IBM Cybersecurity Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Model of three security objectives: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to systems and data.

Risk Formula

Risk is commonly expressed as likelihood of a threat exploiting a vulnerability multiplied by the resulting business impact; controls reduce likelihood, impact, or both.

Cyber Kill Chain

Seven-phase intrusion model: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Defenders can detect or block activity at any phase.

MITRE ATT&CK

Knowledge base of adversary tactics and techniques derived from real intrusions. Tactics describe goals; techniques describe how goals are achieved, enabling behavior-based detection mapping.

Stateful Firewall

Firewall that tracks connection state in a session table and automatically permits return traffic for established sessions, unlike stateless ACLs that must allow each direction explicitly.

IDS Versus IPS

An intrusion detection system passively monitors and alerts on suspicious traffic; an intrusion prevention system sits inline and can actively drop or reset malicious sessions.

DMZ Screened Subnet

Network segment between external and internal firewalls that hosts internet-facing services, limiting damage because a compromised public server cannot reach the internal LAN directly.

IPsec ESP

Encapsulating Security Payload provides confidentiality through encryption plus integrity and authentication. AH, by contrast, provides integrity and authentication without encryption.

EDR

Endpoint detection and response agent that records process, file, registry, and network telemetry, supports threat hunting, and enables remote containment such as host isolation or process termination.

Application Allowlisting

Default-deny endpoint control that permits only explicitly approved executables to run. It blocks unknown malware effectively but requires ongoing maintenance of the approved software inventory.

LSASS Protection

Windows defenses such as Credential Guard and RunAsPPL that isolate or protect the Local Security Authority process, preventing tools from dumping cached credentials and password hashes.

CIS Benchmarks

Consensus-based hardening guides listing specific configuration settings for operating systems, applications, and cloud services, used to build and verify secure baselines.

CVSS Base Score

Numeric severity from 0 to 10 derived from exploitability metrics (attack vector, complexity, privileges, user interaction) and impact metrics (confidentiality, integrity, availability).

CVE

Common Vulnerabilities and Exposures: a unique identifier assigned to a publicly disclosed security flaw, enabling consistent tracking across scanners, vendors, and advisories.

Credentialed Scan

Vulnerability scan that authenticates to the target host, allowing inspection of installed software and configuration. It finds more issues and produces fewer false positives than unauthenticated scanning.

EPSS

Exploit Prediction Scoring System: a probability estimate that a specific CVE will be exploited in the wild within a near-term window, used to prioritize patching beyond severity alone.

Order of Volatility

Forensic collection priority from most to least perishable: CPU registers and cache, memory and network state, running processes, temporary files, disk storage, then remote logs and backups.

Chain of Custody

Chronological record documenting who collected, accessed, transferred, and stored evidence, when, and for what purpose, preserving admissibility and demonstrating that evidence was not altered.

NIST Incident Response Lifecycle

Four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, which captures lessons learned and improves future response.

Write Blocker

Hardware or software device that prevents any write operation to a storage device during acquisition, ensuring original evidence remains unaltered and hashes remain valid.

SIEM

Platform that collects, parses, normalizes, and correlates logs from many sources, then generates alerts and dashboards for security monitoring and compliance reporting.

MTTD and MTTR

Mean time to detect measures average duration from incident occurrence to detection; mean time to respond or remediate measures duration from detection to resolution. Lower values indicate maturity.

SOAR

Security orchestration, automation, and response platform that runs playbooks to enrich alerts, query threat intelligence, open tickets, and execute containment actions with human approval where needed.

UEBA

User and entity behavior analytics baselines normal activity for users, hosts, and accounts, then flags statistically unusual behavior such as abnormal data volume or atypical login times.

RBAC

Role-based access control assigns permissions to roles rather than individuals, and users receive roles. It simplifies administration and supports least privilege and periodic access review.

Kerberos TGT

Ticket-granting ticket issued by the key distribution center after initial authentication; the client presents it to obtain service tickets without resending credentials.

OAuth 2.0

Authorization framework that lets a user grant a third-party application limited access to resources via tokens, without sharing the password. It is not an authentication protocol by itself.

Data Loss Prevention

Controls that inspect content at endpoint, network, and cloud to detect and block unauthorized movement of classified or regulated data such as personal information or cardholder data.

Shared Responsibility Model

Cloud division of duties: the provider secures physical infrastructure, hypervisor, and managed service internals; the customer secures identity, configuration, data, and workloads.

CSPM

Cloud security posture management continuously assesses cloud configurations against benchmarks, detecting public storage, permissive identity policies, disabled logging, and other misconfigurations.

SAST Versus DAST

Static application security testing analyzes source or bytecode without running the application; dynamic testing probes a running application from outside, finding runtime and configuration issues.

ALE

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. Single loss expectancy equals asset value multiplied by exposure factor.