Engineer Information Security flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely access. Controls are classified by the property they primarily protect, guiding risk analysis and control selection.

China PIPL sensitive data consent

China's Personal Information Protection Law requires separate, explicit consent to process sensitive personal information such as biometrics, medical records, financial accounts, location traces, and data of minors under fourteen.

MLPS 2.0 levels

China's GB/T 22239 classified protection scheme defines five security levels. Level 3 and above mandate periodic compliance assessment and filing with public security authorities, with stricter duties for critical information infrastructure operators.

Separation of duties

No single person can complete a high-risk transaction alone; duties are split so collusion is required to abuse the process. It limits insider fraud and accidental error in finance and administration.

TCP SYN flood

Attackers send many SYNs without completing the handshake, exhausting the server's connection backlog. SYN cookies mitigate by encoding connection state in the sequence number so no state is allocated until the ACK arrives.

TLS 1.3 forward secrecy

TLS 1.3 removed RSA key transport and static Diffie-Hellman, mandating ephemeral ECDHE. Session keys cannot be recovered even if the server's long-term private key is later compromised, and the handshake is one round trip.

IPsec AH versus ESP

AH (protocol 51) authenticates and integrity-protects packets but does not encrypt payloads. ESP (protocol 50) provides confidentiality plus integrity. IKE negotiates keys over UDP 500, with NAT traversal on UDP 4500.

802.1X EAP-TLS

Port-based network access control where both supplicant and authentication server present certificates. It resists password theft, unlike PEAP/MSCHAPv2, which authenticates only the server and transmits credential-derived material.

DNSSEC purpose

DNSSEC adds digital signatures to DNS records so resolvers can verify origin authenticity and integrity of answers. It does not encrypt queries and does not prevent denial-of-service or cache-poisoning of unsigned zones.

SELinux enforcing mode

The kernel denies any action not permitted by the loaded policy and logs the denial. Permissive mode logs violations without blocking. Type enforcement, expressed as user:role:type:level contexts, is the core mechanism.

Windows DACL evaluation

Access requests compare the token's security identifiers against access control entries in the object's discretionary ACL. Entries are evaluated in order, with explicit deny entries generally taking precedence over allow entries.

ASLR and DEP

Address space layout randomization randomizes memory addresses; data execution prevention marks pages non-executable. Return-oriented programming bypasses both by chaining existing executable code fragments, so neither is sufficient alone.

Linux setuid bit

A file with the setuid bit runs with the effective user ID of its owner rather than the invoking user. On root-owned binaries this is powerful, so setuid files must be inventoried and minimized.

SQL injection primary defense

Parameterized queries bind input as data, never as SQL syntax, so injected text cannot alter query structure. Input allow-listing and least-privilege database accounts are secondary layers, not substitutes.

Transaction isolation levels

Read Uncommitted permits dirty reads; Read Committed prevents them; Repeatable Read prevents non-repeatable reads; Serializable also prevents phantom reads. Higher isolation reduces concurrency and increases locking overhead.

Database inference attack

An attacker derives sensitive facts from legitimate aggregate queries without direct access. Countermeasures include minimum query-set size thresholds, result suppression, and adding calibrated noise to outputs.

Transparent data encryption limits

TDE encrypts database files and backups at rest but not data in transit or in memory. Anyone with database or OS-level access can read decrypted data, so it does not defend against a privileged insider.

OWASP A01 broken access control

The top-ranked web risk: users act outside intended permissions, including insecure direct object references and missing function-level checks. Fix by enforcing server-side authorization on every request and object.

Stored versus reflected XSS

Stored XSS persists the payload in the application, such as a comment field, and executes for every viewer. Reflected XSS bounces the payload off a single request. Both are stopped by context-aware output encoding.

CSRF token defense

A synchronizer token or double-submit cookie proves the request originated from the legitimate page. Combine with SameSite cookies and forbid state-changing GET requests to close the attack path.

SAST versus DAST

Static analysis inspects source code without running it, finding issues early with more false positives. Dynamic analysis tests a running application, catching runtime and configuration flaws but only on exercised paths.

AES-GCM nonce reuse

Reusing a nonce with the same key in GCM leaks the XOR of plaintexts and allows forgery of the authentication tag, destroying both confidentiality and integrity. Nonces must never repeat per key.

Digital signature properties

Signing hashes the message then encrypts with the signer's private key. Verification with the public key proves integrity, origin, and non-repudiation, but provides no confidentiality because the message stays readable.

Password hashing with salt

A unique random salt per user defeats precomputed rainbow tables, while a deliberately slow key derivation function such as bcrypt, scrypt, or Argon2id raises the cost of offline brute-force cracking.

FIDO2 phishing resistance

WebAuthn credentials are bound to the originating domain by the browser, so a lookalike site cannot replay them. This makes FIDO2 stronger than TOTP codes, which a real-time proxy can relay.

Risk ALE formula

Single loss expectancy equals asset value times exposure factor. Annualized loss expectancy equals single loss expectancy times annualized rate of occurrence, giving a monetary figure for cost-benefit comparison of controls.

RTO and RPO

Recovery time objective is the maximum acceptable downtime; recovery point objective is the maximum acceptable data loss measured in time. Both must fall within the maximum tolerable downtime from the business impact analysis.

ISO 27001 versus 27002

ISO/IEC 27001 states certifiable requirements for an information security management system. ISO/IEC 27002 provides implementation guidance and control detail but is not itself certifiable.

Order of volatility

Forensic collection proceeds from most to least volatile: processor registers and cache, memory, network connections, disk storage, then backups and archives. Capturing disk first can destroy evidence held only in memory.

Zero trust architecture

NIST SP 800-207 model where no implicit trust derives from network location. Each request is evaluated by a policy decision point using identity, device posture, and context, then enforced by policy enforcement points.

Cloud shared responsibility

The provider secures the underlying cloud infrastructure, while the customer secures data, identities, and configuration within it. In IaaS the customer carries more responsibility than in SaaS.

Post-quantum standards

NIST standardized ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) plus SLH-DSA (FIPS 205) for signatures. Harvest-now-decrypt-later attacks make migration urgent for long-lived secrets.