NISP Level 2 flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Core security objectives: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely access. Controls should be mapped to at least one of these properties.

Residual Risk

The risk remaining after controls are applied. It must be documented and formally accepted by an accountable business owner, because no control set eliminates risk entirely.

Annualized Loss Expectancy

ALE = Single Loss Expectancy × Annualized Rate of Occurrence. SLE equals asset value multiplied by exposure factor. Used in quantitative risk analysis to justify control spending.

Separation of Duties

A control that divides a sensitive task among multiple people so no single individual can complete a fraudulent or destructive action alone. Job rotation and mandatory vacation strengthen it.

Recovery Time Objective

The maximum acceptable downtime before a business function must be restored. It drives recovery architecture decisions and differs from RPO, which defines maximum tolerable data loss.

SYN Flood Attack

A Layer 4 denial-of-service attack that sends many SYN packets without completing the handshake, exhausting the server connection table. SYN cookies and rate limiting mitigate it.

IPsec ESP

Encapsulating Security Payload provides confidentiality plus integrity and authentication of packet contents. Unlike AH, it encrypts the payload, so it is used for VPN traffic.

VLAN Hopping

An attack that crosses VLAN boundaries by abusing trunk negotiation or double-tagged 802.1Q frames. Mitigation includes disabling DTP and unused ports and changing the native VLAN.

802.1X

Port-based network access control that authenticates devices before granting LAN access, using three roles: supplicant on the device, authenticator on the switch, and authentication server.

DNSSEC

A set of extensions that cryptographically signs DNS records to provide origin authentication and integrity, preventing cache poisoning. It does not encrypt queries or provide confidentiality.

SUID Binary

A Linux executable that runs with the file owner's privileges rather than the caller's. Misconfigured SUID programs are a common local privilege escalation path.

SELinux

A mandatory access control framework that confines processes using security labels and policy, limiting damage from a compromised service beyond what discretionary permissions allow.

Secure Boot

A UEFI feature that verifies signatures of bootloaders and kernel components before execution, detecting tampering with the boot chain and supporting full-disk-encryption trust.

Endpoint Detection and Response

Host-based tooling that continuously monitors process behavior, file changes, and network connections, enabling detection of fileless and living-off-the-land attacks that signature antivirus misses.

Patch Management Cycle

The sequence of inventorying assets, risk-ranking updates, testing, deploying, and verifying patches. Virtual patching at the network layer offsets zero-day exposure.

SQL Injection Defense

Prepared statements with bound parameters are the primary defense, supported by least-privilege database accounts. Input blacklists and escaping alone are insufficient across all query contexts.

Cross-Site Scripting

Injection of script into pages viewed by other users, in reflected, stored, or DOM-based forms. Context-matched output encoding and Content Security Policy mitigate it.

CSRF Token

An unpredictable per-session value required with state-changing requests, proving the request originated from the legitimate application. SameSite cookies provide additional protection.

Threat Modeling

A design-phase activity that enumerates threats against components and data flows. STRIDE and attack trees are common methods; it is cheaper than fixing flaws after release.

Authenticated Encryption

A cipher mode such as GCM that provides confidentiality and integrity together, detecting tampering. ECB mode leaks plaintext patterns and should not be used.

Password Hashing

Storing passwords with salted, deliberately slow key derivation functions such as bcrypt, scrypt, or Argon2. Plain hashes and reversible encryption are unacceptable for credentials.

Digital Signature

A hash of a message encrypted with the sender's private key. Verification with the public key gives authentication, integrity, and non-repudiation, but not confidentiality.

Multi-Factor Authentication

Authentication using factors from at least two different categories: knowledge, possession, and inherence. Two passwords from the same category do not qualify as MFA.

Certificate Revocation

Invalidating a certificate before expiry via CRL or OCSP. Validators must check revocation status along with signature chain, validity dates, and name matching.

Order of Volatility

The sequence for evidence collection from most to least volatile: registers and cache, memory, network state, processes, disk, backups. Capture volatile data before shutdown.

Chain of Custody

A documented record of who handled evidence, when, and for what purpose. Gaps can render evidence inadmissible in legal or disciplinary proceedings.

Incident Containment

The response phase that stops the spread of an incident. The chosen strategy balances business continuity against evidence preservation, and precedes eradication and recovery.

Mean Time to Detect

The average interval between an incident occurring and being identified. Reducing it depends on log visibility, sensor coverage, and tuned detection content.

CVSS Base Score

A severity metric combining exploitability factors (attack vector, complexity, privileges, user interaction) with impact on confidentiality, integrity, and availability. Environmental metrics adjust it locally.

Penetration Test

An authorized, scoped attempt to exploit vulnerabilities and demonstrate business impact. Rules of engagement and written authorization are mandatory; testing without them is unlawful.

MLPS 2.0

China's Multi-Level Protection Scheme classifies networks into five protection levels based on harm to national, social, and individual interests. Level 3 and above require periodic assessment.

ISO/IEC 27001

An international standard specifying requirements for an information security management system, including risk-based controls in Annex A. It is certifiable, unlike the guidance standard 27002.

Zero Trust

A security model that never grants implicit trust based on network location. It verifies every request explicitly using identity, device posture, and policy, assuming breach.

Shared Responsibility Model

A cloud division of duties: the provider secures infrastructure of the cloud, while the customer secures data, identities, configuration, and access in the cloud.

Prompt Injection

An attack in which crafted input manipulates a large language model to ignore instructions or misuse connected tools. Least-privilege tool access and output filtering reduce impact.