Cybersecurity Foundation flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Property that information is not disclosed to unauthorized individuals, processes, or devices; enforced by encryption, access control, and classification.

Integrity

Property that data and systems remain accurate, complete, and unaltered by unauthorized changes; supported by hashing, checksums, version control, and change management.

Availability

Property that systems and data are accessible to authorized users when needed; supported by redundancy, backups, failover, and denial-of-service defenses.

Non-repudiation

Assurance that a party cannot deny having performed an action; achieved through digital signatures, tamper-evident logs, and trusted timestamps.

Authentication

Process of verifying a claimed identity using one or more factors: something you know, something you have, or something you are.

Authorization

Process of determining which resources and actions an authenticated identity is permitted to access, typically through access control models and policies.

Least privilege

Principle that users, processes, and services receive only the minimum access rights and duration required to perform their assigned tasks.

Defense in depth

Layering multiple independent controls across physical, network, host, application, and data levels so one failed control does not lead to compromise.

Separation of duties

Control that divides a sensitive task among multiple people so no single individual can complete a fraudulent or risky action alone.

Threat

Any potential cause of an unwanted incident that could exploit a vulnerability and cause harm to an asset or organization.

Vulnerability

A weakness in a system, process, or control that a threat could exploit to compromise confidentiality, integrity, or availability.

Risk

The combination of the likelihood of a threat exploiting a vulnerability and the resulting impact on the organization.

Single loss expectancy

SLE equals asset value multiplied by exposure factor; it estimates the monetary loss from one realized risk event.

Annualized loss expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence; it estimates expected yearly loss for a risk.

Zero Trust

Security model that removes implicit trust based on network location and verifies every access request continuously using identity, device, and context signals.

Multifactor authentication

Authentication using two or more factors from different categories, such as a password plus a hardware token or biometric.

NIST Cybersecurity Framework

Voluntary framework organizing outcomes into Identify, Protect, Detect, Respond, Recover, and Govern functions to manage cybersecurity risk.

ISO/IEC 27001

International standard specifying requirements for establishing, operating, and continually improving an information security management system.

CIS Controls

Prioritized set of safeguard groups, from asset inventory to incident response, designed to defend against common attacks.

Policy

High-level management statement of intent and mandatory direction on security; it is binding and typically approved by senior leadership.

Standard

Mandatory, specific requirement that supports a policy, such as approved encryption algorithms or password length rules.

Procedure

Detailed, step-by-step instructions for performing a task or process in a consistent, repeatable manner.

Guideline

Recommended, non-binding advice that helps staff comply with policies and standards but is not mandatory.

Risk register

Living record of identified risks with owner, likelihood, impact, treatment decision, and review date used to track program risk.

Risk acceptance

Formal decision by an accountable owner to tolerate a risk without further treatment, with documented rationale and review date.

Risk transfer

Risk treatment that shifts financial impact to another party, typically through cyber insurance or contractual clauses, without eliminating the risk.

Incident response phases

NIST sequence: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment limits spread before eradication.

Recovery time objective

Maximum acceptable time to restore a system or process after disruption; it drives recovery strategy and architecture decisions.

Recovery point objective

Maximum acceptable amount of data loss measured in time; it determines backup frequency and replication design.

Business impact analysis

Process identifying critical business functions, their dependencies, and the impact of disruption; it produces RTO and RPO targets.

Leading indicator

Forward-looking metric such as patch coverage or MFA adoption that predicts future security performance rather than reporting past outcomes.

Lagging indicator

Metric that reports outcomes already realized, such as incident count, breach cost, or mean time to detect after the fact.

Third-party risk management

Program of due diligence, contractual security requirements, and periodic reassessment applied to vendors and service providers that access data or systems.