CPIT InfoSec flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, approved by senior leadership and used to judge whether residual risk is tolerable.

ALE formula

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. It estimates expected yearly loss for a risk scenario before or after controls.

Residual risk

The risk remaining after existing controls are applied. It is compared against risk appetite to decide whether further treatment, transfer, avoidance, or formal acceptance is required.

Policy versus standard

A policy states mandatory management intent and high-level requirements. A standard specifies the mandatory, measurable requirements that implement the policy, such as approved algorithms or password length.

Three lines model

Operational management owns and manages risk in the first line; risk and compliance functions oversee in the second; internal audit gives independent assurance in the third.

Segregation of duties

Splitting sensitive tasks so no single person can both commit and conceal an error or fraud, for example separating request, approval, and deployment of changes.

Bell-LaPadula model

A confidentiality model enforcing no read up and no write down across security levels, preventing lower-clearance subjects from reading classified data or leaking it downward.

Reference monitor properties

A reference monitor must be always invoked, tamper-proof, and small enough to be verified, mediating every access between subjects and objects in the trusted computing base.

STRIDE

A threat modeling mnemonic: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, applied per element and trust boundary.

Zero trust principle

An architecture that verifies every request explicitly, grants least privilege, and assumes breach, so trust is derived from identity and device posture rather than network location.

Stateful firewall

A firewall that maintains a session table and permits return traffic for established connections, unlike stateless packet filters that evaluate each packet in isolation.

802.1X

Port-based network access control where a supplicant authenticates through an authenticator switch to a RADIUS server before the port grants network access.

IPsec ESP

Encapsulating Security Payload provides confidentiality and integrity for IP packets, whereas AH provides integrity and authentication only, without encryption.

DNSSEC

A set of extensions that cryptographically signs DNS records so resolvers can verify authenticity and integrity of responses, preventing cache poisoning; it does not encrypt queries.

RBAC

Role-based access control assigns permissions to roles and users to roles, simplifying administration and supporting least privilege through periodic role reviews.

OAuth 2.0

An authorization framework that lets a client obtain delegated access tokens for resources without the user sharing credentials; it is not an authentication protocol by itself.

OpenID Connect

An identity layer built on OAuth 2.0 that issues signed ID tokens containing user identity claims, enabling federated single sign-on and authentication.

Kerberos ticket granting ticket

A credential issued by the key distribution center after initial authentication; it is presented to obtain service tickets without re-entering credentials.

AES-GCM

An authenticated encryption mode combining AES counter-mode encryption with Galois field authentication, providing confidentiality and integrity in one operation.

Digital signature

A value produced by hashing a message and signing with a private key; verification with the public key proves integrity, origin authenticity, and supports non-repudiation.

Perfect forward secrecy

A property of ephemeral key exchange such as ECDHE where compromise of long-term keys does not reveal previously recorded session keys or past traffic.

OCSP

Online Certificate Status Protocol lets a client query a responder for the revocation status of a specific certificate, an alternative to downloading certificate revocation lists.

Parameterized query

A database query where user input is bound as parameters rather than concatenated into SQL, preventing SQL injection by separating code from data.

SAST versus DAST

Static analysis inspects source or bytecode without running the application; dynamic analysis tests a running application from outside, finding runtime and configuration issues.

EDR

Endpoint detection and response continuously records endpoint telemetry, detects behavioral attack indicators, and enables actions such as isolating a host or killing a process.

Chain of custody

Documented, unbroken record of who handled evidence, when, and why, ensuring integrity and admissibility from collection through analysis and storage.

Order of volatility

Evidence collection priority from most to least perishable: CPU registers and cache, memory, network state, disk, then backups and archival media.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques observed in real intrusions, used to map detections, prioritize coverage gaps, and structure threat hunting.

Recovery time objective

The maximum acceptable duration to restore a function after disruption; it must be shorter than or equal to the maximum tolerable downtime from the business impact analysis.

Recovery point objective

The maximum acceptable amount of data loss measured in time before an incident, which determines backup frequency and replication design.

GDPR controller

The entity that determines the purposes and means of processing personal data, bearing primary accountability for lawfulness, notices, and data subject requests.

Privacy by design

Embedding privacy protections such as data minimization, purpose limitation, and retention limits into systems and processes from the outset rather than adding them later.