NICA CCCA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Annualized Loss Expectancy (ALE)

Expected yearly monetary loss from a risk. Calculated as Single Loss Expectancy multiplied by Annualized Rate of Occurrence. Used to justify control cost against expected loss reduction.

Residual Risk

Risk remaining after controls are applied. It equals total risk minus the effect of implemented safeguards. It must be documented and formally accepted by an accountable business owner.

Exposure Factor

Percentage of an asset's value lost in a single incident. Multiplied by asset value it produces Single Loss Expectancy. A total loss event has an exposure factor of 100 percent.

Separation of Duties

Administrative control splitting a sensitive task across people so no single person can complete a fraudulent or destructive action alone. Complements least privilege and mandatory job rotation.

Stateful Firewall

Firewall that maintains a connection state table and permits return traffic for established sessions. It filters on state and context, unlike stateless ACLs that evaluate each packet independently.

DMZ Screened Subnet

Network segment hosting externally reachable services between two filtering points. It prevents internet users from directly reaching internal hosts if a public-facing server is compromised.

802.1X Port Authentication

Port-based network access control with three roles: supplicant (device), authenticator (switch or access point), and authentication server (typically RADIUS). Unauthenticated ports stay restricted.

Microsegmentation

Granular policy enforcement between individual workloads, often in virtual or cloud networks. It restricts east-west traffic to limit lateral movement after an initial compromise.

VLAN Hopping

Attack abusing trunk negotiation or double-tagged frames to reach another VLAN. Mitigations include disabling unused ports, avoiding native VLAN 1, and preventing access ports from trunking.

IDS versus IPS

An IDS passively monitors traffic copies and alerts on suspected attacks. An IPS sits inline and can block traffic. Placement determines whether response is detection-only or preventive.

MITRE ATT&CK

Knowledge base of adversary tactics and techniques observed in real intrusions. Defenders map detections to techniques to find coverage gaps and prioritize monitoring improvements.

SIEM Correlation

Aggregation and rule-based linking of logs from multiple sources to detect patterns a single source would miss. Correlation quality depends on synchronized time and normalized log fields.

Honeytoken

Decoy credential, file, or account with no legitimate use. Any access generates a high-fidelity alert, since normal users and processes never touch it.

File Integrity Monitoring

Detection control that baselines critical files and alerts on unauthorized changes. It catches tampering with system binaries, configurations, and web content that antivirus may miss.

Indicator of Compromise

Observable artifact such as a file hash, IP address, or domain suggesting intrusion. Indicators are easy for attackers to change, so they age quickly compared with behavior-based detection.

Order of Volatility

Evidence collection priority from most to least perishable: CPU and cache, memory, network state, running processes, disk, remote logs, backups, archival media. Memory is captured before shutdown.

Chain of Custody

Chronological record documenting who collected, handled, and transferred evidence, when, and why. Unbroken custody preserves admissibility and evidence integrity during investigations.

Containment Phase

Incident response stage limiting spread and damage: isolating hosts, disabling accounts, blocking indicators, or segmenting networks. Choice balances business impact against attacker movement risk.

Lessons Learned Review

Post-incident activity identifying root cause, control gaps, and corrective actions with owners and due dates. It converts incident findings into measurable program improvements.

CVSS Base Score

Numeric severity rating from 0.0 to 10.0 reflecting intrinsic exploitability and impact of a vulnerability. It excludes organizational context, which environmental metrics adjust separately.

EPSS

Exploit Prediction Scoring System estimating the probability a vulnerability is exploited in the wild within a defined window. It complements severity scores for risk-based prioritization.

Authenticated Scan

Vulnerability scan using valid credentials to inspect installed software, patch levels, and configuration directly. It finds far more issues and fewer false positives than unauthenticated scanning.

False Negative

Scanner or detection tool failing to report a real vulnerability or intrusion. False negatives are more dangerous than false positives because the exposure remains invisible to defenders.

SAST versus DAST

Static analysis reviews source code without executing it; dynamic analysis tests a running application from outside. They find different flaw classes and are typically combined in a program.

Role-Based Access Control

Model granting permissions to roles rather than individuals, with users assigned to roles. Simplifies administration and access reviews but can cause role explosion in complex organizations.

Kerberos Ticket-Granting Ticket

Ticket issued by the key distribution center after authentication, used to request service tickets. Stolen TGTs enable pass-the-ticket attacks, so protect and monitor privileged ticket use.

Privileged Access Management

Controls for high-risk accounts: credential vaulting, just-in-time elevation, session recording, and periodic recertification. It reduces standing administrative rights and limits credential theft impact.

Access Recertification

Periodic review where managers confirm each user's entitlements remain necessary. It removes accumulated, orphaned, and excessive access, producing auditable evidence for compliance.

Digital Signature

Hash of a message encrypted with the sender's private key. Verification with the sender's public key provides integrity, authenticity, and non-repudiation but not confidentiality.

Forward Secrecy

Property where compromise of a long-term private key does not decrypt past sessions. Achieved with ephemeral key exchange such as ECDHE in TLS.

HMAC

Message authentication code combining a cryptographic hash with a shared secret key. It verifies integrity and authenticity between parties holding the key, without providing confidentiality.

RTO versus RPO

Recovery Time Objective is the maximum acceptable downtime; Recovery Point Objective is the maximum acceptable data loss measured in time. Both drive backup and recovery architecture.