CCST Cybersecurity flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality keeps data from unauthorized readers, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed.

Least privilege

Granting each user, service, or process only the permissions its assigned task requires, and only for as long as required, so misuse causes limited damage.

Defense in depth

Layering multiple independent controls across network, host, application, and data so that failure or bypass of any single control does not expose the asset.

Symmetric encryption

Uses one shared secret key for both encryption and decryption, such as AES. It is fast but requires a secure channel to distribute the key.

Asymmetric encryption

Uses a public key to encrypt or verify and a mathematically related private key to decrypt or sign. It is slower than symmetric but solves key distribution.

Hashing for integrity

A one-way function like SHA-256 converts data into a fixed-length digest; any change to the input yields a different digest, revealing tampering without hiding the data.

Non-repudiation via digital signature

The sender signs with their private key and anyone verifies with the public key, proving origin and integrity so the sender cannot later deny the action.

TCP three-way handshake

Connection setup using SYN, then SYN-ACK, then ACK before data flows. TCP is connection-oriented and provides reliable, ordered delivery with retransmission.

Stateful vs stateless firewall

A stateful firewall tracks active connections and automatically allows return traffic. A stateless ACL evaluates every packet independently against fixed rules.

IDS versus IPS

An intrusion detection system monitors traffic passively and raises alerts. An intrusion prevention system sits inline and drops or blocks the malicious traffic it detects.

VLAN purpose

Logically divides switch ports into separate Layer 2 broadcast domains, so traffic between VLANs must be routed by a router or Layer 3 switch.

NAT

Network Address Translation rewrites private RFC 1918 addresses such as 10.0.0.0/8 and 192.168.0.0/16 to a public address, conserving public IPv4 space and hiding internals.

TLS

Encrypts application traffic in transit and authenticates the server with a certificate, providing confidentiality and integrity on ports such as 443.

DMZ

A separate subnet hosting internet-facing servers, firewalled away from the internal LAN so a compromised public host cannot directly reach internal systems.

EDR

Endpoint Detection and Response continuously records process, file, and network activity on hosts, applies behavioral analytics to detect attacks, and can isolate a device.

Signature-based detection

Matches files or traffic against known malware patterns. It is effective against known threats but blind to new or polymorphic variants that alter their code.

Application allowlisting

Only explicitly approved executables are permitted to run. Because unknown malware is not on the approved list, it is blocked, making this stronger than blocklisting.

Full-disk encryption

Encrypts the entire drive, as with BitLocker or FileVault, so data at rest is unreadable without the key if a laptop is lost or stolen.

Patch management

Tracking, testing, and deploying vendor updates for operating systems and third-party applications, closing the flaws attackers most commonly exploit for initial access.

Mobile device management

Enforces configuration baselines, encryption, screen locks, and remote wipe on managed phones, tablets, and laptops, extending endpoint control to mobile devices.

Risk formula

Risk equals the likelihood that a threat exploits a vulnerability multiplied by the resulting impact. Lowering either factor lowers the overall risk.

Threat, vulnerability, risk

A threat is a potential cause of harm, a vulnerability is a weakness that can be exploited, and risk is the probability and impact of that exploitation.

SLE and ALE

Single Loss Expectancy equals asset value times exposure factor. Annualized Loss Expectancy equals SLE times the annualized rate of occurrence.

CVSS base score

A 0.0 to 10.0 severity rating for a vulnerability: 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, and 9.0-10.0 critical.

Assessment versus penetration test

A vulnerability assessment enumerates and rates weaknesses without exploiting them. A penetration test actively exploits weaknesses to demonstrate real business impact.

Risk treatment options

Mitigate by adding controls, transfer through insurance or contract, avoid by stopping the activity, or accept and document the residual risk.

NIST incident response phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Findings from each cycle feed back into preparation.

Order of volatility

Collect the most perishable evidence first: CPU registers and cache, RAM, swap or pagefile, network connections, then disk, logs, and archival backups.

Chain of custody

A documented record of who collected, handled, and transferred each item of evidence, and when, so the evidence remains unaltered and admissible.

Containment

Short-term action that stops an incident from spreading, such as isolating a host, disabling an account, or blocking an IP, taken before eradication begins.

Lessons learned

The post-incident review that documents root cause, how effective the response was, and the specific changes needed to prevent recurrence.

Indicator of compromise

Observable evidence of a breach, such as unusual outbound traffic, new privileged accounts, unexpected file encryption, or logins at anomalous times or locations.