CC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Property that information is not disclosed to unauthorized individuals, processes, or devices; enforced by encryption, access controls, and data classification.

Integrity

Assurance that data has not been altered or destroyed in an unauthorized way; supported by hashing, digital signatures, checksums, and controlled change management.

Availability

Guarantee that systems and data are accessible to authorized users when required; achieved through redundancy, backups, fault tolerance, and denial-of-service protection.

Risk

The likelihood that a threat exploits a vulnerability multiplied by the resulting impact; commonly stated as risk equals threat times vulnerability times impact.

Least privilege

Principle that a subject receives only the access rights required to perform its task, and only for the time needed, limiting the damage from compromise.

Defense in depth

Layering independent preventive, detective, and corrective controls so that the failure of any single control does not expose the protected asset.

Due care vs due diligence

Due diligence is the ongoing identification and assessment of risk; due care is the reasonable action an organization then takes to address those identified risks.

Policy

High-level management statement of intent and mandatory direction; standards, procedures, and guidelines are derived from it and must remain consistent with it.

Standard

Mandatory, specific, measurable requirement such as an approved encryption algorithm or minimum password length that supports and enforces a policy.

Annualized Loss Expectancy

ALE equals Single Loss Expectancy multiplied by the Annualized Rate of Occurrence; it estimates yearly financial exposure and justifies spending on controls.

Data owner

Senior manager accountable for a data set who assigns its classification and approves access; day-to-day protection is delegated to the data custodian.

RTO vs RPO

Recovery Time Objective is the maximum tolerable downtime for a process; Recovery Point Objective is the maximum tolerable data loss, measured as time since the last backup.

Risk treatment options

Four responses to assessed risk: avoid by eliminating the activity, mitigate by applying controls, transfer through insurance or contract, or accept and monitor.

Authentication vs authorization

Authentication proves a claimed identity using factors such as passwords, tokens, or biometrics; authorization then determines which resources and actions that identity is permitted.

Three authentication factors

Something you know such as a password or PIN, something you have such as a token, and something you are such as a fingerprint; MFA requires two or more distinct types.

Role-based access control

Grants permissions to job roles instead of individuals; users inherit the rights of the roles assigned to them, simplifying administration and periodic access reviews.

Mandatory access control

Labels objects with sensitivity levels and subjects with clearances; the operating system, not the resource owner, enforces every access decision.

Discretionary access control

Lets the owner of a resource decide who else may access it, usually implemented with access control lists attached to files and folders.

Single sign-on

Lets a user authenticate once and reach multiple applications without re-entering credentials, reducing password fatigue but concentrating risk in one credential.

Separation of duties

Splitting a sensitive task across two or more people so that no single individual can complete a fraudulent or damaging action alone.

OSI model layers

Seven-layer reference model: physical, data link, network, transport, session, presentation, and application; each layer has its own attacks and matching controls.

Stateful firewall

Firewall that records connection state in a table and permits return traffic for established sessions while blocking unsolicited inbound packets.

Shared responsibility model

In cloud, the provider secures physical infrastructure and the service platform; the customer remains responsible for data, identities, configuration, and access regardless of service model.

IaaS vs SaaS

In IaaS the customer manages operating systems, middleware, and applications; in SaaS the provider manages the full stack and the customer manages only data and users.

Zero trust

Security model that grants no implicit trust based on network location and verifies every request using identity, device posture, and policy before allowing access.

Transport Layer Security

Encrypts data in transit, authenticates the server with an X.509 certificate, and negotiates symmetric session keys during the handshake.

Incident response phases

NIST lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity including lessons learned and report updates.

Order of volatility

Priority for collecting evidence from most to least volatile: CPU registers and cache, memory, network connections, disk storage, removable media, and backups.

Chain of custody

Chronological record of who handled evidence, when, where, and why, keeping it unaltered and admissible from seizure through analysis to court.

IDS vs IPS

An IDS passively monitors copies of traffic and alerts on suspected intrusions; an IPS is inline and can block malicious traffic automatically.

SIEM

Security information and event management collects and correlates logs from many sources, producing alerts and supporting investigation and compliance reporting.

3-2-1 backup rule

Keep at least three copies of data, on two different media types, with one copy stored offsite or offline to survive ransomware and site disasters.