NISP L1 PT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

A model describing three core security goals: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized alteration, and availability ensures timely and reliable access to data and systems.

Risk Formula

Risk is commonly expressed as threat multiplied by vulnerability multiplied by impact. Reducing any factor lowers risk; controls address vulnerability, impact, or both.

Defense in Depth

A layered control strategy in which people, process, and technology safeguards overlap, so failure of a single control does not result in compromise of the asset.

Social Engineering

Manipulating people into disclosing information or performing actions, typically by exploiting authority, urgency, fear, or a desire to help. Verification through a known channel counters it.

TCP Three-Way Handshake

Connection setup using SYN, then SYN-ACK, then ACK. It establishes sequence numbers and confirms both endpoints are reachable before data transfer begins.

Stateful Firewall

A firewall that tracks connection state in a session table, allowing return traffic for established sessions and blocking unsolicited inbound packets that do not match a session.

IDS versus IPS

An intrusion detection system monitors and alerts on suspicious traffic without blocking it. An intrusion prevention system sits inline and can drop or reset malicious traffic.

VLAN Segmentation

Dividing a physical network into isolated Layer 2 broadcast domains. Traffic between VLANs must traverse a router or firewall, where policy can be enforced.

Endpoint Detection and Response

Endpoint software that continuously records process, file, and network telemetry, detects suspicious behavior, and enables response actions such as host isolation and artifact quarantine.

Application Allowlisting

A control permitting execution only of explicitly approved applications. It blocks unknown malware regardless of signatures but requires maintenance of the approved list.

Full-Disk Encryption

Encrypting an entire storage device so data is unreadable without the key. It protects against loss or theft of the device, not against misuse while the host is unlocked.

Windows Event 4625

A Windows security log event recording a failed logon attempt. Repeated 4625 events for one account suggest password guessing, spraying, or a misconfigured service.

SQL Injection

An attack where untrusted input is interpreted as SQL code. Parameterized queries with bound parameters prevent it by separating code from data.

Cross-Site Scripting

Injecting script into pages viewed by other users. Prevention relies on context-aware output encoding and input validation, plus a restrictive content security policy.

Broken Access Control

A weakness where users can act beyond their intended permissions, such as changing an object identifier in a request. Enforcement must occur server-side on every request.

Three-Two-One Backup Rule

Keep three copies of data, on two different media types, with one copy offsite. Recoverability is proven only by performing and documenting restore tests.

Multi-Factor Authentication

Authentication using two or more different factor types, such as a password plus a hardware token. Two passwords from the same factor category do not qualify.

Role-Based Access Control

An access model assigning permissions to roles rather than individuals; users receive entitlements by role assignment. It simplifies recertification and reduces privilege creep.

Password Hashing

Storing passwords as salted, deliberately slow hashes such as bcrypt, scrypt, Argon2, or PBKDF2. Fast hashes like MD5 allow rapid offline cracking and are unsuitable.

Privileged Access Management

Controls for administrative accounts including credential vaulting, just-in-time elevation, session recording, and separate identities, preserving accountability and limiting standing privilege.

Symmetric Encryption

Encryption using one shared secret key for both encryption and decryption, as with AES. It is fast and suited to bulk data but requires secure key distribution.

Digital Signature

A value created by hashing a message and encrypting the hash with the sender's private key. Verification with the public key proves integrity and origin.

Certificate Authority Chain

A trust hierarchy where a root CA signs an intermediate CA, which signs end-entity certificates. Validators check the chain, validity dates, and revocation status.

OCSP

Online Certificate Status Protocol, a real-time query to a responder for a certificate's revocation status. It is an alternative to downloading periodic certificate revocation lists.

Incident Response Phases

Preparation, identification, containment, eradication, recovery, and lessons learned. Containment is performed before eradication to prevent further spread of the incident.

Recovery Time Objective

The maximum acceptable elapsed time to restore a service after disruption. It drives recovery architecture and is distinct from recovery point objective, which measures tolerable data loss.

Vulnerability Management Cycle

Inventory assets, scan for weaknesses, prioritize by severity and exploitability, remediate, then verify. A CVSS score alone does not determine remediation priority.

SIEM

Security information and event management software that centralizes, normalizes, and correlates logs from many sources to generate alerts and support investigation.

Chain of Custody

Documentation recording who collected, handled, and stored evidence, and when. It preserves admissibility and integrity during incident investigation and potential legal proceedings.

Ransomware

Malware that encrypts or exfiltrates data and demands payment for restoration. Response relies on isolated, tested backups and containment rather than paying the demand.

ISO/IEC 27001

An international standard specifying requirements for establishing, operating, and continually improving an information security management system, which can be independently certified.

PCI DSS Scope

The systems, people, and processes that store, process, or transmit cardholder data, plus connected systems. Reducing scope through segmentation lowers compliance effort.