SCLE Module 6 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Annualized Loss Expectancy

ALE estimates yearly monetary loss from a risk. Formula: ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO). Used to justify control cost when control cost is less than ALE reduction.

Single Loss Expectancy

SLE is the monetary loss from one incident. Formula: SLE = Asset Value × Exposure Factor. Exposure Factor is the percentage of asset value destroyed by the incident.

Due care versus due diligence

Due diligence is the investigation and verification of risks and controls before action. Due care is the ongoing application of reasonable safeguards. Both support a negligence defense.

Recovery Point Objective

RPO is the maximum acceptable data loss measured in time before an incident. It determines backup frequency; a 1-hour RPO requires backups or replication at least every hour.

Data owner

The data owner is a senior manager accountable for a data asset. The owner sets classification, approves access rules, and accepts residual risk; custodians implement the controls.

Data remanence

Data remanence is residual data left on media after deletion or overwrite attempts. It is addressed by clearing, purging (degaussing, crypto-erase), or physical destruction.

Data states

Data exists in three states: at rest (stored, protected by encryption), in transit (moving, protected by TLS/IPsec), and in use (processed, protected by memory encryption or enclaves).

Retention policy

A retention policy defines how long each data class is kept to satisfy legal, regulatory, and operational needs. Data past retention must be destroyed with verifiable evidence.

Bell-LaPadula model

Bell-LaPadula enforces confidentiality with two rules: no read up (simple security property) and no write down (star property). It prevents leakage from high to low classification.

Biba model

Biba enforces integrity: no read down and no write up. A subject cannot read lower-integrity data or write to higher-integrity objects, preventing contamination of trusted data.

Reference monitor

The reference monitor is an abstract machine that mediates all access. It must be tamper-proof, always invoked, and small enough to be verified; the TCB implements it.

Digital signature

A digital signature is a hash of a message encrypted with the sender's private key. It provides integrity, authentication, and non-repudiation but not confidentiality.

IPsec ESP versus AH

ESP (Encapsulating Security Payload) provides confidentiality plus integrity and authentication. AH (Authentication Header) provides integrity and authentication only, with no encryption.

Stateful firewall

A stateful firewall tracks connection state and permits return traffic for established sessions. It is more secure than a stateless packet filter that inspects each packet alone.

WPA3 SAE

WPA3 uses Simultaneous Authentication of Equals (SAE), a password-authenticated key exchange that resists offline dictionary attacks better than WPA2's four-way handshake.

Network segmentation

Segmentation divides a network into zones (VLANs, subnets, DMZ) to limit lateral movement. Access between zones is controlled by firewalls or ACLs.

OSI model layers

Seven layers from bottom: Physical, Data Link, Network, Transport, Session, Presentation, Application. Security controls map to layers, e.g., TLS at Transport and above.

RBAC

Role-Based Access Control assigns permissions to roles, and users receive roles. It simplifies administration and supports least privilege through role design.

Kerberos TGT

Kerberos clients authenticate to the KDC and receive a Ticket Granting Ticket (TGT). The TGT is used to request service tickets without resending credentials.

FAR and FRR

False Acceptance Rate (FAR) is the rate of accepting unauthorized users; False Rejection Rate (FRR) is rejecting authorized users. The crossover error rate (CER) balances both.

SAML versus OIDC

SAML 2.0 is an XML-based federation standard for web SSO. OpenID Connect is a JSON/REST-based identity layer on OAuth 2.0, common for mobile and APIs.

Password hashing

Passwords should be stored as salted hashes using a slow key derivation function such as bcrypt, scrypt, or Argon2, never plaintext or fast unsalted hashes.

CVSS

The Common Vulnerability Scoring System rates severity from 0 to 10 using base, temporal, and environmental metrics. Base metrics include exploitability and impact.

False negative

A false negative is a real vulnerability or event that a tool fails to report. It is more dangerous than a false positive because it creates a false sense of security.

SOC 2 Type II

SOC 2 Type II reports on controls relevant to trust services criteria over a period of time, unlike Type I, which reports on design at a single point in time.

Penetration test

A penetration test simulates an attacker to exploit vulnerabilities and demonstrate business impact. It differs from a vulnerability scan, which only identifies potential weaknesses.

Incident response phases

Incident response phases are preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment precedes eradication to stop spread.

Chain of custody

Chain of custody documents who handled evidence, when, and where. It preserves admissibility; evidence should be hashed and stored in tamper-evident containers.

Differential backup

A differential backup copies all changes since the last full backup. Restoration needs the last full plus the latest differential, faster than incremental restore chains.

Order of volatility

Order of volatility guides evidence collection from most to least volatile: CPU registers and cache, RAM, swap, network state, disk, backups, and archival media.

SQL injection prevention

Parameterized queries (prepared statements) separate SQL code from data and prevent SQL injection. Client-side validation and denylists alone are insufficient.

STRIDE

STRIDE is a threat modeling mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. It maps threats to design mitigations.