CPA ISC Study Notes: Security, Confidentiality, and Privacy (Area II)

CIA Triad

A model for security objectives comprising Confidentiality, Integrity, and Availability.

Confidentiality

Ensuring that information is accessible only to authorized individuals.

Integrity

Ensuring that information is accurate and complete, and has not been improperly altered.

Availability

Ensuring that systems and data are accessible when needed.

Least Privilege

Granting users the minimum access necessary to perform their job duties.

Need-to-Know

A principle stating that access to information should only be granted based on necessity.

Segregation of Duties (SoD)

A risk management principle that prevents one individual from controlling all aspects of a transaction.

Defense-in-Depth

Layering multiple security controls to protect assets.

Zero Trust

A security model that assumes no user or device is trusted by default.

Security Governance

The framework through which an organization manages its security policy and practices.

Policies

High-level statements of organizational intent regarding security.

Standards

Mandatory rules that translate policies into specific requirements.

Procedures

Detailed step-by-step instructions for implementing standards.

Guidelines

Recommended practices that are non-mandatory.

Security Awareness Training

Educating employees to recognize and respond to security threats.

Asset

Anything of value to an organization, like data or systems.

Threat

A potential cause of an unwanted incident.

Vulnerability

A weakness that allows a threat to exploit an asset.

Risk

The potential for a threat to exploit a vulnerability and cause harm.

Likelihood

The chance that a risk will occur.

Impact

The consequences of a risk event occurring.

Mitigate

To reduce the severity of a risk by implementing controls.

Transfer

To shift the risk to another party, often through insurance.

Avoid

To eliminate the risk by discontinuing the risk-inducing activity.

Accept

To acknowledge the risk and take no action.

Administrative Controls

Policies and procedures that govern the management of security.

Technical Controls

Logical security measures like encryption and access controls.

Physical Controls

Tangible measures like locks and surveillance cameras.

Preventive Controls

Controls that aim to stop security incidents before they occur.

Detective Controls

Controls that identify and alert on security incidents.

Corrective Controls

Controls that fix problems after they've been identified.

Authentication

The process of verifying the identity of a user or system.

Authorization

Process of determining what an authenticated user is allowed to do.

Multi-Factor Authentication (MFA)

A security measure requiring two or more verification factors.

Single Sign-On (SSO)

A user authentication process that allows a user to access multiple applications with one set of login credentials.

Role-Based Access Control (RBAC)

A method of regulating access based on the roles of individual users.

Privileged Access Management (PAM)

Strategies for protecting and monitoring privileged accounts.

Access Lifecycle Management

The process of managing user access from onboarding to termination.

Data Classification

The process of categorizing data based on its sensitivity.

Data Loss Prevention (DLP)

Technologies and practices that prevent unauthorized data sharing and leakage.

Privacy

The management of personal data according to legal and ethical standards.

Public Key Infrastructure (PKI)

A framework for managing digital certificates and public-key encryption.

Incident Response (IR)

A structured approach to preparing for and responding to security incidents.

Business Continuity (BC)

Processes to maintain operations during a disruption.

Disaster Recovery (DR)

Strategies to restore IT systems and data after a disruption.

Recovery Time Objective (RTO)

The target time to restore a service after an incident.

Recovery Point Objective (RPO)

The maximum acceptable amount of data loss measured in time.

Secure Software Development Lifecycle (SDLC)

Integrating security at each stage of software development.

SOC Reports

Reports providing assurance about a service organization's controls.

Complementary User Entity Controls (CUECs)

Controls that the customer must implement to achieve desired security.

Encryption

The process of converting plaintext into ciphertext to protect confidentiality.

Hashing

Transforming data into a fixed-length string, which is irreversible and helps ensure integrity.