EXIN Cyber Security Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core information security objectives: confidentiality (no unauthorised disclosure), integrity (no unauthorised modification) and availability (timely, reliable access when needed).

Vulnerability versus threat

A vulnerability is a weakness that could be exploited; a threat is any potential cause of harm that could exploit it. A risk arises only when both exist together.

Risk definition

Risk is the effect of uncertainty on objectives, commonly expressed as the combination of the likelihood of an event and its impact. It is reduced by controls, not eliminated.

Defence in depth

Layering multiple independent controls so that the failure of any single control does not lead to full compromise of the asset. Layers typically span people, process and technology.

Least privilege

The principle that users, processes and systems receive only the minimum access rights needed to perform their function, and only for as long as required.

Non-repudiation

The assurance that a party cannot credibly deny having performed an action, such as sending a message or approving a transaction. It is usually achieved with digital signatures and reliable audit logs.

Asset classification

Assigning information assets to sensitivity levels such as public, internal, confidential or secret, which then determines the baseline set of protective controls applied to each asset.

Worm versus virus

A virus requires a host file and usually user action to spread; a worm self-propagates across networks without a host or user interaction, which makes it far faster.

Ransomware

Malware that encrypts data or threatens to publish stolen data and demands payment for restoration. Recovery depends on tested, isolated backups rather than on paying.

Spear phishing

A targeted phishing attack crafted for a specific individual or role, using researched personal details to appear credible. It is narrower and harder to detect than bulk phishing.

Whaling

A spear-phishing variant aimed at senior executives or board members, often seeking high-value approvals, credentials or confidential strategic information.

Distributed denial of service

An attack in which many compromised machines, often a botnet, flood a target with traffic to exhaust its resources and make services unavailable to legitimate users.

Man-in-the-middle attack

An attacker positions themselves between two communicating parties to intercept, read or alter traffic. Strong encryption with proper certificate validation is the main defence.

SQL injection

An attack that inserts malicious SQL statements through unsanitised user input, allowing data theft or modification. Parameterised queries and input validation prevent it.

Cross-site scripting

An attack that injects malicious client-side script into web pages viewed by other users, running in their browser session. Output encoding and input validation mitigate it.

Advanced persistent threat

A prolonged, stealthy and well-resourced campaign that gains entry, establishes persistence and quietly exfiltrates data over time instead of causing immediate visible disruption.

Social engineering

Manipulating people into divulging information or performing actions that breach security, by exploiting trust, authority, urgency or curiosity rather than technical weaknesses.

Insider threat

Risk originating from within the organisation, from employees, contractors or partners who misuse legitimate access, whether deliberately or through negligence.

Control types

Preventive controls stop incidents, detective controls identify them, corrective controls restore service afterwards, and compensating controls substitute when the primary control is not feasible.

Multi-factor authentication

Authentication using factors from at least two different categories: knowledge (password), possession (token or phone) and inherence (biometric). Two passwords are not multi-factor.

Symmetric versus asymmetric encryption

Symmetric encryption uses one shared secret key and is fast, suitable for bulk data. Asymmetric encryption uses a public and private key pair and solves key distribution.

Hashing versus encryption

Hashing is a one-way function producing a fixed-length digest and provides integrity checks. Encryption is reversible with a key and provides confidentiality. Hashing does not hide data.

Digital signature

A value created by hashing a message and encrypting the hash with the sender's private key, giving integrity, authenticity and non-repudiation to the recipient.

Intrusion detection versus prevention

An IDS monitors traffic and raises alerts on suspicious patterns; an IPS sits inline and can actively block the traffic it detects. Prevention carries higher false-positive impact.

DMZ

A demilitarised zone is a segmented network holding internet-facing services, separated from the internal network by firewalls so that a compromised public server does not expose internal systems.

Recovery point objective

The RPO is the maximum acceptable amount of data loss measured in time, and it determines backup frequency. A one-hour RPO requires backups or replication at least hourly.

Recovery time objective

The RTO is the maximum tolerable time to restore a process or system after disruption. It drives the choice of resilience measures such as redundancy and failover.

Patch versus vulnerability management

Vulnerability management discovers and prioritises weaknesses; patch management remediates them within agreed timeframes. Discovery without remediation leaves the exposure unchanged.

ISO/IEC 27001

An international standard specifying requirements for an information security management system. Organisations can be independently certified against it, unlike guidance standards such as ISO/IEC 27002.

Plan-Do-Check-Act

The continuous improvement cycle underlying an ISMS: establish objectives and processes, implement them, monitor and report results, then take action to improve performance.

Security policy hierarchy

Policy states management intent at the highest level; standards define mandatory requirements; procedures describe step-by-step execution; guidelines give recommended, non-binding advice.

GDPR breach notification

Under the GDPR, a personal data breach likely to result in risk to individuals must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours.