CISAW Secure Software flashcards
CISAW Secure Software · Build recall with a focused review session.
30 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA Triad
- A model that describes the three core goals of information security: confidentiality (keeping data secret), integrity (keeping data accurate and unaltered), and availability (ensuring data and systems are accessible when needed).
- Confidentiality
- The property that information is not disclosed to unauthorized individuals, processes, or devices. It is achieved through encryption, access controls, and proper handling procedures.
- Integrity
- The property that data has not been altered or destroyed in an unauthorized manner. It ensures data is accurate, complete, and trustworthy throughout its lifecycle.
- Availability
- The property that systems and data are accessible and usable by authorized users when required. It is supported by redundancy, backups, and resilience measures.
- Defense in Depth
- A security strategy that uses multiple layers of controls (physical, technical, and administrative) so that if one layer fails, others still protect the asset.
- IT governance
- The leadership, structures, and processes that ensure IT supports enterprise strategy, objectives, and risk appetite while using resources responsibly.
- Enterprise risk management
- An organization-wide approach to identifying, assessing, responding to, and monitoring risks that could affect strategic objectives. It aligns risk management with strategy and governance.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of its objectives, often expressed as qualitative statements or quantitative limits.
- Risk tolerance
- The acceptable variation in outcomes around a risk appetite, often expressed as thresholds or limits for specific risk categories.
- Three lines model
- A governance model separating management (first line), risk and compliance oversight (second line), and independent internal audit (third line).
- Control environment
- The tone and structure set by leadership that influences risk awareness, integrity, ethical values, and the effectiveness of internal controls.
- Segregation of duties
- Dividing tasks and approvals so no single person can initiate, authorize, record, and review a transaction without detection.
- Least Privilege
- The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.
- Separation of Duties
- A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.
- Role-Based Access Control (RBAC)
- An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.
- Multi-Factor Authentication (MFA)
- An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.
- Authentication
- The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.
- Authorization
- The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.
- Single Sign-On (SSO)
- A mechanism that allows a user to log in once and access multiple applications or systems without re-entering credentials, improving usability and centralizing access control.
- Encryption
- The process of converting plaintext into ciphertext using an algorithm and a key, so that only authorized parties can read the original information.
- Symmetric Encryption
- An encryption method that uses the same secret key for both encryption and decryption, offering speed but requiring secure key distribution.
- Asymmetric Encryption
- Encryption using a suitable public-key scheme and a corresponding private key for decryption. Authenticated key distribution and the specified padding/protocol remain essential; signatures and key agreement are distinct constructions.
- Hash Function
- A digest construction mapping input to an output under its defined algorithm, with cryptographic versions designed for appropriate resistance properties. Password storage needs a suitable salted password-hashing/KDF scheme rather than a bare fast digest.
- Digital Signature
- An electronic signature that uses asymmetric cryptography to verify the authenticity and integrity of a message or document.
- Access control
- The policies and mechanisms that determine who can access which systems, data, or facilities and under what conditions.
- SQL Injection
- A code injection technique that exploits vulnerabilities in an application's database layer by inserting malicious SQL statements through user input, potentially exposing or altering data.
- Cross-Site Scripting (XSS)
- A vulnerability where an attacker injects malicious scripts into web pages viewed by other users, potentially stealing cookies or session tokens.
- Input Validation
- Checking supplied data against expected type, size, format and range. It supports robust handling but does not replace parameterization, context-aware output handling or authorization controls.
- Software composition analysis
- Analysis of software components and dependency information to identify relevant known issues and licensing or provenance questions, complementing code review and dynamic security testing.
- Security requirement
- An explicit protection outcome or constraint linked to the system’s assets, users, threats and obligations, with criteria that can be designed, implemented and verified.