CIPT flashcards
CIPT · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA triad
- A security model consisting of confidentiality, which limits disclosure; integrity, which preserves accuracy and completeness; and availability, which ensures timely and reliable access to data and systems.
- Symmetric encryption
- An encryption method in which the same secret key both encrypts and decrypts data; secure key distribution and storage are its principal operational weaknesses.
- Asymmetric encryption
- A method using a related key pair: a public key to encrypt or verify signatures and a private key to decrypt or sign, enabling secure exchange without sharing a secret.
- Hashing
- A one-way cryptographic function mapping input of any length to a fixed-length digest; it is deterministic and collision-resistant, and the original input cannot be recovered from the output.
- Salting passwords
- Adding a unique random value to each password before hashing so identical passwords produce different digests, defeating precomputed rainbow tables and concealing shared-password patterns.
- Authentication versus authorization
- Authentication establishes and verifies a subject's claimed identity, while authorization determines which resources and actions that authenticated subject is permitted to use.
- Digital certificate
- A digitally signed structure binding a public key to an identity, issuer, and validity period; it is issued and revoked within a public key infrastructure.
- Data protection by design
- The GDPR Article 25 duty to embed data protection into processing design and defaults from the outset, using measures such as pseudonymization, minimization, and transparency.
- Data protection impact assessment
- A GDPR Article 35 process describing processing, assessing necessity and risks to individuals, and identifying mitigations before high-risk processing begins.
- Record of processing activities
- A GDPR Article 30 inventory documenting purposes, categories of data and data subjects, recipients, transfers, retention periods, and security measures for each processing activity.
- Controller versus processor
- A controller determines the purposes and means of processing; a processor handles personal data only on the controller's documented instructions under an Article 28 contract.
- Data Protection Officer
- A role under GDPR Articles 37 to 39 that monitors compliance, advises the organization on obligations, and acts as the contact point for supervisory authorities.
- Article 32 security measures
- A GDPR requirement for technical and organizational measures ensuring confidentiality, integrity, availability, and resilience, including encryption and regular testing of safeguard effectiveness.
- Threat modeling
- A structured analysis of system architecture that identifies assets, entry points, adversaries, and threats, then prioritizes mitigations before code is deployed.
- STRIDE
- A threat classification scheme comprising Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.
- Defense in depth
- Layering independent preventive, detective, and corrective controls across people, process, and technology so that one failed control does not expose the whole system.
- Least privilege
- Granting each user, process, and service only the access rights required for its specific function, limiting the damage from compromise, error, or misuse.
- Pseudonymization
- A GDPR Article 4(5) technique replacing identifiers with pseudonyms so data cannot be attributed without additional separately held information; the data remains personal data.
- Tokenization
- Replacing a sensitive value such as a card number with a random token whose mapping is held in a hardened vault, rendering a leaked token unusable.
- Data minimization
- A principle requiring that personal data collected and retained be adequate, relevant, and limited to what is necessary for the stated purpose.
- Purpose limitation
- A principle requiring personal data to be collected for specified, explicit, legitimate purposes and not reused incompatibly without a lawful basis.
- Privacy-enhancing technologies
- Technical measures such as encryption, differential privacy, secure multiparty computation, homomorphic encryption, and synthetic data that reduce exposure while still enabling processing.
- Differential privacy
- A technique that adds calibrated statistical noise to query results so an individual's presence cannot be inferred; epsilon quantifies the privacy loss.
- Data loss prevention
- Tools that classify sensitive data and enforce policies to block, encrypt, or log its transmission, copying, or access across endpoints, email, and networks.
- Consent management platform
- A system capturing, recording, and enforcing consent preferences by purpose, including timestamps and withdrawal, and signaling those states to downstream systems.
- Privacy requirements engineering
- Eliciting legal and policy obligations as verifiable technical requirements and test cases early in the software development lifecycle, then tracing them to implemented controls.
- Schrems II
- A 2020 CJEU ruling invalidating the EU-US Privacy Shield and requiring transfer impact assessments plus supplementary measures alongside standard contractual clauses.
- Cloud shared responsibility
- A division of security duties in which the provider secures the underlying infrastructure while the customer secures data, identities, configuration, and access.
- Shadow IT
- Unsanctioned systems and services adopted by employees without IT approval, producing unmanaged data flows, unreported processing, and an unpatched attack surface.
- IoT privacy risk
- Connected devices often ship with weak default credentials, infrequent firmware updates, and continuous sensor collection, making data flows and patching difficult to govern.
- Key management lifecycle
- Governance of cryptographic keys from generation and distribution through storage, rotation, revocation, and destruction, including separation of duties from data custodians.
- Legacy system risk
- Older systems may lack encryption, logging, granular access control, or vendor patch support, extending compliance exposure and limiting available privacy remediation.