ITIL 4 InfoSec flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Information security management practice

The ITIL 4 practice whose purpose is to protect the information used by the organization, ensuring confidentiality, integrity, and availability while supporting the organization's objectives and value creation.

Confidentiality, integrity, availability (CIA)

The three core information security objectives: information is accessible only to authorized parties, is accurate and complete, and is available when needed by authorized users.

Four dimensions of service management

Organizations and people, information and technology, partners and suppliers, and value streams and processes; each dimension must be assessed for security implications when designing and operating services.

Service value chain

Six interconnected activities (plan, improve, engage, design and transition, obtain and build, deliver and support) through which value is created; security activities are embedded across all of them.

Guiding principles

Seven ITIL 4 recommendations including focus on value, start where you are, progress iteratively with feedback, collaborate and promote visibility, think holistically, keep it simple, and optimize and automate.

Proportionate controls

Security controls sized to the value of the asset and the likelihood and impact of compromise; over-control adds cost and friction without reducing risk meaningfully.

Security value stream

The end-to-end flow from security demand to delivered protection, tracing requirements through design, build, transition, and operation so controls are not lost at handover.

Governance definition

The means by which an organization is directed and controlled; for security it sets direction, ensures objectives are met, verifies risk management, and confirms responsible resource use.

Evaluate, direct, monitor

The three governance activities: evaluate options and set direction, direct implementation through assignment and resourcing, and monitor performance and compliance against objectives.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives; set by the governing body and used to judge whether residual risk is acceptable.

Risk tolerance

The acceptable variation around the risk appetite; it defines the boundary beyond which action must be taken to bring risk back within acceptable limits.

Security policy hierarchy

A layered set of documents: policy states management intent and is mandatory; standards define specific requirements; procedures describe steps; guidelines are advisory recommendations.

Accountability in governance

The governing body remains ultimately accountable for information security; it may delegate execution to management but cannot delegate accountability for outcomes.

Security strategy

A document stating security objectives, risk appetite, and the high-level approach to achieving them, aligned with business strategy and legal and regulatory obligations.

Governance reporting

Timely, relevant, and decision-useful information provided to the governing body to confirm that security objectives are being achieved and risks are being managed.

Risk definition

The possible occurrence of an event that could cause harm or loss, or make it harder to achieve objectives; security risk concerns confidentiality, integrity, and availability of information.

Risk assessment

The process of identifying assets, threats, and vulnerabilities; estimating likelihood and impact; and evaluating the result against defined risk criteria to determine treatment priority.

Risk treatment options

Four choices: avoid the activity, mitigate by applying controls, transfer through insurance or contract, or accept and retain the risk with an informed decision.

Residual risk

The risk remaining after controls have been applied; it must be formally accepted by the accountable owner and recorded in the risk register.

Risk register

A record of each risk with identifier, description, owner, likelihood, impact, current controls, treatment plan, residual rating, and review date.

Risk criteria

The appetite, thresholds, and scoring scales defined before assessment so that ratings are consistent and comparable across the organization and over time.

Preventive, detective, corrective

Control types by purpose: preventive controls stop an event, detective controls identify it, and corrective controls limit damage and restore normal operation.

Least privilege

An access control principle under which identities receive only the minimum access required for their role, reviewed periodically to prevent accumulation of unnecessary rights.

Defense in depth

Layering multiple independent controls so that failure of one does not expose the asset; no single control or person should be a single point of compromise.

Segregation of duties

An administrative control that divides sensitive tasks among different people so no single individual can both commit and conceal a harmful action.

Change security impact assessment

A step in change enablement that evaluates whether a change introduces new vulnerabilities or bypasses existing controls before the change is approved.

Security awareness training

A preventive administrative control that reduces human-factor risk by improving recognition of threats such as phishing and correct handling of sensitive information.

Supplier security management

Embedding security requirements in contracts, performing due diligence before onboarding, and monitoring third-party security posture throughout the relationship lifecycle.

Security incident

A breach or suspected breach of information security; it is distinct from a service incident, though both can occur together and require coordinated response.

Containment before eradication

An incident response rule: limit the spread and impact of an incident first, then remove the cause, then recover, then learn from the event.

Chain of custody

Documented, unbroken record of who handled evidence and when, preserving integrity for potential legal or disciplinary proceedings through forensic copies and controlled access.

Post-incident review

A structured examination after an incident that identifies root causes and improvement actions, feeding problem management and the continual improvement practice.

Outcome-based security metrics

Measures such as reduced incident counts, time to detect and contain, and control effectiveness, preferred over activity volume because they show whether security objectives are achieved.