Security+ flashcards

To prevent unauthorized disclosure of information. It's about keeping secrets secret, plain and simple.

Integrity ensures that data has not been altered or destroyed in an unauthorized manner. If it's changed, you should know.

Availability means authorized users can access systems and data when needed. If the system is down, it's not available, and that's usually a problem.

Integrity ensures data hasn't changed. Non-repudiation specifically prevents a party from denying an action they performed, like sending an email or signing a contract. It's about accountability.

A disgruntled former employee, a nation-state hacking group, or even an opportunistic script kiddie. Anyone who poses a risk.

A weakness in a system, design, or implementation that could be exploited by a threat actor. Think of it as an unlocked door.

Risk is the likelihood that a threat will exploit a vulnerability, multiplied by the impact if it happens. It's the 'what if' scenario with consequences.

A control is a measure put in place to reduce risk. This could be a firewall, a security policy, or even employee training.

Users and systems should only be granted the minimum necessary permissions to perform their job functions. No more, no less. It limits damage if an account is compromised.

It requires multiple individuals to complete a critical task, preventing any single person from performing a malicious action or making a critical error without oversight. It's about checks and balances.

Employing multiple layers of security controls to protect assets. If one layer fails, another is there to catch it. It's not just one firewall, but multiple security mechanisms.

Knowledge about existing or emerging threats, including their tactics, techniques, and procedures (TTPs). It helps anticipate and prepare for attacks.

A security policy is a high-level statement from management defining security requirements and expectations. It tells people what they're supposed to do, or not do.

A policy states 'what' needs to be done. A procedure details 'how' to do it, step-by-step. Policies are the rules, procedures are the instructions.

A standard specifies mandatory requirements for specific technologies or configurations, often to ensure compliance with policies. For example, a standard might dictate specific encryption algorithms.

Exercising reasonable care to protect an organization's assets and resources. It's about doing your homework and making sure you've taken appropriate steps, like vetting a third-party vendor's security.

The core principle is 'never trust, always verify.' It assumes no user or device, inside or outside the network perimeter, should be trusted by default. Every access request is authenticated and authorized.

It divides a network into smaller, isolated segments down to the individual workload level. This limits the lateral movement of threats by applying granular security policies to each segment, reducing the attack surface. If one part is breached, the damage is contained.

NAC enforces security policies on devices attempting to connect to a network. It can authenticate users and devices, assess their security posture (e.g., up-to-date antivirus), and grant or deny access based on predefined rules. If your laptop isn't patched, it won't get on the corporate network.

Jump servers, also known as jump boxes or bastion hosts, provide a hardened, controlled access point to sensitive network segments or systems. Administrators connect to the jump server first, then from there to the target system, adding an extra layer of auditing and security. It's a choke point.

A honeypot is a decoy system or network designed to attract and trap attackers, allowing organizations to study their methods, tools, and motivations without risking production systems. It's a controlled environment for observation. You deploy it to learn from attacks.

A honeynet is a network of multiple honeypots designed to simulate a real production network. It offers a more complex and realistic target for attackers, providing richer data on sophisticated attack campaigns and lateral movement. It's a collection of traps.

In a security context, a darknet refers to an unused portion of an organization's IP address space that is monitored for incoming traffic. Any traffic directed to these unused IPs indicates scanning or attack attempts, as legitimate traffic should never go there. It's an early warning system for reconnaissance.

DLP systems identify, monitor, and protect sensitive data in use, in motion, and at rest. They prevent unauthorized disclosure of confidential information by enforcing policies that block, log, or alert on attempts to transmit or store sensitive data inappropriately. It stops secrets from leaving the building.

EDR continuously monitors and collects data from endpoint devices (laptops, servers) to detect and investigate suspicious activities. It provides visibility into endpoint behavior, enabling rapid response to threats that bypass traditional defenses. It's advanced threat hunting for your devices.

A SIEM system aggregates and analyzes security alerts and log data from various sources across an organization's IT infrastructure. It provides a centralized view of security events, helping with threat detection, compliance reporting, and incident response. It's where all the logs go to be correlated.

SOAR platforms collect security alerts, automate incident response tasks, and orchestrate various security tools. They help security teams manage and respond to a high volume of incidents more efficiently and consistently by defining playbooks for common scenarios. It takes the manual steps out of incident response.

