ICDL Cyber Security (ICDL) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

A security model with three goals: confidentiality (only authorized access), integrity (data accurate and unaltered), and availability (systems and data accessible when needed).

Least privilege

A principle that users and processes should have only the minimum permissions necessary to perform their tasks, reducing the impact of accidents or compromise.

Authentication vs authorization

Authentication verifies who you are (e.g., password, biometric); authorization determines what an authenticated identity is allowed to do.

Phishing

A social-engineering attack that tricks users into revealing credentials or clicking malicious links by impersonating a trusted entity, often via email.

Non-repudiation

A property ensuring a party cannot deny having performed an action, typically achieved with digital signatures or tamper-evident audit logs.

Virus

Malware that attaches to a host file and spreads when the infected file is executed, requiring user action or another program to propagate.

Worm

Self-replicating malware that spreads across networks without needing a host file or user interaction, often exploiting unpatched vulnerabilities.

Trojan

Malware disguised as legitimate software that does not self-replicate but creates backdoors, steals data, or downloads additional payloads once executed.

Ransomware

Malware that encrypts files or locks systems and demands payment for decryption; offline backups and patching are key mitigations.

Spyware

Software that covertly collects information about a user's activity, such as browsing habits or keystrokes, without consent.

Rootkit

Malware that hides its presence and maintains privileged access at the operating system or firmware level, making it hard to detect and remove.

Botnet

A network of compromised devices controlled remotely by an attacker, often used to send spam or launch distributed denial-of-service attacks.

Firewall

A network security device or software that filters traffic based on rules, blocking unauthorized access while allowing permitted communications.

VPN

A virtual private network creates an encrypted tunnel over an untrusted network, protecting data in transit and masking the user's IP address.

WPA3

The latest Wi-Fi security standard, using SAE (Simultaneous Authentication of Equals) to resist offline dictionary attacks and provide forward secrecy.

IDS vs IPS

An intrusion detection system monitors and alerts on suspicious activity; an intrusion prevention system also blocks or drops the malicious traffic.

DMZ

A demilitarized zone is a segmented network area hosting public-facing services, isolated from the internal LAN by firewalls to limit breach impact.

DDoS attack

Distributed denial-of-service floods a target with traffic from many compromised devices, exhausting resources and making services unavailable.

HTTPS

HTTP secured with TLS, encrypting web traffic and authenticating the server via a digital certificate, shown by a padlock icon.

TLS certificate

A digital document issued by a certificate authority that binds a public key to a domain, enabling encrypted and authenticated HTTPS connections.

Session cookie

A temporary cookie stored while a user is logged in, maintaining session state; it is deleted when the browser closes.

Private browsing

A browser mode that avoids saving local history and cookies but does not hide activity from websites, ISPs, or employers.

URL spoofing

Creating a deceptive web address that resembles a legitimate one (e.g., using look-alike characters or subdomains) to trick users into visiting a malicious site.

Drive-by download

Unintentional download of malware that occurs simply by visiting a compromised or malicious website, often exploiting browser vulnerabilities.

SPF, DKIM, DMARC

Email authentication mechanisms: SPF lists authorized sending servers, DKIM signs messages, and DMARC sets policy and reporting based on SPF/DKIM results.

Digital signature

A cryptographic mechanism that verifies the sender's identity and ensures message integrity and non-repudiation, but does not provide confidentiality.

End-to-end encryption

A communication method where only the sender and recipient can read messages; intermediaries such as service providers cannot decrypt them.

S/MIME

A standard for public-key encryption and digital signing of email messages, commonly used in enterprise environments.

Vishing

Voice phishing: a phone-based social-engineering attack where a caller impersonates a trusted entity to extract sensitive information or money.

3-2-1 backup rule

A backup strategy: keep at least three copies of data, on two different media types, with one copy stored offsite.

Data at rest

Data stored on a device or medium (e.g., hard drive, USB stick) that should be protected with encryption to prevent access if the device is lost or stolen.

Data minimization

A privacy principle of collecting and retaining only the personal data necessary for a specified purpose, reducing risk and regulatory exposure.