ICSP CS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Annualized Loss Expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. It estimates expected yearly monetary loss for an asset and is compared against control cost to justify a safeguard.

Residual Risk

The risk remaining after controls are applied. Management must formally accept it, because no control set eliminates all exposure.

Business Impact Analysis

A study identifying critical business functions and their dependencies, and deriving recovery time objectives and recovery point objectives that drive continuity strategy.

Due Diligence

Ongoing verification that implemented controls actually work and that requirements are met. Due care is choosing prudent controls; due diligence is checking them continuously.

Separation of Duties

Splitting a sensitive task so no single person can complete it alone, preventing fraud and undetected error. It complements least privilege.

Role-Based Access Control

Authorization grants permissions to roles rather than individuals; users are assigned roles. It simplifies administration and supports least privilege through role design.

Crossover Error Rate

The point where false rejection rate equals false acceptance rate for a biometric system. A lower crossover error rate indicates a more accurate system.

SAML

An XML-based federation standard for exchanging authentication and authorization assertions between an identity provider and service providers, commonly used for enterprise single sign-on.

TACACS+

A Cisco AAA protocol that encrypts the entire payload and separates authentication, authorization and accounting, often used to administer network devices.

Least Privilege

Granting users and processes only the access needed for their assigned tasks, for only as long as needed, reducing the impact of compromise or misuse.

Authenticated Encryption

A cipher mode such as GCM that provides both confidentiality and integrity, detecting tampering. It prevents certain modification attacks that unauthenticated modes allow.

Digital Signature

A hash of a message encrypted with the sender's private key. Verification with the public key proves integrity, origin authenticity and supports nonrepudiation.

Key Escrow

Storing copies of cryptographic keys with a trusted third party so encrypted data can be recovered. It enables recovery but creates a high-value target.

Salt

Random data added to a password before hashing so identical passwords produce different hashes, defeating precomputed rainbow tables and forcing per-user work.

Certificate Revocation List

A signed list published by a certificate authority of certificates revoked before expiration. OCSP offers a real-time alternative query for the same status.

IPsec ESP

Encapsulating Security Payload provides confidentiality plus integrity and authentication of packet contents, unlike AH which does not encrypt the payload.

DMZ

A segmented network between the internet and internal networks hosting externally accessible services, limiting what an attacker can reach after compromising a public host.

802.1X

Port-based network access control using a supplicant, an authenticator such as a switch, and an authentication server, blocking unauthenticated devices before network admission.

ARP Spoofing

Sending forged ARP replies to associate an attacker's MAC address with another host's IP, enabling interception or redirection of local traffic.

Bell-LaPadula

A confidentiality model enforcing no read up and no write down across security levels, preventing lower-clearance subjects from reading higher-classified data.

Biba Model

An integrity model enforcing no read down and no write up, preventing low-integrity data from contaminating higher-integrity objects and subjects.

Reference Monitor

The abstract component mediating all subject access to objects; it must be complete, tamper-proof and verifiable. The security kernel implements it in hardware and software.

Fail-Safe Defaults

A design principle where access is denied on failure or ambiguity. The opposite, fail-open, permits access when a control malfunctions and is generally avoided.

Hypervisor Escape

An attack where code in a guest virtual machine breaks isolation and executes on the host, compromising every VM on that hypervisor.

SOC 2 Report

An attestation covering controls relevant to security, availability, processing integrity, confidentiality and privacy, issued under trust services criteria rather than financial reporting.

False Negative

A test result that misses a real vulnerability. False negatives create unaddressed exposure, while false positives waste remediation effort on nonexistent issues.

Penetration Test

An authorized, scoped simulation that actively exploits vulnerabilities to demonstrate real business impact, going beyond the enumeration performed by a vulnerability scan.

Chain of Custody

Documentation recording who handled evidence, when, and where, from collection through presentation. It preserves admissibility and demonstrates that evidence was not altered.

Order of Volatility

A collection priority for evidence: CPU registers and cache, memory, network state, then disk and archival media. Volatile data disappears first and must be captured earliest.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time before an incident. It determines backup frequency, while recovery time objective determines restoration speed.

Threat Modeling

Structured identification of threats against a system during design, often using data flow diagrams and frameworks such as STRIDE, so controls are built in rather than added later.

Data Custodian

The party responsible for implementing and maintaining the technical controls protecting an asset, following classification and handling rules set by the data owner.