Immutable systems, once deployed, are never modified. If an update or change is needed, a new system with the desired configuration is created and deployed, replacing the old one. This reduces configuration drift, simplifies patching, and makes systems more resilient to tampering. You don't patch it, you replace it.

IaC manages and provisions infrastructure through machine-readable definition files, rather than manual hardware configuration or interactive configuration tools. It enables consistent, repeatable, and version-controlled infrastructure deployments. It's how you build environments programmatically.

SCADA stands for Supervisory Control and Data Acquisition. These systems are used to control and monitor industrial processes, infrastructure, and facility-based processes, such as power grids, water treatment plants, and manufacturing. They are critical infrastructure components and common targets.

OT refers to hardware and software that monitors and controls physical processes, devices, and infrastructure. The primary concern is often availability and integrity, as disruptions can have severe physical consequences, unlike IT where confidentiality might be the top priority. Downtime in OT can be dangerous.

An embedded system is a specialized computer system with a dedicated function within a larger mechanical or electrical system. Examples include smart devices, car navigation systems, and industrial controllers. They often have limited resources and unique security challenges due to their specific purpose and long lifespans.

Firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. It's essentially software permanently stored in a hardware device, like a router or a hard drive, providing instructions for how it operates. It's the brain of the hardware.

A hardware root of trust is a module or component within a system that is inherently trusted. It provides a secure starting point for the entire system's boot process, ensuring the integrity of subsequent components and software loaded. If the root is trusted, everything built upon it can be verified. It's the foundational secure element.

A TPM is a secure cryptoprocessor that stores cryptographic keys and provides hardware-based security functions, such as secure boot, disk encryption, and platform integrity checks. It's a physical chip on a motherboard designed to enhance system security. It's where your BitLocker keys are often stored.

An HSM is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. They are typically used in servers for high-value operations like certificate authority key generation or database encryption. It's a dedicated box for cryptographic operations and key storage.

Fog computing extends cloud computing closer to the edge of the network, bringing computation, storage, and networking services closer to the data sources. This reduces latency, conserves bandwidth, and improves response times for IoT and real-time applications. It's a localized cloud for faster processing.

Edge computing processes data near the source of data generation, at the 'edge' of the network, rather than sending it to a centralized cloud or data center. It's often used for IoT devices and applications requiring immediate insights or low latency, like autonomous vehicles. It's about processing data where it's created.

A container packages an application and all its dependencies (libraries, configuration files) into a single, isolated unit that can run consistently across different computing environments. They provide lightweight virtualization, ensuring applications behave the same regardless of where they are deployed. It's a self-contained, portable application environment.

Serverless computing allows developers to build and run application code without managing servers. The cloud provider dynamically manages server allocation and provisioning, scaling resources automatically based on demand. Developers only pay for the compute resources consumed when their code is actively running, not for idle servers. You write the code, the cloud runs it when needed.

The core principle is 'never trust, always verify.' It assumes no user or device, inside or outside the network perimeter, should be trusted by default. Every access request is authenticated and authorized.

It divides a network into smaller, isolated segments down to the individual workload level. This limits the lateral movement of threats by applying granular security policies to each segment, reducing the attack surface. If one part is breached, the damage is contained.

NAC enforces security policies on devices attempting to connect to a network. It can authenticate users and devices, assess their security posture (e.g., up-to-date antivirus), and grant or deny access based on predefined rules. If your laptop isn't patched, it won't get on the corporate network.

Jump servers, also known as jump boxes or bastion hosts, provide a hardened, controlled access point to sensitive network segments or systems. Administrators connect to the jump server first, then from there to the target system, adding an extra layer of auditing and security. It's a choke point.

A honeypot is a decoy system or network designed to attract and trap attackers, allowing organizations to study their methods, tools, and motivations without risking production systems. It's a controlled environment for observation. You deploy it to learn from attacks.

A honeynet is a network of multiple honeypots designed to simulate a real production network. It offers a more complex and realistic target for attackers, providing richer data on sophisticated attack campaigns and lateral movement. It's a collection of traps.

In a security context, a darknet refers to an unused portion of an organization's IP address space that is monitored for incoming traffic. Any traffic directed to these unused IPs indicates scanning or attack attempts, as legitimate traffic should never go there. It's an early warning system for reconnaissance.

