NPower Sec+ 01 Security Fundamentals

Vocabulary flashcards covering core cybersecurity concepts, security controls, access control models, physical security, Zero Trust Architecture, and data protection methods.

CIA triad

The three core security goals: Confidentiality, Integrity, and Availability.

Confidentiality

A security goal ensuring only authorized people can access data, implemented using tools such as encryption and access controls.

Integrity

A security goal ensuring data is accurate and has not been changed without authorization, implemented using tools like hashing, file integrity monitoring, and digital signatures.

Availability

A security goal ensuring data and systems are accessible when authorized users need them, implemented using tools like redundancy, backups, and failover.

DAD triad

The opposite of the CIA triad, describing the consequences attackers cause: Disclosure, Alteration, and Denial.

Disclosure (DAD)

Unauthorized exposure of data; the direct opposite of confidentiality.

Alteration (DAD)

Unauthorized modification of data; the direct opposite of integrity.

Denial (DAD)

Authorized users being blocked from data or systems; the direct opposite of availability.

Five consequential risks of a data breach

The five risk categories resulting from a breach: Financial, Reputational, Strategic, Operational, and Compliance.

Financial risk (data breach)

Direct monetary costs from a data breach, including fines, legal fees, response and recovery costs, and lost revenue.

Reputational risk (data breach)

Consequences of a breach that result in loss of customer trust and damage to the organization's brand.

Strategic risk (data breach)

Consequences of a breach where competitors gain an advantage or development plans and trade secrets are exposed.

Operational risk (data breach)

Disruption to normal business processes and systems caused by a data breach.

Compliance risk (data breach)

Violating laws or regulations (such as HIPAA, GDPR, or PCI DSS) during a data breach, leading to penalties.

Least privilege

A principle where a user is granted only the limited access required to perform their specific job role, and nothing more.

Defense in depth

A strategy employing multiple layers of security so that if one layer fails, another layer prevents the attack.

Gap analysis

A process that compares an organization's current security state to a desired state or standard to identify what is missing.

Control categories (Security+)

Technical, Managerial, Operational, and Physical; categories describe who or what implements the security control.

Control types (Security+)

Preventive, Deterrent, Detective, Corrective, Compensating, and Directive; types describe what the security control does.

Managerial controls

Administrative controls focused on risk management and oversight, such as annual risk assessments, penetration testing, and vulnerability scanning.

Operational controls

Security controls carried out by people on a day-to-day basis, such as annual security awareness training, change management, and business continuity plans.

Technical controls

Security controls implemented through technology, such as firewall rules, DLP, antivirus/antimalware, IPS/IDS, screen savers, and screen filters.

Directive controls

Controls that instruct people on what to do, exemplified by policies and procedures.

Deterrent controls

Controls designed to discourage attackers from attempting an attack, such as visible CCTV and motion sensors.

Detective controls

Controls that identify that an event has occurred or is currently happening, such as CCTV footage and log files.

Corrective controls

Actions taken to recover and restore systems after an incident has occurred, such as fire suppression systems.

Preventive controls

Controls that stop an event from happening in the first place, such as firewalls, physical locks, least privilege, and MFA.

Compensating controls

Substitute safeguards used when a primary control cannot be implemented, such as protections wrapped around a legacy system.

Identification

The process of claiming an identity, such as by entering a username.

Authentication

The process of proving a claimed identity using credentials such as a password, MFA, or biometrics.

Authorization

The process of determining what actions an authenticated user is permitted to perform.

Discretionary access control (DAC)

An access control model where the resource owner decides who is granted access, such as NTFS file permissions in Windows.

Mandatory access control (MAC)

An access control model where a central authority regulates access based on labels and data classifications, commonly used in military environments.

Role-based access control

An access control scheme where permissions are assigned to specific roles and users are placed into those roles based on job function.

Rule-based access control

An access control scheme where access is evaluated and granted according to set rules that apply to everyone, such as firewall rules or time-of-day restrictions.

Attribute-based access control (ABAC)

A granular access control model that evaluates attributes of the user, resource, and environment (such as department, location, time, and device).

