Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Vocab List > Vocab List > Flashcards

Vocab List Flashcards

1
Q

Acceptance (of Risk)

A

Senior management chooses to accept the risk of an activity as it is.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Asset Inventory

A

A full catalog of the organization’s property (tangible, intellectual, digital, etc.), with sufficient detail/descriptions of attributes to determine specific responsibility/ownership and current configuration/disposition/protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Availability

A

Ensuring data can be accessed in authorized manner, as permitted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Avoidance (of Risk)

A

Senior management chooses to cease the activity to remove the risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Business Impact Analysis

A

The overall effort (and the artifact resulting from this effort) to assess the relative value of assets within an organization, the potential threats to those assets, and the possible damage that might be caused if an asset or assets is harmed or lost.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Change management

A

The process, method, and resources used to modify the configuration of assets in the inventory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CIA Triad

A

The triad includes these three ideas: confidentiality, integrity, and availability of assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Configuration Management

A

The process, method, and resources used to determine baseline settings and version of assets in the inventory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Due Care

A

The legal duty owed by an organization to its constituents (users/customers/employees/the public).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Due Diligence

A

Documented efforts demonstrating the organization’s activities to provide due care.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Governance

A

The processes, roles, and policies an organization uses to make decisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

[Security] Guidelines

A

Recommendations (not mandates) for security best practices, usually from sources external to the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Integrity

A

Protecting data from unauthorized modification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Job Rotation

A

Shifting personnel (usually within a given department) among various roles throughout the year, for security, morale, and continuity purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Least Privilege

A

Personnel are only given the minimal set of permissions necessary to perform their job function.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Maximum Allowable Downtime (MAD)

A

[also referred to as “MTD”— maximum tolerable downtime] The amount of time an organization can suffer an interruption to its critical path and still remain an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Mitigation (of Risk)

A

Risk is reduced through the use of controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Need to Know

A

Information is only disclosed to those who have a business need and permission to access it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

[Security] Policy

A

The organization’s strategic security direction and mandates, published and signed by senior management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Privileged (Users/Account)

A

Those with more access/permissions than regular users can cause more harm to the organization than regular users (and, historically, have); therefore, privileged accounts must be managed in a more restrictive and thorough manner than regular accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

[Security] Procedures

A

Specific instructions for performing security-related tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Recovery Point Objective (RPO)

A

The amount of data that can be lost by the organization without destroying the organization (usually measured in time, backward from the current moment; so, “the last 72 hours’ worth of data”).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Recovery Time Objective (RTO)

A

The duration that an organization can suffer an interruption of its critical path without destroying the organization (measured as time, necessarily less than the MAD/MTD).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Residual Risk

A

Risk that remains after controls are put into operation (risk mitigation).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Risk

A

Potential harm to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Separation of Duties

A

Purposefully imposing inefficiency on a business process so that one person cannot complete an entire transaction on their own, forcing collusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Service Level Agreement (SLA)

A

The SLA describes, objectively, specifically, and numerically, the terms of the service the provider will deliver on a regular basis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

[Security] Standards

A

Minimum target levels and security best practices; may be created within the organization and imposed on all business units or may be taken from external creators (such as standards bodies like ISO, PCI, or SANS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Threat

A

A factor that poses risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Transfer (of Risk)

A

Another party is paid to share risk on the organization’s behalf.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Vulnerability

A

An avenue that causes or enhances risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Algorithm

A

A mathematical function that is used in the encryption and decryption processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Antimalware Solutions

A

Solutions that inhibit, detect, quarantine, and remove malware targeting the environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Asymmetric Cryptography

A

Cryptography in which two different but mathematically related keys are used, and one key is used to encrypt, and another is used to decrypt.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Asynchronous

A

Encrypt/decrypt requests are processed in queues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Avalanche Effect

A

A minor change in either the key or the plaintext will have a significant, large change in the resulting ciphertext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Ciphertext or Cryptogram

A

The altered form of a plaintext message that is unreadable by anyone except the intended recipients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Coaxial Cable

A

Insulated copper wire terminating in a single pin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Collision

A

Occurs when a hash function generates the same output for different inputs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Confusion

A

Provided by mixing or changing the key values used during the repeated rounds of encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Content Distribution Networks (CDNs)

A

Also sometimes referred to as content delivery network; used to replicate portions of data geographically closer to end users in order to enhance performance/quality of service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Convergence

A

The practice of using one communication medium/protocol to convey multiple forms of communication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Cryptanalysis

A

The study of techniques for attempting to defeat cryptographic techniques and, more generally, information security services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Cryptosystem

A

The entire cryptographic operation and system; typically includes the algorithm, key, and key management functions, together with the services that can be provided through cryptography.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Decryption

A

The reverse process from encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Diffusion

A

Provided by mixing up the location of the plaintext throughout the ciphertext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Digital Certificate

A

A digital certificate is an electronic document that contains the name of an organization or individual, the business address, the digital signature of the certificate authority issuing the certificate, the certificate holder’s public key, a serial number, and the expiration date.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Distributed System

A

System that performs a single task using resources that are located across multiple machines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Embedded Systems

A

Very similar to ICS; typically processors with limited capabilities that govern machinery and equipment used for a variety of tasks, allowing for automation of commands and localized computing.

