EXIN Information Security Essentials flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core information security objectives: confidentiality (no unauthorized disclosure), integrity (no unauthorized alteration), and availability (accessible when needed). Controls are judged by which of these they support.

Information vs data

Data is raw, uninterpreted facts or symbols; information is data that has been processed, organized, or contextualized so it has meaning and value to a recipient. Security protects information, which is derived from data.

Non-repudiation

A property ensuring that a party cannot credibly deny having performed an action, such as sending a message or approving a transaction. It is typically supported by digital signatures and protected audit logs.

Three states of information

Information exists at rest (stored on media), in transit (moving over networks), and in use (being processed). Different controls, such as encryption and access control, apply to each state.

Vulnerability

A weakness in an asset, system, or process that a threat could exploit to cause harm. Vulnerabilities may be technical (unpatched software), procedural, or human, and are distinct from threats.

Spear phishing

A targeted phishing attack aimed at a specific individual or role, using researched personal or organizational details to appear credible. It is harder to detect than bulk phishing and often precedes fraud or malware delivery.

Ransomware

Malicious software that encrypts or locks data and demands payment for restoration. Effective defenses include tested offline or immutable backups, prompt patching, least privilege, and network segmentation.

Residual risk

The risk that remains after controls have been applied. It should be compared with the organization's risk appetite and formally accepted by an accountable owner rather than left undocumented.

Risk treatment options

The four standard responses to identified risk: mitigate by applying controls, transfer via insurance or contracts, avoid by stopping the activity, or accept and retain with management approval.

Annualized loss expectancy

A quantitative risk metric: single loss expectancy (asset value times exposure factor) multiplied by the annualized rate of occurrence. It estimates expected yearly monetary loss for a given risk scenario.

Policy hierarchy

The ordering of security documents: policy states management intent and is mandatory; standards specify mandatory requirements; procedures describe step-by-step execution; guidelines are recommended, non-mandatory advice.

Least privilege

A principle granting users and systems only the access rights necessary to perform their assigned tasks, and only for as long as needed. It limits damage from error, compromise, or misuse.

Segregation of duties

A control splitting a sensitive process across different people so no single person controls all stages, such as requesting, approving, and executing a payment. It reduces fraud and undetected error.

Data classification

Assigning labels such as public, internal, confidential, or secret to information, with defined handling rules per label. Classification drives appropriate protection and access decisions.

Policy exception

A documented, time-bound deviation from a policy, approved by an authorized manager after risk assessment. Exceptions should be logged, reviewed, and closed rather than granted informally.

Asset owner

The role accountable for a specific asset, including its classification, its protection requirements, and acceptance of residual risk. Custodians perform daily administration while owners remain accountable.

Security awareness training

Education for all staff on security risks and expected behavior, such as recognizing phishing and reporting incidents. It builds a security culture and is distinct from role-specific technical training.

Offboarding controls

Procedures on employee departure or role change: promptly revoke accounts and access rights, recover devices and badges, and remind the leaver of continuing confidentiality obligations.

Insider threat

Risk from people within the organization, whether malicious (deliberate theft or sabotage) or negligent (error, falling for phishing). Controls include least privilege, monitoring, and job rotation.

Multi-factor authentication

Authentication using two or more factors from different categories: something you know, something you have, or something you are. Combining different categories is stronger than repeating one category.

Symmetric vs asymmetric encryption

Symmetric encryption uses one shared secret key and is fast, suited to bulk data. Asymmetric encryption uses a public/private key pair and supports key exchange and digital signatures.

Hashing

A one-way function producing a fixed-length value from input, used for integrity checks and password storage. Any change to the input produces a different hash, revealing tampering.

Digital signature

A value created by hashing a message and encrypting the hash with the sender's private key. It provides integrity, authenticity, and non-repudiation, verifiable with the sender's public key.

Intrusion detection vs prevention

An IDS monitors traffic or hosts and raises alerts on suspicious activity. An IPS sits inline and can actively block or drop malicious traffic. Detection alone does not stop an attack.

Role-based access control

An access control model where permissions are assigned to roles rather than individuals, and users are granted roles based on their job. It simplifies administration and supports least privilege.

Mantrap

A physical access control consisting of two interlocked doors where the first must close before the second opens. It prevents tailgating and controls entry into high-security areas.

UPS vs generator

An uninterruptible power supply provides immediate short-term power and clean shutdown during outages. A generator provides longer-term backup power but takes time to start, so both are often combined.

Secure media disposal

Destroying or sanitizing storage media so data cannot be recovered, using shredding, degaussing, or cryptographic erase. It applies to disks, tapes, and mobile devices before reuse or disposal.

Incident response phases

The standard sequence: preparation; detection and reporting; assessment; containment, eradication, and recovery; and post-incident review. Lessons learned feed back into preparation to improve future handling.

Recovery time objective

The maximum acceptable time a business function or system may be unavailable after a disruption. RTO drives recovery design and is set from the business impact analysis.

Recovery point objective

The maximum acceptable amount of data loss measured in time, indicating how far back a restore may go. A one-hour RPO means backups or replication must occur at least hourly.

Business impact analysis

An analysis identifying critical business processes, their dependencies, and the impact of their unavailability over time. Its results set recovery priorities and RTO/RPO targets for continuity planning.

ISO/IEC 27001

An international standard specifying requirements for establishing, operating, monitoring, and improving an information security management system. Certification is granted by an accredited external body after audit.

Plan-Do-Check-Act

The continual improvement cycle underlying an ISMS: plan the system and controls, do implement and operate them, check monitor and review performance, act to maintain and improve.