C-ACYFSW flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk Appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, approved by leadership and expressed in qualitative or quantitative terms.

Three Lines Model

Governance structure where operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the board.

Residual Risk

The risk remaining after controls and treatments are applied. It must be documented and formally accepted by the accountable risk owner at the correct authority level.

Annualized Loss Expectancy

A quantitative risk formula: ALE equals single loss expectancy multiplied by annualized rate of occurrence, estimating expected yearly financial loss for an asset.

STRIDE Threat Model

A threat classification covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, applied across trust boundaries in a data-flow diagram.

Risk Register

A living record of identified risks including asset, threat, likelihood, impact, inherent and residual rating, owner, treatment plan, and review date.

Zero Trust Architecture

A design principle that removes implicit trust based on network location and instead verifies every request using identity, device posture, and policy before granting access.

Defense in Depth

Layering preventive, detective, and corrective controls so that failure or bypass of any single control does not expose the protected asset.

Symmetric vs Asymmetric

Symmetric encryption uses one shared key and is fast for bulk data; asymmetric uses a public/private key pair for key exchange and digital signatures.

Shared Responsibility Model

A cloud division of duties: the provider secures the physical and virtualization layers, while the customer secures data, identities, and configuration within its scope.

Multifactor Authentication

Authentication requiring two or more distinct factor types, such as knowledge plus possession, so a single compromised credential does not grant access.

OAuth 2.0

An authorization framework that lets a user delegate limited access to a resource without sharing credentials, issuing access tokens scoped to specific permissions.

Tokenization

Replacing sensitive data with a non-sensitive surrogate token mapped in a secure vault; unlike encryption, the token cannot be reversed mathematically.

Least Privilege

Granting identities only the minimum access needed for their role, for the shortest practical duration, and recertifying that access periodically.

SPF DKIM DMARC

Email authentication trio: SPF authorizes sending servers, DKIM cryptographically signs messages, and DMARC aligns both with the visible From domain and sets enforcement policy.

IDS versus IPS

An intrusion detection system passively monitors and alerts on suspicious traffic; an intrusion prevention system sits inline and can actively block the traffic.

Endpoint Detection and Response

An agent-based tool that continuously records endpoint process, file, and network behavior, supports threat hunting, and can isolate a compromised host.

Network Segmentation

Dividing a network into zones with controlled inter-zone traffic so compromise of one segment cannot freely reach sensitive systems, limiting lateral movement.

Order of Volatility

Forensic collection priority from most to least volatile: processor state, memory, network connections, running processes, disk storage, then archival backups.

Chain of Custody

A documented, unbroken record of who collected, handled, and stored evidence, when, and for what purpose, supporting admissibility and integrity.

Recovery Time Objective

The maximum acceptable time to restore a service after disruption; it drives backup design, redundancy, and continuity planning decisions.

Containment Strategy

The incident response step that limits spread by isolating hosts, blocking indicators, or segmenting networks, chosen to preserve evidence and business function.

Vendor Due Diligence

Pre-contract assessment of a third party's security posture, scaled by data sensitivity, system access, and business dependency, repeated periodically based on criticality.

Fourth-Party Risk

Risk introduced by a vendor's own subcontractors and suppliers; it requires contractual flow-down obligations and visibility beyond the direct relationship.

Software Bill of Materials

A machine-readable inventory of components and dependencies in a software product, enabling rapid identification of exposure when a library vulnerability is disclosed.

Concentration Risk

Exposure created when critical services depend on a single provider or shared component, so one failure disrupts multiple business functions simultaneously.

SOC 2 Type II

An independent attestation report covering the design and operating effectiveness of controls over a period, commonly used to assess service providers handling sensitive data.

Policy Exception

A documented, time-bound approval to deviate from a security standard, recording the risk, compensating controls, approver, and expiry date.

Phishing Simulation Metrics

Awareness program measures including click rate, credential-submission rate, report rate, and time to first report, which indicate behavior rather than training completion.

Prompt Injection

An attack where crafted input manipulates a large language model into ignoring instructions or leaking data, mitigated by input filtering and human review of outputs.

OT Security Constraints

Operational technology prioritizes availability and has long patch cycles, so segmentation, protocol-aware monitoring, and compensating controls replace routine endpoint patching.

Insider Threat Program

A combination of least privilege, behavior analytics, acceptable-use policy, and proportional monitoring designed to detect and deter misuse by authorized users.