SC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ALE

Annualized Loss Expectancy equals Single Loss Expectancy multiplied by Annualized Rate of Occurrence, expressing expected yearly monetary loss from a risk.

Residual risk

The risk that remains after security controls have been applied and accepted by management, distinct from the original inherent risk.

RTO versus RPO

Recovery Time Objective is the maximum acceptable downtime; Recovery Point Objective is the maximum acceptable data loss measured in time.

Due care

Acting responsibly on identified risk by implementing controls, as opposed to due diligence, which is the ongoing investigation that informs those actions.

Data owner

The role accountable for a data asset who sets classification and access rules; custodians implement the technical controls the owner requires.

Data remanence

Residual data left on media after deletion or overwrite; addressed by clearing, purging, degaussing, or physical destruction.

Tokenization

Replacing sensitive data with a surrogate token that maps back through a protected vault, reducing exposure while preserving format for processing.

PII definition

Personally Identifiable Information is data that can identify an individual directly or when combined with other available data.

Bell-LaPadula model

A confidentiality model enforcing no read up and no write down, preventing subjects from accessing data above their clearance.

Biba integrity model

An integrity model enforcing no read down and no write up, preventing low-integrity data from contaminating higher-integrity objects.

Reference monitor

The abstract machine enforcing access control that must be always invoked, tamper-proof, and verifiable for the trusted computing base.

HMAC

A keyed hash construction that provides integrity and authenticity using a shared secret, distinct from a plain unkeyed hash.

Common Criteria EAL

Evaluation Assurance Levels 1 through 7 rate the depth of assurance evidence for a product; higher levels mean more verification, not more features.

IPsec ESP

Encapsulating Security Payload provides confidentiality plus optional integrity and authentication, whereas AH provides integrity and authentication only.

Stateful firewall

A firewall that tracks connection state and permits return traffic for established sessions, unlike a stateless packet filter.

TLS purpose

TLS provides confidentiality, integrity, and server authentication over a network; client authentication requires mutual TLS configuration.

Network segmentation

Dividing a network into zones with controlled inter-zone traffic, limiting lateral movement and containing the blast radius of a compromise.

DMZ

A demilitarized zone is a segmented network hosting externally accessible services, isolating them from the internal trusted network.

ABAC

Attribute-Based Access Control grants access using policies evaluated against subject, resource, action, and environment attributes.

Kerberos TGT

A ticket-granting ticket issued by the key distribution center that lets a principal request service tickets without resending credentials.

FAR and FRR

False Acceptance Rate measures incorrect biometric accepts; False Rejection Rate measures incorrect rejects; their crossover is the equal error rate.

SAML

An XML-based federation standard for exchanging authentication and authorization assertions between an identity provider and service providers.

Penetration test

An authorized simulated attack that validates whether vulnerabilities are exploitable, going beyond the identification performed by a vulnerability scan.

SAST versus DAST

Static analysis inspects source code without executing it; dynamic analysis tests a running application from the outside.

SOC 2 report

An attestation report covering the trust services criteria for security, availability, processing integrity, confidentiality, and privacy.

Statistical sampling

Selecting a random, representative subset of a population so results can be generalized with measurable confidence.

Order of volatility

Evidence collection priority from most to least volatile, such as memory and network state before disk before backups.

Chain of custody

Documentation recording who handled evidence, when, and how, ensuring integrity and admissibility from collection through presentation.

Differential backup

A backup capturing all changes since the last full backup; restoration needs the last full plus the latest differential.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned form the standard incident handling lifecycle.

STRIDE

A threat modeling mnemonic covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

Parameterized query

A query that separates code from data using bound parameters, preventing SQL injection by ensuring input is never executed.