NCCSI flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Core security model: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely and reliable access to systems and data for authorized users.

Defense in Depth

Layering independent administrative, technical, and physical controls so that failure of any single control does not expose the asset. Each layer is assessed separately for coverage gaps.

Least Privilege

Granting a subject only the minimum access rights required to perform its function, for the shortest necessary duration, reducing the blast radius of credential compromise or insider misuse.

Annualized Loss Expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. SLE is asset value times exposure factor, giving an expected yearly monetary loss for a risk scenario.

Due Care vs Due Diligence

Due care is ongoing maintenance of reasonable controls; due diligence is the investigation verifying those controls are appropriate. Both are needed to defend against negligence claims.

Separation of Duties

Splitting a sensitive process across two or more people so no single individual can complete a critical transaction alone, preventing fraud and undetected error in high-risk workflows.

Discretionary Access Control

A model where the resource owner decides who receives access and at what level. Flexible but difficult to govern centrally, so it is weak for highly sensitive or regulated data.

Role-Based Access Control

Rights are assigned to roles rather than individuals, and users gain permissions through role membership. Simplifies administration and supports periodic access recertification by job function.

Multifactor Authentication

Requiring two or more different authentication factor types: knowledge, possession, or inherence. Two passwords or two hardware tokens do not qualify as multifactor authentication.

OpenID Connect

Identity layer built on OAuth 2.0 that authenticates users and issues a signed ID token containing identity claims, enabling single sign-on across relying party applications.

Privileged Access Management

Controls for administrative accounts including credential vaulting, session recording, just-in-time elevation, and periodic review, limiting standing privileges that attackers commonly target.

SYN Flood Attack

A denial-of-service technique sending many TCP SYN packets without completing the handshake, exhausting the server's half-open connection table. Mitigated by SYN cookies and rate limiting.

Stateful Firewall

A firewall that tracks connection state in a table and permits return traffic for established sessions, unlike stateless packet filters that evaluate each packet independently against rules.

IDS vs IPS

An intrusion detection system passively monitors traffic and alerts on suspicious patterns. An intrusion prevention system sits inline, can block traffic, and may drop malicious packets in real time.

WPA3 SAE

Wi-Fi security mode replacing the WPA2 pre-shared key handshake with Simultaneous Authentication of Equals, a password-authenticated key exchange resisting offline dictionary attacks on captured handshakes.

DNSSEC

Extension adding digital signatures to DNS records so resolvers can verify origin authenticity and integrity of responses. It does not encrypt queries or hide which domains are requested.

Application Allowlisting

A control permitting execution only of explicitly approved software, blocking everything else. More resistant to novel malware than blocklisting, which only stops known-bad signatures.

Endpoint Detection and Response

Agent-based tooling that records process and system telemetry, detects behavioral anomalies beyond signature matching, and supports response actions such as host isolation and process termination.

Mobile Device Management

Centralized control of mobile devices enforcing configuration, encryption, passcode policy, application distribution, and remote wipe. MAM instead protects app data without full device management.

Authenticated Encryption

A cipher mode such as AES-GCM that provides confidentiality and integrity in one operation, detecting tampering with ciphertext or associated data and preventing undetected modification.

Digital Signature

A hash of a message encrypted with the sender's private key. Verification with the public key proves integrity, authenticity, and non-repudiation, but does not provide confidentiality.

Diffie-Hellman Key Exchange

Protocol allowing two parties to derive a shared secret over an untrusted channel. It provides no authentication alone, so certificates or signatures must prevent man-in-the-middle attacks.

Certificate Revocation

Mechanisms withdrawing trust from a certificate before expiry. CRLs are published lists; OCSP queries real-time status. Revocation is checked during certificate validation.

HMAC

A message authentication code combining a cryptographic hash with a shared secret key, verifying message integrity and authenticity between parties that both hold the key.

Order of Volatility

Forensic collection priority from most to least volatile: CPU registers and cache, RAM, network connections, disk storage, remote logs, archival media. Capture volatile evidence first.

Chain of Custody

Documentation recording who collected, handled, transferred, and stored evidence, and when. Unbroken custody supports authenticity and admissibility; gaps weaken or void evidence.

Containment Phase

Incident response step limiting spread and damage after detection, using host isolation, account disablement, or network segmentation, while preserving volatile evidence before eradication begins.

Mean Time to Detect

Average elapsed time between an incident actually occurring and its discovery by monitoring or reporting. A key SOC metric; lower values reduce attacker dwell time and impact.

Risk Treatment Options

Four responses to identified risk: mitigate by applying controls, transfer via insurance or contract, avoid by ceasing the activity, or accept with documented management sign-off.

Risk Register

Living record of identified risks listing asset, threat, vulnerability, likelihood, impact, owner, chosen treatment, and review date. Tracks residual risk after controls are applied.

NIST Cybersecurity Framework

Voluntary framework organized around functions: govern, identify, protect, detect, respond, recover. Used to structure and communicate a program's security posture and maturity.

Cloud Shared Responsibility

Division where the provider secures the cloud infrastructure and the customer secures what they place in it. The split shifts by service model: IaaS, PaaS, or SaaS.

Cloud Security Posture Management

Tooling that continuously scans cloud configurations for misconfigurations and policy drift, such as public storage buckets or overly permissive security groups, and reports remediation actions.