NSA Assessment flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality keeps data from unauthorized disclosure, integrity keeps it unaltered and trustworthy, and availability keeps it accessible to authorized users when needed.

Defense in depth

Layering independent controls across perimeter, network, host, application, and data so that failure of one control does not expose the asset completely.

DMZ

A screened subnet hosting externally accessible services, separated from the internal network by firewalls so a compromised public server cannot directly reach internal hosts.

Stateful inspection

A firewall that tracks connection state tables, allowing return traffic for established sessions while blocking unsolicited inbound packets that do not match a session.

Zero trust

A model that removes implicit trust based on network location, requiring authentication and authorization for every request regardless of where it originates.

Risk formula

Risk equals threat multiplied by vulnerability multiplied by impact. Removing any factor, such as patching a vulnerability, drives the resulting risk toward zero.

Bell-LaPadula model

A confidentiality model with no read up and no write down, preventing subjects from reading higher-classified data or leaking it to lower classification levels.

Biba model

An integrity model with no read down and no write up, preventing low-integrity data from contaminating higher-integrity objects or subjects.

Reference monitor

The abstract access control enforcement component that must be always invoked, tamper-proof, and small enough to be verified as correct.

Common Criteria EAL

Evaluation Assurance Levels EAL1 through EAL7 rate the depth of testing and verification applied to a product, not the number of security features it offers.

Microsegmentation

Applying security policy per workload or application rather than per subnet, limiting lateral movement even inside a single network segment.

Fail-safe default

A design principle where access is denied if a control fails or a decision cannot be made, unless availability requirements explicitly justify failing open.

AES

A symmetric block cipher with a 128-bit block size and 128, 192, or 256-bit keys, used for bulk encryption because it is fast and well analyzed.

GCM mode

Galois/Counter Mode provides authenticated encryption with associated data, delivering both confidentiality and integrity in one pass without a separate MAC.

HMAC

A keyed hash construction providing message authentication and integrity; it proves the message came from someone holding the key but does not hide content.

Digital signature

A hash of a message signed with the sender's private key; verification with the public key proves integrity, origin, and non-repudiation.

Perfect forward secrecy

Using ephemeral Diffie-Hellman keys per session so that compromise of a long-term private key cannot decrypt previously recorded sessions.

Certificate revocation

CRL publishes revoked certificates periodically, while OCSP queries real-time status for a single certificate; validation must check one of these.

ECB mode weakness

Electronic Codebook encrypts identical plaintext blocks into identical ciphertext blocks, leaking patterns; it must not be used for real data.

TCP handshake

Connection setup uses SYN, then SYN-ACK, then ACK. Teardown uses FIN/ACK exchanges or a RST to abort an existing connection.

TTL field

An IPv4 header value decremented by each router; reaching zero discards the packet and returns ICMP time exceeded, which traceroute exploits.

ARP spoofing

Sending forged ARP replies to bind an attacker MAC to a legitimate IP, enabling man-in-the-middle interception inside a local broadcast domain.

DNS record types

A maps names to IPv4, AAAA to IPv6, CNAME creates aliases, MX directs mail, NS delegates authority, and TXT carries verification and email policy data.

TLS 1.3

A transport security version completing the handshake in one round trip, removing legacy ciphers, and requiring ephemeral key exchange for forward secrecy.

NIST incident response phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity, forming the standard lifecycle for handling security incidents.

Order of volatility

Evidence collection priority from most to least transient: registers and cache, memory, network state, disk, remote logs, and archival backups.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques observed in real intrusions, used to structure detection coverage and threat hunting.

Chain of custody

A documented, unbroken record of who handled evidence, when, and how, with hashes verifying that it was not altered.

SIEM correlation

Aggregating and normalizing logs from multiple sources, then applying rules to link related events into a single high-confidence alert.

CVSS severity bands

Base scores map to None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, and Critical 9.0 to 10.0.

MTTD and MTTR

Mean time to detect measures average detection delay after an event; mean time to respond measures average time from detection to resolution.

Kerberos TGT

The Key Distribution Center issues a ticket-granting ticket after authentication; it is presented to obtain service tickets, with timestamps limiting replay.