ECF Cybersecurity (Core) flashcards

38 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core security objectives: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to systems and data.

Risk formula

Risk equals threat multiplied by vulnerability multiplied by impact. A threat exploits a weakness; impact is the resulting harm; the product expresses overall exposure.

ALE calculation

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. SLE equals asset value times exposure factor. ALE supports cost-benefit decisions for controls.

Residual risk

The risk remaining after controls are applied. It equals inherent risk minus mitigated risk and must be formally accepted by management with documented rationale.

Defense in depth

Layering administrative, technical, and physical controls so that failure of one layer does not expose the asset. Examples include policy, firewalls, encryption, and locked server rooms.

OSI model layers

Seven layers from top to bottom: Application, Presentation, Session, Transport, Network, Data Link, Physical. Each layer defines distinct communication functions and corresponding security controls.

Stateful firewall

A firewall that tracks connection state and permits return traffic for established sessions. It is more secure than stateless packet filtering, which evaluates each packet independently.

IDS versus IPS

An intrusion detection system passively monitors and alerts on suspicious traffic. An intrusion prevention system sits inline and can block or drop malicious traffic in real time.

DMZ

A demilitarized zone is a segmented network hosting internet-facing services, isolated from the internal LAN by firewalls to limit exposure if a public service is compromised.

IPsec transport mode

IPsec mode that protects only the payload while retaining the original IP header. It is typically used for host-to-host or endpoint-to-gateway encrypted communication.

802.1X

Port-based network access control that authenticates devices before granting LAN access. It involves a supplicant, an authenticator such as a switch, and an authentication server.

AAA

Authentication verifies identity, authorization determines permitted actions, and accounting logs activity. Together they form the core access control framework for systems and networks.

Multi-factor authentication

Authentication using two or more distinct factor types: something you know, something you have, or something you are. Two passwords do not constitute MFA.

RBAC

Role-based access control assigns permissions to roles rather than individuals. Users receive roles based on job function, simplifying administration and supporting least privilege.

Separation of duties

Dividing sensitive tasks among different people so no single individual can complete a high-risk action alone, reducing fraud and error risk.

Kerberos

A ticket-based authentication protocol using a key distribution center. It issues a ticket-granting ticket and service tickets; time synchronization is required to prevent replay attacks.

Privileged access management

Controls that vault administrative credentials, enforce just-in-time elevation, and record privileged sessions to reduce misuse of high-privilege accounts.

System hardening

Reducing attack surface by removing unnecessary services, disabling default accounts, applying patches, enforcing least privilege, and enabling logging against an approved baseline.

EDR

Endpoint detection and response continuously monitors endpoint behavior, detects malicious activity, and supports containment and remediation. It is broader than signature-based antivirus.

Application allowlisting

A control that permits only explicitly approved executables to run. It is stronger than blocklisting because unknown or novel malicious programs are denied by default.

Configuration drift

Deviation of a system from its approved secure baseline over time. Continuous compliance scanning and configuration management detect and correct drift.

Symmetric encryption

Encryption using a single shared key for both encryption and decryption, such as AES. It is fast and suited to bulk data but requires secure key distribution.

Asymmetric encryption

Encryption using a public and private key pair, such as RSA or ECC. It supports key exchange and digital signatures but is slower than symmetric encryption.

Cryptographic hash

A one-way function producing a fixed-length digest, such as SHA-256. It provides integrity and collision resistance but does not provide confidentiality.

Digital signature

A hash of a message encrypted with the sender's private key. Verification with the public key confirms origin, integrity, and non-repudiation.

Public key infrastructure

A system where certificate authorities issue and sign certificates binding public keys to identities. Revocation is handled through CRLs and OCSP responders.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment limits spread before eradication removes the cause.

Chain of custody

Documentation recording who handled evidence, when, and how. It preserves integrity through hashing and sealed storage so evidence remains admissible.

Order of volatility

Evidence collection priority from most to least volatile: CPU and cache, memory, network state, disk, backups. Volatile data must be captured first.

SIEM

Security information and event management aggregates and correlates logs from many sources to detect incidents. Effectiveness depends on log coverage and time synchronization.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques observed in real intrusions. It supports threat modeling, detection engineering, and threat hunting.

CVSS

The Common Vulnerability Scoring System rates vulnerability severity from 0 to 10 using base, temporal, and environmental metrics. Base scores reflect intrinsic characteristics.

Threat hunting

A hypothesis-driven, proactive search for undetected adversary activity. It differs from alert-driven monitoring by actively seeking evidence rather than waiting for alerts.

Vulnerability management cycle

Discover assets, scan for weaknesses, prioritize by risk, remediate, verify fixes, and report. Prioritization considers exploitability, exposure, and business criticality.

NIST Cybersecurity Framework

A voluntary framework organized into five functions: Identify, Protect, Detect, Respond, Recover. It helps organizations structure and improve cybersecurity risk management.

GDPR data subject rights

Rights include access, rectification, erasure, restriction of processing, data portability, and objection. Organizations must respond within defined timeframes.

Business continuity plan

A plan to maintain critical operations during disruption, defining recovery time and recovery point objectives. Disaster recovery focuses on restoring systems after major outages.

Third-party risk management

Assessing and monitoring vendor security through due diligence, contractual requirements, right-to-audit clauses, and ongoing performance monitoring.