LPI Security Essentials flashcards
LPI Security Essentials · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA triad
- The three core security goals: confidentiality (no unauthorized disclosure), integrity (no unauthorized modification), and availability (timely access for authorized users).
- Risk
- The combination of the likelihood that a threat exploits a vulnerability and the resulting impact on the organization; used to prioritize controls.
- Defense in depth
- Layering independent controls across physical, network, host, application, and data levels so that one failed control does not expose the asset.
- Least privilege
- Granting each user or process only the permissions strictly needed for its task, for the shortest necessary time, limiting blast radius after compromise.
- Worm vs. virus
- A virus needs a host file and usually user action to spread; a worm self-propagates across networks without user interaction, exploiting reachable services.
- Fail-safe default
- A design rule where access is denied when a control cannot make a decision, so errors favor security rather than exposure.
- Symmetric encryption
- Encryption where sender and receiver share one secret key, such as AES or ChaCha20; fast for bulk data but hard to distribute securely.
- Asymmetric encryption
- Encryption using a public/private key pair such as RSA or ECC; it solves key distribution and enables signatures but is far slower than symmetric ciphers.
- Hybrid encryption
- Using asymmetric crypto to exchange a random symmetric session key, then encrypting the payload with a fast cipher such as AES-GCM.
- Password hashing KDF
- A deliberately slow, salted function such as Argon2id, scrypt, bcrypt, or PBKDF2 used to store passwords so offline cracking remains expensive.
- HMAC
- A keyed hash using a shared secret that verifies message integrity and authenticity between two parties, but does not provide non-repudiation.
- Digital signature
- A value computed with a private key and verified with the matching public key, proving integrity, origin, and non-repudiation.
- AEAD
- Authenticated encryption with associated data, such as AES-GCM or ChaCha20-Poly1305, which provides confidentiality and integrity in a single operation.
- Forward secrecy
- A property of ephemeral key exchange in TLS 1.3 where compromise of the long-term private key does not decrypt past recorded sessions.
- Host hardening
- Removing unused software and services, disabling default accounts, applying patches, and enabling default-deny host firewalls on a device.
- Full-disk encryption
- Encrypting an entire storage volume, as with LUKS, BitLocker, or FileVault, protecting data at rest when a device is powered off or stolen.
- Secure Boot
- A firmware feature that verifies signatures of the bootloader and kernel against enrolled keys, blocking bootkits from loading.
- Crypto-erase
- Destroying the encryption key of a self-encrypting drive so all stored data becomes unrecoverable, the preferred disposal method for SSDs.
- Unix permission bits
- Read, write, and execute flags for owner, group, and other; combined with umask defaults, they govern file access on Linux systems.
- Setuid risk
- A setuid binary runs with the file owner's privileges, often root, so a flaw in it can allow full privilege escalation.
- Stateful firewall
- A firewall that tracks connection state and automatically permits return traffic for established sessions, unlike stateless packet filters.
- DMZ
- A network segment hosting internet-facing services, isolated from the internal LAN so a compromised public server cannot reach internal hosts directly.
- IDS vs. IPS
- An IDS passively detects and alerts on suspicious traffic; an IPS sits inline and can block it, at the cost of added latency and false positives.
- NAT limitation
- NAT translates addresses to conserve public IPs and hide internal topology; it does not inspect, filter, or block malicious traffic.
- DNSSEC
- A set of DNS extensions that cryptographically signs records so resolvers can verify integrity and origin of answers; it does not encrypt queries.
- Zero trust
- A model that authenticates and authorizes every request regardless of network location, replacing implicit trust inside a perimeter.
- MFA
- Authentication requiring two or more distinct factor types, such as a password plus a hardware token or biometric, reducing credential-theft impact.
- Passkeys / FIDO2
- Origin-bound public-key credentials stored on a device or authenticator; they resist phishing because the private key never leaves the authenticator.
- OAuth 2.0
- An authorization framework that issues access tokens so an application can act on a resource owner's behalf; it is not an authentication protocol by itself.
- OIDC
- OpenID Connect, an identity layer on top of OAuth 2.0 that adds an ID token and user info endpoint for federated single sign-on.
- RBAC
- Role-based access control assigns permissions to roles and roles to users, simplifying administration when access maps to job functions.
- Pseudonymization
- Replacing identifiers with codes so direct identification needs a separate key; the data remains personal data under privacy law.