CNDA flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core security objectives: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to systems and data.

Defense in depth

A layered strategy using multiple independent controls across perimeter, network, host, identity, and monitoring so that failure of any single control does not expose the whole environment.

Least privilege

Granting users, services, and processes only the permissions required for their defined tasks, minimizing the blast radius of a compromised account or exploited service.

Risk formula

Risk is commonly expressed as Threat times Vulnerability times Impact. Controls reduce vulnerability or impact, and residual risk is what remains after treatment.

AAA framework

Authentication verifies identity, authorization determines permitted actions, and accounting records activity. RADIUS and TACACS+ are common protocols implementing all three.

Zero Trust

A model that removes implicit trust from internal networks; every request is authenticated and authorized using identity, device posture, and context regardless of network location.

Stateful firewall

A firewall that tracks connection state in a session table, allowing return traffic for established sessions without separate rules, unlike stateless ACLs evaluating packets individually.

Egress filtering

A boundary policy restricting outbound traffic to approved destinations and ports, blocking command-and-control callbacks and making data exfiltration harder.

DMZ segmentation

Placing internet-facing services on an isolated subnet with tightly restricted paths to internal networks, so compromise of an exposed host does not grant internal access.

IDS versus IPS

An IDS passively detects and alerts on malicious traffic; an IPS sits inline and can block it. Signature, anomaly, and behavior are the main detection methods.

IPsec ESP and AH

ESP provides encryption plus integrity and authentication; AH provides integrity and authentication without encryption. Both are IPsec protocols used in VPN tunnels.

802.1X

Port-based network access control that authenticates a device or user through an authenticator and authentication server before granting network connectivity.

Microsegmentation

Applying least-privilege rules between individual workloads, limiting east-west lateral movement inside a data center after a perimeter breach.

NAT is not security

Network address translation hides internal addressing but performs no inspection, authentication, or policy enforcement, so it must not substitute for a firewall.

Patch management lifecycle

The repeatable process of inventorying assets, risk-ranking updates, testing, deploying, and verifying patches, measured by mean time to remediate.

Application allowlisting

A deny-by-default execution policy permitting only approved binaries. It resists renamed or polymorphic malware better than blocklisting, which fails against unknown variants.

EDR telemetry

Endpoint detection and response collects process, file, registry, network, and memory events, supporting detection, threat hunting, and containment beyond signature-only antivirus.

Windows privilege tiers

A model separating Tier 0 domain controllers, Tier 1 servers, and Tier 2 workstations; credentials must never cross downward between tiers to prevent credential theft escalation.

File integrity monitoring

Hashing critical files and alerting on unexpected changes, detecting tampering with system binaries, configuration files, and audit logs.

Full-disk encryption

Encrypting stored data so a stolen drive cannot be read. It does not protect data in use or against an attacker with control of the running operating system.

Endpoint isolation

Cutting a host's network connectivity while preserving memory and disk state, stopping command-and-control traffic without destroying evidence, and reversible unlike reimaging.

Syslog severity levels

Eight levels numbered 0 to 7, where 0 is emergency and 7 is debug. Lower numbers are more severe, and collectors typically filter below a configured threshold.

Detection rule anatomy

A rule specifies a data source, matching condition or logic, threshold or time window, and response action. Tuning adjusts these to cut false positives while preserving coverage.

MITRE ATT&CK

A knowledge base of adversary tactics, the why of an action, and techniques, the how. Detections are written against specific techniques such as T1059 command execution.

SIEM versus SOAR

A SIEM normalizes and correlates logs to generate alerts; a SOAR platform automates playbook actions. Neither replaces analyst validation of alert validity.

NIDS placement

A network IDS outside the firewall sees internet noise; placed inside, it sees traffic that actually passed the boundary policy, changing alert volume and relevance.

NTP for correlation

Synchronized time across log sources enables reliable event correlation and timeline reconstruction; clock skew breaks ordering and undermines forensic accuracy.

MTTD and MTTR

Mean time to detect measures how quickly incidents are identified; mean time to respond measures time to contain or resolve. Both are core monitoring effectiveness metrics.

NIST incident phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. These four phases structure the incident response lifecycle.

Order of volatility

Collection priority from most to least volatile: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media.

Chain of custody

Documentation tracking who collected, handled, and stored evidence, when, and how, including hashes, ensuring integrity and admissibility through the investigation.

Containment versus eradication

Containment stops spread through isolation, account disablement, or blocking; eradication removes the root cause such as malware or a vulnerable service before recovery begins.

IOC versus TTP

Indicators of compromise such as hashes, IPs, and domains are time-sensitive; tactics, techniques, and procedures endure longer and drive more durable detection content.