NISP Level 1 - Security Awareness flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core security goals: confidentiality (only authorized access), integrity (data is accurate and unaltered), and availability (systems and data are accessible when needed).

Defense in depth

Layering multiple independent technical, administrative, and physical controls so that the failure or bypass of any single control does not expose the protected asset.

Least privilege

A principle granting each user, process, or service only the minimum access rights and duration needed to perform its function, limiting damage from misuse or compromise.

Risk treatment options

Four documented choices for handling identified risk: mitigate with controls, transfer via insurance or contract, avoid the activity entirely, or formally accept it with owner sign-off.

Credential stuffing

An attack replaying username and password pairs stolen from one breach against other services, succeeding wherever users reused the same credentials across multiple sites.

Multi-factor authentication

Authentication requiring two or more different factor types: something you know, something you have, or something you are. Two passwords do not satisfy this requirement.

Phishing-resistant MFA

Authentication bound to the legitimate site origin, such as FIDO2 hardware keys or passkeys, which resists real-time relay and proxy attacks that defeat SMS codes.

Password manager

A tool that generates and stores a unique high-entropy secret per site, removing the need to memorize passwords and eliminating reuse; protected by one strong master passphrase.

SPF, DKIM, DMARC

Three DNS-based email controls: SPF authorizes sending servers, DKIM cryptographically signs messages, and DMARC tells receivers how to handle failures and report them.

Business email compromise

A fraud in which an attacker impersonates or hijacks an executive or vendor mailbox to trick staff into redirecting payments or disclosing sensitive information.

Out-of-band verification

Confirming a sensitive request through a separate channel already known to be valid, such as a previously stored phone number, never contact details supplied in the message.

Social engineering levers

Psychological triggers attackers exploit: urgency, authority, fear, curiosity, and reward. A message combining urgency with a request to bypass process is high risk.

HTTPS and TLS

TLS encrypts traffic between browser and server, shown by the padlock. It proves the connection is encrypted, not that the site operator or content is trustworthy.

Rogue access point

An unauthorized wireless access point, often mimicking a legitimate hotspot name, that lets an attacker intercept or manipulate traffic from connected devices on public networks.

Mobile app permissions

The access an app requests to device data and sensors. Permissions mismatched to the app's stated function, such as contacts for a flashlight, indicate privacy risk.

BYOD containerization

Separating work applications and data from personal data on an employee-owned device, allowing corporate data to be encrypted, controlled, and remotely wiped without touching personal content.

Ransomware double extortion

An attack that steals data before encrypting it, then threatens both to keep systems locked and to publish the stolen information, so paying does not guarantee confidentiality.

Worm versus trojan

A worm self-propagates across networks without user action, while a trojan disguises itself as legitimate software and relies on the user to install and run it.

Shadow copy deletion

A ransomware step that removes local Windows volume snapshots before encryption, defeating quick local recovery and forcing restoration from separate offline or immutable backups.

Endpoint detection and response

Security software that monitors endpoint behavior, such as mass file renaming or scripting abuse, and can isolate a host, detecting threats that signature-based antivirus misses.

Data classification

Assigning data to tiers such as public, internal, confidential, or restricted, which then determines required handling, storage, sharing, and retention controls.

Data minimization

Collecting and retaining only personal data that is necessary for a defined purpose, reducing privacy exposure and the impact of any breach.

Encryption at rest

Protecting stored data on disks, databases, and backups so that lost or stolen media cannot be read without the decryption key; complements encryption in transit.

Data subject rights

Privacy rights commonly including access, correction, deletion, restriction of processing, and portability, which require an organizational process and response within legal deadlines.

Tailgating

Following an authorized person through a badge-controlled door without presenting credentials; countered by mantraps, turnstiles, and visitor escort rules.

Clean desk policy

A rule requiring sensitive documents and media to be secured away when a workspace is unattended, preventing theft and shoulder surfing of exposed information.

Media sanitization

Destroying data before disposal through shredding, degaussing, or cryptographic erase, because deleting files or formatting does not remove recoverable data from the device.

Incident response phases

The standard sequence: preparation, detection and analysis, containment, eradication, recovery, and lessons learned, with containment prioritized to limit ongoing damage.

Evidence preservation

Avoiding deletion, reformatting, or reimaging of affected systems before the incident team authorizes it, and recording times, actions, and observed indicators.

GDPR breach notification

The EU rule requiring notification to the supervisory authority within 72 hours of learning of a personal data breach where it is likely to result in risk to individuals.

Policy versus procedure

A policy states mandatory rules and intent, while a procedure gives the step-by-step instructions for carrying them out; standards specify required controls and guidelines are recommendations.

RPO and RTO

Recovery Point Objective is the maximum acceptable data loss measured in time; Recovery Time Objective is the maximum acceptable downtime before a process must be restored.

3-2-1 backup rule

Keeping at least three copies of data, on two different media types, with one copy stored offsite or offline so a single event cannot destroy all copies.

Immutable backup

A backup that cannot be altered or deleted during a defined retention period, such as object-lock or tape storage, protecting recovery data from ransomware encryption.