IIBF IT Security flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core information security objectives: confidentiality (only authorised parties access data), integrity (data is accurate and unaltered), and availability (systems and data are accessible when needed).

Multi-factor authentication

Authentication using two or more independent factor types drawn from knowledge, possession, and inherence. Two passwords are single-factor, because both are the same factor type.

Asymmetric encryption

Encryption using a mathematically related public and private key pair. The public key encrypts or verifies signatures; the private key decrypts or signs. Slower than symmetric, so used for key exchange.

Hash function

A one-way function mapping any input to a fixed-length digest. It detects accidental or deliberate alteration but provides no confidentiality and, without a key, no authenticity.

Spear phishing

A targeted phishing attack crafted for a specific individual using researched details such as role, colleagues, or ongoing projects, making the lure far more convincing than bulk phishing.

Defence in depth

Layering independent controls across people, process, and technology so that failure of any single control does not expose the asset. Examples include segmentation, patching, and monitoring.

Vulnerability versus exploit

A vulnerability is a weakness in a system; an exploit is the technique or code that abuses it. A threat is the actor or event that may trigger the exploit.

ISO/IEC 27001

The international standard specifying requirements for establishing, operating, and continually improving an information security management system, against which organisations can be independently certified.

Statement of Applicability

An ISMS document listing each applicable control, whether it is implemented, and the justification for inclusion or exclusion. It is a core ISO/IEC 27001 audit artefact.

Least privilege

Granting each user, process, or system only the minimum access rights needed to perform its function, and reviewing those rights periodically to remove accumulated excess.

Segregation of duties

Splitting a sensitive process so no single person controls all stages, such as initiation, approval, and reconciliation, reducing the chance of error or concealed fraud.

Data classification

Labelling information by sensitivity, typically public, internal, confidential, and restricted, so handling, storage, transmission, and retention rules follow automatically from the label.

Incident response phases

Preparation; detection and analysis; containment; eradication; recovery; and lessons learned. Evidence handling must maintain a documented chain of custody throughout.

RTO versus RPO

Recovery time objective is the maximum tolerable downtime before a process must be restored; recovery point objective is the maximum tolerable data loss measured backward in time.

PDCA cycle

Plan, Do, Check, Act: the continual improvement loop underpinning an ISMS, where controls are planned, implemented, monitored, and adjusted based on measured results.

Risk register

A structured record of identified risks, each with owner, cause, potential impact, existing controls, inherent and residual ratings, treatment decision, and review date.

Residual risk

The risk remaining after existing controls are applied. It must be compared against risk appetite and formally accepted by someone with the authority to do so.

Single loss expectancy

The monetary loss from one risk event, calculated as asset value multiplied by the exposure factor, which is the percentage of the asset damaged or lost.

Annualised loss expectancy

Expected yearly loss from a risk, calculated as single loss expectancy multiplied by annualised rate of occurrence, used to justify control spend quantitatively.

Compensating control

An alternative safeguard used when the primary control is impractical, intended to reduce the same risk to an acceptable level, with the gap documented and approved.

Key risk indicator

A forward-looking metric with defined thresholds that signals increasing exposure, such as rising failed-login rates or growth in unresolved high-severity findings.

Risk appetite versus tolerance

Risk appetite is the amount of risk the institution chooses to accept in pursuit of objectives; tolerance is the acceptable variation around that level for a specific risk category.

Business impact analysis

An exercise identifying critical business processes, their dependencies, and the impact of disruption over time, producing maximum tolerable downtime and recovery objectives.

Enhanced due diligence

Additional identity and source-of-funds checks applied to higher-risk customers, such as politically exposed persons or those in high-risk jurisdictions, beyond standard KYC.

Strong customer authentication

Authentication for electronic payments using two independent elements from knowledge, possession, and inherence, dynamically linked to the amount and the payee.

Tokenisation

Replacing a sensitive credential such as a card number with a surrogate token valid only in a defined domain, so the real value is not stored or transmitted.

Certificate pinning

A mobile app technique that trusts only a specific expected server certificate or public key, blocking interception via fraudulently issued certificates from other authorities.

Consent-based open banking

A model where the customer authorises a third party to access defined account data for a stated purpose and duration, with the right to revoke consent at any time.

Fraud triangle

A model explaining fraud as the coincidence of pressure or incentive, opportunity, and rationalisation. Removing opportunity through controls is the most direct preventive lever.

Account takeover

Fraud where an attacker gains control of a genuine customer account, often via credential theft, then changes contact details and adds payees to move funds.

Mule account

An account used to receive and layer illicit funds, frequently showing rapid in-and-out movement, many unrelated counterparties, and recent opening with high throughput.

Authorised push payment fraud

Fraud where the customer genuinely authorises a transfer to a fraudster, so authentication succeeds. Controls rely on payee verification, scam warnings, and behavioural checks.

Suspicious transaction report

A report filed to the financial intelligence unit when there are reasonable grounds to suspect laundering or related crime. The trigger is suspicion, not a fixed amount.