)
Recovery: use Detection (scan) & Protection, e.g., IDPS

Capabilities of an Adversary 
Data Access
Physical presence
OS
Network access (LAN or remote?)
Side/Covert Channels
User/Root Access
Supercomputing power

Trust (doors & keys, user/admin, users/cloud operator)

Risk Analysis (event probability, cost)
