ECF-GSF Core flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

ALE formula

Annualized Loss Expectancy = Single Loss Expectancy (asset value times exposure factor) multiplied by Annualized Rate of Occurrence. It estimates expected yearly loss for a given risk and supports cost-benefit comparison of controls.

Residual risk

The risk that remains after controls are applied. It equals inherent risk minus mitigated risk and must be formally accepted by an accountable asset or business owner, never silently ignored.

Defense in depth

Layering independent preventive, detective, and corrective controls across people, process, and technology so that failure of any single control does not expose the protected asset.

Risk treatment options

Four responses to identified risk: mitigate by adding controls, transfer via insurance or contract, avoid by discontinuing the activity, or accept with documented approval from an accountable owner.

Threat modeling STRIDE

A structured technique enumerating Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege against each component, then defining mitigations for each identified threat.

Stateful vs stateless firewall

A stateful firewall tracks connection state and allows return traffic automatically; a stateless ACL evaluates each packet independently and requires explicit rules for both directions of a flow.

DMZ screened subnet

A network segment hosting internet-facing services between two filtering points, so a compromised public host cannot directly reach internal systems without crossing an additional enforced boundary.

IPsec tunnel mode

Mode that encrypts the entire original IP packet and encapsulates it in a new packet, used for gateway-to-gateway VPNs and remote access; transport mode protects only the payload.

802.1X authentication

Port-based network access control where a supplicant authenticates through an authenticator switch to a RADIUS server before the port grants normal LAN access.

Zero trust architecture

A model that removes implicit trust based on network location and verifies every request using identity, device posture, and context at policy decision and enforcement points.

SYN flood mitigation

A denial-of-service attack exhausting half-open TCP connection tables. SYN cookies and connection rate limits mitigate it by avoiding state allocation until the handshake completes.

MFA factor types

Authentication factors are knowledge (password), possession (token, certificate), and inherence (biometric). Multi-factor authentication requires two or more distinct types, not two instances of one type.

RBAC vs ABAC

Role-based access control assigns permissions to roles and users to roles. Attribute-based access control evaluates user, resource, and environment attributes in policy, allowing finer, context-aware decisions.

Password hashing choice

Store passwords with salted, deliberately slow algorithms such as bcrypt, scrypt, Argon2, or PBKDF2. Fast hashes like MD5 or SHA-1 enable rapid offline cracking and are unsuitable.

Kerberos clock skew

Kerberos rejects tickets whose timestamps differ from the domain controller beyond tolerance, commonly five minutes. Time synchronization is therefore a prerequisite for successful domain authentication.

Single sign-on federation

SSO lets one authentication grant access to multiple applications; federation extends this across trust domains using protocols such as SAML or OpenID Connect with an identity provider's assertions.

Three states of data

Data exists at rest in storage, in transit across networks, and in use in memory or processing. Each state requires distinct controls such as encryption, TLS, and confidential computing.

Tokenization vs encryption

Tokenization replaces sensitive data with a non-sensitive token mapped in a secured vault, reducing compliance scope. Encryption transforms data reversibly with a key and preserves its format and length.

3-2-1 backup rule

Maintain three copies of data on two different media types with one copy offsite. Immutable or offline copies additionally protect against ransomware encryption of connected backups.

Crypto-shredding

Secure destruction by deleting the encryption keys protecting stored data, rendering ciphertext unrecoverable. It is effective for cloud and distributed storage where physical destruction is impractical.

Authenticated encryption modes

Modes such as AES-GCM and CCM provide confidentiality and integrity in one operation. ECB leaks plaintext patterns and must not protect real data; CBC requires a random IV plus a MAC.

Digital signature purpose

A hash signed with the sender's private key and verified with the public key. It proves integrity, origin authenticity, and non-repudiation but does not by itself provide confidentiality.

Forward secrecy

Property achieved with ephemeral Diffie-Hellman key exchange, ensuring compromise of a long-term private key does not allow decryption of previously recorded sessions.

PKI trust chain

A self-signed root CA signs an intermediate CA, which signs leaf certificates. Clients validate the path and check revocation through CRL or OCSP before trusting the endpoint.

HMAC

A keyed hash construction combining a shared secret with a hash function to provide message authentication and integrity, detecting tampering without requiring asymmetric cryptography.

EDR versus antivirus

Endpoint detection and response continuously collects process, file, registry, and network telemetry for behavioral detection and remote response; signature-based antivirus matches known malware patterns only.

SAST versus DAST

Static application security testing analyzes source or bytecode without executing it; dynamic testing probes a running application from outside. Both are complemented by dependency scanning.

Cloud shared responsibility

The provider secures the infrastructure of the cloud, including physical and hypervisor layers; the customer secures data, identity, configuration, and access in the cloud.

Application allowlisting

Permitting only explicitly approved executables to run, which blocks novel and unknown malware. It is stronger than blocklisting, which stops only already-known bad software.

NIST incident response phases

Preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Lessons learned from the final phase feed back into improved preparation and detection.

Chain of custody

Documented, unbroken record of who collected, handled, and stored evidence, including hashes and timestamps, so findings remain admissible and defensible in legal or disciplinary proceedings.

Order of volatility

Forensic collection priority from most to least volatile: CPU registers and cache, memory, network state, disk, remote logs, archival media. Collect volatile evidence before it disappears.

GDPR breach notification

Controllers must notify the supervisory authority of a personal data breach within 72 hours of awareness unless unlikely to result in risk, and inform affected data subjects when risk is high.

Policy hierarchy

Policy states management intent; standards define mandatory requirements; procedures give step-by-step instructions; guidelines are recommendations. Lower documents must align with higher ones.