CSIS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to information and systems.

Due care versus due diligence

Due care is the prudence expected of a reasonable professional; due diligence is the ongoing investigation and verification that such care is actually applied.

Security policy hierarchy

Policies state mandatory management intent; standards specify required controls; procedures give step-by-step instructions; guidelines are recommended practices and are not mandatory.

Separation of duties

Splitting critical tasks among different people so no single individual can complete a sensitive transaction or control it end to end, reducing fraud and error risk.

AAA framework

Authentication verifies identity, authorization determines permitted actions, and accounting records activity for audit and accountability, forming the core access control framework.

RBAC versus ABAC

Role-based access control grants permissions by job role; attribute-based access control evaluates user, resource, action, and environment attributes for finer-grained, context-aware decisions.

Kerberos ticket types

Kerberos uses a Ticket Granting Ticket from the authentication service to request service tickets from the ticket-granting service, enabling single sign-on without resending passwords.

Biometric error rates

False acceptance rate measures unauthorized users accepted; false rejection rate measures legitimate users rejected; crossover error rate is where both rates are equal, indicating accuracy.

Symmetric versus asymmetric

Symmetric encryption uses one shared secret key for encryption and decryption and is fast; asymmetric encryption uses a public/private key pair and supports key exchange and signatures.

Digital signature properties

A digital signature uses the signer's private key over a message hash and provides integrity, authentication, and non-repudiation, but not confidentiality by itself.

Perfect forward secrecy

A key agreement property where compromise of long-term keys does not compromise previously established session keys, typically achieved with ephemeral Diffie-Hellman key exchange.

Key escrow risk

Key escrow stores cryptographic keys with a trusted third party for recovery; it introduces a high-value single point of compromise and must be tightly controlled and audited.

Stateful versus stateless firewall

A stateful firewall tracks connection state and permits return traffic for established sessions; a stateless firewall filters each packet independently using static rules.

IDS versus IPS

An intrusion detection system monitors and alerts on suspicious traffic passively; an intrusion prevention system sits inline and can block or drop malicious traffic in real time.

DMZ purpose

A demilitarized zone is a segmented network between the internet and internal networks that hosts public-facing services, limiting exposure if those services are compromised.

802.1X port security

IEEE 802.1X authenticates devices or users before granting network port access, using a supplicant, an authenticator, and an authentication server such as RADIUS.

Defense in depth

Layered controls across people, process, and technology ensure that failure of one control does not expose the whole system, including preventive, detective, and corrective layers.

Fail-safe default

A secure design principle stating that access decisions should deny by default and systems should fail into a safe, closed state when errors occur.

STRIDE threat model

STRIDE classifies threats as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, guiding threat identification during design.

Risk formula

Risk is commonly expressed as likelihood multiplied by impact; quantitative risk uses monetary values, while qualitative risk uses ranked scales such as high, medium, and low.

ALE calculation

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence; single loss expectancy equals asset value multiplied by exposure factor.

Risk treatment options

Risk can be avoided by stopping the activity, mitigated by reducing likelihood or impact, transferred through insurance or contracts, or accepted with documented management approval.

RTO versus RPO

Recovery time objective is the maximum acceptable downtime after disruption; recovery point objective is the maximum acceptable data loss measured in time before the incident.

GDPR data subject rights

The GDPR grants rights including access, rectification, erasure, restriction, portability, and objection, with breach notification generally required within 72 hours of awareness.

PCI DSS scope

PCI DSS applies to organizations that store, process, or transmit cardholder data and defines requirements for protecting account data, including encryption, access control, and monitoring.

Chain of custody

A documented chronological record of evidence handling that shows who collected, accessed, transferred, and stored evidence, preserving admissibility and integrity for legal proceedings.

Incident response phases

NIST incident response phases are preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, often summarized as the incident response lifecycle.

Order of volatility

Digital forensics collects evidence from most volatile to least volatile: CPU registers and cache, memory, network state, running processes, disk, then archival media.

SIEM function

A security information and event management system centralizes log collection, correlates events across sources, generates alerts, and supports investigation and compliance reporting.

SQL injection defense

Use parameterized queries or prepared statements and least-privilege database accounts; input validation and escaping are supplementary, not primary, defenses against SQL injection.

SAST versus DAST

Static application security testing analyzes source or bytecode without running the application; dynamic testing probes a running application from the outside, finding runtime and configuration issues.

Data masking purpose

Data masking replaces sensitive values with realistic substitutes so non-production environments and less-privileged users can work without exposing actual personal or confidential data.