ISC2 CSSLP flashcards
ISC2 CSSLP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Confidentiality
- Confidentiality ensures information is disclosed only to authorized subjects; controls include encryption, access control, and data classification.
- Integrity
- Integrity ensures data and systems are modified only in authorized ways; controls include hashing, digital signatures, checksums, and change control.
- Least privilege
- Least privilege grants each user or process the minimum access needed for its task, reducing the impact of accident, error, or compromise.
- Defense in depth
- Defense in depth places multiple independent controls across layers so that failure or bypass of one control does not expose the protected asset.
- Security gate
- A security gate is a lifecycle checkpoint with defined exit criteria that must be satisfied before work advances to the next phase.
- Risk management lifecycle
- Risk management lifecycle is the iterative process of identifying, assessing, treating, and monitoring risk until it is accepted, mitigated, transferred, or avoided.
- Security champion
- A security champion is a trained member of a development team who promotes secure practices and serves as a liaison to the security organization.
- Security metric
- A security metric quantifies program performance, such as vulnerability age, defect density, or mean time to remediate, to support management decisions.
- Abuse case
- An abuse case describes how an attacker or misuse actor could exploit system functionality, producing threats that complement normal use cases.
- Traceability matrix
- A requirements traceability matrix links each security requirement to design elements, implementation components, and verification evidence so coverage can be demonstrated.
- Data classification
- Data classification assigns sensitivity labels that determine handling, access, encryption, retention, and disposal requirements for information.
- Privacy requirement
- A privacy requirement constrains personal data processing through minimization, purpose limitation, consent, retention limits, and subject access rights.
- Trust boundary
- A trust boundary is a point where data or control passes between components with different privilege, ownership, or sensitivity, requiring validation and control.
- Fail-safe default
- Fail-safe default means access is denied unless explicitly permitted, and a control failure preserves protection rather than granting access.
- Separation of duties
- Separation of duties divides a sensitive process among multiple identities so no single person can complete it without detection or collusion.
- Attack surface
- Attack surface is the set of reachable interfaces, protocols, services, and data paths an attacker can use to interact with a system.
- Input validation
- Input validation checks that data meets expected format, type, length, and range using allow lists before the data is processed.
- Output encoding
- Output encoding converts untrusted data into a context-specific safe representation so browsers and interpreters treat it as data, not code.
- Parameterized query
- A parameterized query sends SQL code and data separately, preventing user input from altering query structure and causing injection.
- Static analysis
- Static analysis examines source code or binaries without executing them to find patterns associated with defects and vulnerabilities.
- Penetration test
- A penetration test is an authorized simulation of attacker techniques against a defined scope to identify exploitable weaknesses and validate controls.
- Fuzzing
- Fuzzing supplies malformed, random, or unexpected inputs to a program to trigger crashes, hangs, and input-handling defects.
- Security regression test
- A security regression test re-verifies a previously fixed vulnerability or control after changes to confirm the protection remains effective.
- Dynamic analysis
- Dynamic analysis tests a running application, observing behavior and inputs to detect runtime vulnerabilities such as injection or authentication flaws.
- Hardening
- Hardening reduces exposure by removing unnecessary services, accounts, protocols, and permissions and by applying secure configuration settings.
- Configuration baseline
- A configuration baseline is an approved set of settings for a system; drift detection compares current configuration against it.
- Incident response
- Incident response is a structured process of preparation, detection, containment, eradication, recovery, and lessons learned after a security event.
- Patch management
- Patch management identifies, tests, deploys, and verifies software updates, prioritizing by exploitability, exposure, and business impact.
- Software bill of materials
- A software bill of materials lists components, versions, licenses, and dependencies in an artifact so vulnerabilities and supply-chain risk can be tracked.
- Provenance attestation
- A provenance attestation records how, when, and where an artifact was built, supporting verification that it came from an approved process.
- Dependency pinning
- Dependency pinning fixes component versions and integrity hashes so builds use expected artifacts rather than unexpected substitutes.
- Third-party risk assessment
- Third-party risk assessment evaluates a supplier's security posture, provenance, incident history, and contractual controls before and during use.