WBCHSE HS Cyber Security flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Core security model of Confidentiality (only authorized access), Integrity (only authorized modification) and Availability (reliable timely access). Controls are evaluated by which of the three properties they protect.

Phishing

Fraudulent message, usually email, that impersonates a trusted party to trick the recipient into revealing credentials, clicking a malicious link, or opening an infected attachment.

Ransomware

Malware that encrypts or locks access to files and systems, then demands payment for restoration. Recovery depends on offline, tested backups rather than on paying.

TCP three-way handshake

Connection setup sequence of SYN, SYN-ACK and ACK that synchronizes sequence numbers before data transfer. A half-open SYN flood abuses this process to exhaust server resources.

Private IP ranges

Non-routable IPv4 blocks 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, used inside local networks and translated to public addresses by NAT at the gateway.

Stateful firewall

Firewall that records active connections in a state table and permits return traffic belonging to an established session, unlike a simple packet filter that inspects each packet independently.

IDS versus IPS

An intrusion detection system monitors traffic and raises alerts passively. An intrusion prevention system sits inline and can block malicious traffic in real time.

Least privilege

Security principle that every user, service and process receives only the minimum access rights required for its function, limiting damage if an account or application is compromised.

chmod 644

Linux permission setting giving the owner read and write, and group and others read only. Common for ordinary files that should not be executable by anyone.

Secure Boot

UEFI feature that verifies digital signatures of bootloaders and kernel components before execution, blocking bootkits and unauthorized operating system replacement.

Symmetric encryption

Encryption using a single shared secret key for both encryption and decryption, such as AES. It is fast and suited to bulk data but requires secure key distribution.

Digital signature

Value produced by hashing a message and encrypting the hash with the sender's private key. Verification with the public key proves integrity, origin and non-repudiation.

Salt

Random value added to a password before hashing and stored alongside the result, so identical passwords produce different hashes and precomputed rainbow tables become ineffective.

SQL injection

Web flaw where untrusted input is concatenated into a database query and interpreted as SQL code, allowing data theft or modification. Parameterized queries prevent it.

Cross-site scripting

Injection of attacker script into pages viewed by other users, executed in their browser session. Prevented by contextual output encoding and a restrictive Content-Security-Policy.

CSRF

Cross-Site Request Forgery tricks a logged-in user's browser into submitting an unwanted state-changing request to a site. Anti-CSRF tokens and SameSite cookies mitigate it.

IT Act 2000

India's primary cyber law, amended in 2008, defining electronic records, digital signatures and offences such as identity theft, cheating by personation and cyber terrorism.

Chain of custody

Chronological record of who collected, handled and transferred evidence, with dates and signatures, proving that digital evidence was not altered and remains admissible.

Order of volatility

Forensic collection priority starting with the most perishable data: CPU registers and cache, memory, network connections and processes, then disk storage, then backups and archives.

Incident response phases

NIST lifecycle of Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity, with lessons learned feeding back into preparation.

RTO and RPO

Recovery Time Objective is the maximum acceptable downtime after disruption. Recovery Point Objective is the maximum acceptable data loss measured in time.

Risk treatment options

Four responses to identified risk: mitigate by adding controls, transfer through insurance or contract, avoid by stopping the activity, or accept with documented management approval.

Shared responsibility model

Cloud division of duties: the provider secures infrastructure, hypervisor and physical facilities, while the customer secures data, identities, access configuration and application code.

Zero Trust

Security model that grants no implicit trust based on network location; every request is authenticated, authorized and logged, assuming the network may already be compromised.

Prompt injection

Attack on large language model applications where crafted input overrides system instructions, causing the model to leak data or perform unintended actions.

CVSS base score

Standard 0.0 to 10.0 severity rating built from exploitability and impact metrics. Ranges map to Low, Medium, High and Critical, but asset context still guides prioritization.

SIEM

Security Information and Event Management platform that centralizes logs from many sources, correlates events and generates alerts for analyst investigation in a SOC.

Write blocker

Hardware or software device that allows read-only access to a storage drive during forensic imaging, preventing any modification of the original evidence.

Parameterized query

Database query where placeholders separate SQL structure from user-supplied values, so input is treated as data and cannot alter query logic, preventing injection.

Nmap SYN scan

Port scanning technique sending TCP SYN packets and evaluating responses without completing the handshake, identifying open ports quickly and with less logging on the target.

Default credentials risk

IoT and network devices shipped with well-known admin usernames and passwords are mass-scanned and recruited into botnets. Credentials must be changed at installation.

Hash function properties

One-way, deterministic, fixed-length output with collision resistance. Used for integrity verification, password storage and digital signatures, but never for confidentiality.