GSTP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security steering committee

A cross-functional governance body that sets security strategy, prioritizes investments, resolves escalations, and ensures alignment with business objectives and risk appetite.

Risk appetite statement

A formal declaration of the amount and type of risk an organization is willing to accept in pursuit of its objectives, including qualitative and quantitative thresholds.

Policy exception process

A documented workflow for requesting, reviewing, approving, and time-limiting deviations from security policy, including risk acceptance by an authorized owner.

NIST CSF tiers

Four implementation tiers (Partial, Risk-Informed, Repeatable, Adaptive) describing how an organization manages cybersecurity risk and integrates it with business processes.

Security balanced scorecard

A performance measurement framework that tracks security from four perspectives: financial, customer/stakeholder, internal process, and learning and growth.

RACI matrix

A responsibility assignment chart that defines who is Responsible, Accountable, Consulted, and Informed for each security activity or decision.

Annualized loss expectancy (ALE)

The expected yearly financial loss from a risk, calculated as annualized rate of occurrence (ARO) multiplied by single loss expectancy (SLE).

Risk treatment options

Four standard responses to risk: mitigate (reduce), transfer (share, e.g., insurance), avoid (eliminate activity), and accept (retain with documented approval).

Business impact analysis (BIA)

A process that identifies critical business functions and their dependencies, and determines recovery time objectives (RTO) and recovery point objectives (RPO).

Key risk indicator (KRI)

A forward-looking metric with defined thresholds that provides early warning of increasing risk exposure, enabling proactive management action.

Defense in depth

A layered security strategy that uses multiple overlapping preventive, detective, and corrective controls so that failure of one control does not compromise the whole.

Risk register

A central repository documenting identified risks, their owners, likelihood and impact scores, treatment plans, status, and residual risk after controls.

Zero Trust architecture

A security model that assumes no implicit trust based on network location; every access request is authenticated, authorized, and continuously validated.

Shared responsibility model

A cloud security framework delineating which security controls are managed by the cloud provider versus the customer, varying by service model (IaaS, PaaS, SaaS).

STRIDE threat model

A threat classification scheme: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege, used during design reviews.

Micro-segmentation

A network security technique that divides data centers and cloud environments into granular security zones, applying least-privilege policies to individual workloads.

Privileged access management (PAM)

A set of controls (vaulting, session recording, just-in-time access) that secure, monitor, and audit accounts with elevated administrative privileges.

Shift-left security

Integrating security activities (threat modeling, code scanning, testing) early in the software development lifecycle to find and fix defects at lower cost.

SASE

Secure Access Service Edge: a cloud-delivered architecture combining network security (SWG, CASB, FWaaS, ZTNA) with WAN capabilities to secure distributed access.

Kotter’s 8-step model

A change leadership framework: create urgency, form coalition, create vision, communicate, empower action, generate short-term wins, consolidate gains, anchor changes.

ADKAR model

A change management model focused on individual transitions: Awareness, Desire, Knowledge, Ability, and Reinforcement, used to diagnose and address change barriers.

Stakeholder influence-interest grid

A tool that maps stakeholders by their power to affect a change and their interest in it, guiding tailored engagement and communication strategies.

Security culture survey

A structured assessment measuring employee attitudes, beliefs, and behaviors regarding security, used to identify cultural gaps and track improvement over time.

Change fatigue

A state of apathy or resistance resulting from too many concurrent or poorly sequenced change initiatives, reducing adoption and increasing risk of failure.

Champion network

A group of influential employees at various levels who advocate for and support a change initiative, providing peer-to-peer communication and feedback.

Incident response lifecycle

The phases of handling a security incident: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Mean time to detect (MTTD)

The average elapsed time between the occurrence of a security incident and its detection by monitoring or reporting mechanisms.

Mean time to respond (MTTR)

The average time from incident detection to containment or resolution, a key operational metric for security response effectiveness.

Vulnerability management SLA

A defined timeframe for remediating vulnerabilities based on severity (e.g., critical within 15 days), used to track and enforce remediation performance.

SIEM

Security Information and Event Management: a platform that aggregates and correlates logs from multiple sources to detect and alert on security events.

SMART metrics

Performance indicators that are Specific, Measurable, Achievable, Relevant, and Time-bound, ensuring clarity and accountability in security reporting.

Purple team exercise

A collaborative simulation where red team (attack) and blue team (defense) work together to test and improve detection and response capabilities.