NISP Level 1 - Security Operations flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality, integrity, and availability: the three core security objectives. Confidentiality limits disclosure to authorized parties, integrity preserves accuracy, and availability ensures timely access.

Bell-LaPadula model

A mandatory access control model focused on confidentiality. It enforces no read up and no write down, preventing subjects from accessing higher-classification data or leaking it to lower levels.

Biba integrity model

A mandatory access control model focused on integrity. It enforces no read down and no write up, preventing subjects from reading less trustworthy data or modifying more trustworthy data.

Reference monitor

An abstract enforcement component that mediates every access request. It must be tamper-proof, always invoked, and small enough to be verified, forming the basis of a trusted computing base.

GDPR breach notification

Controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in risk to data subjects.

MLPS 2.0

China's Multi-Level Protection Scheme assigns information systems protection levels one through five. Level three and above require periodic assessment, and operators must implement controls matching the assigned level.

ISO/IEC 27001

An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system. Certification is granted to organizations, not products.

PCI DSS

A payment card industry standard with twelve requirement families covering network security, encryption, access control, monitoring, and testing. Applicability and self-assessment type depend on how card data is handled.

Multi-factor authentication

Authentication using two or more distinct factor types: something you know, something you have, and something you are. Two passwords or two hardware tokens do not constitute MFA.

OAuth 2.0

An authorization framework for delegated access to resources. It issues access tokens to clients but does not authenticate users by itself; OpenID Connect adds an identity layer on top.

Kerberos ticket

A time-limited credential issued by a key distribution center. The ticket-granting ticket obtains service tickets, and clock skew beyond the configured tolerance causes authentication failure.

Role-based access control

An access control model that assigns permissions to roles and roles to users. It simplifies administration but can suffer role explosion as organizations grow and roles multiply.

Stateful firewall

A firewall that tracks the state of network connections and permits return traffic for established sessions. It is more precise than stateless packet filtering but does not inspect application content.

IPsec ESP

Encapsulating Security Payload provides confidentiality through encryption plus integrity and authentication. It differs from AH, which provides integrity and authentication without confidentiality.

DMZ

A segmented network zone hosting externally reachable services. Strict inter-zone rules separate it from internal networks, limiting lateral movement if an internet-facing host is compromised.

Web application firewall

A layer-seven control that inspects HTTP and HTTPS traffic against application attacks such as injection and cross-site scripting. It complements, but does not replace, secure coding.

Endpoint detection and response

A security tool that continuously collects endpoint telemetry, applies behavioral detection, and supports response actions such as isolating a host or killing a process.

CIS Benchmark

A consensus hardening configuration guide for operating systems and applications. Organizations tailor it to their environment and measure configuration drift against the approved baseline.

Patch management lifecycle

The process of inventorying assets, classifying vulnerabilities by severity, testing patches, deploying them, verifying installation, and documenting exceptions with compensating controls and expiration dates.

SQL injection

An attack that inserts malicious SQL through unvalidated input. Parameterized queries and least-privilege database accounts are the primary defenses; escaping input alone is insufficient.

Data classification

Assigning data to categories such as public, internal, confidential, or restricted. Classification drives handling rules, encryption requirements, access decisions, and retention periods.

Threat modeling

A structured analysis of a system performed during design to identify threats, attack paths, and required controls. STRIDE and attack trees are common methods.

Authenticated encryption

A mode such as AES-GCM that provides both confidentiality and integrity in one operation. It detects tampering and requires a unique nonce for each encryption under the same key.

Digital signature

A cryptographic value produced with a private key over a message hash. Verification with the corresponding public key provides integrity, authenticity, and non-repudiation.

Perfect forward secrecy

A property achieved through ephemeral key exchange, such as ECDHE, so that compromise of a long-term private key does not expose previously recorded session traffic.

Incident response lifecycle

The phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment decisions balance business impact against evidence preservation.

Chain of custody

Documentation tracking evidence from collection through storage and transfer. It records who handled the item, when, and why, supporting admissibility and integrity in investigations.

CVSS

A scoring system for vulnerability severity. Base scores reflect intrinsic characteristics, while temporal and environmental scores adjust for exploit maturity and local context.

Known Exploited Vulnerabilities

A catalog maintained by CISA listing vulnerabilities confirmed to be exploited in the wild. Entries warrant priority remediation ahead of higher-scoring but unexploited issues.

Annualized loss expectancy

A quantitative risk value calculated as single loss expectancy multiplied by annualized rate of occurrence. It estimates expected yearly loss and supports cost-benefit decisions on controls.

Recovery time objective

The maximum acceptable time to restore a process or system after disruption. It is derived from business impact analysis and drives recovery architecture and testing requirements.

3-2-1 backup rule

Maintain three copies of data on two different media types with one copy offsite. Adding an immutable or offline copy improves resilience against ransomware encryption.