ISACA CSX Fundamentals flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely access; controls are classified by which property they protect.

Risk formula

Risk is commonly expressed as likelihood multiplied by impact; residual risk is what remains after controls are applied and accepted by management.

Authentication vs authorization

Authentication verifies claimed identity using credentials; authorization determines which resources and actions that identity may access after authentication succeeds.

Least privilege

Granting each user or process only the access needed for its task, reducing the impact of compromise or misuse and limiting lateral movement.

Defense in depth

Layering preventive, detective, and corrective controls so that failure of one control does not expose the asset; no single control is assumed sufficient.

Symmetric encryption

Encryption using one shared secret key for both encryption and decryption, such as AES; it is fast and suited to bulk data but requires secure key distribution.

Asymmetric encryption

Encryption using a public and private key pair, such as RSA or ECC; it supports key exchange and digital signatures but is slower than symmetric encryption.

Hashing

A one-way function producing a fixed-length digest used for integrity checks; it is not reversible and does not provide confidentiality by itself.

Digital signature

A hash encrypted with the sender's private key; verification with the sender's public key provides integrity, authentication, and non-repudiation.

Phishing

Deceptive messages that trick recipients into revealing credentials or executing malware; spear phishing is targeted and whaling targets senior executives.

Ransomware

Malware that encrypts or locks data and demands payment for restoration; offline or immutable backups are the primary recovery control.

Worm vs virus

A virus requires a host file and user action to spread; a worm self-propagates across networks without user interaction, making it faster spreading.

Firewall

A control that permits or denies network traffic based on rules such as address, port, and protocol; default-deny inbound is a common baseline.

IDS vs IPS

An intrusion detection system monitors and alerts on suspicious traffic; an intrusion prevention system sits inline and can block detected traffic.

Multi-factor authentication

Authentication requiring factors from different categories such as knowledge, possession, and inherence; two passwords count as only one factor.

Access control models

DAC lets owners set permissions, MAC enforces central labels, RBAC grants by role, and ABAC evaluates attributes of subject, object, and context.

Vulnerability scanning

Automated identification of known weaknesses and missing patches across assets; it is broad and frequent but does not chain exploits like penetration testing.

Penetration testing

Authorized simulation of an adversary to exploit weaknesses and assess business impact; it is deeper and less frequent than vulnerability scanning.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned; containment limits spread before eradication removes the cause.

Chain of custody

Documentation of who handled evidence, when, and why; an unbroken chain supports admissibility and evidentiary value in investigations.

Order of volatility

Forensic collection priority from most to least volatile: registers and cache, memory, network state, disk, and archival media.

RTO and RPO

Recovery time objective is the maximum tolerable downtime; recovery point objective is the maximum tolerable data loss measured in time.

Business impact analysis

Identifies critical processes and dependencies and derives RTO and RPO values used to select recovery strategies and justify continuity investment.

Policy vs standard vs procedure

Policy states mandatory management intent, standards specify mandatory requirements, procedures give step-by-step instructions, and guidelines are recommended practices.

Due care vs due diligence

Due care is acting on identified risk; due diligence is ongoing verification that controls work, evidenced through assessments and audits.

Risk treatment options

Mitigate by applying controls, transfer through insurance or contracts, avoid by eliminating the activity, or accept and document the residual risk.

Zero trust

A model that removes implicit trust based on network location and verifies every request using identity, device posture, and policy evaluation.

Shared responsibility model

In cloud computing the provider secures underlying infrastructure while the customer secures data, identities, configurations, and access according to service model.

Data classification

Assigning labels such as public, internal, confidential, and restricted to drive handling, retention, encryption, and access requirements.

SIEM

Security information and event management aggregates and correlates logs from many sources to detect anomalies and support investigation and compliance reporting.

Patch latency

The time between a vendor releasing a security patch and its deployment; exceptions require documented risk acceptance with an expiry date.

Security control types

Preventive controls stop events, detective controls identify them, corrective controls repair after them, and compensating controls substitute for primary controls.