ISC Engineer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Defense in Depth

Layering multiple independent controls across people, process, and technology so that failure of any single control does not result in full compromise of the protected asset.

Least Privilege

A principle granting each subject only the minimum access rights required to perform its function, for the shortest duration necessary, reducing the impact of compromised accounts.

Non-repudiation

Assurance that a party cannot credibly deny having performed an action. Achieved with digital signatures binding a private key holder to a specific message or transaction.

Fail-closed vs. fail-open

Fail-closed denies access when a control fails, protecting confidentiality; fail-open permits access, protecting availability. Selection depends on which loss is more damaging.

Discretionary Access Control

An access model where the resource owner decides who may access the resource and with what rights, typically implemented through ACLs on files and shares.

Role-Based Access Control

An access model assigning permissions to roles rather than individuals; users are placed into roles, simplifying administration and supporting separation of duties.

Attribute-Based Access Control

A policy model evaluating subject, resource, action, and environment attributes at request time, enabling fine-grained and context-aware authorization decisions.

Kerberos Ticket Granting Ticket

A credential issued by the KDC after initial authentication; the client presents it to obtain service tickets without resending the password, requiring synchronized clocks.

OpenID Connect

An identity layer built on OAuth 2.0 that issues an ID token containing verified user claims, allowing relying parties to authenticate users via a federated provider.

Screened Subnet (DMZ)

A network segment hosting internet-facing services, separated from internal networks by firewalls so that compromise of an exposed host does not directly reach internal systems.

IPsec ESP

Encapsulating Security Payload provides confidentiality through encryption plus integrity and authentication, operating in transport or tunnel mode within an IPsec security association.

Network Microsegmentation

Applying granular per-workload policy controls, often host-based, to restrict east-west traffic inside a data center and limit lateral movement after compromise.

802.1X Port Authentication

Port-based network access control using a supplicant, an authenticator switch, and a RADIUS server exchanging EAP messages before granting network access.

Stateful Firewall

A firewall maintaining a connection state table so return traffic for permitted sessions is automatically allowed, unlike stateless ACLs requiring explicit bidirectional rules.

STRIDE Threat Modeling

A design-phase technique enumerating spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege across each identified trust boundary.

SAST vs. DAST

Static analysis inspects source or binaries without executing them, finding code-level flaws early; dynamic analysis tests a running application from outside, finding runtime and configuration issues.

Input Validation Allow-List

Accepting only explicitly permitted characters or formats at trust boundaries, rejecting everything else, which prevents injection more reliably than blocking known bad patterns.

Configuration Drift

Deviation of a system's running configuration from its approved secure baseline over time, detected by continuous comparison and remediated to restore the intended posture.

Authenticated Encryption (AES-GCM)

A cipher mode providing both confidentiality and integrity in one operation, producing a tag that detects tampering, and avoiding the pattern leakage of ECB mode.

Digital Signature

A value produced by signing a message hash with a private key and verified with the corresponding public key, providing integrity, origin authentication, and non-repudiation.

Forward Secrecy

A property where compromise of a long-term private key does not reveal past session keys, achieved through ephemeral Diffie-Hellman key exchange per session.

HMAC

A message authentication code computed from a shared secret and a hash function, verifying integrity and origin between parties sharing the key but not providing non-repudiation.

Certificate Revocation Check

Validation that a certificate was not revoked before its expiry, performed via CRL download or OCSP query during the PKI trust chain validation process.

Credentialed Vulnerability Scan

A scan authenticating to targets to inspect installed packages and configuration directly, producing fewer false positives and deeper coverage than an unauthenticated scan.

Alert Precision and Recall

Precision measures the share of alerts that are true positives; recall measures the share of real events detected. Tuning detection shifts the balance between false positives and negatives.

SIEM Correlation

Centralized collection of logs from multiple sources with rule-based correlation to detect multi-stage activity that no single log source would reveal alone.

Order of Volatility

Evidence collection priority from most to least perishable: CPU registers and cache, RAM, network state, disk, then archival media and logs.

Recovery Time Objective

The maximum acceptable duration of service interruption after a disruption, driving the choice of recovery strategy and standby infrastructure investment.

Recovery Point Objective

The maximum tolerable amount of data loss measured in time, determining backup frequency and replication design for a given business process.

Annualized Loss Expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence; used in quantitative risk analysis to compare risk against control cost.

Policy Standard Procedure Guideline

A hierarchy where policy states management intent, standards set mandatory requirements, procedures give step-by-step instructions, and guidelines offer recommended non-mandatory practices.

Risk Treatment Options

Four responses to identified risk: mitigate by applying controls, transfer via insurance or contract, avoid by eliminating the activity, or accept with documented owner approval.