CENTC flashcards
CENTC · Build recall with a focused review session.
34 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA triad
- Core security model: confidentiality restricts disclosure, integrity prevents unauthorized modification, and availability ensures timely access to authorized users.
- Least privilege
- Principle that each user, process, or device receives only the minimum access rights needed to perform its function, reducing potential damage from compromise.
- Defense in depth
- Layering multiple independent controls so failure of one layer does not expose the asset; no single control is trusted as sole protection.
- Digital signature
- Cryptographic value created with a sender's private key and verified with the public key, providing integrity, authenticity, and non-repudiation.
- Symmetric vs asymmetric encryption
- Symmetric uses one shared key and is fast (AES); asymmetric uses a public/private key pair to solve key distribution but is slower (RSA, ECC).
- Risk formula
- Risk is commonly expressed as Threat multiplied by Vulnerability multiplied by Impact; controls reduce vulnerability or impact to lower residual risk.
- IP spoofing
- Falsifying a packet's source address to impersonate a trusted host; ingress and egress filtering at network boundaries mitigate it.
- On-path attack
- Formerly called man-in-the-middle; an attacker intercepts traffic between two parties, potentially reading or altering it. TLS and certificate validation defend against it.
- Phishing
- Social-engineering attack using deceptive email or messages to trick recipients into revealing credentials or executing malicious content; DMARC, SPF, and DKIM reduce spoofing.
- DDoS categories
- Volumetric floods saturate bandwidth, protocol attacks exhaust connection state, and application-layer floods consume server resources; each needs different mitigation.
- SQL injection
- Attack inserting malicious SQL through unvalidated input to manipulate a database; parameterized queries and input validation are structural mitigations.
- Zero-day exploit
- Exploitation of a previously unknown vulnerability for which no patch exists; signature detection fails, so behavioral analysis is required.
- Lateral movement
- Technique an intruder uses to move from an initially compromised host to other systems, escalating reach before detection.
- DMZ
- Screened subnet hosting externally reachable services between two firewalls, isolating public-facing systems from the internal network.
- Network segmentation
- Dividing a network into zones with enforced policy between them, limiting blast radius and containing intruder movement.
- Zero Trust
- Architecture removing implicit trust based on network location; every request is authenticated and authorized per session regardless of origin.
- 802.1X
- Port-based access control using a supplicant, an authenticator such as a switch, and an authentication server via EAP, typically RADIUS.
- IPsec ESP vs AH
- ESP provides confidentiality plus integrity and authentication; AH provides integrity and authentication only, without encryption.
- Microsegmentation
- Applying fine-grained per-workload security policy, often in software-defined networking, rather than relying only on perimeter controls.
- Stateful firewall
- Firewall that tracks connection state and permits return traffic for established sessions, unlike stateless ACLs that filter each packet independently.
- IDS vs IPS
- An IDS passively monitors and alerts on suspicious traffic; an IPS sits inline and can actively block detected malicious traffic.
- WPA3
- Wireless security standard adding SAE to resist offline dictionary attacks and improving protection over WPA2's PSK mode.
- NAT
- Translates IP addresses between networks (SNAT, DNAT, PAT); it conserves addresses and obscures topology but is not a security control.
- DHCP snooping
- Switch feature that filters untrusted DHCP messages and builds a binding table, preventing rogue DHCP servers and supporting dynamic ARP inspection.
- SIEM
- Security information and event management platform that centralizes, normalizes, correlates, and alerts on log data from many sources.
- Incident response phases
- NIST sequence: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity with lessons learned.
- Order of volatility
- Evidence collection priority from most to least transient: memory and registers, then disk, then remote logs and archives.
- Chain of custody
- Documented record of who handled evidence, when, and how, preserving admissibility and integrity through investigation and legal proceedings.
- MTTD and MTTR
- Mean time to detect and mean time to respond; lower values indicate a more effective monitoring and incident response capability.
- NIST CSF functions
- Five core functions: Identify, Protect, Detect, Respond, and Recover, used to organize and assess cybersecurity program activities.
- ALE formula
- Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence; SLE equals asset value times exposure factor.
- Risk treatment options
- Mitigate by applying controls, transfer via insurance or contract, avoid by eliminating the activity, or accept and document residual risk.
- Policy vs standard vs procedure
- Policy states management intent, a standard gives mandatory specific requirements, and a procedure provides step-by-step instructions for performing a task.
- RTO and RPO
- Recovery time objective is the maximum acceptable downtime; recovery point objective is the maximum tolerable data loss measured in time.