ICYB flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Core security objectives: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to systems and data.

Spear Phishing

A targeted phishing attack crafted for a specific person or team, often using researched context such as colleagues' names or current projects to make the lure convincing.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques observed in real intrusions, used to structure detection coverage, threat hunting, and red team scenarios.

Kill Chain

A seven-phase model of an intrusion: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives; defenders aim to interrupt any phase.

Stateful Firewall

A firewall that tracks connection state in a session table and allows return traffic implicitly, unlike stateless ACLs that evaluate every packet independently.

DMZ

A segmented network zone hosting internet-facing services, isolated from the internal network so that compromise of a public server does not grant direct internal access.

IPsec ESP Tunnel Mode

An IPsec configuration that encrypts and authenticates entire original IP packets and encapsulates them in new packets, commonly used for site-to-site VPNs between gateways.

802.1X

Port-based network access control where a supplicant authenticates through a switch or access point to a RADIUS server before gaining network access.

Multifactor Authentication

Authentication requiring two or more distinct factor categories: something you know, something you have, or something you are; two passwords do not qualify.

RBAC

Role-based access control assigns permissions to roles and then assigns users to roles, simplifying administration and supporting least privilege at scale.

SAML Assertion

An XML statement issued by an identity provider asserting a user's identity and attributes to a service provider, enabling browser-based single sign-on.

Kerberos TGT

A ticket-granting ticket issued by the key distribution center after initial authentication; the client presents it to obtain service tickets without resending credentials.

EDR

Endpoint detection and response software continuously records host telemetry such as process, file, and network activity, enabling behavioral detection, threat hunting, and remote containment.

Application Allowlisting

A deny-by-default control that permits only explicitly approved executables to run; effective against unknown malware but requires a maintenance process for updates.

LAPS

Microsoft Local Administrator Password Solution assigns unique, rotated local administrator passwords per Windows machine and stores them in Active Directory, blocking lateral movement via shared credentials.

Patch Prioritization

Ranking remediation by exploitability, exposure, and business criticality rather than CVSS score alone, so internet-facing and actively exploited flaws are fixed first.

Authenticated Encryption

A cipher mode such as AES-GCM that provides both confidentiality and integrity, detecting tampering instead of silently decrypting modified ciphertext.

Digital Signature

A value produced by encrypting a message hash with the sender's private key; verification with the public key proves integrity, origin, and non-repudiation.

Certificate Revocation

The process of invalidating a certificate before expiry, published through CRL files or checked in real time via OCSP by relying parties during validation.

Data Minimization

A privacy principle requiring collection and retention of only personal data necessary for a stated purpose, reducing breach impact and regulatory exposure.

Tokenization

Replacing sensitive data such as card numbers with non-sensitive surrogate tokens mapped in a protected vault, reducing the scope of protected data systems.

Chain of Custody

Documentation recording who handled evidence, when, and how, from collection through analysis, ensuring forensic integrity and admissibility in legal proceedings.

SIEM

A platform that centralizes logs from many sources, correlates events against detection rules, and alerts analysts, forming the data backbone of a security operations center.

MTTD

Mean time to detect: the average elapsed time between an incident occurring and defenders recognizing it, a key measure of monitoring effectiveness.

NIST IR Lifecycle

Four incident response phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity including lessons learned.

ALE

Annualized loss expectancy, calculated as single loss expectancy multiplied by annualized rate of occurrence, used to justify security spending quantitatively.

Residual Risk

The risk remaining after controls are applied; management formally accepts it, transfers it, or requires further treatment.

RTO and RPO

Recovery time objective is the maximum tolerable downtime for a process; recovery point objective is the maximum tolerable data loss measured in time.

ISO/IEC 27001

An international standard specifying requirements for an information security management system, including risk assessment, control selection, and continual improvement.

STRIDE

A threat modeling mnemonic covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, applied to data flow diagrams.

Shared Responsibility Model

Cloud division of duties: the provider secures infrastructure and managed service internals, while the customer secures identity, data, configuration, and guest systems.

SAST

Static application security testing analyzes source or binary code without executing it, finding flaws such as injection patterns early in the development lifecycle.