Information Assurance and Security Vocabulary

Vocabulary flashcards covering core concepts of Information Assurance, Information Security, the CIA Triad, access control principles, and the Security System Development Life Cycle (SecSDLC).

Information Security (InfoSec)

The practice of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Information Assurance (IA)

Encompasses security measures, management processes, policies, and procedures needed to ensure the confidentiality, integrity, availability, and non-repudiation of information systems.

Asset

The information, hardware, software, or personnel that must be protected.

Threat

A potential danger that could exploit a vulnerability (e.g., a hacker, a natural disaster, an employee error).

Vulnerability

A weakness in the system, design, implementation, or policy that could be exploited by a threat (e.g., an unpatched operating system, a weak password policy).

Control/Countermeasure

A mechanism (technical, physical, or administrative) put in place to reduce or eliminate a vulnerability or prevent a threat from exploiting it.

Confidentiality

Protecting information from being disclosed to unauthorized parties and ensuring it is accessed only by authorized individuals, systems, or processes.

Integrity

Protecting information from unauthorized modification or destruction, ensuring that data is accurate and complete.

Availability

Ensuring that authorized users have access to information and associated systems whenever they are needed.

Authenticity

Verifying the identity of the user, person, or system that created or sent the information.

Non-repudiation

Ensuring that the party who sent or created a transmission or data cannot later deny having done so.

Utility/Possession

Having the information/system in a usable and accessible format.

CIA Triad

The core model of information security representing Confidentiality, Integrity, and Availability, which serves as a guide for developing security policies, controls, and strategies.

Least Privilege Principle

A security principle where users are granted only the minimum level of access necessary to perform their job functions.

Role-Based Access Control (RBAC)

An access control method where access rights are assigned based on job roles rather than individuals.

Need-to-Know Basis

A security practice where sensitive information is shared only with individuals who genuinely require it, even if they have general system access.

Defense in Depth

A security strategy implementing multiple layers of security controls so that if one control fails, others remain in place to protect information.

SecSDLC

A phased approach based on the standard SDLC for developing and implementing a security program or a secured system, focusing on risk management and security controls.

Investigation (SecSDLC)

The SecSDLC phase where objectives, scope, constraints, and feasibility of the security project are defined.

Analysis (SecSDLC)

The SecSDLC phase involving the analysis of existing security systems, threats, vulnerabilities, and the current business environment.

Logical design (SecSDLC)

The SecSDLC phase that specifies how the security requirements will be met, independent of specific technology.

Physical design (SecSDLC)

The SecSDLC phase involving the selection of specific technologies, components, and platforms to support the logical design.

Implementation (SecSDLC)

The SecSDLC phase where the security solution is built, tested, deployed, and users and administrators are trained.

Maintenance & change (SecSDLC)

The SecSDLC phase focused on continually monitoring, reviewing, patching, and updating the system and its controls over time.