DSTC flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Core security model of Confidentiality (no unauthorized disclosure), Integrity (no unauthorized modification), and Availability (reliable timely access). Controls are mapped to the property they protect.

Risk Formula

Risk equals Threat multiplied by Vulnerability multiplied by Impact. A credible threat with no matching vulnerability yields no risk, so controls target vulnerabilities or impact.

Defense in Depth

Layering preventive, detective, and corrective controls across people, process, and technology so that failure of any single control does not expose the protected asset.

Zero-Day Vulnerability

A weakness exploited before the vendor has released a patch. Compensating controls such as segmentation and least privilege reduce exposure until remediation is available.

Phishing Variants

Phishing uses email, vishing uses voice calls, and smishing uses SMS text. All three exploit human trust, so defenses combine awareness training with technical filtering.

Stateful vs Stateless Firewall

A stateful firewall tracks connection state and automatically permits return traffic. A stateless ACL evaluates each packet independently and must explicitly permit both directions.

IDS versus IPS

An intrusion detection system passively monitors and alerts. An intrusion prevention system sits inline and can block traffic, trading potential disruption for active enforcement.

DMZ Purpose

A demilitarized zone segments internet-facing services from internal networks, so compromise of an exposed host does not grant direct access to internal systems.

IPsec ESP and AH

ESP provides confidentiality through encryption plus integrity. AH provides integrity and origin authentication but no encryption. Tunnel mode encapsulates the whole original packet.

Network Segmentation

Dividing a network into zones with enforced traffic controls. Segmentation and microsegmentation limit lateral movement after an initial compromise of a host.

802.1X Port Authentication

A standard requiring a supplicant, an authenticator switch, and an authentication server. Devices must authenticate before the switch grants network port access.

Endpoint Detection and Response

EDR collects endpoint telemetry such as process, file, registry, and network activity, enabling detection and response actions including host isolation and process termination.

Application Allowlisting

A control permitting only explicitly approved executables to run and blocking all others. It is stronger than blocklisting because unknown malware is denied by default.

Host Hardening

Reducing attack surface by disabling unused services, removing default accounts, applying least privilege, enforcing full-disk encryption, and keeping operating systems and applications patched.

File Integrity Monitoring

Detecting unauthorized changes to critical system and configuration files. It supports both intrusion detection and compliance evidence for change control.

AAA Model

Authentication proves identity, Authorization determines permitted actions, and Accounting records activity. All three are needed for accountable access control.

Multi-Factor Authentication

Requiring two or more different factor types: something you know, have, or are. Two passwords are not MFA because they belong to the same factor category.

RBAC versus ABAC

Role-based access control assigns permissions to roles and users to roles. Attribute-based access control evaluates attributes and policy conditions for finer, context-aware decisions.

Least Privilege

Granting only the minimum access required for a task, for the minimum duration. It limits the blast radius when an account or process is compromised.

Password Hashing

Passwords must be stored with salted, slow algorithms such as bcrypt, Argon2, or PBKDF2. Fast hashes like MD5 and SHA-1 are unsuitable for password storage.

Privileged Access Management

Vaulting administrative credentials, enforcing just-in-time elevation, and recording privileged sessions to reduce standing privilege and improve accountability for high-risk accounts.

Incident Response Phases

Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Containment precedes eradication so the incident does not spread during cleanup.

Order of Volatility

Collect the most perishable evidence first: CPU and memory, network state, running processes, disk, remote logs, and archival media. Memory is lost on shutdown.

Chain of Custody

Documentation recording who handled evidence, when, and how. Unbroken custody preserves admissibility and integrity of forensic artifacts through investigation and legal proceedings.

MTTD and MTTR

Mean time to detect measures detection speed; mean time to respond or recover measures remediation speed. Both are key performance indicators for incident response programs.

SIEM Function

A security information and event management platform aggregates and normalizes logs, correlates events across sources, and generates alerts for analyst triage and investigation.

False Positive versus Negative

A false positive flags benign activity as malicious and wastes analyst time. A false negative misses real malicious activity and is generally the costlier failure.

Vulnerability Prioritization

CVSS indicates technical severity, not business risk. Prioritization also weighs exploitability, internet exposure, asset criticality, and available compensating controls.

3-2-1 Backup Rule

Keep three copies of data on two different media types with one copy offsite. Restore testing is required to prove recoverability, not just backup completion.

Threat Hunting

A hypothesis-driven, proactive search for adversary activity that existing alerts missed. It differs from alert-driven monitoring, which reacts to predefined detections.

Risk Treatment Options

Mitigate by applying controls, transfer through insurance or contracts, avoid the activity entirely, or accept the residual risk with documented management approval.

ALE Calculation

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. SLE equals asset value multiplied by exposure factor.

RTO versus RPO

Recovery time objective is the maximum tolerable downtime for a process. Recovery point objective is the maximum tolerable data loss measured in time.

Data Controller versus Processor

The controller determines why and how personal data is processed. The processor acts on the controller's documented instructions and carries its own security obligations.