TAISE flashcards
TAISE · Build recall with a focused review session.
30 cards. Read the term and the definition here. The deck at the top of this page is optional.
- AI system boundary
- The relevant model, data, retrieval, tools, identities and consumers considered in an actual use case, broader than a model’s weights alone.
- Evaluation leakage
- Information overlap or other contamination reducing the independence of an evaluation, potentially overstating performance in the intended deployment context.
- Indirect prompt injection
- Adversarial instructions embedded in retrieved or otherwise external content that attempt to redirect an AI application beyond the authorized task.
- Excessive agency
- An AI application’s overly broad functionality, permissions or autonomy that can enable damaging consequential actions under unexpected or manipulated behavior.
- Meaningful human oversight
- Review with relevant information, competence, authority and ability to intervene, rather than nominal approval without understanding or an enforced action boundary.
- Residual AI risk
- The remaining relevant uncertainty and potential harm after chosen controls, requiring accountable evaluation in the actual use context rather than a framework label.
- Least Privilege
- The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.
- Separation of Duties
- A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.
- Role-Based Access Control (RBAC)
- An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.
- Multi-Factor Authentication (MFA)
- An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.
- Authentication
- The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.
- Authorization
- The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.
- Single Sign-On (SSO)
- A mechanism that allows a user to log in once and access multiple applications or systems without re-entering credentials, improving usability and centralizing access control.
- Encryption
- The process of converting plaintext into ciphertext using an algorithm and a key, so that only authorized parties can read the original information.
- Symmetric Encryption
- An encryption method that uses the same secret key for both encryption and decryption, offering speed but requiring secure key distribution.
- Asymmetric Encryption
- Encryption using a suitable public-key scheme and a corresponding private key for decryption. Authenticated key distribution and the specified padding/protocol remain essential; signatures and key agreement are distinct constructions.
- Hash Function
- A digest construction mapping input to an output under its defined algorithm, with cryptographic versions designed for appropriate resistance properties. Password storage needs a suitable salted password-hashing/KDF scheme rather than a bare fast digest.
- Digital Signature
- An electronic signature that uses asymmetric cryptography to verify the authenticity and integrity of a message or document.
- Access control
- The policies and mechanisms that determine who can access which systems, data, or facilities and under what conditions.
- Security Information and Event Management (SIEM)
- A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.
- Incident Response
- A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.
- Risk Assessment
- The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.
- Risk Management
- The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.
- Security Audit
- A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.
- Risk
- The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.
- Inherent risk
- The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.
- Residual risk
- The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.
- Risk analysis
- The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.
- Risk evaluation
- The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.
- Risk register
- A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.