DLP systems identify, monitor, and protect sensitive data in use, in motion, and at rest. They prevent unauthorized disclosure of confidential information by enforcing policies that block, log, or alert on attempts to transmit or store sensitive data inappropriately. It stops secrets from leaving the building.

EDR continuously monitors and collects data from endpoint devices (laptops, servers) to detect and investigate suspicious activities. It provides visibility into endpoint behavior, enabling rapid response to threats that bypass traditional defenses. It's advanced threat hunting for your devices.

A SIEM system aggregates and analyzes security alerts and log data from various sources across an organization's IT infrastructure. It provides a centralized view of security events, helping with threat detection, compliance reporting, and incident response. It's where all the logs go to be correlated.

SOAR platforms collect security alerts, automate incident response tasks, and orchestrate various security tools. They help security teams manage and respond to a high volume of incidents more efficiently and consistently by defining playbooks for common scenarios. It takes the manual steps out of incident response.

Immutable systems, once deployed, are never modified. If an update or change is needed, a new system with the desired configuration is created and deployed, replacing the old one. This reduces configuration drift, simplifies patching, and makes systems more resilient to tampering. You don't patch it, you replace it.

IaC manages and provisions infrastructure through machine-readable definition files, rather than manual hardware configuration or interactive configuration tools. It enables consistent, repeatable, and version-controlled infrastructure deployments. It's how you build environments programmatically.

SCADA stands for Supervisory Control and Data Acquisition. These systems are used to control and monitor industrial processes, infrastructure, and facility-based processes, such as power grids, water treatment plants, and manufacturing. They are critical infrastructure components and common targets.

OT refers to hardware and software that monitors and controls physical processes, devices, and infrastructure. The primary concern is often availability and integrity, as disruptions can have severe physical consequences, unlike IT where confidentiality might be the top priority. Downtime in OT can be dangerous.

An embedded system is a specialized computer system with a dedicated function within a larger mechanical or electrical system. Examples include smart devices, car navigation systems, and industrial controllers. They often have limited resources and unique security challenges due to their specific purpose and long lifespans.

Firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. It's essentially software permanently stored in a hardware device, like a router or a hard drive, providing instructions for how it operates. It's the brain of the hardware.

A hardware root of trust is a module or component within a system that is inherently trusted. It provides a secure starting point for the entire system's boot process, ensuring the integrity of subsequent components and software loaded. If the root is trusted, everything built upon it can be verified. It's the foundational secure element.

A TPM is a secure cryptoprocessor that stores cryptographic keys and provides hardware-based security functions, such as secure boot, disk encryption, and platform integrity checks. It's a physical chip on a motherboard designed to enhance system security. It's where your BitLocker keys are often stored.

An HSM is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. They are typically used in servers for high-value operations like certificate authority key generation or database encryption. It's a dedicated box for cryptographic operations and key storage.

Fog computing extends cloud computing closer to the edge of the network, bringing computation, storage, and networking services closer to the data sources. This reduces latency, conserves bandwidth, and improves response times for IoT and real-time applications. It's a localized cloud for faster processing.

Edge computing processes data near the source of data generation, at the 'edge' of the network, rather than sending it to a centralized cloud or data center. It's often used for IoT devices and applications requiring immediate insights or low latency, like autonomous vehicles. It's about processing data where it's created.

A container packages an application and all its dependencies (libraries, configuration files) into a single, isolated unit that can run consistently across different computing environments. They provide lightweight virtualization, ensuring applications behave the same regardless of where they are deployed. It's a self-contained, portable application environment.

Serverless computing allows developers to build and run application code without managing servers. The cloud provider dynamically manages server allocation and provisioning, scaling resources automatically based on demand. Developers only pay for the compute resources consumed when their code is actively running, not for idle servers. You write the code, the cloud runs it when needed.

Virtualization allows a single physical machine to host multiple isolated virtual machines (VMs). From a security perspective, it enables workload isolation, sandboxing, and efficient resource utilization, but also introduces new attack vectors like hypervisor compromise or VM escape. It's about separating environments on shared hardware.

VDI hosts desktop operating systems and applications on a centralized server, allowing users to access their personalized desktops remotely from various devices. Security benefits include centralized management, easier patching, and data remaining in the data center, not on the endpoint. It's delivering a desktop as a service.

