CISSP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Annualized loss expectancy

Annualized loss expectancy, calculated as single loss expectancy multiplied by annualized rate of occurrence, expresses the expected yearly monetary loss from a given risk.

RTO and RPO

Recovery time objective is the maximum tolerable downtime before a process must be restored; recovery point objective is the maximum tolerable data loss measured in time.

Due diligence

Ongoing verification and assessment activities, such as audits and independent reviews, that demonstrate an organization is exercising due care in protecting its assets.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, stated by executive management and bounded by risk tolerance.

Data custodian

Role that implements and maintains the technical controls protecting data, such as backups, encryption, and access administration, as directed by the accountable data owner.

Cryptographic erasure

Sanitization method that destroys or overwrites the encryption key so remaining ciphertext becomes unrecoverable, allowing media reuse without a full overwrite.

Data remanence

Residual data left on storage media after nominal deletion, which must be countered by clearing, purging, degaussing, or physical destruction before reuse.

Data steward

Role focused on data quality, business definitions, and metadata management rather than on approving access or implementing technical protection controls.

Bell-LaPadula model

Confidentiality model whose rules are no read up (simple security property) and no write down (star property), preventing higher-classified data from leaking downward.

Clark-Wilson model

Integrity model in which users may act on data only through approved well-formed transactions, enforced with separation of duties and complete audit logging.

Reference monitor

Abstract mechanism that mediates every access by subjects to objects and must be tamper-proof, always invoked, and small enough to be fully verified.

Covert timing channel

Covert channel that leaks information by modulating the timing or delay of shared resource usage rather than by altering the content of a message.

IPsec Authentication Header

Authentication Header mode of IPsec that provides data integrity, origin authentication, and anti-replay protection but does not encrypt the packet payload.

WPA3 SAE

Simultaneous Authentication of Equals handshake used by WPA3 that provides forward secrecy and resists offline dictionary attacks against the network passphrase.

Stateful firewall

Firewall that records the state of active connections and permits return traffic belonging to an already established and explicitly allowed session.

DNSSEC

Extension to DNS that uses digital signatures to provide origin authentication and integrity of DNS records; it does not encrypt queries or responses.

Crossover error rate

Point on a biometric system's error curve where the false acceptance rate equals the false rejection rate; a lower value indicates greater accuracy.

Kerberos TGT

Ticket-granting ticket issued by the key distribution center after initial authentication, used to request service tickets without resending the user's credentials.

Attribute-based access control

Authorization model that grants or denies access by evaluating attributes of the subject, object, action, and environment against defined policy rules.

OAuth 2.0

Delegated authorization framework that issues access tokens so a client can reach resources without the user's password; it is not an authentication protocol.

CVSS

Open framework that scores vulnerability severity from 0 to 10 using base, temporal, and environmental metric groups to help prioritize remediation work.

SOC 2 Type II

Assurance report covering the operating effectiveness of controls against trust services criteria over a defined period, rather than design at a single point in time.

False negative

Result where a test or control fails to detect a vulnerability or event that actually exists, generally considered more dangerous than a false positive.

Dynamic application security testing

Testing approach that probes a running application from the outside, simulating attacker requests without access to source code or internal design details.

Order of volatility

Sequence for collecting evidence from most to least volatile, such as CPU registers and memory before disk, backups, and archival media.

Incremental backup

Backup that copies only data changed since the most recent backup of any type; restoration requires the last full backup plus every subsequent incremental.

Chain of custody

Unbroken documented record of who handled evidence, when, and for what purpose, from collection through storage to presentation in legal proceedings.

Warm site

Alternate processing facility with partial infrastructure and data already in place that requires some installation and configuration before operations resume.

Parameterized query

Prepared statement that binds user input as data rather than executable code, serving as the primary defense against SQL injection attacks.

Polyinstantiation

Database technique storing multiple versions of the same record at different classification levels so lower-level users cannot infer the existence of higher-level data.

Software bill of materials

Inventory listing the components and dependencies contained in a software product, used to track known vulnerabilities and license obligations.

CMMI

Capability maturity model integration with five levels, from initial through managed, defined, quantitatively managed, and optimizing, used to appraise development process capability.