CSA (Other exams) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Defense in depth

Layering independent preventive, detective, and corrective controls so that failure of any single control does not result in compromise. Layers must use different mechanisms to count separately.

Separation of duties

A control ensuring no single identity can both initiate and approve a high-impact action, preventing fraud and undetected error by requiring two people to complete the transaction.

Trust boundary

Any point where data or control passes between components with different privilege levels, ownership, or exposure. Threat modeling focuses on these crossings because that is where trust assumptions are tested.

Policy versus standard

Policy states management intent and is mandatory; a standard specifies the concrete mandatory requirements that implement the policy. Guidelines are recommendations and are not auditable obligations.

Annualized loss expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. It converts risk into a yearly monetary figure so controls can be justified against their cost.

Residual risk

The risk remaining after controls are applied. It is compared against the organization's stated risk tolerance; exceeding tolerance requires escalation to an accountable owner.

Risk treatment options

Exactly four: mitigate (reduce), transfer (insurance, contract), avoid (stop the activity), and accept (documented with owner and review date). Ignoring risk is not a treatment.

NIST Cybersecurity Framework

A voluntary framework of outcomes organized as Identify, Protect, Detect, Respond, Recover, with Govern added in CSF 2.0. It describes what to achieve, not specific products or controls.

SOC 2 Trust Services Criteria

An attestation report, issued by an independent auditor, covering controls over security, availability, processing integrity, confidentiality, and privacy for a service organization over a defined period.

Phishing-resistant MFA

Authentication bound to the legitimate origin, such as FIDO2/WebAuthn security keys or passkeys. It defeats real-time relay phishing, unlike SMS or push OTP which can be proxied or fatigue-attacked.

OAuth 2.0 versus OIDC

OAuth 2.0 delegates authorization via access tokens and is not an authentication protocol. OpenID Connect adds an identity layer with a signed ID token, making it suitable for federated login.

PKCE

Proof Key for Code Exchange. The client sends a hashed verifier with the authorization request and the original with the token request, preventing authorization code interception in public clients.

Attribute-based access control

Authorization decisions computed from attributes of the subject, resource, action, and environment, evaluated against policy. It scales better than roles when access depends on context such as time or data classification.

Privileged access management

Vaulting, brokering, and recording privileged sessions, with approval workflows and automatic credential rotation, to limit standing administrative access and create an audit trail of elevation.

Microsegmentation

Enforcing per-workload network policy, often identity-based, so that workloads communicate only along explicitly permitted flows. It limits east-west lateral movement after an initial compromise.

Zero Trust architecture

A model that removes implicit trust from network location and verifies every request using identity, device posture, and context, with policy enforcement points placed close to the protected resource.

TLS inspection trade-off

Break-and-inspect proxies re-sign traffic with an internal CA, enabling content inspection but breaking certificate pinning and creating privacy and legal exposure for protected traffic.

DNS filtering

Blocking or sinkholing malicious domains at the resolver, stopping command-and-control and phishing before a connection occurs. Encrypted DNS can bypass it if clients are not managed.

Cloud shared responsibility

The provider secures the cloud itself (facilities, hypervisor, managed service internals); the customer secures what runs in it (identity, configuration, data, network policy). The split shifts across IaaS, PaaS, and SaaS.

Cloud control plane logging

Audit logs of management actions such as role changes, policy edits, and key deletion. They are separate from data-plane logs and must be explicitly enabled and protected from tampering.

Container isolation limits

Containers share the host kernel, so a kernel exploit can cross container boundaries. Mitigations include user namespaces, seccomp, AppArmor, read-only filesystems, and avoiding privileged containers.

Infrastructure as code scanning

Static analysis of templates for misconfigurations such as public storage, open security groups, and unencrypted volumes, applied before deployment rather than discovered in production.

Envelope encryption

Wrapping data keys with a root key held in a KMS or HSM, so bulk data is encrypted locally while the root key never leaves the boundary in plaintext. Rotation can rewrap keys without re-encrypting data.

Authenticated encryption

A mode such as AES-GCM that provides both confidentiality and integrity, detecting tampering. Unauthenticated modes like CBC without a MAC allow ciphertext manipulation and padding-oracle attacks.

Password hashing

Using a salted, memory-hard key derivation function such as Argon2id, scrypt, or bcrypt to store passwords. Fast hashes like SHA-256 allow rapid offline cracking after a breach.

Tokenization

Replacing sensitive data with a surrogate token mapped in a secure vault. The token has no mathematical relationship to the original, which can reduce compliance scope unlike encryption.

STRIDE

A threat modeling mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Applied per element and trust boundary in a data-flow diagram.

Broken access control

Failure to enforce authorization server-side on every request, enabling access to other users' objects or higher-privilege functions. It is consistently the highest-ranked application risk category.

Parameterized queries

Prepared statements that separate SQL code from data, so user input cannot alter query structure. They are the primary defense against SQL injection, unlike escaping or blocklists.

Software bill of materials

A machine-readable inventory of components and dependencies in a build. It enables rapid identification of exposure when a new vulnerability is disclosed in a library you ship.

Incident response phases

Per NIST SP 800-61: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Containment precedes eradication, and evidence preservation precedes both.

Order of volatility

Evidence collection priority: registers and cache, then memory, network state, disk, and archival media. Volatile data is lost on shutdown, so memory is captured before powering off.