Security+ flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Confidentiality ensures information is not disclosed to unauthorized individuals or systems; encryption and access controls are common technical controls that enforce it.

Integrity

Integrity ensures data is not altered without authorization and remains accurate and complete; hashing, digital signatures, and change controls help detect or prevent unauthorized modification.

Availability

Availability ensures systems and data are accessible to authorized users when needed; redundancy, backups, and denial-of-service protections support it.

Non-repudiation

Non-repudiation provides proof that an action occurred and prevents a party from denying it, commonly implemented with digital signatures that bind identity to data.

MFA

Multifactor authentication requires two or more distinct factor categories, such as knowledge, possession, or inherence; using two passwords is not MFA.

Least privilege

Least privilege grants users and processes only the permissions required to perform their tasks, reducing the impact of compromise and limiting lateral movement.

Zero trust

Zero trust assumes no implicit trust based on network location; it continuously verifies identity and context and applies least privilege and segmentation.

Phishing

Phishing is a social-engineering attack that uses fraudulent messages to trick recipients into revealing credentials, clicking malicious links, or opening harmful attachments.

Ransomware

Ransomware encrypts or steals data and demands payment; mitigation includes offline backups, patching, MFA, and segmentation to limit spread.

Worm

A worm is self-propagating malware that spreads across networks without user interaction, often exploiting unpatched vulnerabilities or weak configurations.

SQL injection

SQL injection inserts malicious SQL into input fields to manipulate databases; parameterized queries and input validation are primary mitigations.

Zero-day vulnerability

A zero-day is a vulnerability unknown to the vendor or without an available patch; defenses rely on compensating controls, monitoring, and least privilege.

Credential stuffing

Credential stuffing uses breached username-password pairs to attempt logins on other services; MFA and breached-password checks reduce success.

DDoS

A distributed denial-of-service attack overwhelms a target with traffic from many hosts; mitigations include rate limiting, scrubbing, and content delivery networks.

DMZ

A DMZ or screened subnet is a network segment between the internet and internal networks that hosts public-facing services while limiting direct internal access.

IDS vs IPS

An IDS passively monitors and alerts on suspicious traffic, while an IPS sits inline and can block or drop malicious traffic.

Microsegmentation

Microsegmentation applies granular security policies between workloads or systems, limiting lateral movement even inside a data center or cloud environment.

Shared responsibility model

In cloud computing, the shared responsibility model divides security duties between provider and customer; the split varies by IaaS, PaaS, and SaaS.

RTO

Recovery time objective is the maximum acceptable time to restore a system or process after disruption; it drives backup and recovery design.

Defense in depth

Defense in depth layers multiple independent controls so failure of one control does not expose the entire system; examples include segmentation, MFA, and monitoring.

Incident response phases

Incident response typically follows preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned; containment limits damage before removal.

SIEM

A security information and event management system aggregates and correlates logs from many sources to detect incidents and support investigations and compliance reporting.

SOAR

Security orchestration, automation, and response platforms automate playbooks and integrate tools, reducing response time while retaining human approval for high-impact actions.

Order of volatility

Forensic order of volatility prioritizes collecting the most perishable evidence first, such as CPU registers and RAM, before disks and archived logs.

Chain of custody

Chain of custody documents who collected, handled, and transferred evidence, when, and why; it preserves admissibility and integrity through a recorded audit trail.

Backup types

Full backups copy all selected data; incremental copies changes since the last backup; differential copies changes since the last full; restore needs differ by type.

Risk formula

Risk is commonly expressed as likelihood multiplied by impact; risk assessment estimates both to prioritize treatments and compare against risk appetite.

Risk responses

Risk can be avoided, transferred, mitigated, or accepted; mitigation reduces likelihood or impact, transfer shifts financial impact, and acceptance retains residual risk.

BIA

A business impact analysis identifies critical business functions and dependencies and estimates disruption impacts, supporting recovery objectives such as RTO and RPO.

RTO vs RPO

Recovery time objective is the maximum tolerable downtime; recovery point objective is the maximum tolerable data loss measured in time.

Third-party risk

Third-party risk management assesses vendors and partners for security, privacy, and continuity risks using due diligence, contracts, right-to-audit clauses, and ongoing monitoring.

Data classification

Data classification labels information by sensitivity and value, such as public, internal, confidential, and restricted, to drive handling, retention, and access controls.