ISC2 CC Flashcards
A documented, lowest level of security configuration
allowed by a standard or organization
Baseline
In 2016, the European Union passed comprehensive
legislation that addresses personal privacy,
deeming it an individual human right.
General Data
Protection
Regulation
(GDPR)
professional organization that sets
standards for telecommunications, computer
engineering and similar disciplines.
Institute of
Electrical and
Electronics
Engineers
develops voluntary international standards
in collaboration with its partners in international
standardization, the International Electro-
technical Commission (IEC) and the International
Telecommunication Union (ITU), particularly in the field
of information and communication technologies
International
Organization
of Standards
(ISO)
The internet standards organization, made up of network
designers, operators, vendors and researchers, that defines
protocol standards (e.g., IP, TCP, DNS) through a process
of collaboration and consensus
Internet
Engineering
Task Force
(IETF)
A weighted factor based on a subjective analysis of the
probability that a given threat is capable of exploiting
a given vulnerability or set of vulnerability
Likelihood of
Occurrence
part of the U.S. Department of Commerce
and addresses the measurement infrastructure within
science and technology efforts within the U.S. federal
government. NIST sets standards in a number of areas,
including information security within the Computer Security
Resource Center of the Computer Security Divisions
National
Institutes of
Standards and
Technology
(NIST)
The inability to deny taking an action such as
creating information, approving information
and sending or receiving a message
Non-
repudiation
“any information about an individual maintained by an agency,
including (1) any information that can be used to distinguish
or trace an individual’s identity, such as name, Social
Security number, date and place of birth, mother’s maiden
name, or biometric records; and (2) any other information
that is linked or linkable to an individual, such as medical,
educational, financial and employment information.”
Personally
Identifiable
Information
(PII)
Information regarding health status, the provision of
healthcare or payment for healthcare as defined in HIPAA
Protected
Health
Information
(PHI)
A method for risk analysis that is based on
the assignment of a descriptor such as low,
medium or high.
Qualitative
Risk Analysis
A method for risk analysis where numerical values
are assigned to both impact and likelihood based
on statistical probabilities and monetarized
valuation of loss or gain
Quantitative
Risk Analysis
The process of detecting and analyzing incidents to
limit the incident’s effect
Incident
Handling
or Incident
Response(IR)
The documentation of a predetermined set of
instructions or procedures to detect, respond to
and limit consequences of a malicious cyberattack
against an organization’s information system
Incident
Response Plan
(IRP)
An architectural approach to the design of buildings
and spaces which emphasizes passive features
to reduce the likelihood of criminal activity.
Crime
Prevention
through
Environmental
Design (CPTED)
Information security strategy integrating people,
technology, and operations capabilities to establish
variable barriers across multiple layers and missions
of the organization
Defense in
Depth
An automated system that controls an individual’s ability to access one or more computer system resources, such as a workstation, network, application or database. This system requires the validation of an individual’s identity through some mechanism, such as a PIN, card, biometric or other token. It has the capability to assign different access privileges to different individuals depending on their roles and responsibilities in an organization
Logical Access
Control
Systems
A certain amount of access control is left to the
discretion of the object’s owner, or anyone else who is
authorized to control the object’s access. The owner can
determine who should have access rights to an object
and what those rights should be
Discretionary
Access Control
(DAC)
An entrance to a building or an area that
requires people to pass through two doors
with only one door opened at a time.
Mantrap
The practice of ensuring that an organizational
process cannot be completed by a single person;
forces collusion as a means to reduce insider threats
Segregation
of Duties
The process of creating, maintaining and
deactivating user identities on a system
User
Provisioning
A set of routines, standards, protocols, and tools for building
software applications to access a web-based software
application or web tool
Application
programming
interface (API)
An IP network protocol standardized by the Internet
Engineering Task Force (IETF) through RFC 792 to
determine if a particular service or host is available
internet
Control
Message
Protocol
(ICMP)
Standard protocol for transmission of data
from source to destinations in packet-switched
communications networks and interconnected
systems of such network
Internet
Protocol (IPv4)
