BCS CISMP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core information security properties: confidentiality limits access to authorised parties, integrity keeps data accurate and complete, and availability ensures timely access for authorised users.

Least privilege

A principle stating that each user, process, or system receives only the minimum access rights needed to perform its function, reducing the impact of error or compromise.

Defence in depth

Layering multiple independent controls across people, process, and technology so that if one control fails, others still reduce the likelihood or impact of a security breach.

Segregation of duties

Splitting a sensitive task across two or more people so no single individual controls every stage, preventing fraud and undetected error in critical transactions.

Three lines model

A governance structure where operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the governing body.

Policy hierarchy

The ordered set of documents from governing policy stating management intent, through mandatory standards and step-by-step procedures, down to recommended guidelines with no mandatory force.

Need to know

An access restriction granting information only to those whose duties genuinely require it, which is narrower than role-based access because it is decided per item of information.

Risk definition

The effect of uncertainty on objectives, expressed in information security as a function of the likelihood of a threat exploiting a vulnerability and the resulting business impact.

Single loss expectancy

The monetary loss from one risk event, calculated as asset value multiplied by the exposure factor, which is the proportion of the asset damaged by that event.

Annualised loss expectancy

The expected yearly loss from a risk, calculated as single loss expectancy multiplied by the annualised rate of occurrence; used to justify the cost of controls.

Residual risk

The risk remaining after existing and planned controls have been applied, which the risk owner must formally accept or treat further.

Risk appetite

The amount and type of risk an organisation is willing to seek or retain in pursuit of its objectives, set by senior management and used to judge whether residual risk is acceptable.

Risk treatment options

The four standard responses to risk: mitigate by adding controls, transfer to a third party such as an insurer, avoid by stopping the activity, or accept and retain with sign-off.

Risk register

A living record of identified risks listing asset, threat, vulnerability, existing controls, likelihood, impact, score, risk owner, treatment plan, and review date.

Business impact analysis

An analysis identifying critical business processes and dependencies and quantifying the operational and financial effect of their disruption over time, feeding recovery objectives and continuity strategy.

ISO/IEC 27001

The international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system, against which organisations can be independently certified.

ISO/IEC 27002

An international standard providing implementation guidance for information security controls, organised into organisational, people, physical, and technological themes that support an ISMS.

Annex A control themes

In ISO/IEC 27001:2022 the 93 Annex A controls are grouped into four themes: organisational with 37 controls, people with 8, physical with 14, and technological with 34.

NIST CSF functions

The NIST Cybersecurity Framework core functions: Identify, Protect, Detect, Respond, and Recover, with Govern added in version 2.0; voluntary and outcome-based rather than certifiable.

Statement of applicability

A mandatory ISMS document listing every Annex A control, stating whether it is applied or excluded, and giving justification for each exclusion.

PCI DSS scope

A contractual security standard for organisations that store, process, or transmit payment card data, enforced by the card schemes rather than by legislation.

COBIT purpose

An ISACA framework for enterprise governance of IT, defining governance and management objectives that link IT activity to business goals and stakeholder needs.

Control categories

Functional classifications of controls: preventive stops incidents, detective identifies them, corrective repairs damage, deterrent discourages attack, and recovery restores normal service.

Multi-factor authentication

Authentication requiring two or more factors from different categories: something you know, something you have, or something you are, so a single stolen factor is insufficient.

Role-based access control

An access model where permissions are assigned to roles reflecting job functions, and users gain access by being placed in roles rather than by individual permission grants.

Symmetric encryption

Encryption using one shared secret key for both encryption and decryption, offering speed suitable for bulk data but requiring secure key distribution to all parties.

Digital signature

A cryptographic value created with the sender's private key that lets a recipient verify the sender's authenticity and the message integrity, and supports non-repudiation.

DMZ

A segmented network zone hosting externally accessible services, positioned between the internet and the internal network so compromise of a public server does not directly expose internal systems.

Incident response phases

The typical lifecycle of preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned, applied in a documented and rehearsed process.

Order of volatility

A forensic principle requiring collection of the most perishable evidence first, such as memory and network connections, before disks, backups, and archival media.

Recovery time objective

The maximum acceptable elapsed time to restore a business process or system after disruption, set from the business impact analysis and driving recovery strategy choice.

Recovery point objective

The maximum acceptable amount of data loss measured in time, determining how frequently backups or replication must occur for a given system.