50
Q

Encapsulation

A

Embedding one protocol inside another.

51
Q

Encryption

A

Obscuring data through the use of a defined, reversible process.

52
Q

Encryption

A

The process and act of converting the message from its plaintext to ciphertext.

53
Q

Fiber Optic

A

Spun glass or plastic that conveys data via light pulses instead of electricity.

54
Q

Firewalls

A

Devices typically used to monitor inbound traffic (can sometimes monitor bidirectional traffic as well).

55
Q

Hash Function

A

A hash function is a one-way mathematical operation that reduces a message or data file into a smaller fixed length output, or hash value.

56
Q

Honeypots/Honeynets

A

Simulated environments/components that contain no raw production data.

57
Q

Industrial Control Systems (ICS)

A

Typically processors with limited capabilities that govern machinery and equipment used in manufacturing processes, allowing for automation of commands (such as patterns, recipes, and templates) and centralized control/monitoring.

58
Q

Initialization Vector (IV)

A

A nonsecret binary vector used as the initializing input algorithm for the encryption of a plaintext block sequence to increase security by introducing additional cryptographic variance and to synchronize cryptographic equipment.

59
Q

Internet of Things (IoT)

A

Current pop culture term generally used to describe IP/web-enabled appliances and devices, often for residential/consumer purposes.

60
Q

Internet Protocol (IP)

A

Part of the TCP/IP communications protocol suite; typically used to describe the process of carving messages into pieces (packets) and transmit them to a recipient in a nondeterministic manner.

61
Q

Intrusion Detection or Prevention Systems (IDS/IPS)

A

Systems that monitor traffic, often inside a specific network.

62
Q

Key Clustering

A

Occurs when different encryption keys generate the same ciphertext from the same plaintext message.

63
Q

Key/Cryptovariable

A

The input that controls the operation of the cryptographic algorithm.

64
Q

Key Space

A

The total number of possible values of keys in a cryptographic algorithm.

65
Q

Key Space

A

The total number of possible values of keys in a cryptographic algorithm.

66
Q

Network Segmentation

A

The division of the overall networked environment into various smaller networks and parts of networks in order to group users and assets (including data) according to different usages and/or sensitivities.

67
Q

Nonrepudiation

A

Inability to deny taking part in a transaction.

68
Q

OSI 7-Layer Model

A

Academic conceptual means of describing the ways computers communicate with one another.

69
Q

Plaintext/Cleartext

A

Message or data in its natural format and in readable form.

70
Q

Public Key Infrastructure (PKI)

A

The use of a third party to enhance trust in a transaction. The third party digitally signs the public keys of the participants, issuing them digital certificates; the transactional parties exchange certificates, see each other’s public keys and the signature of the trusted third party, and can verify the sender of subsequent messages.

71
Q

Sandboxing

A

The practice of abstracting contact with underlying hardware, instead constraining programs/software to run in a restricted environment that provides resources (processing, memory) at a remove.

72
Q

Software-Defined Networking (SDN)

A

An approach to networking that abstracts the hardware involved in communication away from the design and control of the overall network.

73
Q

Substitution

A

The process of exchanging one letter or byte for another.

74
Q

Symmetric Cryptography

A

The same key is required to encrypt and decrypt.

75
Q

Synchronous

A

Each encryption or decryption request is performed immediately.

76
Q

Transposition/Permutation

A

The process of reordering the plaintext to hide the message but keeping the same letters.

77
Q

Twisted Pair

A

Cable composed of pairs of copper wire wound around each other.

78
Q

Virtual Local Area Network (VLAN)

A

A network segment created through the use of logical addressing restrictions (as opposed to physical isolation).

79
Q

Virtual Private Network (VPN)

A

Encrypted tunnel that creates a secure, temporary connection between an external user and the network, typically allowing the user to have similar access/permissions to what the user would experience if access were achieved from within the network environment.

80
Q

Work Factor

A

The time and effort required to break a protective measure; in cryptography, the time and effort required to break a cryptographic algorithm.

