ISSEP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Verification vs validation

Verification confirms the system meets its specified requirements (built right); validation confirms it meets stakeholder needs and intended use (right system built). Both are required before authorization.

Traceability matrix

A mapping linking each security requirement to design elements, implementation artifacts, and a verification method such as test, analysis, inspection, or demonstration. It proves completeness and supports change impact analysis.

Security Assessment Report

A document recording assessment findings, control effectiveness, residual risk, and recommendations. It informs the authorizing official's risk decision but does not itself grant authorization.

Configuration baseline

An approved, documented set of configuration items under formal change control. Security-relevant changes must be evaluated against the baseline before approval and implementation.

Cost of late defect repair

Defects found in operations cost far more to fix than those found in requirements or design. This heuristic justifies early security review and threat modeling.

LPTA source selection

Lowest-price-technically-acceptable award. Appropriate when requirements are commodity-like; poor fit when security differentiation matters, since it rewards minimum compliance.

Firm-fixed-price contract

A contract type where the seller bears cost-overrun risk and the buyer pays a set price. Requires well-defined requirements, so security scope must be precisely specified.

Statement of work security clauses

Contract language specifying security controls, verification evidence, audit rights, and acceptance criteria. Vague clauses produce unenforceable obligations and disputed deliverables.

Supply chain risk management

Identifying and controlling risks from vendors, components, and services, including counterfeit parts, compromised software, and subcontractor access. Requires provenance, SBOM, and flow-down requirements.

Right-to-audit clause

A contractual provision letting the buyer examine the seller's security practices and evidence. It provides ongoing assurance after award and supports remediation of discovered deficiencies.

Acceptance testing

Verification performed before final acceptance that delivered systems meet contract requirements, including security configuration. Failures may delay payment or trigger corrective action.

Annualized loss expectancy

ALE = single loss expectancy x annualized rate of occurrence. It estimates expected yearly loss for an asset-threat pair and supports cost-benefit comparison of controls.

Risk treatment options

Mitigate (reduce), transfer (insure or contract), avoid (eliminate activity), or accept (retain with owner approval). Each choice must be documented with rationale and review date.

Risk register

A log of identified risks with description, threat source, affected assets, likelihood and impact scores, treatment, owner, and review date. It is the operational record of risk decisions.

Continuous monitoring

Ongoing collection of configuration, vulnerability, and control-effectiveness data to detect drift and new risk. Findings feed the POA&M and risk register for treatment.

Incident response phases

Preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Evidence handling must preserve chain of custody throughout.

Mean time to detect

Average elapsed time between an incident's occurrence and its discovery. Lower MTTD shortens attacker dwell time and is a core security operations metric.

System security plan

A document describing the system boundary, environment, and control implementations. It is primary authorization evidence and must reflect actual configuration, not intended design.

Recovery time objective

The maximum tolerable downtime before a function's loss becomes unacceptable. It drives recovery strategy selection and is set by business impact analysis.

Recovery point objective

The maximum tolerable data loss measured in time. It determines backup frequency and replication design; a lower RPO generally raises cost.

Business impact analysis

An analysis identifying critical functions, dependencies, and outage tolerances. It precedes contingency strategy selection so recovery investments match actual business need.

Hot, warm, cold sites

Alternate processing sites ranked by readiness: hot (near-immediate failover), warm (hours to days), cold (days to weeks). Cost increases with readiness level.

System boundary definition

The documented scope of a system including assets, interfaces, and data flows. It determines which controls apply and which authorization evidence is required.

Well-formed requirement criteria

Necessary, unambiguous, complete, singular, feasible, verifiable, and bounded. Words like 'should' or 'consider' make security requirements untestable and unenforceable.

STRIDE threat model

A threat categorization: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Each category suggests specific mitigating controls.

Security assurance requirements

Requirements about evidence of correctness rather than behavior, such as testing depth, configuration management rigor, and vulnerability analysis. They raise confidence in functional requirements.

Reference monitor properties

Complete mediation of every access, tamper-proofness, and verifiability. These properties underlie trusted computing base design and mandatory access control enforcement.

Least privilege

Granting each subject only the access needed for its function, for only as long as needed. It limits blast radius from compromise and supports separation of duties.

Fail-safe defaults

Access decisions default to denial unless explicitly permitted. This design principle prevents unauthorized access when policy is missing, ambiguous, or a component fails.

Access control model selection

DAC for owner-managed resources, MAC for classified or label-driven data, RBAC for role-structured organizations, ABAC for fine-grained attribute and context policy at scale.

MFA factor categories

Something you know, have, or are. Multi-factor authentication requires factors from different categories; repeating one category does not constitute MFA.

Cryptographic algorithm roles

Symmetric algorithms such as AES encrypt bulk data; asymmetric algorithms such as RSA and ECC handle key exchange and signatures; SHA-2 and SHA-3 provide integrity hashing.