CASSPT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CVSS Base Score

A 0–10 severity score from intrinsic characteristics: exploitability (attack vector, complexity, privileges, user interaction) and impact on confidentiality, integrity, and availability.

EPSS

Exploit Prediction Scoring System: the probability a CVE will be exploited in the wild within 30 days. Used with CVSS to prioritize patching by real-world likelihood.

CISA KEV Catalog

A maintained list of vulnerabilities known to be exploited in the wild. Membership is a strong signal to prioritize remediation regardless of CVSS score.

STRIDE Model

Threat modeling framework categorizing threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Each category maps to candidate mitigations.

MITRE ATT&CK

A knowledge base of adversary tactics, techniques, and procedures observed in real intrusions. Used to map detection coverage and prioritize defensive gaps.

Authenticated Vulnerability Scan

A scan using credentials to inspect host configuration, installed patches, and registry settings. It finds far more issues and produces fewer false positives than unauthenticated scanning.

Threat Intelligence TLP

Traffic Light Protocol markings (RED, AMBER, GREEN, CLEAR) that define sharing boundaries for threat intelligence, indicating who may receive and redistribute the information.

Bell-LaPadula Model

A confidentiality model enforcing no read up and no write down. Subjects cannot access higher-classification data or write to lower levels, preventing leakage.

Biba Integrity Model

An integrity model enforcing no read down and no write up. It prevents subjects from consuming lower-integrity data or contaminating higher-integrity objects.

Zero Trust Architecture

A design assuming breach where every request is authenticated and authorized explicitly. Policy decision points evaluate context and enforcement points apply least privilege.

Defense in Depth

Layering independent controls across perimeter, network, host, application, data, and identity. Each layer assumes prior layers may fail, so no single control is trusted alone.

Shared Responsibility Model

Cloud division of duties: the provider secures the infrastructure 'of the cloud' while the customer secures data, identities, and configurations 'in the cloud'.

DMZ

A demilitarized zone segment hosting internet-facing services, separated from internal networks by firewalls. It limits exposure if a public-facing system is compromised.

Clark-Wilson Model

An integrity model using well-formed transactions and separation of duties. Users access data only through certified programs, and duties are split to prevent fraud.

RTO and RPO

Recovery Time Objective is the maximum acceptable downtime; Recovery Point Objective is the maximum tolerable data loss measured in time. Both drive backup and replication design.

Change Management Process

A controlled workflow: request, risk assessment, approval, testing, implementation, verification, and documentation. Emergency changes still require retroactive review and approval.

Configuration Baseline

A documented hardened configuration, often based on CIS Benchmarks or STIGs. Drift detection compares live systems against the baseline and flags deviations.

3-2-1 Backup Rule

Keep three copies of data, on two different media, with one copy offsite. Restores must be tested regularly because untested backups frequently fail.

RBAC

Role-Based Access Control assigns permissions to roles rather than individuals. Users receive roles based on job function, simplifying reviews and least-privilege enforcement.

Least Privilege

Granting only the access required to perform a task, for only as long as needed. It limits blast radius if credentials are compromised or misused.

Patch Management Lifecycle

Inventory assets, classify patches by severity, test, deploy, and verify. Critical patches are typically applied within 24 to 72 hours per policy.

NIST Incident Response Lifecycle

Four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Each phase has defined documentation and decision points.

SIEM

Security Information and Event Management: centralizes logs from many sources, correlates events, and generates alerts. It supports investigation and compliance retention.

Chain of Custody

A documented record of who handled evidence, when, and where. It preserves admissibility by showing evidence was not altered or tampered with.

Pyramid of Pain

A model ranking indicators by how much difficulty they cause adversaries. TTPs sit at the top; IP addresses and file hashes at the bottom are easily changed.

MTTD and MTTR

Mean Time To Detect and Mean Time To Respond. These metrics measure detection and response efficiency and are tracked to improve incident readiness.

Containment Strategy

Actions limiting incident spread: isolating hosts, blocking indicators, disabling accounts, or segmenting networks. Choice balances blast radius against operational impact.

Threat Hunting

A proactive, hypothesis-driven search for adversaries that evade existing detections. Findings produce new detection rules and improved telemetry coverage.

Risk Treatment Options

Mitigate, transfer, avoid, or accept. Residual risk remains after controls and requires documented acceptance by an accountable owner.

NIST Cybersecurity Framework

A voluntary framework with functions Identify, Protect, Detect, Respond, Recover, and Govern. Organizations use it to structure and communicate security program maturity.

ISO/IEC 27001

An international standard specifying requirements for an Information Security Management System. Certification requires documented risk treatment and continual improvement.

Policy Hierarchy

Policy states intent; standards set mandatory requirements; procedures give step-by-step instructions; guidelines offer recommendations. Higher levels govern lower levels.