Flash Cards
Administrative Controls
Procedures implemented to define the roles, responsibilities, policies, and administrative functions needed to manage the control environment.
Annualized Rate of Occurrence (ARO)
An estimate of how often a threat will be successful in exploiting a vulnerability over the period of a year.
Arms Export Control Act of 1976
Authorizes the President to designate those items that shall be considered as defense articles and defense services and control their import and the export.
Availability
The principle that ensures that information is available and accessible to users when needed.
Breach
An incident that results in the disclosure or potential exposure of data.
Compensating Controls
Controls that substitute for the loss of primary controls and mitigate risk down to an acceptable level.
Compliance
Actions that ensure behavior that complies with established rules.
Confidentiality
Supports the principle of “least privilege” by providing that only authorized individuals, processes, or systems should have access to information on a need-to- know basis.
Copyright
Covers the expression of ideas rather than the ideas themselves; it usually protects artistic property such as writing, recordings, databases, and computer programs.
Corrective: Controls
Controls implemented to remedy circumstance, mitigate damage, or restore controls.
Data Disclosure
A breach for which it was confirmed that data was actually disclosed (not just exposed) to an unauthorized party.
Detective Controls
Controls designed to signal a warning when a security control has been breached.
Deterrent Controls
Controls designed to discourage people from violating security directives.
Directive Controls
Controls designed to specify acceptable rules of behavior within an organization.
Due Care
The care a “reasonable person” would exercise under given circumstances.
Due Diligence
Is similar to due care with the exception that it is a pre-emptive measure made to avoid harm to other persons or their property.
Enterprise Risk Management
A process designed to identify potential events that may affect the entity, manage risk so it is within its risk appetite, and provide reasonable assurance regarding the achievement of entity objectives.
Export Administration Act of 1979
Authorized the President to regulate exports of civilian goods and technologies that have military applications.
Governance
Ensures the business focuses on core activities, clarifies who in the organization has the authority to make decisions, determines accountability for actions and responsibility for outcomes, and addresses how expected performance will be evaluated.
Incident
A security event that compromises the confidentiality, integrity, or availability of an information asset.
Integrity
Comes in two forms; making sure that information is processed correctly and not modified by unauthorized persons, and protecting information as it transits a network.
Information Security Officer
Accountable for ensuring the protection of all of the business information assets from intentional and unintentional loss, disclosure, alteration, destruction, and unavailability.
Least Privilege
Granting users only the accesses that are required to perform their job functions.
Logical (Technical) Controls
Electronic hardware and software solutions implemented to control access to information and information networks.
Patent
Protects novel, useful, and nonobvious inventions.
Physical Controls
Controls to protect the organization’s people and physical environment, such as locks, fire management, gates, and guards; physical controls may be called “operational controls” in some contexts.
Preventive Controls
Controls implemented to prevent a security incident or information breach.
Recovery Controls
Controls implemented to restore conditions to normal after a security incident.
Recovery Time Objective (RTO)
How quickly you need to have that application’s information available after downtime has occurred.
Recovery Point Objective (RPO)
The point in time to which data must be restored in order to successfully resume processing.
Risk
- A combination of the probability of an event and its consequence (ISO 27000)
- An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with
a particular harmful result.(RFC 2828)
Risk Acceptance
The practice of accepting certain risk(s), typically based on a business decision that may also weigh the cost versus the benefit of dealing with the risk in another way.
Risk Avoidance
The practice of coming up with alternatives so that the risk in question is not realized.
Risk Mitigation
The practice of the elimination of or the significant decrease in the level of risk presented.
Risk Transfer
The practice of passing on the risk in question to another entity, such as an insurance company.
Risk Management
A systematic process for identifying, analyzing, evaluating, remedying, and monitoring risk.
Single Loss Expectancy (SLE)
Defined as the difference between the original value and the remaining value of an asset after a single exploit.
Single Points of Failure (SPOF)
Any single input to a process that, if missing, would cause the process or several processes to be unable to function.
Trademark
Any word, name, symbol, color, sound, product shape, device, or combination of these that is used to identify goods and distinguish them from those made or sold by others.