Group-based access control

An access model that uses groups to simplify the assignment of rights and permissions to many users at once.

Linux permission string order

The standard permission string consisting of three sets of rwx characters representing owner (user), group, and others in order (where r = read, w = write, and x = execute).

Linux permission numeric values

Octal values assigned to file permissions where Read = $4$, Write = $2$, and Execute = $1$, summed per category set (e.g., rwx = $7$, rw- = $6$).

Perimeter security (physical)

Outer boundary defenses including signage, fences/gates, access control, lighting, cameras, and robot sentries.

Signage

Warning signs placed at the perimeter to set behavioral expectations and deter unauthorized intruders.

Fences / gates

Physical barriers installed to delay, control, and channel entry at an organization's perimeter.

Lighting (physical security)

Perimeter illumination that deters intruders by eliminating hiding spots and assists surveillance cameras in capturing clear footage.

Robot sentries

Autonomous patrol robots that monitor a perimeter or facility for physical security.

Security guards

Personnel who actively patrol facilities, check identification, and respond to security incidents, functioning as both deterrent and responsive controls.

Two-person integrity / control

A physical security measure requiring two authorized individuals to be present for a sensitive action or within a secure area to prevent a single individual from acting alone.

Mantrap

A secure physical space with two interlocking doors designed so only one door can open at a time, preventing tailgating and piggybacking (also referred to as an access control vestibule).

Tokens (physical)

Physical hardware devices that serve as an authentication factor representing 'something you have.'

Biometric locks

Physical locking mechanisms unlocked via biological characteristics such as fingerprints, iris scans, or facial recognition ('something you are').

Electronic locks

Locks operated electronically via keypads or card readers that possess the ability to log entry events and timestamps.

Conduits

Protective rigid tubes or channels designed to house and shield network cables from tampering, physical damage, and wiretapping.

Cable locks

Physical locks that tether a laptop or small appliance to a fixed piece of furniture or anchor point to prevent theft.

Air gap

A security measure that ensures a computer or network is completely physically isolated from all outside networks, including the internet.

USB data blocker

A hardware adapter connected to a USB cable that physically blocks data pins while allowing power to pass, preventing juice jacking.

Faraday cage

A specialized enclosure designed to block external electromagnetic fields and wireless signals to prevent eavesdropping and unauthorized remote access.

Zero Trust (ZTA)

A security model founded on the principle of 'never trust, always verify,' requiring every request to be verified, authenticated, and authorized regardless of perimeter location.

Control plane (Zero Trust)

The architectural component of Zero Trust responsible for evaluating policies, performing authentication, and making access and traffic flow decisions.

Data plane (Zero Trust)

The architectural component of Zero Trust responsible for moving and forwarding network traffic based on decisions issued by the control plane.

Adaptive identity

A Zero Trust mechanism that dynamically adjusts access rights based on user behavior, physical location, and assessed risk level.

Threat scope reduction

A security practice that minimizes potential damage and attack surface by strictly enforcing least privilege and network segmentation.

Policy administrator

The Zero Trust control plane component that enforces access rules by actively communicating with internal services and systems.

Policy engine

The Zero Trust control plane component that evaluates context and conditions against rules to make the final allow or deny access decision.

Policy enforcement point (PEP)

The Zero Trust data plane component that directly enables, monitors, and terminates traffic connections by executing policy decisions.

Implicit trust zones

Network zones traditionally assumed to be safe without verification, which are completely eliminated in a Zero Trust Architecture.

Data at rest

Inactive data residing in storage, such as archives, backups, and USB drives, primarily secured using encryption.

Data in transit

Data actively moving across a network, such as email attachments and web traffic, primarily secured using TLS or VPNs.

Data in use

Data actively being processed by applications, system RAM, CPU registers, or open documents.

Data minimization

The practice of collecting and retaining only the data strictly necessary for business purposes and deleting it once it is no longer needed.

DLP (data loss prevention)

A suite of software tools designed to detect, monitor, and prevent unauthorized exfiltration of sensitive data outside an organization.

Regular expressions in DLP

Pattern-matching strings utilized by DLP software to locate sensitive formatted data, such as Social Security numbers and credit card numbers.