SecurityX flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Annualized Loss Expectancy (ALE)

ALE estimates the yearly financial loss from a risk: ALE = Single Loss Expectancy × Annualized Rate of Occurrence. It converts per-incident impact into an annual budgeting figure for control justification.

Single Loss Expectancy (SLE)

The monetary loss expected from one realized risk event, calculated as asset value multiplied by exposure factor, where exposure factor is the percentage of the asset destroyed by that event.

Recovery Point Objective (RPO)

The maximum tolerable amount of data loss expressed in time before an incident. An RPO of one hour requires backups, snapshots, or replication occurring at least hourly.

Recovery Time Objective (RTO)

The maximum acceptable time to restore a process or system after disruption. It drives recovery site selection and resilience design and must never exceed the maximum tolerable downtime.

GDPR breach notification window

Under GDPR, controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in risk to individuals.

Data controller versus processor

The controller determines the purposes and means of processing personal data. The processor handles data only on the controller's documented instructions and carries narrower direct obligations and liability.

NIST Risk Management Framework steps

Seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The framework gives a repeatable process for managing security and privacy risk across a system lifecycle.

SOC 1 versus SOC 2 reports

SOC 1 addresses controls relevant to financial reporting. SOC 2 addresses the trust services criteria: security, availability, processing integrity, confidentiality, and privacy. SOC 3 is a public summary.

Zero trust core principle

No user or device is trusted based on network location alone. Every request is authenticated, authorized, and encrypted, with least privilege enforced by a policy decision point and enforcement point.

Cloud shared responsibility model

The provider always secures physical facilities and the underlying virtualization layer. The customer's scope grows from data and identity in SaaS up to operating systems and applications in IaaS.

RAID 5 versus RAID 6

RAID 5 survives one disk failure using distributed single parity; RAID 6 survives two failures using double parity. Neither substitutes for backup, since deletion and ransomware replicate across the array.

Screened subnet and DMZ

A network segment between the internet and internal networks that hosts publicly reachable services. Firewall rules limit inbound traffic and restrict lateral movement from that segment into internal networks.

Microsegmentation

Granular policy enforcement between individual workloads regardless of subnet, using host-based firewalls or software-defined networking to limit east-west lateral movement after a compromise.

Hot, warm, and cold sites

Hot sites are fully equipped and near-instant. Warm sites have hardware and partial data needing hours to days. Cold sites provide only space and power, requiring weeks to restore.

Control function categories

Preventive controls stop events, detective controls identify them, corrective controls restore operations, deterrent controls discourage attackers, compensating controls substitute for primary controls, and directive controls mandate required behavior.

SASE versus CASB

Secure Access Service Edge converges SD-WAN networking with cloud-delivered security services such as SWG, CASB, ZTNA, and firewall-as-a-service. CASB alone brokers and inspects traffic to cloud applications.

STRIDE threat categories

Six threat classes: Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Each class maps to a corresponding family of mitigating controls.

SAST versus DAST

Static analysis examines source or bytecode without running the application, is white-box, and fits early in CI. Dynamic analysis attacks a running application black-box and finds runtime and configuration flaws.

Parameterized queries

Prepared statements that separate SQL code from user-supplied data. Input is bound as data rather than interpreted as executable syntax, which prevents SQL injection even when validation is imperfect.

HMAC versus digital signature

Both provide integrity and authenticity. HMAC uses a shared symmetric key so it cannot prove origin to a third party; a digital signature uses asymmetric keys and provides non-repudiation.

Purpose of a password salt

A unique random value stored alongside each password hash. It defeats precomputed rainbow tables and ensures identical passwords produce different hashes, forcing attackers to attack each account separately.

TLS 1.3 key exchange

TLS 1.3 removed static RSA and non-ephemeral Diffie-Hellman key transport, requiring forward secrecy through ephemeral (EC)DHE and completing the handshake in a single round trip.

Perfect forward secrecy

Ephemeral session keys are generated per connection and discarded after use. Later compromise of the server's long-term private key cannot decrypt previously recorded session traffic.

Same-origin policy

A browser rule permitting scripts to read resources only from the same scheme, host, and port. Cross-origin reads are blocked unless the server explicitly allows them through CORS response headers.

Order of volatility

Collect the most perishable evidence first: CPU registers and cache, RAM, swap and page files, network connections and remote logs, then disk, then backups and archival media.

Chain of custody

Chronological documentation of who handled evidence, when, and why, supported by signatures and hashes proving integrity from seizure through analysis and presentation in legal proceedings.

Full versus incremental backup

A full backup copies all selected data. An incremental copies changes since the last backup of any type; a differential copies everything changed since the last full backup.

CVSS base score ranges

CVSS v3.1 base scores run from 0.0 to 10.0: none 0.0, low 0.1 to 3.9, medium 4.0 to 6.9, high 7.0 to 8.9, critical 9.0 to 10.0.

Cyber Kill Chain stages

Seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders aim to interrupt the adversary at any stage.

False positive versus false negative

A false positive flags benign activity as malicious and consumes analyst time. A false negative is malicious activity that goes undetected, which is usually the costlier detection failure.

Tabletop exercise

A discussion-based test in which stakeholders verbally walk through a scenario and their response decisions, validating plans, roles, and communications without activating systems or disrupting operations.

EDR versus traditional antivirus

EDR continuously records process, file, and network telemetry, then applies behavioral detection and response actions. Signature-based antivirus only matches known file hashes and patterns.