CISSO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Annualized Loss Expectancy

ALE equals Single Loss Expectancy multiplied by Annualized Rate of Occurrence. It estimates expected yearly monetary loss for a risk and supports cost-benefit comparison of proposed controls.

Exposure Factor

The percentage of an asset's value lost if a specific threat materializes. SLE equals asset value times exposure factor; a total loss has an EF of 100 percent.

Residual Risk

The risk remaining after controls are applied. It must be formally accepted by the accountable business or asset owner and recorded in the risk register.

Risk Treatment Options

Four choices exist: mitigate by applying controls, transfer by insurance or contract, avoid by eliminating the activity, or accept and document the exposure.

Security Policy Hierarchy

Policy states mandatory intent, standards specify mandatory requirements, procedures give step-by-step instructions, and guidelines are recommended practices. Higher levels authorize lower levels.

Risk Appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It is set by senior management and guides control investment decisions.

Separation of Duties

No single person should control all parts of a sensitive transaction. It prevents fraud and error by requiring collusion, and is a core governance control.

Qualitative versus Quantitative Risk

Qualitative analysis ranks risk using ordinal scales such as high, medium, and low. Quantitative analysis assigns monetary values and produces annualized loss expectancy for cost-benefit decisions.

Bell-LaPadula Model

A confidentiality model enforcing no read up and no write down across security levels. It prevents unauthorized disclosure but does not address integrity.

Biba Integrity Model

An integrity model enforcing no read down and no write up. Subjects cannot be corrupted by lower-integrity data and cannot corrupt higher-integrity objects.

Defense in Depth

Layering independent controls across physical, network, host, application, and data tiers so failure of one layer does not expose the asset.

Digital Signature Properties

A digital signature provides authentication of the signer, integrity of the message, and non-repudiation. It does not by itself provide confidentiality of the content.

Symmetric versus Asymmetric Encryption

Symmetric algorithms such as AES use one shared key and are fast but require secure key distribution. Asymmetric algorithms such as RSA and ECC use key pairs and enable key exchange and signatures.

Hashing Purpose

A cryptographic hash produces a fixed-length digest used to verify integrity. SHA-2 and SHA-3 are current standards; hashing provides no confidentiality and is not reversible.

Common Criteria EAL

Evaluation Assurance Levels EAL1 through EAL7 rate the depth of security evaluation. EAL4 is the commonly targeted commercial level; higher levels cost more and take longer.

Zero Trust Architecture

A model that grants no implicit trust based on network location. Every access request is authenticated, authorized, and continuously evaluated regardless of origin.

Network Segmentation

Dividing a network into zones with enforced boundaries and least-privilege rules. It limits lateral movement after compromise and isolates sensitive systems such as cardholder data environments.

Incident Response Lifecycle

Preparation, detection and analysis, containment eradication and recovery, then post-incident activity. Lessons learned feed back into preparation to improve future response.

Order of Volatility

Evidence collection priority: CPU registers and cache, then RAM, network state, running processes, disk storage, and finally backups and archival media.

Chain of Custody

A documented record of who handled evidence, when, where, and why. Unbroken custody is required for evidence to be admissible in legal proceedings.

Recovery Time Objective

The maximum acceptable time to restore a process or system after disruption. It drives DR site selection and determines whether hot, warm, or cold standby is required.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time. It determines backup and replication frequency; a one-hour RPO requires at least hourly replication.

Hot Site versus Cold Site

A hot site is fully equipped and ready with near-zero recovery time and highest cost. A cold site provides only space and power with the longest recovery time.

Business Impact Analysis

A process identifying critical business processes, their dependencies, and the impact of disruption over time. It produces recovery time and recovery point objectives.

Forensic Write Blocker

Hardware or software that prevents writes to a storage device during imaging. It preserves original evidence integrity and supports later hash verification of the acquired image.

Containment versus Eradication

Containment limits the spread of an incident, for example by isolating hosts or disabling accounts. Eradication removes the root cause, such as malware or the exploited vulnerability, before recovery.

Accreditation versus Certification

Certification is the security assessment of a system against controls. Accreditation is the formal authorization to operate granted by the authorizing official based on that assessment.

NIST Risk Management Framework

Six steps: categorize the system, select controls, implement controls, assess controls, authorize operation, and monitor continuously. It structures federal security authorization.

ISO/IEC 27001

An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system, with Annex A controls.

GDPR Breach Notification

Controllers must notify the supervisory authority of a personal data breach without undue delay and generally within 72 hours of becoming aware, unless the breach is unlikely to result in risk.

Legal Hold

A directive to preserve all potentially relevant records when litigation is reasonably anticipated. Destroying such records constitutes spoliation and can result in sanctions.

Best Evidence Rule

Courts prefer the original document or recording over copies. Secondary evidence such as copies is admissible only when the original is unavailable for an acceptable reason.