NCCS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core security properties: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to systems and data.

Threat versus vulnerability

A threat is any potential cause of harm, such as an attacker or natural event. A vulnerability is a weakness that a threat can exploit. Risk arises when the two combine with impact.

Worm versus virus

A virus requires a host file and usually user action to spread. A worm self-propagates across networks without user interaction, which makes it capable of rapid, widespread infection.

Spear phishing

A targeted phishing attack crafted for a specific person or group using researched details such as role, colleagues, and projects. It is more convincing than bulk phishing and harder to detect.

Cyber kill chain

A seven-phase model of intrusion: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders disrupt the chain at any phase.

Default-deny firewall posture

A rule set that blocks all traffic by default and permits only explicitly allowed flows. Rules are ordered most-specific first because evaluation stops at the first match.

IDS versus IPS

An intrusion detection system passively monitors mirrored traffic and alerts. An intrusion prevention system sits inline and can block malicious traffic, but a false positive can disrupt legitimate business traffic.

DMZ screened subnet

A segmented network hosting internet-facing services. It is reachable from the internet and the internal network, but the internal network is not directly reachable from it, limiting breach impact.

IPsec transport versus tunnel mode

Transport mode protects only the payload and leaves the original IP header intact for host-to-host use. Tunnel mode encapsulates the entire original packet inside a new header, used for site-to-site VPNs.

Network segmentation

Dividing a network into isolated zones with enforced controls between them. Segmentation limits lateral movement after compromise, so an intrusion in one zone cannot freely reach sensitive systems.

Endpoint detection and response

A host agent that continuously records process, file, and network behavior, applies behavioral analytics to detect malicious activity, and enables response actions such as host isolation and process termination.

Application allowlisting

A default-deny execution control that permits only approved applications to run. It stops unknown malware more effectively than blocklisting, which always lags behind new malicious variants.

Patch management tiers

A risk-based schedule: critical and high-severity patches on an accelerated cycle, moderate on standard, low on deferred. Compensating controls apply when patching cannot meet the schedule.

File integrity monitoring

A control that baselines critical system and configuration files and alerts on unauthorized changes. It detects tampering, persistence mechanisms, and configuration drift that other endpoint controls may miss.

Role-based access control

An access model where permissions are assigned to roles rather than individuals, and users receive roles based on job function. It simplifies administration and supports least privilege and review.

Multi-factor authentication

Authentication requiring factors from at least two different categories: something you know, something you have, or something you are. Two passwords from the same category do not qualify.

Separation of duties

A control ensuring no single person can complete a sensitive transaction alone. It prevents fraud and error by requiring independent approval, such as a requester and a separate approver.

Zero trust architecture

A model that grants no implicit trust based on network location. Every request is authenticated and authorized per session using identity, device posture, and contextual signals.

Symmetric versus asymmetric encryption

Symmetric encryption uses one shared key and is fast, suited to bulk data. Asymmetric encryption uses a public-private key pair, is slower, and enables key exchange and digital signatures.

Digital signature properties

A signature created with the sender's private key and verified with the public key provides integrity, sender authentication, and non-repudiation. It does not by itself provide confidentiality.

Certificate authority chain

A root CA signs intermediate CAs, which sign end-entity certificates. Validation checks the signature chain, validity dates, revocation status, and whether the certificate name matches the target.

Hashing versus encryption

Hashing is one-way and verifies integrity; it cannot be reversed. Encryption is reversible with the correct key and provides confidentiality. An HMAC combines hashing with a secret key for authentication.

Data states

Data exists at rest (stored, protected by encryption or tokenization), in transit (moving, protected by TLS or IPsec), and in use (being processed, protected by enclaves or confidential computing).

Incident response phases

The ordered process: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment comes before eradication so the incident does not spread during cleanup.

Chain of custody

A documented, unbroken record of who handled evidence, when, and why. It preserves admissibility and integrity, and volatile data such as memory must be captured before shutdown.

RTO versus RPO

Recovery time objective is the maximum acceptable downtime before a system must be restored. Recovery point objective is the maximum acceptable data loss measured in time.

Threat intelligence indicator types

Technical indicators such as IP addresses, hashes, and domains are short-lived. Tactics, techniques, and procedures describe adversary behavior and remain useful far longer for detection engineering.

Annualized loss expectancy

ALE estimates yearly risk cost: single loss expectancy multiplied by annualized rate of occurrence. SLE is asset value multiplied by exposure factor. ALE supports cost justification for controls.

Risk treatment options

Mitigate by applying controls, transfer through insurance or contracts, avoid by discontinuing the activity, or accept with documented management approval. Acceptance requires an accountable owner.

Policy versus standard versus procedure

A policy states mandatory management intent and is executive-approved. Standards specify required technical or process details. Procedures give step-by-step instructions. Guidelines are recommended, not mandatory.

Cloud shared responsibility

The provider secures facilities, hardware, and hypervisor. The customer secures data, identities, and configurations, plus the guest operating system in IaaS. The split shifts by service model.

Cloud identity as perimeter

In cloud environments, identity and access policy replace the network edge as the main control. Least privilege, MFA, and short-lived role credentials are the primary defenses against compromise.