Trade Secret
Proprietary business or technical information, processes, designs, practices, etc., that are confidential and critical to the business.
Vulnerability Assessment
Determines the potential impact of disruptive events on the organization’s business processes.
Wassenaar Arrangement
Established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, thus preventing destabilizing accumulations.
Categorization
The process of determining the impact of the loss of confidentiality, integrity, or availability of the information to an organization.
Clearing
The removal of sensitive data from storage devices in such a way that there is assurance that the data may not be reconstructed using normal system functions or software file/data recovery utilities.
Curie Temperature
The critical point where a material’s intrinsic magnetic alignment changes direction.
Data Classification
Entails analyzing the data that the organization retains, determining its importance and value, and then assigning it to a category.
Data Custodians
Ensure important datasets are developed, maintained, and accessible within their defined specifications.
Data Modeling
The methodology that identifies the path to meet user requirements.
Data Remanence
The residual physical representation of data that has been in some way erased.
Data Standards
Objects, features, or items that are collected, automated, or affected by activities or the functions of organizations.
Federal Information Processing Standards (FIPS)
The official series of publications relating to standards and guidelines adopted.
File Encryption Software
Allows greater flexibility in applying encryption to specific file(s).
Framework Core
A set of cybersecurity activities, desired outcomes, and applicable references that are common across critical infrastructure sectors.
Framework Implementation Tiers
Provide context on how an organization views cybersecurity risk and the processes in place to manage that risk.
Framework Profile
Represents the outcomes based on business needs that an organization has selected from the Framework Categories and Subcategories.
IT Asset Management (ITAM)
ITAM is a much broader discipline, adding several dimensions of management and involving a much broader base of stakeholders.
Media Encryption Software
Software that is used to encrypt otherwise unprotected storage media such as CDs, DVDs, USB drives, or laptop hard drives.
The National Checklist Program (NCP)
The U.S. Government repository of publicly available security checklists (or benchmarks) that provide detailed low- level guidance on setting the security configuration of operating systems and applications.
NIST Computer Security Division (CSD)
Focuses on providing measurements and standards to protect information systems against threats to the confidentiality of information, integrity of information and processes, and availability of information and services in order to build trust and confidence
Purging
The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique.
Quality Assurance (QA)
An assessment of quality based on standards external to the process and involves reviewing of the activities and quality control processes to ensure final products meet predetermined standards of quality.
Quality Control (QC)
An assessment of quality based on internal standards, processes, and procedures established to control and monitor quality.
Self-Encrypting USB Drives
Portable USB drives that embed encryption algorithms within the hard drive, thus eliminating the need to install any encryption software.
Abstraction
Involves the removal of characteristics from an entity in order to easily represent its essential properties.
Access Control Matrix
A two-dimensional table that allows for individual subjects and objects to be related to each other.
Asymmetric Algorithms
One-way functions, that is, a process that is much simpler to go in one direction (forward) than to go in the other direction (backward or reverse engineering).
Address Space Layout Randomization (ASLR)
Involves randomly arranging the positions of key data areas of a program, including the base of the executable and the positions of the stack, heap, and libraries in a process’s memory address space.
Aggregation
Combining non-sensitive data from separate sources to create sensitive information.
Algorithm
A mathematical function that is used in the encryption and decryption processes.
Bell–La Padula Model
Explores the rules that would have to be in place if a subject is granted a certain level of clearance and a particular mode of access.
Brewer-Nash (The Chinese Wall) Model
This model focuses on preventing conflict of interest when a given subject has access to objects with sensitive information associated with two competing parties.
Cable Plant Management
The design, documentation, and management of the lowest layer of the OSI network model – the physical layer.
Certificate Authority (CA)
An entity trusted by one or more users as an authority in a network that issues, revokes, and manages digital certificates.
Ciphertext or Cryptogram
The altered form of a plaintext message, so as to be unreadable for anyone except the intended recipients.
Cloud Computing
A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management
Common Criteria
Provides a structured methodology for documenting security requirements, documenting and validating security capabilities, and promoting international cooperation in the area of IT security.
Community Cloud Infrastructure
Provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns.
