CIA TRIAD, THREATS/VULNERABILITIES, AND CONTROLS

CIA Triad

The three core principles of information security: Confidentiality, Integrity, and Availability.

Confidentiality

The principle of keeping sensitive information inaccessible to unauthorized users.

Integrity

The principle of maintaining the accuracy and consistency of data over its lifecycle.

Availability

The principle ensuring that information and resources are accessible to authorized users when needed.

Encryption

The process of converting information into a code to prevent unauthorized access.

Access Control

The practice of limiting access to data and resources to authorized users only.

Hashing Algorithm

A function that converts an input into a fixed-length string of characters, used for data integrity verification.

SHA

Secure Hash Algorithm; a family of cryptographic hash functions designed for data integrity.

MD5

Message Digest 5; a widely used hashing algorithm that produces a 128-bit hash value.

Vulnerability

A flaw or weakness in a system that can be exploited by threats to gain unauthorized access.

Threat

Any circumstance or event that has the potential to cause harm to a system or organization.

Risk

The potential for loss or damage when a threat exploits a vulnerability.

Nonrepudiation

The assurance that someone cannot deny the validity of their signature or the sending of a message.

Authenticity

The property of being genuine or original, ensuring that data has not been altered by unauthorized entities.

Defense in Depth

A security approach that uses multiple layers of defense to protect information and resources.

Compensating Control

An alternative measure used to fulfill the requirement of a primary control that is unavailable.

Directive Control

Controls that provide guidance and policy direction for security efforts.

Zero Trust

A security model that assumes threats could be internal or external, requiring verification for every access attempt.

BeyondCorp

Google's implementation of the Zero Trust model, removing trust from the network perimeter.

Secure Zone

Segmentation of a network to create areas with specific access and security controls to protect data.

Micro Segmentation

Dividing the network into smaller, isolated segments to minimize the risk of lateral movement by attackers.

Monitoring Plan

The component that observes activity within the network to detect and respond to potential threats.

Policy Enforcement Point

The system component that enforces access control policies and decisions made by the control plan.

____ is the principle of keeping unauthorized users from accessing sensitive information.

Confidentiality

The assurance that someone cannot deny the validity of their signature is known as ____.

Nonrepudiation

A flaw in a system that can be exploited is termed a ____.

Vulnerability

The continuous movement of data in a secure manner is referred to as ____.

Data Integrity

____ refers to the process of translating information into an unreadable format to prevent unauthorized access.

Encryption

The principle ensuring that information is reliably accessible to authorized users is called ____.

Availability

A ____ control is an alternative measure used when a primary security control is not available.

Compensating

The principle focusing on keeping data accurate and consistent is known as ____.

Integrity

The practice of managing who can access specific data and resources is called ____ Control.

Access

In a security framework, ____ enforcement points are systems that uphold access control policies.

Policy

What does the CIA Triad represent in information security?

The CIA Triad represents Confidentiality, Integrity, and Availability, which are the three core principles of information security.

What is the purpose of encryption?

The purpose of encryption is to convert information into a code to prevent unauthorized access.

What does access control limit?

Access control limits access to data and resources to authorized users only.

How does hashing contribute to data integrity?

Hashing converts input data into a fixed-length string, allowing verification of data integrity.

What is the goal of using defense in depth?

The goal of defense in depth is to use multiple layers of security measures to protect information and resources.

What does the term 'risk' refer to in information security?

Risk refers to the potential for loss or damage when a threat exploits a vulnerability.

What is a vulnerability in the context of cybersecurity?

A vulnerability is a flaw or weakness in a system that can be exploited by threats.

Define nonrepudiation in information security.

Nonrepudiation is the assurance that someone cannot deny the validity of their signature or the sending of a message.

What is the significance of the Zero Trust model?

Zero Trust assumes that threats could be internal or external, requiring verification for every access attempt.

What does policy enforcement point do?

A policy enforcement point enforces access control policies and decisions made by the control plan.