SCLE Module 17 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core security objectives: confidentiality (only authorized parties access data), integrity (data is accurate and unaltered), and availability (systems and data are accessible when needed).

Vulnerability versus threat

A vulnerability is a weakness that can be exploited; a threat is any potential cause of harm that could exploit that weakness. Risk arises when a threat can act on a vulnerability.

Single loss expectancy

The monetary loss from one incident, calculated as asset value multiplied by exposure factor, where exposure factor is the proportion of the asset destroyed in that event.

Annualized loss expectancy

Expected yearly loss from a risk, computed as single loss expectancy multiplied by annualized rate of occurrence, which estimates how many times per year the event happens.

Residual risk

The risk remaining after controls are applied. It equals total inherent risk minus the risk reduction achieved by implemented safeguards, and must be formally accepted by an accountable owner.

Control categories

Administrative controls are policy and process, technical controls are technology-enforced mechanisms such as encryption or access lists, and physical controls are tangible barriers such as locks and guards.

Risk treatment options

Mitigate by reducing likelihood or impact, transfer by insurance or contract, avoid by eliminating the activity, or accept by acknowledging and retaining the risk with documented approval.

Policy versus standard

A policy states management intent and mandatory direction at a high level; a standard specifies the mandatory, measurable requirements that implement the policy, such as encryption strength or password length.

Risk register contents

A structured record of each risk with its asset, threat, likelihood, impact, calculated score, accountable owner, chosen treatment, target date, and current status for tracking.

Risk appetite

The amount and type of risk an organization is willing to pursue or retain in achieving its objectives, set by leadership and translated into tolerance thresholds for operational decisions.

Separation of duties

An internal control that divides a sensitive process among different people so no single individual can initiate, approve, execute, and record the same transaction without detection.

Third-party risk management

The process of assessing suppliers before onboarding, embedding security and audit clauses in contracts, and periodically reassessing their controls and financial and operational stability.

Quantitative versus qualitative analysis

Quantitative analysis assigns monetary values and supports cost-benefit decisions; qualitative analysis uses ordinal ratings like high, medium, and low, which is faster but harder to defend financially.

Trust boundary

A point where data or control passes between components with different privilege, ownership, or trust level; enforcement such as authentication and validation belongs at each such crossing.

Zero trust architecture

A design that removes implicit trust based on network location and instead verifies identity, device health, and context for every request before granting access to a resource.

Fail-safe defaults

A design principle stating that when a control fails or a decision cannot be made, access should be denied, unless availability requirements for that specific asset justify failing open.

Symmetric versus asymmetric encryption

Symmetric algorithms such as AES use one shared key and are fast for bulk data; asymmetric algorithms such as RSA and ECC use key pairs and suit key exchange and digital signatures.

Key management lifecycle

The phases a cryptographic key passes through: generation, distribution, storage, use, rotation, revocation, and destruction, with keys protected separately from the data they encrypt.

Threat modeling

A structured design-time analysis that identifies assets, entry points, trust boundaries, and credible threats, then defines controls and validates that mitigations address each identified threat.

Microsegmentation

A network design that enforces granular, default-deny policy between individual workloads rather than relying on perimeter firewalls, limiting lateral movement after a compromise.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Containment must be balanced against evidence preservation before destructive remediation steps.

Order of volatility

Evidence collection priority from most to least volatile: processor registers and cache, memory, network connections, disk storage, backups, and archival media.

Chain of custody

A documented, unbroken record of who collected, handled, transferred, and stored evidence, and when, used to demonstrate that evidence has not been altered or tampered with.

Recovery point objective

The maximum tolerable amount of data loss measured in time, which determines backup frequency; a one-hour RPO requires backups or replication at least every hour.

Recovery time objective

The maximum acceptable time to restore a service after disruption. It drives recovery architecture choices such as hot standby, warm site, or cold site.

Differential versus incremental backup

Incremental backups capture changes since the last backup of any type; differential backups capture changes since the last full backup, making restores faster but backups larger.

False positive versus false negative

A false positive is an alert on benign activity, causing wasted effort; a false negative is a missed real event, causing undetected harm. Tuning trades one rate against the other.

Design versus operating effectiveness

Design effectiveness asks whether a control, as specified, would achieve its objective; operating effectiveness asks whether it actually ran consistently throughout the audit period.

Penetration test rules of engagement

A written agreement defining scope, targets, timing, permitted techniques, prohibited actions, escalation contacts, and handling of discovered sensitive data before testing begins.

Key risk indicator

A metric that provides early warning that risk exposure is increasing or a control is degrading, with defined thresholds that trigger escalation to management.

Written authorization

Documented permission from the asset owner specifying scope and limits before any security testing. Without it, testing constitutes unauthorized access regardless of intent.

Conflict of interest disclosure

The obligation to reveal any relationship or interest that could bias professional judgment, and to decline or reassign engagements where objectivity cannot be preserved.