Information Security Master Summary Flashcards

A comprehensive vocabulary review of key concepts, models, frameworks, controls, and compliance standards covered in the Information Security course notes.

Information Security (InfoSec)

Protection of important information against unauthorized access, disclosure, use, alteration, or disruption. Serves as an umbrella term covering physical IT asset security, endpoint security, data encryption, network security, etc.

IT Security

Protects physical/digital IT assets and data centers; does not cover paper files/media. Focuses on technology assets rather than the information itself.

Cybersecurity

Focuses on securing digital information systems from cyberthreats. Has a narrower scope than InfoSec and is not concerned with paper/analog data.

Data Security

Protects digital information from unauthorized access, corruption, or theft across its entire lifecycle. Covers physical security of hardware/storage, administrative/access controls, and logical security of software/policies.

NIST SP 800-100

A handbook giving a broad overview of InfoSec program elements aimed at CIOs/CISOs/security managers to guide building an InfoSec program strategy.

Confidentiality

A pillar of the CIA Triad focused on preventing unauthorized disclosure of information; achieved via authentication, access controls, and cryptography.

Integrity

A pillar of the CIA Triad focused on verifying that data has not been modified, tampered with, or corrupted; achieved via hashing.

Availability

A pillar of the CIA Triad focused on ensuring information is available when needed; achieved via redundancy and backups.

AAA Framework

An access control framework consisting of Authentication, Authorization, and Accounting that controls access to data/system resources, enforces policies, and audits actions.

Least Privilege

Core security principle requiring that a user, system, process, or application is given only the permissions necessary to complete its assigned tasks/functions—and nothing more.

Non-repudiation

Core security principle that prevents an entity from denying an action took place (e.g., digitally signed emails, system event logs).

Defense in Depth

Security concept of implementing several layers of protection combining physical and logical security.

Implicit Deny

Security control principle where unless something is explicitly allowed, it is denied.

Identity Proofing

The process of validating an individual's identity (via Driver's License, Passport, etc.) before credentials are issued; occurs prior to authentication.

Due Care

The "prudent man" rule — doing what any responsible person would do; implementing a security measure to mitigate risk.

Due Diligence

Managing due care — ensuring the implemented security measure was done correctly.

Gross Negligence

The opposite of due care — failing to act responsibly and suffering a loss as a result, which can create legal liability.

Information Security Governance

How an organization manages its InfoSec program via policies, procedures, and roles to ensure cybersecurity objectives are achieved at the right cost through a top-down approach driven by senior management.

Asset

Any item that has value to an organization (e.g., people, property, information).

Vulnerability

A weakness in the system/design/code, or lack of preventive mechanisms — an internal factor IT pros can control.

Threat

Any condition that could cause harm/loss/damage/compromise to an asset — an external or internal factor IT pros cannot control, only manage/mitigate.

Risk

The probability of the realization of a threat exploiting a vulnerability. Formally defined as: $\text{Risk} = \text{Threat} \times \text{Vulnerability}$.

Strategic Risk

Risk arising from operating in a specific industry/time (e.g., shifting consumer preferences making products obsolete).

Compliance Risk

Risk arising from legislative laws and regulations that organizations must follow.

Financial Risk

Risk associated with how an organization handles money, credit, interest rates, or exchange rates.

Operational Risk

Risk stemming from internal failures of processes, people, or systems (including unforeseen external events like power outages).

Reputational Risk

Loss of reputation resulting from product failures, lawsuits, or negative publicity.

Risk Mitigation

Adding controls to reduce risk to an acceptable level (not eliminate all risk), such as firewalls or IDS/IPS.

Risk Transference

Shifting risk to another party when it is too costly to accept, avoid, or mitigate (e.g., purchasing flood insurance).

Risk Avoidance

Changing system configuration or design to avoid a risk entirely (e.g., replacing unsupported Windows XP with Windows 10).

Risk Acceptance

Choosing to accept a risk, common when the risk is low or adequate countermeasures already exist.

Technical Controls

Security controls implemented through technical mechanisms, such as firewalls, IDS/IPS, antivirus, and endpoint security.

