Security Posture Flashcards
The process of identifying the difference between current security measures and desired standards or compliance requirements. It highlights weaknesses and areas for improvement.
Gap Analysis
Educates employees about cybersecurity risks, best practices, and how to recognize and respond to threats such as phishing, malware, and social engineering.
Security Awareness Training
Involves identifying, analyzing, and evaluating risks to an organization’s assets, systems, or data. It determines potential threats, their likelihood, and their impact, guiding decisions to mitigate those risks.
Risk Assessment
A discussion-based simulation where participants review and practice their response to hypothetical security incidents or emergencies. It is conducted in a low-stress environment to identify weaknesses in procedures.
Tabletop Exercise
A security framework that assumes no user, device, or system should be trusted by default, even if they are inside the network perimeter. Verification is required for every access request.
Zero Trust Model
Implement Least Privilege
Never Trust, Always Verify
Assume Breach
Zero Trust Model
The implementation of the Zero Trust Model in an organization’s network and systems. It integrates technologies like identity management, multi-factor authentication, and micro-segmentation to enforce the “never trust, always verify” principle.
Zero Trust Architecture
The operational practice of implementing the Zero Trust Model by enforcing strict identity verification and least privilege access across all systems, users, and devices.
Zero Trust Security
The outdated security assumption that everything inside an organization’s network is secure and trustworthy. It contrasts with the Zero Trust Model, which assumes that no user, device, or system should be trusted without verification.
Implicit Trust
Continuously tracking and recording activity on networks, systems, and applications. Logs capture events like user access, file changes, or system errors for analysis.
Monitoring and Logging
A dynamic security approach that adjusts access controls based on the context of a user’s behavior, location, device, or other factors. It is often used in conjunction with multi-factor authentication (MFA).
Adaptive Identity
A network security strategy that divides a network into smaller segments and applies security policies to each one. This limits lateral movement by attackers and isolates potential breaches.
Microsegmentation
The decision-making component in an access control system. It evaluates access requests against policies to determine if access should be granted or denied.
Policy Engine (PE)
The component that enforces access control decisions made by the Policy Engine. It allows or blocks access to resources based on those decisions.
Policy Enforcement Point (PEP)
The intermediary component that communicates between the Policy Engine and the Policy Enforcement Point. It pushes configuration changes and enforces policies at the enforcement point.
Policy Administrator (PA)
The component within an access control system responsible for evaluating access requests against policies and making the “allow” or “deny” decision.
Receives access requests from the Policy Engine (PE) and the Policy Enforcement Point (PEP).
Policy Decision Point (PDP)
A physical security measure consisting of a small, enclosed area with two sets of interlocking doors. Only one door can open at a time, ensuring controlled entry and exit.
Used to prevent unauthorized access by verifying credentials before allowing entry.
Access Control Vestibule
A decoy system or resource set up to attract attackers, detect their activities, and analyze their methods. It mimics a legitimate target without providing real value to the attacker.
Honeypot
A network of honeypots designed to simulate a larger environment, such as an enterprise network. It provides a more realistic target for attackers, making it easier to study complex threats.
Honeynet
A piece of data, such as a fake document, file, or database entry, designed to lure attackers. Accessing or using this could trigger an alert, indicating unauthorized activity.
Honeytoken
A decoy file intentionally placed in a system or network to detect unauthorized access or insider threats. It is designed to appear valuable or interesting to an attacker, such as a document labeled “Passwords” or “Confidential Plans.”
Honeyfile
A security tool that monitors network traffic or system activity for malicious behavior and sends alerts to administrators when suspicious activity is detected.
Examples: Network-Based IDS & Host-based IDS.
Intrusion Detection System (IDS)
A security tool that monitors network traffic or system activity, detects malicious behavior, and takes proactive actions (e.g., blocking traffic) to stop threats in real time.
Intrusion Prevention System (IPS)
A formal agreement between two or more organizations that outlines the roles, responsibilities, and expectations for a business partnership.
Business Partnership Agreement (BPA)
