CCIS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality limits disclosure to authorized parties, integrity limits modification to authorized parties, and availability ensures timely access. Every control should be mapped to at least one of these three properties.

ALE formula

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. Single loss expectancy equals asset value multiplied by exposure factor. A control is justified when its annual cost is below the ALE reduction.

Stateful vs stateless firewall

A stateful firewall tracks connection state and permits return traffic for established sessions. A stateless filter evaluates each packet independently against rules, so return traffic needs explicit rules.

IPsec ESP vs AH

Encapsulating Security Payload encrypts and optionally authenticates packet contents. Authentication Header provides integrity and origin authentication without encryption. ESP is used when confidentiality is required.

MFA factor types

Multi-factor authentication requires two or more different factor categories: knowledge, possession, and inherence. Two passwords or two hardware tokens of the same category do not constitute MFA.

Kerberos TGT

The key distribution center authenticates a principal and issues a ticket-granting ticket. The client presents the TGT to obtain service tickets without resending credentials. Ticket lifetime and clock skew affect renewal.

Application allowlisting

Only approved executables may run, identified by hash, publisher, or path. Unknown malware is blocked regardless of signature because it is not on the approved list. Audit mode builds the list before enforcement.

EDR versus antivirus

Signature antivirus matches known malicious files. Endpoint detection and response records process, file, network, and registry telemetry, enabling behavioral detection, investigation, and response actions such as host isolation.

Authenticated encryption GCM

Galois/Counter Mode provides confidentiality and integrity in one operation. It requires a unique nonce per key; nonce reuse breaks confidentiality and integrity. CBC instead needs a random IV and separate integrity checking.

Digital signature

A hash of the message is signed with the sender's private key; the recipient verifies with the public key. This proves integrity, origin, and non-repudiation, but not confidentiality.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment limits spread before eradication removes the cause, and lessons learned should update playbooks and detections.

Order of volatility

Evidence collection priority from most to least volatile: processor registers and cache, memory, network state, running processes, disk storage, and archival backups. Capture volatile data first because it disappears on shutdown.

CVSS versus EPSS

CVSS base score rates technical severity from exploitability and impact. EPSS estimates the probability a vulnerability will be exploited in the near term. Contextual exposure and asset criticality further adjust remediation priority.

Risk treatment options

Mitigate by applying controls, transfer through insurance or contracts, avoid by discontinuing the activity, or accept with documented owner approval and review. Accepted risks require expiry dates, not permanent waivers.

Cloud shared responsibility

The provider secures facilities, hardware, and the hypervisor. The customer secures data, identity, configuration, and workloads. Provider compliance attestations do not transfer to customer-managed settings.

SIEM correlation

A security information and event management system centralizes logs, normalizes fields, and applies correlation rules to generate alerts. Detection quality depends on log coverage, parsing accuracy, and synchronized time.

Tokenization versus encryption

Tokenization replaces sensitive data with a token mapped in a vault; the token has no mathematical relation to the original. Encryption transforms data reversibly with a key, so compromise of the key exposes the plaintext.

Forward secrecy

Ephemeral key exchange such as ECDHE ensures that compromise of a long-term private key does not decrypt previously recorded sessions. It limits the impact of future key compromise on historical traffic.

RTO and RPO

Recovery time objective is the maximum tolerable downtime for a process. Recovery point objective is the maximum tolerable data loss measured in time. Both derive from a business impact analysis.

SPF DKIM DMARC

SPF authorizes sending servers by IP. DKIM signs messages to prove integrity and domain origin. DMARC publishes policy and reporting based on SPF and DKIM alignment, resisting sender spoofing.

Zero trust

No implicit trust is granted from network location. Every request is authenticated and authorized per session using identity, device posture, and context. Access is limited to specific applications rather than broad network segments.

Patch prioritization inputs

Combine base severity, exploitation probability, known active exploitation, internet exposure, and asset criticality. Internet-facing systems with active exploitation get emergency windows regardless of base score ranking.

CVE CWE CPE

CVE identifies a specific disclosed vulnerability. CWE classifies the underlying weakness type. CPE identifies the affected product and version. Together they support inventory matching and scanner accuracy.

Chain of custody

A documented record of who handled evidence, when, and for what purpose. Combined with integrity hashes and write blockers, it supports authenticity and admissibility of forensic findings.

SOC tier structure

Tier one triages alerts and closes noise. Tier two investigates and contains incidents. Tier three hunts threats and engineers detections. Documented escalation criteria prevent serious incidents from being closed prematurely.

Cloud security groups vs ACLs

Security groups are stateful and attached to instances, allowing return traffic automatically. Network ACLs are stateless and attached to subnets, so both directions need explicit rules. Both must be reviewed for public exposure.

Envelope encryption

A data key encrypts the data, and a master key in a key management service or hardware module encrypts the data key. Rotating the master key avoids re-encrypting bulk data.

CSPRNG requirement

Keys, initialization vectors, and salts must come from a cryptographically secure random number generator. Predictable randomness breaks key strength and nonce uniqueness regardless of algorithm choice.

STRIDE threat model

Spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Each category prompts specific design questions about authentication, integrity, logging, confidentiality, availability, and authorization.

Kill chain versus ATT&CK

The kill chain describes sequential attack stages from reconnaissance to actions on objectives. ATT&CK catalogs tactics and techniques. Detection coverage is measured by technique, and behavior-based hunting is more durable than indicator matching.

Privileged access management

Vaults privileged credentials, brokers sessions, and records administrative activity. Just-in-time elevation with approval reduces standing privilege, and break-glass accounts are documented and monitored.

Data loss prevention

Inspects content in motion, at rest, and in use, matching patterns such as personal data or card numbers. Effective policies depend on classification labels, because unlabeled data cannot be reliably blocked.