SSCP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality, integrity, availability

The three core security objectives: preventing unauthorized disclosure, preventing unauthorized modification, and ensuring timely and reliable access to data and services.

Defense in depth

A layered control strategy in which multiple independent safeguards protect an asset, so the failure of any single control does not expose that asset.

Least privilege

A principle granting users and processes only the access rights required to perform their assigned tasks, and only for the period those tasks require.

Due care versus due diligence

Due care is the reasonable protection actually implemented; due diligence is the ongoing verification and review that those protections remain adequate and current.

Policy, standard, procedure, guideline

Policy states mandatory management intent; a standard sets specific mandatory requirements; a procedure gives step-by-step instructions; a guideline offers discretionary advice.

Identification versus authentication

Identification is the act of claiming an identity, such as entering a username; authentication is proving that claim using one or more credential factors.

Mandatory access control

An access model in which the system, not the data owner, decides access by comparing subject clearance labels with object classification labels, as in multilevel security.

Role-based access control

An access model that assigns permissions to roles rather than to individuals; users acquire rights by being placed into the appropriate role.

Kerberos ticket-granting ticket

A credential issued by the Kerberos KDC after initial authentication; the client presents it to obtain service tickets without resending the password.

Crossover error rate

The biometric threshold at which the false acceptance rate equals the false rejection rate, used to compare the overall accuracy of biometric systems.

Single loss expectancy

The monetary loss from one realized incident, calculated as asset value multiplied by the exposure factor, the percentage of the asset damaged.

Annualized loss expectancy

The expected yearly cost of a risk, calculated by multiplying the single loss expectancy by the annualized rate of occurrence for that risk.

Qualitative risk assessment

A ranking approach that uses ordinal scales such as high, medium, and low instead of precise monetary values, useful when reliable loss data is unavailable.

Recovery time objective

The maximum acceptable duration of downtime after a disruption before business impact becomes unacceptable; it drives recovery planning and resource prioritization.

STRIDE threat model

A threat classification covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, applied during design reviews.

Order of volatility

A forensic collection rule ranking evidence by how quickly it disappears, from CPU registers and memory down to disk and archival backups; collect the most volatile first.

Chain of custody

Documentation recording who collected, handled, and transferred evidence, along with when and why, so its integrity can be defended in legal proceedings.

Differential backup

A backup that copies every file changed since the last full backup; restoring requires the last full backup plus the most recent differential.

Hot site

A fully equipped alternate facility with current data and systems that can take over operations almost immediately after a disruption, at high ongoing cost.

Digital signature

A hash of a message encrypted with the sender's private key; the recipient verifies it with the public key, proving integrity and origin of the message.

Symmetric key distribution problem

Because both parties share a single secret key, every pair of users needs a secure channel to exchange it, which does not scale to large groups.

Certificate revocation list

A CA-published list of certificates revoked before their expiration date; OCSP provides a faster per-certificate query as an alternative.

HMAC

A message authentication code built from a hash function and a shared secret key, providing integrity and authenticity without encrypting the underlying data.

Cipher block chaining mode

A block cipher mode that XORs each plaintext block with the previous ciphertext block, so identical plaintext blocks produce different ciphertext output.

Stateful firewall

A firewall that tracks connection state and automatically allows return traffic for sessions it has already permitted, rather than judging every packet in isolation.

IPsec tunnel mode

An IPsec mode that encapsulates and encrypts the entire original packet inside a new packet, typically used for gateway-to-gateway virtual private networks.

DMARC

An email policy record that tells receivers how to handle messages failing SPF or DKIM checks and aligns those results with the visible From domain.

Network segmentation

Dividing a network into zones with controlled traffic between them, limiting lateral movement and containing the impact of a compromise.

SQL injection prevention

Using parameterized queries or prepared statements so user input is treated purely as data and never concatenated into executable SQL statements.

Cloud shared responsibility

A division of security duties in which the provider secures the underlying infrastructure while the customer secures data, identities, and configuration settings.

Application allowlisting

A control that permits only explicitly approved executables to run on a system, blocking all other software including previously unknown malware.

Rootkit

Malware that conceals its presence and privileged access by altering operating system or kernel structures, often hiding files, processes, and network connections.