ASIS APP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

The property that information is disclosed only to authorized subjects. It is protected by encryption, access controls, and classification, and is lost through unauthorized disclosure or interception.

Integrity

The property that data and systems remain accurate, complete, and unaltered by unauthorized means. Controls include hashing, checksums, change control, and separation of duties.

Availability

The property that systems and data are accessible to authorized users when needed. It is supported by redundancy, backups, failover, and protection against denial-of-service attacks.

Defense in depth

A strategy layering multiple independent controls so that failure of one control does not expose the asset. Each layer assumes preceding layers may be defeated.

Least privilege

Granting each subject only the access rights required to perform its function, for only as long as needed. It limits the damage from compromised accounts or insider misuse.

Separation of duties

Dividing a sensitive process among multiple people so no single individual can complete it alone. It reduces fraud and error risk; collusion remains the residual threat.

Multifactor authentication

Authentication using two or more different factor types: something you know, something you have, and something you are. Two instances of the same type do not qualify.

Role-based access control

An access control model assigning permissions to roles rather than individuals; users gain rights by being placed in roles. It simplifies administration and supports least privilege.

Preventive control

A control that stops an unwanted event before it occurs, such as a lock, firewall rule, or access badge requirement. It acts in advance rather than after the event.

Detective control

A control that identifies that an unwanted event has occurred, such as an alarm, log review, or motion sensor. It does not stop the event, only reveals it.

Security policy

A high-level mandatory statement of management intent and direction on security. It is supported by more specific standards, procedures, and guidelines that implement its requirements.

Standard

A mandatory, specific requirement that supports a policy, such as an encryption algorithm or password length. Standards are measurable and auditable, unlike guidelines.

Procedure

A step-by-step mandatory instruction describing how to perform a specific task to meet a standard or policy. Procedures are operational and detailed.

Guideline

A recommended, non-mandatory practice that suggests how to meet policy or standards. Deviation from a guideline is permitted when justified.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by executive leadership. It bounds acceptable residual risk.

Security awareness training

Education aimed at changing everyday security behavior across the workforce, covering threats such as phishing and social engineering. It differs from role-based technical training.

Third-party risk management

The process of assessing and monitoring vendors and partners for security exposure, including due diligence, contractual requirements, and periodic reassessment throughout the relationship.

Governance hierarchy

The flow of security authority from the board and executives, who set direction and risk appetite, through security leadership, who set policy, to managers, who enforce it.

Security metrics

Measurable indicators of security program performance, ideally tied to business outcomes such as incident cost or downtime hours rather than raw tool counts.

Risk definition

The potential for loss expressed as the combination of threat, vulnerability, and impact. A risk requires a threat able to exploit a vulnerability with a consequence.

Single loss expectancy

The expected monetary loss from one occurrence of an incident: SLE = asset value x exposure factor, where exposure factor is the fraction of value lost.

Annualized loss expectancy

The expected yearly loss from a risk: ALE = SLE x annualized rate of occurrence (ARO). It supports cost-benefit comparison of candidate controls.

Annualized rate of occurrence

The estimated frequency with which a specific threat event occurs in one year. It multiplies SLE to produce ALE in quantitative risk analysis.

Residual risk

The risk remaining after controls are applied. It must be documented and accepted by an authorized party when it exceeds or approaches the risk tolerance.

Risk transfer

A risk response shifting financial consequence to another party, typically through insurance or contract. The underlying risk itself is not eliminated.

Risk acceptance

A deliberate decision to retain a risk without further controls, made by an authorized party with documented justification. It is valid only within the organization's risk appetite.

Business impact analysis

An analysis identifying critical business functions and quantifying the effect of their disruption. It produces recovery priorities, recovery time objectives, and recovery point objectives.

Recovery time objective

The maximum tolerable time a business function may be unavailable after a disruption before unacceptable consequences occur. It drives recovery capability design.

Recovery point objective

The maximum tolerable amount of data loss measured in time before a disruption. It determines backup frequency and replication design.

CPTED

Crime Prevention Through Environmental Design: shaping the physical environment using natural surveillance, natural access control, territorial reinforcement, and maintenance to reduce crime opportunity.

Fail-safe lock

A locking configuration that releases to allow egress when power is lost, protecting life safety. It is required where people could be trapped during an emergency.

Anti-passback

An access control rule requiring a credential to exit before it can re-enter, preventing one person from passing a badge back to another. It enforces one-person-per-credential.