ICDL IT Security flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality, integrity and availability: the three core security properties that controls aim to protect. Confidentiality prevents unauthorised disclosure, integrity prevents unauthorised modification, availability ensures timely access.

Vulnerability vs threat

A vulnerability is a weakness in a system, while a threat is anything capable of exploiting that weakness. Risk combines the likelihood of exploitation with the resulting impact.

Least privilege

A principle granting each user or process only the access needed for its task, for the shortest time required. It limits the damage an account compromise can cause.

Defence in depth

Layering multiple independent security controls so that the failure of one layer does not expose the whole system. Examples include firewalls, antivirus and user training together.

Authentication vs authorisation

Authentication confirms who a user is, while authorisation decides what that authenticated user may do. Authentication precedes authorisation in any access decision.

Non-repudiation

The assurance that a party cannot credibly deny having performed an action. It is achieved through digital signatures and tamper-evident audit logs.

Computer virus

Malicious code that attaches itself to a host file or program and spreads when that host is executed, typically requiring some user action.

Worm

Self-replicating malware that spreads across networks without needing a host file or user action, often exploiting unpatched services and consuming bandwidth.

Trojan horse

Malware disguised as legitimate software that users are tricked into installing. It does not self-replicate but may open a backdoor for attackers.

Ransomware

Malware that encrypts or locks access to data and demands payment for restoration. Offline, tested backups are the most reliable recovery control.

Spear phishing

A targeted phishing message crafted for a specific individual or organisation using personal details to appear credible. It is narrower and harder to spot than bulk phishing.

Rootkit

Malware that conceals its presence at a privileged system level, often hiding files and processes. Detection may require offline or boot-time scanning.

Logic bomb

Malicious code that lies dormant and triggers its payload when a specified condition occurs, such as a date or the removal of a user account.

Zero-day exploit

An attack using a vulnerability for which no patch yet exists. Because no signature is available, behaviour-based detection is more effective than signature matching.

Firewall

A device or software that filters network traffic against rules based on address, port and protocol. Stateful firewalls also track the state of active connections.

HTTPS and TLS

HTTPS wraps web traffic in TLS, providing encryption, integrity checking and server authentication via a certificate. A padlock indicates a valid TLS session.

VPN

A virtual private network creates an encrypted tunnel between a device and a remote endpoint over an untrusted network, protecting data in transit against interception.

WPA2 and WPA3

Current Wi-Fi security standards that encrypt wireless traffic and authenticate clients. Older WEP encryption is broken and offers no meaningful protection.

Private IP address ranges

Address blocks 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are reserved for internal networks. They are not routed on the internet and reach it via NAT.

Pharming

Redirection of users to fraudulent websites through manipulation of DNS records or a local hosts file, so a correctly typed address still reaches an attacker's site.

Man-in-the-middle attack

An attacker secretly intercepts and possibly alters traffic between two parties. Certificate validation and encrypted channels are the main countermeasures.

Port scanning

Probing a host's network ports to discover which services are listening. Closing unused ports reduces the attack surface available to an intruder.

Multi-factor authentication

Authentication combining at least two different categories: something you know, something you have, or something you are. Two passwords do not count as multi-factor.

Role-based access control

An access model where permissions are assigned to job roles and users inherit them through role membership. It simplifies administration and supports least privilege.

Password salting and hashing

Storing passwords as salted hashes with a deliberately slow algorithm so identical passwords produce different hashes and precomputed tables cannot be reused.

Data controller vs processor

The controller determines why and how personal data is processed, while the processor handles it on the controller's instructions. Legal responsibility rests mainly with the controller.

Data minimisation

Collecting and retaining only the personal data necessary for a stated purpose, reducing both breach impact and regulatory exposure.

Breach notification window

Under the GDPR, a personal data breach likely to risk individuals' rights must be reported to the supervisory authority within 72 hours of the controller becoming aware.

3-2-1 backup rule

Keep three copies of data on two different media types, with one copy stored offsite. This protects against ransomware, hardware failure and site disasters.

URL inspection rule

To judge a link, read the exact domain immediately before the first single slash after the scheme, and watch for look-alike or extra subdomain spellings.

Suspicious email signs

Unexpected urgency, requests for credentials or payment, mismatched sender addresses and unsolicited attachments indicate possible phishing regardless of apparent sender.

Public Wi-Fi risk

Open wireless networks are untrusted, so traffic may be intercepted. Use HTTPS and a VPN rather than assuming the network is safe.

Digital footprint

The persistent trail of information a person leaves online. Content may be copied or indexed, so privacy settings and posting choices have lasting effects.