Module 3: Risk Impact on Access Control

Vocabulary flashcards covering the concepts, equations, domains, threats, and defensive controls discussed in Module 3: Risk Impact on Access Control.

Risk Assessment

The critical first step in designing an access control system that identifies, prioritizes, and determines methods to minimize or mitigate potential threats and vulnerabilities within an existing system.

Risk

The probability that a particular threat will exploit a vulnerability, causing harm to an organization; calculated using the equation $\text{Risk} = \text{Probability} \times \text{Impact}$.

Asset Value (AV)

The relative value, expressed either in monetary terms or qualitative worth, of a resource protected by an access control system.

Threat

A list or description of potential attacks that can be launched against an asset.

Vulnerability

An unintended weakness in a system's design that allows an attacker to gain unauthorized access, seize control, or damage the system.

Probability of Occurrence

The likelihood that a specific threat will successfully exploit a vulnerability in a system.

Impact

The magnitude of harm or loss experienced by an organization should a risk materialize.

Control

A technical, physical, or administrative safeguard or procedure designed to reduce risk.

Password Cracking

An access control threat involving guessing or deciphering user credentials using brute force and sophisticated algorithms.

Heightened Access

An attack whereby an intruder logs into a system at one authorization level and exploits system or application vulnerabilities to attain higher privileges.

Social Engineering

The use of deception, trickery, or manipulation to induce authorized personnel into divulging sensitive data or granting unauthorized system access.

Tailgating (Piggybacking)

A physical security breach where an unauthorized individual follows closely behind an authorized employee to enter a secured facility using their credentials.

Quantitative Risk Assessment

A risk assessment methodology that relies on numerical data, financial figures, and formulas to calculate, identify, and rank organizational risks.

Exposure Factor (EF)

The percentage or proportion of an asset's overall value that is expected to be lost when a specific incident occurs.

Single Loss Expectancy (SLE)

The financial loss anticipated every single time an asset is compromised, calculated as $\text{SLE} = \text{AV} \times \text{EF}$.

Annualized Rate of Occurrence (ARO)

The estimated number of times an incident or threat is expected to occur over the course of a single year.

Annualized Loss Expectancy (ALE)

The expected annual financial loss attributable to a particular risk, calculated using the formula $\text{ALE} = \text{SLE} \times \text{ARO}$.

Qualitative Risk Assessment

A risk assessment process that utilizes expert judgment and consensus rather than mathematical calculations to estimate the probability and impact of risk/asset pairs.

Risk Acceptance

A risk management strategy wherein an organization acknowledges a risk exists but chooses to take no action because remediation costs outweigh potential benefits.

Risk Mitigation

The primary IT risk management strategy, consisting of deploying technical or administrative controls to reduce the likelihood and/or impact of a risk.

Risk Transference

A risk management strategy that reallocates the financial or operational consequences of a risk to an outside third party, commonly via insurance policies.

Sensitive Compartmented Information Facility (SCIF)

A fortified, perimeter-controlled area used by the U.S. government requiring armed guards, badge scanners, and biometric authentications to open and view classified materials.

Defense-in-Depth

A multilayered access control strategy designed to handle failure by ensuring that if an individual protective layer is breached, another line of defense prevents compromise.

User Domain

The IT infrastructure domain focusing on the human element, where the primary layer of defense is training users on secure password creation and social engineering awareness.

Workstation Domain

The IT infrastructure domain encompassing endpoint devices, primarily safeguarded by antivirus software, regular operating system patching, and host firewalls.

Host Firewall

A software-based firewall installed directly on a workstation designed to control traffic and shield that specific computer from unauthorized access.

LAN Domain

The Local Area Network domain, secured through intrusion detection/prevention systems, server-level antivirus scanners, and inbound e-mail inspection.

Intrusion Detection System (IDS)

A security monitoring tool that analyzes network traffic against patterns of known malicious behavior, alerting administrators and aiding in post-incident analysis.

Intrusion Prevention System (IPS)

An active security mechanism that inspects traffic in real time, automatically notifying administrators and dropping or blocking identified malicious packets.

LAN-to-WAN Domain

The boundary intersection where the local area network links with the wide area network, using a perimeter firewall as its primary security mechanism.

Packet Filter Firewall

A firewall that evaluates individual incoming and outgoing packets against a custom rule set to permit or drop them, without tracking the connection state.

Stateful Inspection Firewall

A firewall that evaluates packet contents while tracking active session states, allowing reply traffic from previously established connections without re-filtering.

Application Gateway

A specialized firewall that tracks and inspects traffic flowing to and from a specific network protocol or application, such as FTP or SSL.

Proxy Server

An intermediary system that intercepts network requests entering and leaving a network, concealing internal addresses and filtering web browsing by keywords or URIs.

Remote Access Domain

The infrastructure domain that governs external access to private networks, primarily secured through Virtual Private Networks (VPNs) and IP tunneling.

IP Tunneling

The technique of wrapping network packets inside an outer packet to transmit encrypted data across public network infrastructure over an authenticated pathway.

System/Application Domain

The domain containing enterprise applications, web servers, and mainframes, where the primary security process is rigorous software patch management and testing.