ATSA flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Non-repudiation via digital signature

Sender hashes the message and encrypts the hash with their private key. Any party verifies with the sender's public key, proving origin and integrity and preventing later denial of authorship.

Zero Trust core principle

No implicit trust based on network location. Every request is continuously authenticated and authorized using identity, device health, and context before access to a resource is granted.

Preventive versus detective control

A preventive control stops an event before it occurs, such as a firewall block or locked door. A detective control identifies an event after it occurs, such as IDS alerts or log review.

Hashing versus encryption

Hashing is a one-way function producing a fixed-length digest used for integrity checks; it cannot be reversed. Encryption is reversible with the correct key and provides confidentiality.

Stateful firewall behavior

Tracks active connections in a state table and automatically permits return traffic for established sessions, unlike stateless ACLs that must explicitly allow both directions.

SYN flood mitigation

An attacker sends many TCP SYNs without completing handshakes, exhausting the connection table. SYN cookies and rate limiting preserve service availability during the flood.

IPsec tunnel versus transport mode

Tunnel mode encrypts the entire original packet including headers and is used for site-to-site VPNs. Transport mode encrypts only the payload and preserves the original IP header.

DMZ purpose

A segmented network hosting internet-facing services, isolated from the internal network by firewalls, so compromise of an exposed server does not grant direct internal access.

IDS versus IPS placement

An IDS is passive, receiving copies of traffic and alerting on matches. An IPS sits inline and can drop malicious traffic, but a failure can affect availability.

Syslog severity levels

Numerical levels 0 through 7, where 0 is emergency and 7 is debug. Lower numbers indicate higher severity, so filtering on level 3 or below captures critical events.

SIEM correlation

A SIEM normalizes logs from many sources, applies rules joining related events across time and hosts, and generates alerts that individual log entries would not trigger.

MTTD and MTTR

Mean time to detect is the average interval from event occurrence to detection. Mean time to respond is the average interval from detection to containment or resolution.

Why NTP matters for investigations

Accurate synchronized clocks across hosts and network devices allow log events from different sources to be ordered into a reliable timeline during incident reconstruction.

Honeypot detection value

A decoy system with no legitimate business use generates almost no benign traffic, so any interaction is high-signal evidence of scanning, exploitation attempts, or compromised internal hosts.

CVSS base score components

Eight metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, and Availability. Together they produce a 0.0 to 10.0 severity score.

CVE versus CWE

CVE is a unique identifier for a specific disclosed vulnerability instance. CWE classifies the underlying weakness type, such as SQL injection or buffer overflow, across many products.

Credentialed versus uncredentialed scanning

Credentialed scans log into targets and inspect installed software and configuration, finding far more issues. Uncredentialed scans see only externally observable service behavior.

EPSS and KEV prioritization

EPSS estimates probability a vulnerability will be exploited in the near term. CISA KEV lists vulnerabilities known to be exploited in the wild, warranting urgent remediation.

False positive versus false negative

A false positive reports a vulnerability that does not actually exist, wasting remediation effort. A false negative misses a real vulnerability, leaving genuine exposure undetected.

NIST incident response phases

Four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Each phase produces documentation feeding later phases and future readiness.

Order of volatility

Collection priority from most to least perishable: CPU registers and cache, RAM and swap, network connections, running processes, disk storage, then backups and archived media.

Chain of custody

A documented, unbroken record of who handled evidence, when, and why. It includes hashing at acquisition and secure storage, supporting admissibility in legal proceedings.

MITRE ATT&CK tactics versus techniques

Tactics are adversary goals such as Initial Access or Lateral Movement. Techniques are the specific methods used to achieve a tactic, such as phishing or remote service exploitation.

Threat hunting hypothesis

An analyst forms a testable statement about adversary behavior based on known TTPs, queries available telemetry for evidence, and converts confirmed findings into automated detections.

STRIDE threat categories

Six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Applied per component and trust boundary during design review.

Fail-closed versus fail-open

Fail-closed denies access when a control fails, preserving security at the cost of availability. Fail-open permits access on failure, preserving availability but potentially exposing protected assets.

Cloud shared responsibility model

The provider secures the underlying infrastructure, including physical facilities and hypervisor. The customer secures data, identity, access configuration, and workloads running in the cloud.

TPM measured boot

The TPM records cryptographic hashes of boot components into platform configuration registers. Remote attestation later compares these measurements against known-good values to detect tampering.

OAuth versus OpenID Connect

OAuth 2.0 delegates authorization, granting an application limited access to resources without sharing credentials. OpenID Connect adds an authentication layer on OAuth 2.0 that returns verified user identity.

Kerberos ticket flow

The client authenticates to the KDC and receives a ticket-granting ticket, then requests service tickets for specific resources. Clock skew beyond the allowed window causes authentication failure.

Password hashing requirements

Store passwords using a unique salt and a deliberately slow algorithm such as Argon2, bcrypt, scrypt, or PBKDF2, making offline brute-force and rainbow-table attacks impractical.

Single loss expectancy formula

SLE equals asset value multiplied by exposure factor, the percentage of value lost in one event. Annualized loss expectancy equals SLE multiplied by annualized rate of occurrence.

RTO versus RPO

Recovery time objective is the target duration to restore a service after disruption. Recovery point objective is the maximum acceptable data loss measured backward in time.

Risk treatment options

Mitigate by applying controls, transfer through insurance or contracts, avoid by eliminating the activity, or accept and document the residual risk with management approval.