Confusion
Provided by mixing (changing) the key values used during the repeated rounds of encryption. When the key is modified for each round, it provides added complexity that the attacker would encounter.
Control Objects for Information and Related Technology (COBIT)
Provides a set of generally accepted processes to assist in maximizing the benefits derived using information technology (IT) and developing appropriate IT governance.
Covert Channels
Communications mechanisms hidden from the access control and standard monitoring systems of an information system.
Cryptanalysis
The study of techniques for attempting to defeat cryptographic techniques and, more generally, information security services.
Cryptology
The science that deals with hidden, disguised, or encrypted communications. It embraces communications security and communications intelligence.
Cyber-Physical Systems (CPS)
Smart networked systems with embedded sensors, processors, and actuators that are designed to sense and interact with the physical world and support real-time, guaranteed performance in safety-critical applications.
Data Hiding
Maintains activities at different security levels to separate these levels from each other.
Data Warehouse
A repository for information collected from a variety of data sources.
Decoding
The reverse process from encoding – converting the encoded message back into its plaintext format.
Diffusion
Provided by mixing up the location of the plaintext throughout the ciphertext.
Digital Certificate
An electronic document that contains the name of an organization or individual, the business address, the digital signature of the certificate authority issuing the certificate, the certificate holder’s public key, a serial number, and the expiration date
Digital Rights Management (DRM)
A broad range of technologies that grant control and protection to content providers over their own digital media.
Digital Signatures
Provide authentication of a sender and integrity of a sender’s message.
Enterprise Security Architecture (ESA)
Focused on setting the long-term strategy for security services in the enterprise.
Firmware
The storage of programs or instructions in ROM.
“Generally Accepted Principles and Practices for Securing Information Technology Systems” (NIST SP 800-14)
Provides a foundation upon which organizations can establish and review information technology security programs.
Graham-Denning
Primarily concerned with how subjects and objects are created, how subjects are assigned rights or privileges, and how ownership of objects is managed.
Inference
The ability to deduce (infer) sensitive or restricted information from observing available information.
ISO/IEC 21827:2008, The Systems Security Engineering – Capability Maturity Model (SSE-CMM)
Describes the essential characteristics of an organization’s security engineering process that must exist to ensure good security engineering.
Hash Function
Accepts an input message of any length and generates, through a one-way operation, a fixed-length output
Industrial Control Systems (ICS)
Used to control industrial processes such as manufacturing, product handling, production, and distribution.
IT Infrastructure Library (ITIL)
Defines the organizational structure and skill requirements of an IT organization as well as the set of operational procedures and practices that direct IT operations and infrastructure, including information security operations.
Embedded Systems
Used to provide computing services in a small form factor with limited processing power.
Encoding
The action of changing a message into another format through the use of a code.
Hybrid Cloud Infrastructure
A composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability.
Initialization Vector (IV)
A non-secret binary vector used as the initializing input algorithm for the encryption of a plaintext block sequence to increase security by introducing additional cryptographic variance and to synchronize cryptographic equipment.
Key Clustering
When different encryption keys generate the same ciphertext from the same plaintext message.
Key Length
The size of a key, usually measured in bits or bytes, which a cryptographic algorithm used in ciphering or deciphering protected information.
Key Space
This represents the total number of possible values of keys in a cryptographic algorithm or other security measure, such as a password.
Message Authentication Code (MAC)
A small block of data that is generated using a secret key and then appended to the message.
Message Digest
A small representation of a larger message. Message digests are used to ensure the authentication and integrity of information, not the confidentiality.
Middleware
A connectivity software that enables multiple processes running on one or more machines to interact.
Multilevel Lattice Models
A security model describes strict layers of subjects and objects and defines clear rules that allow or disallow interactions between them based on the layers they are in.
Non-repudiation
A service that ensures the sender cannot deny a message was sent and the integrity of the message is intact.
OpenID Connect
An interoperable authentication protocol based on the OAuth 2.0 family of specifications.
OWASP
A nonprofit organization focused on improving the security of software.
Paging
Divides the memory address space into equal-sized blocks called pages
