Information Security Concepts Flashcards

A complete set of vocabulary flashcards covering key information security domains including security principles, business continuity, access controls, network security, and security operations.

CIA Triad

Confidentiality, Integrity, Availability: the three core goals of information security.

Confidentiality

Ensuring information is accessible only to those authorized to see it.

Integrity

Ensuring data is accurate and unaltered except by authorized action.

Availability

Ensuring systems and data are accessible when needed.

Non-repudiation

Assurance that someone cannot deny having performed an action (e.g., via digital signatures/logs).

Authentication

Verifying that a user or system is who/what it claims to be.

Authorization

Determining what an authenticated user is allowed to do.

Accounting (AAA)

Tracking user actions (logging), the third piece alongside Authentication and Authorization.

Identification

The act of claiming an identity (e.g., entering a username), distinct from proving it.

Privacy

Protection of personally identifiable information (PII) from unauthorized use or disclosure.

Risk

The potential for loss or damage when a threat exploits a vulnerability.

Threat

Anything capable of causing harm to an asset.

Vulnerability

A weakness that a threat can exploit.

Risk Management

The overall process of identifying, assessing, and controlling risk.

Risk Assessment

The process of identifying and analyzing risks.

Risk Treatment (Response)

The four common strategies: Avoid, Transfer, Mitigate, Accept.

Risk Avoidance

Eliminating the activity or condition that creates the risk.

Risk Transfer

Shifting risk to a third party (e.g., insurance, outsourcing).

Risk Mitigation

Reducing the likelihood or impact of a risk (e.g., adding controls).

Risk Acceptance

Choosing to accept a risk because the cost of addressing it exceeds the benefit.

Residual Risk

The risk remaining after controls have been applied.

Control

A safeguard or countermeasure to reduce risk.

Administrative (Managerial) Controls

Policies, procedures, training.

Technical (Logical) Controls

Firewalls, encryption, access control lists.

Physical Controls

Locks, fences, guards, cameras.

Preventive Control

Stops an incident before it happens.

Detective Control

Identifies that an incident occurred.

Corrective Control

Fixes/restores after an incident.

Deterrent Control

Discourages an attacker (e.g., warning signs).

Compensating Control

An alternative control used when the primary one isn't feasible.

Governance

The framework of policies and oversight guiding security decisions.

Ethics (ISC2 Code of Ethics)

Canons: Protect society/commonwealth/infrastructure; act honorably, honestly, justly, responsibly, legally; provide diligent/competent service; advance the profession.

Zero Trust

"Never trust, always verify" — no implicit trust based on network location.

Least Privilege

Users/systems get only the minimum access needed to perform their job.

Separation of Duties (SoD)

Splitting critical tasks among multiple people to prevent fraud/error.

Defense in Depth

Layering multiple security controls so no single point of failure exists.

Due Care

Taking reasonable steps to protect assets (the "prudent person" standard, ongoing).

Due Diligence

The research/investigation done before taking action (e.g., vetting a vendor).

Business Continuity Plan (BCP)

Plan to keep essential business functions running during/after a disruption.

Disaster Recovery Plan (DRP)

Plan focused specifically on restoring IT systems/data after a disaster.

Business Impact Analysis (BIA)

Identifies critical business functions and the impact of their disruption.

Recovery Time Objective (RTO)

Maximum acceptable time to restore a system/function after disruption.

Recovery Point Objective (RPO)

Maximum acceptable amount of data loss, measured in time (how far back backups must go).

Maximum Tolerable Downtime (MTD)

Longest a business function can be unavailable before causing unacceptable harm.

Mean Time to Repair (MTTR)

Average time to fix a failed component.

Mean Time Between Failures (MTBF)

Average time between failures of a system.

Hot Site

Fully equipped, near-instant failover backup facility.

Warm Site

Partially equipped backup facility; faster than cold, slower than hot.

Cold Site

Basic facility with power/space only; requires significant setup time.

