Cambridge SC flashcards

38 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Core security objectives: confidentiality restricts disclosure to authorised parties, integrity keeps data accurate and complete, and availability ensures timely access when needed.

Threat versus vulnerability

A threat is a potential cause of harm such as an attacker or malware; a vulnerability is a weakness that the threat can exploit. Risk combines both with impact.

Defence in depth

Layering independent preventive, detective and corrective controls so that compromise of one control does not expose the asset. Examples include firewalls, endpoint protection, logging and backups.

Ransomware

Malware that encrypts or exfiltrates data and demands payment for restoration or non-disclosure. Reliable offline backups and segmentation are primary mitigations.

Phishing versus spear phishing

Phishing is broad, untargeted fraudulent messaging. Spear phishing is tailored to a specific person using researched details, making it harder to detect through generic filtering.

CVSS base score

A 0.0 to 10.0 severity rating for a vulnerability derived from exploitability and impact metrics. Scores of 9.0 and above are Critical, but exposure and known exploitation also matter.

Multi-factor authentication

Authentication requiring two or more different factor types: knowledge, possession and inherence. Two passwords or two push approvals are not true multi-factor authentication.

Role-based access control

An access control model assigning permissions to roles rather than individuals, with users assigned to roles. Simplifies administration and supports least privilege at scale.

Least privilege

Granting each identity only the access needed for its current task, for only as long as needed. Limits blast radius if an account or process is compromised.

Password salting

Adding a unique random value to each password before hashing so identical passwords produce different hashes. Defeats precomputed rainbow tables and requires slow hash functions such as Argon2.

OAuth 2.0

An authorisation delegation framework issuing access tokens so a client can act on a resource owner's behalf. It is not an authentication protocol; OpenID Connect adds authentication on top.

Zero trust

A model removing implicit trust based on network location. Every request is authenticated, authorised and encrypted using identity, device posture and context, with least privilege enforced continuously.

Symmetric versus asymmetric encryption

Symmetric uses one shared key and is fast, suited to bulk data. Asymmetric uses a public and private key pair, solving key distribution and enabling digital signatures.

Authenticated encryption

Encryption that provides confidentiality plus integrity and authenticity in one construction, such as AES-GCM. Detects tampering and prevents chosen-ciphertext attacks.

Digital signature

A hash of a message encrypted with the sender's private key. Verification with the sender's public key proves integrity, origin authenticity and supports non-repudiation.

Certificate authority chain

A hierarchy where a trusted root CA signs an intermediate CA, which signs end-entity certificates. Validators build the chain to a trusted root in the local trust store.

ECB mode weakness

Electronic Codebook encrypts identical plaintext blocks to identical ciphertext blocks, leaking structural patterns. It must not be used for protecting real data; use GCM or CBC with an IV.

HMAC

A keyed hash construction combining a message with a shared secret to produce a message authentication code, giving integrity and authenticity without encrypting the content.

Stateful firewall

A firewall tracking connection state and permitting only return traffic belonging to an established session. More precise than stateless packet filtering based on headers alone.

IDS versus IPS

An intrusion detection system passively monitors and alerts on suspicious traffic. An intrusion prevention system sits inline and can block the traffic it detects.

SYN flood

A denial-of-service attack sending many SYN requests without completing the handshake, exhausting the connection table. Mitigated by SYN cookies and rate limiting.

Network segmentation

Dividing a network into zones with controlled traffic between them using VLANs, subnets and firewalls. Limits lateral movement after a host is compromised.

TLS 1.3

The current TLS version, removing legacy ciphers and static RSA key exchange. It mandates forward secrecy, simplifies the handshake and encrypts more of the session.

STRIDE

A threat modelling mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Each category suggests specific mitigations during design.

SAST versus DAST

Static analysis inspects source or bytecode without running the application, finding issues early. Dynamic analysis tests the running application, finding runtime and configuration issues.

SQL injection prevention

Use parameterised queries or prepared statements so user input is treated as data, never concatenated into SQL. Combine with least-privilege database accounts and input validation.

Software composition analysis

A tool category that inventories third-party libraries and flags versions with known vulnerabilities. Essential because most modern applications are assembled from open-source dependencies.

Order of volatility

Forensic collection priority from most to least perishable: registers and cache, memory, network state, processes, disk, remote logs, archival media. Capture volatile data before shutdown.

Chain of custody

A documented record of who collected, handled and stored evidence, when and why. Hashes taken at collection and continuous logging support admissibility and integrity.

MTTD and MTTR

Mean time to detect and mean time to respond or recover. Lower values indicate a more effective security operations capability; trends matter more than single incidents.

RTO and RPO

Recovery time objective is maximum tolerable downtime; recovery point objective is maximum tolerable data loss measured in time. Both drive backup and resilience design.

Risk treatment options

Mitigate by applying controls, transfer through insurance or contract, avoid by stopping the activity, or accept with documented owner sign-off. Residual risk is recorded in the register.

ISO/IEC 27001

An international standard specifying requirements for an information security management system, covering risk assessment, controls and continual improvement. Organisations can be independently certified against it.

Policy, standard, procedure

A policy states management intent and mandatory rules; standards give specific mandatory requirements; procedures give step-by-step instructions. Guidelines are non-binding recommendations.

Data minimisation

A privacy principle requiring collection and retention of only personal data adequate, relevant and necessary for the stated purpose. Reduces breach impact and compliance scope.

Controller versus processor

The controller determines why and how personal data is processed; the processor acts on the controller's documented instructions. A written processing agreement is required between them.

72-hour breach notification

Under GDPR, a controller must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in risk.

Data protection impact assessment

A structured assessment required before high-risk processing such as large-scale monitoring or special-category data. It documents necessity, risks and mitigations before processing begins.