ATP 108 flashcards

38 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

A model describing the three core security objectives: confidentiality (authorized access only), integrity (accuracy and completeness), and availability (timely and reliable access).

Threat

Any potential cause of an unwanted incident that could harm an asset, such as an attacker, malware, or natural disaster.

Vulnerability

A weakness in a system, process, or control that a threat could exploit to cause harm.

Risk

The combination of the likelihood of a threat exploiting a vulnerability and the resulting impact on the organization.

Least Privilege

A principle requiring that users and systems receive only the minimum access rights needed to perform their functions, for the minimum necessary time.

Defense in Depth

A strategy of layering multiple independent controls so that the failure of one control does not result in total compromise.

Separation of Duties

A control that divides critical tasks among different individuals so no single person can complete a sensitive transaction alone.

Asset Classification

The process of categorizing information assets by sensitivity and criticality to determine appropriate handling and protection requirements.

NIST CSF Functions

The core functions of the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover, with Govern added in CSF 2.0.

ISO/IEC 27001

An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).

Risk Treatment Options

The four ways to handle risk: mitigate (reduce), transfer (share, e.g., insurance), avoid (eliminate the activity), or accept (retain).

Residual Risk

The risk remaining after controls have been applied; it equals inherent risk minus the risk reduction achieved by controls.

Zero Trust

A security model based on verify explicitly, use least privilege access, and assume breach, rather than trusting users or devices by network location.

CIS Controls

A prioritized set of safeguards for cyber defense; Implementation Group 1 provides the minimum baseline for small or low-risk organizations.

Three Lines Model

A governance structure where management owns risk (first line), risk and compliance functions oversee it (second line), and internal audit provides independent assurance (third line).

Single Loss Expectancy

The monetary loss from a single incident, calculated as asset value multiplied by exposure factor (SLE = AV × EF).

Annualized Loss Expectancy

The expected yearly loss from a risk, calculated as single loss expectancy multiplied by annualized rate of occurrence (ALE = SLE × ARO).

Business Impact Analysis

A process that identifies critical business functions and determines recovery time objectives (RTO) and recovery point objectives (RPO).

Incident Response Lifecycle

A structured process with phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.

Change Management

A controlled process for requesting, assessing, approving, testing, implementing, and reviewing changes to systems and configurations.

3-2-1 Backup Rule

A backup strategy requiring at least three copies of data, on two different media types, with one copy stored offsite.

Vulnerability Management Cycle

The ongoing process of discovering, prioritizing, remediating, verifying, and reporting vulnerabilities in an environment.

Stateful Firewall

A firewall that tracks the state of active connections and permits return traffic belonging to an allowed session.

IDS vs IPS

An intrusion detection system monitors and alerts on suspicious activity, while an intrusion prevention system can block it inline.

SIEM

Security information and event management software that aggregates logs, correlates events, and generates alerts for detection and compliance reporting.

Symmetric Encryption

Encryption using a single shared key for both encryption and decryption; it is fast and suited to bulk data protection.

Asymmetric Encryption

Encryption using a public/private key pair; the public key encrypts or verifies signatures, and the private key decrypts or signs.

Multi-Factor Authentication

Authentication requiring two or more factors from different categories: something you know, something you have, or something you are.

Role-Based Access Control

An access control model that grants permissions based on a user's job role rather than individual identity.

GDPR

An EU regulation governing the processing of personal data of EU residents, based on principles including lawfulness, data minimization, and accountability.

HIPAA Security Rule

A U.S. regulation requiring administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information.

PCI DSS

A standard for organizations that store, process, or transmit cardholder data, covering secure networks, data protection, vulnerability management, access control, monitoring, and policy.

SOX Section 404

A U.S. requirement that management assess and external auditors attest to the effectiveness of internal controls over financial reporting.

NIST SP 800-53

A catalog of security and privacy controls for federal information systems, used to select controls based on risk.

Breach Notification (GDPR)

A requirement to notify the supervisory authority of a personal data breach within 72 hours of becoming aware, where required.

Professional Skepticism

An attitude of questioning and verifying assertions with evidence rather than relying solely on management representations.

Conflict of Interest

A situation where a professional's personal or financial interests could impair objectivity; it must be disclosed and managed or recused.

Due Professional Care

The obligation to act competently, use accepted methodologies, document work, and maintain skills through continuing education.