CSEC 140 Week 1: Introduction to Cybersecurity Flashcards

Vocabulary flashcards covering core concepts, security principles, and threat modeling terms from CSEC 140 Week 1.

Security

Protecting things we value from harm, misuse, loss, or disruption.

Defense in Depth

The strategy of using layered defenses so that no single control failure becomes a disaster.

Cybersecurity

The practice of protecting digital systems, networks, devices, accounts, and data from unauthorized access, misuse, disruption, damage, or theft.

Confidentiality

A core security goal ensuring that only the right people can see information.

Integrity

A core security goal ensuring that information and systems are accurate and not improperly changed.

Availability

A core security goal ensuring that systems and data are usable when needed.

First Principles

Basic ideas that help us reason from the ground up instead of memorizing a checklist.

Least Privilege

The security principle that users and programs get only the permissions they need.

Secure Defaults

The security principle where the safest option should be the starting point.

Fail Safely

The security principle specifying that when something breaks, it should not expose everything.

Minimize Attack Surface

The security principle focused on removing unnecessary features, services, and permissions.

Separation of Duties

The security principle stating that one person or component should not control every step.

Verify, then Trust Carefully

The security principle to check identity, input, and behavior instead of making assumptions.

Threat Modeling

A structured way to identify what can go wrong in a system and decide what to do about it before attackers or accidents cause harm.

Asset

Something valuable, such as data, service, account, money, safety, or reputation.

Threat

A possible cause of harm, such as an attacker, accident, disaster, bug, or insider.

Vulnerability

A weakness that could be exploited, such as a missing patch, weak password, or bad process.

Attack Vector

The path used to cause harm, such as a phishing email, stolen laptop, or exposed API.

Control / Mitigation

A safeguard that reduces risk, such as MFA, encryption, backups, training, or logging.

Risk

A combination of likelihood and impact.

Spoofing

A STRIDE threat type asking if someone can pretend to be someone else.

Tampering

A STRIDE threat type asking if data or code can be changed improperly.

Repudiation

A STRIDE threat type asking if someone can deny what they did.

Information Disclosure

A STRIDE threat type asking if private data can be exposed.

Denial of Service

A STRIDE threat type asking if the system can be made unavailable.

Elevation of Privilege

A STRIDE threat type asking if someone can gain higher access.