Operational Controls

Security controls executed through human procedures and operations, such as penetration tests and standard operating procedures.

Qualitative Risk Analysis

Subjective risk assessment used when no precise values exist; commonly utilizes a risk matrix.

Quantitative Risk Analysis

Numeric/countable risk assessment ("Probabilistic Risk Analysis") that expresses consequences in dollars, time, lives, etc.

Exposure Factor (EF)

The percentage of asset value lost during a risk event ($\text{EF} = 1.0$ if an asset loses all value).

Single Loss Expectancy (SLE)

A quantitative risk metric representing the monetary loss expected each time a specific threat exploits a vulnerability.

Annual Loss Expectancy (ALE)

A quantitative risk metric representing the annual cost of a risk event, used by executives to decide whether to mitigate, transfer, avoid, or accept a risk.

Sensitive Data

Any information that isn't public or unclassified; includes confidential, proprietary, or protected data that an organization must protect due to value or legal/regulatory requirements.

Data Retention

Long-term storage of valuable assets driven by legal, regulatory, and organizational compliance requirements.

Data at Rest

Data stored on media (hard drive, USB, tape) that is not currently being transmitted or used; typically protected via disk or file encryption.

Data in Motion (Transit)

Data currently moving across a network from one device to another; protected using SSL, TLS, or VPN/IPSec encryption.

Data in Use

Data currently being created, updated, appended, or erased by a system, app, or user. It is the hardest to protect because it is unencrypted while in use, requiring integrity checks and auditing.

Personally Identifiable Information (PII)

Any information that alone or combined could identify an individual (e.g., medical, educational, financial, or employment info).

Protected Health Information (PHI)

Information created/received by a healthcare provider/plan relating to physical or mental health, or payment for care, of an individual.

Proprietary Data

Data that helps an organization maintain a competitive edge (e.g., software code, technical plans, internal processes, IP, trade secrets).

Top Secret

Classification label applied to information where unauthorized disclosure could cause grave damage to national security.

Secret

Classification label applied to information where unauthorized disclosure could cause serious damage to national security.

Confidential

Classification label applied to information where unauthorized disclosure is reasonably expected to cause damage.

Unclassified

Label applied to data that does not meet the criteria for Top Secret, Secret, or Confidential, requiring no standard protection level.

Access Control

A data security process that manages who is authorized to access corporate data/resources, verifying user identities and granting appropriate access levels.

Authentication

The access control component and process of verifying a user's identity when logging into a system.

Authorization

The access control component and process of determining and verifying what permissions or access rights a user has once logged in.

Accounting

The access control element responsible for tracking and recording user access and actions via system logs.

Preventive Controls

Security controls that prevent an action before it happens (e.g., background check, drug test before hiring).

Detective Controls

Security controls that send alerts during or after an attack (e.g., building alarm during break-in, IDS alerting admins).

Corrective Controls

Security controls designed to "correct" a damaged system or process (e.g., antivirus quarantining or deleting malware).

Recovery Controls

Security controls that restore systems after an incident (e.g., backups and restoration procedures).

Deterrent Controls

Security controls designed to discourage users from attempting an action (e.g., security guards, warning signs, fences).

Compensating Controls

Security controls added to compensate for another control's weakness (e.g., Defense in Depth, multiple layers of security).

Mandatory Access Control (MAC)

The strictest access control model, used by government and military, where both subjects and objects receive sensitivity labels and access is granted only when labels match.

Discretionary Access Control (DAC)

Access control model where every object has an owner who decides who gets access; followed by most operating systems.

Role-Based Access Control (RBAC)

Access control model that uses assigned roles or groups to manage permissions based on job function (e.g., Accounting department access to QuickBooks).

Rule-Based Access Control

Access control model that uses specific rules to define when access is granted, serving to complement role-based access.

PCI DSS

Security standard that protects the payment card ecosystem by enforcing controls that permit or deny transactions.

HIPAA

Regulatory standard that protects patient health data from disclosure without consent.

SOC 2

Auditing procedure designed for cloud service providers storing customer data.

ISO 27001

ISO's gold standard certification for information security and compliance.