81
Q

Business Continuity (BC)

A

Actions, processes, and tools for ensuring an organization can continue critical operations during a contingency.

82
Q

Business Impact Analysis (BIA)

A

The effort to determine the value of each asset belonging to the organization, as well as the potential risk of losing assets, the threats likely to affect the organization, and the potential for common threats to be realized.

83
Q

Critical Path

A

Those activities and functions that the organization needs to perform to stay operational.

84
Q

Differential Backup

A

All data in the environment that has changed since the last full backup was copied.

85
Q

Full Backup

A

All data in the environment is copied.

86
Q

Incident

A

An unscheduled event.

87
Q

Incremental Backup

A

All data in the environment that has changed since the last backup (full or incremental) was copied.

88
Q

Maximum Allowable Downtime (MAD)

A

The measure of how long an organization can survive an interruption of critical functions.

89
Q

Maximum Tolerable Downtime (MTD)

A

See: MAD.

90
Q

Recovery Point Objective (RPO)

A

A measure of how much data the organization can lose before the organization is no longer viable.

91
Q

Recovery Time Objective (RTO)

A

The target time set for recovering from any interruption.

92
Q

Audit

A

Review of an environment to determine compliance with a standard.

93
Q

Egress Monitoring

A

Monitoring all the ways data can be exfiltrated from an organization; often marketed under the term DLP.

94
Q

False Positive

A

Indication of an activity/situation that is not accurate; for example, wrongly reporting that a detrimental event has occurred.

95
Q

Key Performance Indicators (KPIs)

A

Metrics reflecting how the organization has performed.

96
Q

Key Risk Indicators (KRIs)

A

Metrics attempting to determine how much risk the organization faces.

97
Q

Scoping

A

Determining, prior to a review/test/audit, which aspects of an organization will be involved/reviewed.

98
Q

Tailoring

A

Determining which elements of a baseline will be applied to an environment or part of an environment.

99
Q

Accountability

A

The ability to attribute every action/event to a specific entity.

100
Q

Authentication

A

A method for verifying that the entity presenting an identity assertion is, in fact, that entity.

101
Q

Authorization

A

The set of permissions/capabilities granted to a specific entity upon the receipt of an authenticated identity assertion.

102
Q

Federation

A

Granting access to an entity to various services/organizations, based on that entity’s credentials for one organization/service.

103
Q

Identification

A

A unique value assigned to every person, device, and service that will access the environment.

104
Q

Identity Assertion

A

A value used to denote a specific entity (often a username).

105
Q

Identity Deprovisioning

A

The process of formally revoking access from an entity.

106
Q

Identity Proofing

A

When an organization validates that a person is who they claim to be; usually done at the start of employment.

107
Q

Identity Provisioning

A

The process of issuing an identity assertion to an entity.

108
Q

LDAP

A

Lightweight Directory Access Protocol; a format for storing a catalog of information, typically associated with recognizing entries on the list.

109
Q

Multifactor Authentication

A

Use of two or more different factors to verify an identity assertion; sometimes abbreviated as 2FA (for two-factor authentication) or MFA (for multifactor authentication).

110
Q

Salt

A

A random element added to plaintext before hashing, to add complexity.

111
Q

Application Programming Interfaces (APIs)

A

Sets of rules, tools, and languages used by programmers to simplify the creation of software

112
Q

Configuration/Change Management (CM) [in software development context]

A

Monitoring and managing changes to a program or documentation.

113
Q

Dynamic Application Security Testing (DAST)

A

Also sometimes referred to as “black box testing” or “play testing”; in DAST, the application is actually executed, and testers (often from the user community) perform functions with the application in a runtime state, trying to determine if the software can successfully perform required functionality but also attempting to find situations in which the software fails.

114
Q

Static Application Security Testing (SAST)

A

Also sometimes referred to as “white box testing” or “secure code review”; involves using methods and tools to review the actual source code of an application, locating known flaws and vulnerabilities.

115
Q

STRIDE Model

A

Popular software threat modeling tool.

116
Q

Compliance

A

The condition of adhering to all mandates/rules/obligations.

117
Q

Digital Rights Management (DRM)

A

A technological control solution for protecting intellectual property and sensitive data, usually at the file level; often functions by adding an additional layer of access control to protected files. Also referred to as information rights management (IRM), enterprise rights management (ERM), and other nonstandard terms.

118
Q

General Data Protection Regulation (GDPR)

A

EU personal privacy law.

119
Q

Intellectual Property

A

Intangible assets; literally, property of the mind. Ideas, concepts, and knowledge that belong to a certain entity, under protection of law.

120
Q

Personally Identifiable Information (PII)

A

Data that can be used to determine the identity of an individual.

CISSP Vocab List (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions