SCYM flashcards
SCYM · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA triad
- Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely, reliable access to systems and data for authorized users.
- Single loss expectancy
- The monetary loss from one incident, calculated as asset value multiplied by exposure factor, where exposure factor is the percentage of asset value destroyed.
- Annualized loss expectancy
- The expected yearly loss from a risk, computed as single loss expectancy multiplied by the annualized rate of occurrence, used to justify control costs.
- Digital signature
- A hash of a message encrypted with the sender's private key; it proves integrity and origin and provides non-repudiation, but does not conceal the content.
- Symmetric encryption
- Encryption using one shared key for both encryption and decryption; it is fast and suited to bulk data, but key distribution and key count scale poorly.
- Hashing versus encryption
- Hashing is a one-way function producing a fixed-length digest used for integrity checks; encryption is reversible with a key and protects confidentiality of the data.
- Defense in depth
- Layering independent preventive, detective and corrective controls so that the failure of any single control does not expose the whole system.
- Exposure factor
- The percentage of an asset's value that would be lost if a specific threat were realized, used as a multiplier when calculating single loss expectancy.
- Multi-factor authentication
- Authentication requiring two or more credentials from different categories: something you know, something you have, or something you are; two passwords do not qualify.
- Password salting
- Adding unique random data to each password before hashing so identical passwords produce different digests, defeating precomputed rainbow-table attacks.
- OAuth 2.0
- An authorization framework that issues access tokens so a client application can reach protected resources on a user's behalf without handling the user's password.
- OpenID Connect
- An identity layer built on OAuth 2.0 that adds a signed ID token, a JSON Web Token, so client applications can verify who the authenticated user is.
- SAML 2.0 assertions
- XML statements issued by an identity provider describing a user's authentication event and attributes to a service provider, enabling browser-based single sign-on.
- Role-based access control
- An access model where permissions are assigned to roles and users are made members of roles, simplifying administration and supporting least privilege.
- Ticket-granting ticket
- A time-limited Kerberos credential issued by the key distribution center that lets a user request service tickets without re-entering a password each time.
- Separation of duties
- Splitting a sensitive task across multiple people so that no single individual can complete a fraud or serious error alone without collusion.
- TLS 1.3 forward secrecy
- TLS 1.3 uses ephemeral (EC)DHE key exchange, so compromise of a server's long-term private key cannot decrypt previously recorded sessions.
- TCP three-way handshake
- Connection setup using SYN, then SYN-ACK, then ACK; it synchronizes sequence numbers and confirms both endpoints can send and receive.
- User Datagram Protocol
- A connectionless transport protocol with no handshake, ordering or retransmission; used where low latency matters more than reliable delivery.
- ARP spoofing
- Sending forged ARP replies that bind an attacker's MAC address to a legitimate IP, enabling on-path interception of local network traffic.
- DNSSEC
- A set of DNS extensions that cryptographically sign records so resolvers can verify origin authenticity and integrity; it does not encrypt queries or responses.
- IPsec ESP
- The IPsec protocol that encrypts packet payloads and optionally authenticates them, whereas the AH protocol authenticates only and gives no confidentiality.
- CIDR usable host count
- For an IPv4 subnet, usable host addresses equal two raised to the power of thirty-two minus the prefix length, minus two for network and broadcast.
- Stateful firewall
- A firewall that tracks connection state and permits return traffic for established sessions, unlike stateless ACLs that inspect each packet independently.
- Incident response lifecycle
- Prepare; detect and analyze; contain, eradicate and recover; then perform post-incident activity including lessons learned and evidence retention.
- Order of volatility
- Evidence collection priority from most to least perishable: CPU registers and cache, memory, network state, disk storage, then backups and archival media.
- Chain of custody
- A documented, unbroken record of who collected, handled and stored evidence and when, required for that evidence to be admissible.
- Recovery time objective
- The maximum acceptable time to restore a service after a disruption; the recovery point objective instead defines the maximum acceptable data loss.
- Business impact analysis
- A study identifying critical business processes, their dependencies, and the operational and financial impact of their disruption, informing recovery priorities.
- Change management approval
- A controlled process of requesting, risk-assessing, testing, approving, implementing and documenting changes, with a tested back-out plan.
- Synchronized time source
- Using NTP so all hosts share a common clock, which is required for reliable log correlation, Kerberos authentication and forensic timeline reconstruction.
- GDPR breach notification
- Under the GDPR, a data controller must notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it.