IIBA CCA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Cybersecurity analysis definition

The discipline of identifying, evaluating, and prioritizing information risk so security decisions support business objectives, producing documented findings that drive risk treatment and control selection.

Vulnerability versus threat

A vulnerability is a weakness that can be exploited; a threat is a potential cause of harm that may exploit it. Conflating the two misstates risk and leads to misprioritized remediation.

Risk exposure formula

Risk exposure combines likelihood of a threat event with the magnitude of resulting impact on the asset. Ratings are ordinal or monetary and must record the rationale behind each assigned value.

Single loss expectancy

SLE equals asset value multiplied by exposure factor, where exposure factor is the proportion of asset value lost in one incident. It estimates the cost of a single realized event.

Annualized loss expectancy

ALE equals SLE multiplied by annualized rate of occurrence. Comparing ALE before and after a proposed control quantifies expected savings and supports cost-benefit justification for the investment.

Qualitative risk matrix

A grid mapping likelihood categories against impact categories to produce a risk rating such as low, medium, or high. It is fast and consistent but depends on calibrated category definitions.

Risk treatment options

Four responses exist: mitigate by applying controls, transfer via insurance or contract, avoid by eliminating the activity, or accept and document the residual risk with accountable owner approval.

Residual risk

The risk remaining after controls are applied. It must be documented, owned, and compared against the organization's risk appetite to determine whether further treatment is required.

Risk appetite and tolerance

Risk appetite is the amount of risk an organization is willing to pursue or retain; tolerance is the acceptable variation around that level. Findings exceeding tolerance require escalation.

Defense in depth

Layering preventive, detective, and corrective controls across people, process, and technology so that failure of one control does not eliminate protection of the asset.

Control gap analysis

Mapping implemented controls against a selected framework's requirements to reveal uncovered risks. Output is a prioritized list of missing or ineffective controls, not a compliance certificate.

Threat modeling purpose

Systematically identifying assets, trust boundaries, entry points, and adversary capabilities during design so abuse cases and mitigations are built in before deployment rather than retrofitted.

STRIDE categories

Spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Each category prompts specific abuse-case questions per component and trust boundary.

Trust boundary

A line where data or control passes between components with different privilege or trust levels. Threat modeling concentrates analysis on these crossings because they concentrate attack opportunity.

Attack surface

The set of exposed entry points, interfaces, and services an adversary can reach. Reducing attack surface by removing unused services and tightening exposure lowers likelihood of exploitation.

Indicator of compromise

Observable evidence such as unusual hashes, domains, or account behavior suggesting intrusion. Indicators require context and corroboration before being treated as confirmed malicious activity.

False positive versus negative

A false positive flags benign activity as malicious; a false negative misses actual malicious activity. Detection tuning must weigh both because reducing one typically increases the other.

Log correlation

Combining events from multiple sources against a baseline to identify patterns a single source cannot reveal. Correlation quality depends on synchronized time and normalized field formats.

Baseline definition

A documented reference state of normal configuration or behavior. Deviations from baseline are candidate findings, and the baseline itself must be reviewed as the environment changes.

Business impact analysis

Analysis that identifies critical processes and their dependencies, then sets recovery time and recovery point objectives. Its outputs constrain continuity and resilience recommendations.

Recovery time objective

The maximum acceptable duration before a disrupted process must be restored. RTO drives architecture choices such as redundancy and failover, not merely backup frequency.

Recovery point objective

The maximum acceptable data loss measured in time before an incident. RPO determines backup and replication intervals needed to meet the business requirement.

Least privilege principle

Granting only the access necessary for a task and no more. Analysis tests whether entitlements match role requirements and flags excess privilege as elevated impact if credentials are compromised.

Separation of duties

Splitting critical tasks among different people so no single actor can complete a harmful action alone. It is a preventive control analyzed through role and entitlement review.

Asset inventory dependency

Risk analysis cannot exceed the completeness of the asset inventory. Unknown assets carry unassessed risk, so inventory discovery and ownership assignment precede meaningful assessment.

Data classification role

Labeling data by sensitivity and required handling. Classification determines applicable controls and impact ratings, so misclassification distorts every downstream risk calculation.

Root cause analysis

Determining the underlying condition that permitted a finding rather than only the symptom. Recurring findings usually indicate process or design causes that remediation at the symptom level cannot fix.

Risk register contents

A record of identified risks with description, owner, likelihood, impact, rating, treatment plan, and status. It is the authoritative traceable record linking findings to decisions.

Control effectiveness evaluation

Assessing whether a control is designed appropriately and operating as intended. Design effectiveness and operating effectiveness are separate conclusions requiring separate evidence.

Detection versus prevention

Preventive controls stop events; detective controls reveal them after the fact. Mature analysis requires both because no preventive control set is complete against all threats.

Key risk indicator

A measurable metric that signals rising or falling risk exposure, such as patch latency or privileged account count. Indicators must be tied to a threshold that triggers action.

Analysis finding structure

A complete finding states the condition observed, the criteria it violates, the risk and impact, and a recommended treatment with owner. Missing any element makes the finding unactionable.