NCCSA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality, integrity, and availability: the three core security objectives. Confidentiality limits disclosure, integrity prevents unauthorized modification, and availability ensures timely authorized access to systems and data.

Least privilege

A principle granting each user, process, or service only the access rights required to perform its function, and only for the time needed, reducing the impact of misuse or compromise.

Separation of duties

A control that divides a sensitive task among multiple people so no single individual can complete it alone, preventing fraud and undetected error in high-value processes.

Defense in depth

Layering independent preventive, detective, and corrective controls across people, process, and technology so that failure of any single control does not expose the protected asset.

Non-repudiation

Assurance that a party cannot credibly deny performing an action, typically achieved through digital signatures or tamper-evident audit logs that bind the action to an identity.

Zero trust

A model that grants no implicit trust based on network location; every access request is evaluated against identity, device posture, and policy before the resource is reached.

Stateful firewall

A firewall that tracks connection state in a session table and automatically permits return traffic for established connections, unlike stateless filters that must allow both directions explicitly.

DMZ

A segmented network zone hosting internet-facing services, separated from internal networks by filtering controls so compromise of a public host does not grant direct internal access.

IPsec ESP

The IPsec Encapsulating Security Payload protocol, which provides confidentiality through encryption plus integrity and authentication at layer 3; AH provides integrity only, without encryption.

VLAN segmentation

Splitting a switched network into separate broadcast domains. VLANs reduce broadcast traffic and organize traffic, but inter-VLAN policy must be enforced by a router or firewall.

DNSSEC

A set of extensions that cryptographically signs DNS records so resolvers can verify origin authenticity and integrity of responses; it does not encrypt queries or hide them from observers.

802.1X

A port-based network access control standard that authenticates a supplicant device or user through an authenticator and authentication server before granting network access.

Application allowlisting

An endpoint control permitting only approved executables, identified by hash or publisher, to run; unknown programs are blocked even when no malware signature exists.

EDR

Endpoint detection and response software that continuously records process, file, registry, and network telemetry, applies behavioral detection, and supports response actions such as host isolation and file quarantine.

Full-disk encryption

Encryption of an entire storage volume so data at rest is unreadable without the key. It protects lost or stolen devices but not data accessed by a logged-in user or running malware.

Secure boot

A firmware feature that verifies the cryptographic signature of boot components before execution, blocking unauthorized bootloaders and helping preserve the integrity of the startup chain.

3-2-1 backup rule

Keep three copies of data on two different media types with one copy offsite; at least one copy should be offline or immutable so ransomware cannot encrypt every replica.

RBAC

Role-based access control assigns permissions to roles rather than individuals, and users receive permissions through role membership, simplifying administration and access reviews.

Multi-factor authentication

Authentication requiring factors from at least two different categories, such as a password plus a hardware token; two passwords from the same category remain single-factor.

Federated identity

An arrangement where an identity provider authenticates a user and sends a signed assertion, such as SAML or OpenID Connect, to a relying party that trusts it without storing the credential.

Privileged access management

Controls for high-privilege accounts: credential vaulting, just-in-time elevation with time-bound grants, session recording, and monitoring to limit and audit administrative access.

Password salting

Adding a unique random value to each password before hashing so identical passwords produce different hashes, defeating precomputed rainbow tables and hiding shared-password patterns.

Annualized loss expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence, estimating expected yearly loss from a risk and supporting comparison of control cost against benefit.

Risk treatment options

The four responses to identified risk: mitigate by applying controls, transfer through insurance or contract, avoid by ending the activity, or accept with documented ownership and review.

CVSS

A standardized scoring system expressing vulnerability severity from base metrics, adjusted by temporal and environmental metrics; the score reflects severity, not business risk alone.

Vulnerability versus threat

A vulnerability is a weakness that could be exploited; a threat is an actor or event with the potential to exploit it. Risk is the potential loss when the two combine.

Incident response phases

Preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Each phase produces outputs that feed the next and inform lessons learned.

Order of volatility

Evidence collection priority from most to least perishable: processor registers and cache, memory, network state, running processes, disk storage, remote logs, and archival media.

Chain of custody

A documented record of who collected, handled, and stored evidence, with times and methods, supporting integrity and admissibility of evidence in investigation or legal proceedings.

Recovery time objective

The maximum acceptable elapsed time to restore a business process after disruption; it drives recovery design, while recovery point objective sets acceptable data loss.

Policy versus standard

A policy states mandatory management intent and scope; a standard specifies the mandatory technical or procedural requirements that implement the policy. Procedures give step-by-step instructions.

Risk register

A maintained record of identified risks listing asset, threat, likelihood, impact, owner, treatment decision, and review date, serving as the audit trail of risk management decisions.