Incident

An event that violates security policy or threatens asset confidentiality/integrity/availability.

Incident Response Plan (IRP)

Predefined steps for handling security incidents.

Incident Response Lifecycle

Preparation → Detection & Analysis → Containment → Eradication → Recovery → Lessons Learned (Post-Incident Activity).

Preparation

Building the tools, training, and plans before an incident occurs.

Detection & Analysis

Identifying that an incident has occurred and assessing scope.

Containment

Limiting the spread/impact of an incident.

Eradication

Removing the root cause (e.g., malware) from the environment.

Recovery

Restoring systems to normal operation.

Lessons Learned

Post-incident review to improve future response.

Backup

A copy of data kept for restoration purposes.

Full Backup

Complete copy of all selected data.

Incremental Backup

Backs up only data changed since the last backup (full or incremental).

Differential Backup

Backs up all data changed since the last full backup.

Redundancy

Duplication of critical components to eliminate single points of failure.

High Availability (HA)

Design approach ensuring systems remain operational with minimal downtime.

Single Point of Failure (SPOF)

A component whose failure would take down the whole system.

Access Control

Mechanisms that restrict access to resources.

Physical Access Control

Controls like badges, locks, mantraps, biometric scanners.

Logical (Technical) Access Control

Controls like passwords, ACLs, encryption.

Discretionary Access Control (DAC)

Resource owner decides who gets access.

Mandatory Access Control (MAC)

Access determined by system-enforced labels/classifications (e.g., government/military systems).

Role-Based Access Control (RBAC)

Access assigned based on job role.

Rule-Based Access Control

Access determined by predefined rules (e.g., firewall rules).

Attribute-Based Access Control (ABAC)

Access based on attributes (user, resource, environment).

Multi-Factor Authentication (MFA)

Authentication requiring 2+ factors: something you know, have, are (and sometimes somewhere you are/something you do).

Something You Know

Password, PIN.

Something You Have

Token, smart card, phone (OTP app).

Something You Are

Biometric (fingerprint, retina, face).

Single Sign-On (SSO)

One authentication grants access to multiple systems.

Federation

Trust relationship allowing identity to be used across organizational boundaries.

Provisioning

Creating user accounts/access.

Deprovisioning

Removing user accounts/access (critical during offboarding).

Privileged Access Management (PAM)

Managing/monitoring accounts with elevated privileges.

Mantrap

A physical access control with two interlocking doors to prevent tailgating.

Tailgating/Piggybacking

Unauthorized person following an authorized person through a secure entry point.

Network Segmentation

Dividing a network into smaller zones to limit access/spread of threats.

DMZ (Demilitarized Zone)

A buffer network segment between the internet and internal network, hosting public-facing services.

VLAN

Virtual LAN; logically segments a network without physical separation.

Firewall

Device/software that filters traffic based on rules.

Packet-Filtering Firewall

Filters based on IP/port/protocol at the packet level.

Stateful Inspection Firewall

Tracks the state of active connections to make filtering decisions.

Next-Generation Firewall (NGFW)

Combines traditional filtering with deep packet inspection, IPS, app awareness.

IDS (Intrusion Detection System)

Monitors and alerts on suspicious activity; does not block.

IPS (Intrusion Prevention System)

Monitors and actively blocks suspicious activity.

VPN (Virtual Private Network)

Encrypted tunnel for secure communication over an untrusted network.

NAT (Network Address Translation)

Translates private IP addresses to public ones.

Proxy Server

Intermediary that forwards requests between clients and servers.

Honeypot

A decoy system designed to lure and study attackers.

OSI Model

7-layer model: Physical, Data Link, Network, Transport, Session, Presentation, Application.

TCP/IP Model

4-layer model: Network Access, Internet, Transport, Application.

TCP

Connection-oriented, reliable transport protocol (three-way handshake: SYN, SYN-ACK, ACK).