Snapshots capture the state of a virtual machine at a specific point in time. In security, they are useful for quickly reverting a system to a known good state after an incident, or for testing patches and configurations without impacting the live system. It's a quick rollback point.

VM escape is an attack where an attacker breaks out of a guest virtual machine and gains unauthorized access to the host operating system or other virtual machines running on the same host. This bypasses the isolation provided by the hypervisor, which is a critical security boundary. It's a hypervisor vulnerability.

A type 1 hypervisor, or bare-metal hypervisor, runs directly on the host hardware, controlling the hardware and managing guest operating systems. It is generally considered more secure and performant than type 2, as it has no underlying operating system to compromise. It's the OS for your VMs.

A type 2 hypervisor, or hosted hypervisor, runs as a software layer on top of a conventional operating system (e.g., VMware Workstation on Windows). It's simpler for desktop use but introduces more overhead and a larger attack surface due to relying on the host OS. It's a program that runs VMs.

Cloud computing delivers on-demand computing services over the internet, including servers, storage, databases, networking, software, analytics, and intelligence. Security involves understanding the shared responsibility model, where the cloud provider secures the 'cloud itself' and the customer secures 'in the cloud.' You get flexibility, but you still have responsibilities.

This model defines security duties between a cloud provider and its customers. The provider is responsible for the security *of* the cloud (physical infrastructure, virtualization layer), while the customer is responsible for security *in* the cloud (data, applications, network configurations, identity management). Know your boundaries.

IaaS provides virtualized computing resources over the internet. Customers manage operating systems, applications, and middleware, while the provider manages the underlying infrastructure like servers, networking, and storage. It offers the most control but also the most customer responsibility in the shared model. You get the raw machines.

PaaS provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app. The provider manages the OS, runtime, and middleware. You just bring your code. You get a development environment.

SaaS delivers software applications over the internet, typically on a subscription basis. The provider manages all aspects of the application, including infrastructure, platform, and software updates. It offers the least control but also the least customer responsibility in the shared model. You just use the application.

Server hardening is the process of securing a server by reducing its attack surface. This involves removing unnecessary services, closing unused ports, applying patches, configuring strong passwords, implementing least privilege, and disabling default accounts. It's about locking down the server.

Resource exhaustion is a type of denial-of-service attack where an attacker consumes all available system resources (CPU, memory, disk I/O, network bandwidth), making the system unavailable to legitimate users. It prevents normal operation by overwhelming the system. It's a common target for DoS attacks.

A supply chain attack targets less secure elements in a software or hardware supply chain to compromise the end product or system. This could involve injecting malware into a software update, tampering with hardware during manufacturing, or exploiting vulnerabilities in third-party libraries. You don't attack the target directly, you attack someone who builds for them.

Asset management involves identifying, tracking, and managing all hardware, software, and data assets within an organization. From a security perspective, it ensures that all assets are known, accounted for, and subjected to appropriate security controls and monitoring. You can't protect what you don't know you have.

A risk assessment identifies potential threats and vulnerabilities, evaluates the likelihood and impact of those risks, and helps an organization prioritize which risks to address. It's about understanding what could go wrong and how bad it would be.

Quantitative risk assessment assigns monetary values to assets, threats, and impacts, calculating specific costs and probabilities. Qualitative assessment uses descriptive terms (e.g., high, medium, low) to describe likelihood and impact based on expert judgment. One gives you numbers, the other gives you categories.

A vulnerability assessment systematically identifies security weaknesses and flaws in systems, applications, or networks. It often involves scanning tools, but doesn't actively exploit the vulnerabilities. It tells you where the holes are.

A penetration test, or pen test, simulates a real-world attack against a system, network, or application to identify exploitable vulnerabilities. Unlike a vulnerability scan, it actively attempts to exploit weaknesses to demonstrate potential impact. It's controlled hacking to prove a weakness.

Likelihood is the probability or frequency of a specific threat exploiting a vulnerability and causing harm. It's often expressed as a percentage or a qualitative rating like low, medium, or high. How often do we expect this to happen?

Impact is the magnitude of harm that would result if a threat successfully exploits a vulnerability. This can include financial loss, reputational damage, operational disruption, or legal penalties. How bad would it be if it happens?

Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. It's a statement about the level of risk the business is comfortable with. Some businesses tolerate more risk than others.

Risk tolerance is the acceptable deviation from the risk appetite. It defines the specific maximum risk an organization is willing to take with respect to individual risks. It's the practical boundary for specific risk decisions.

Threat modeling is a structured approach to identifying potential threats, vulnerabilities, and attack vectors in a system or application design. It typically happens early in the development lifecycle to proactively build in security. You try to think like an attacker before you build it.

A BIA identifies critical business functions and processes, and the potential impact of disruptions to these functions. It quantifies the financial and operational consequences of outages, helping to prioritize recovery efforts. It tells you what absolutely cannot go down and for how long.

RTO is the maximum acceptable duration of time that a system, application, or service can be down after a disaster or incident before significant damage occurs to the business. How quickly do we need to be back online?

RPO is the maximum amount of data (measured in time) that an organization can afford to lose following a disaster or incident. It determines the frequency of backups. How much data loss can we tolerate?

A DRP is a documented, structured approach that describes how an organization can quickly resume mission-critical operations after an unplanned incident or disaster. It's the playbook for getting back up after something bad happens.

A BCP outlines how an organization will continue to operate its essential functions during and after a disaster or significant disruption. It's broader than a DRP, focusing on keeping the business running, not just IT systems. It's about staying in business, not just restoring servers.

Tabletop exercises are discussion-based sessions where participants talk through their roles and responses during an incident or disaster scenario. They help identify gaps in plans, clarify responsibilities, and improve coordination without actual system disruption. It's a walk-through, not a live test.

A security awareness training program educates employees about security policies, best practices, and common threats like phishing. Its goal is to reduce human error, which is often a major factor in security incidents. It's about making your users part of the defense.

A data owner is the individual or entity (often a department head or executive) with ultimate responsibility for the protection and usage of a specific dataset. They determine classifications, access rights, and retention policies. They decide who can see what.

A data custodian is responsible for the practical implementation of security controls and management of data assets as directed by the data owner. This often includes IT staff who manage databases, servers, and backup systems. They implement the technical controls.

Privacy by design is an approach that integrates privacy considerations into the design and architecture of systems, products, and services from the very beginning, rather than adding them as an afterthought. It's about building privacy in, not bolting it on.

Due diligence is the reasonable care a prudent person or organization is expected to exercise to avoid harm to others or themselves. In security, it refers to the ongoing effort to understand and manage risks. It's doing your homework and keeping up with it.

Due care is the reasonable actions taken to protect assets and information. It's the implementation of the security controls identified through due diligence. If due diligence is understanding the risk, due care is acting on it. It's actually implementing the controls.

An SLA is a contract between a service provider and a customer that defines the level of service expected, including security-related metrics like uptime, incident response times, and data protection measures. It's a promise about performance and security.

An MOU is a non-binding agreement between two or more parties outlining their intentions to work together. In security, it might define general principles for collaboration, information sharing, or shared responsibilities before a formal contract. It's a handshake agreement, not a contract.

An ISA is a formal document that specifies the security requirements for connecting two or more information systems that belong to different organizations. It details how data will be protected when shared or exchanged across system boundaries. It's the security rules for linking networks.

A data retention policy defines how long specific types of data must be kept and how they should be stored. This is driven by legal, regulatory, and business requirements. Keeping data too long can be a liability. It's about knowing how long to hold onto data.

Data minimization is the principle that organizations should only collect, process, and store the absolute minimum amount of personal data necessary to achieve their specified purpose. Less data means less risk if a breach occurs. Don't collect data you don't need.

Mandatory vacations require employees, especially those in sensitive roles, to take time off. This can help detect fraudulent activities or security policy violations, as an accomplice might be needed to cover absence, or issues might surface during their time away. It's a control to uncover fraud.

Job rotation requires employees to periodically switch roles. This helps prevent any single individual from having too much control or knowledge for an extended period, making it harder to commit fraud or maintain a long-term malicious activity without detection. It spreads out critical knowledge and responsibility.

Separation of duties divides critical functions or tasks among multiple individuals so that no single person can complete a high-risk operation alone. For instance, the person who approves a payment shouldn't be the same person who processes it. It's designed to prevent fraud and error.

A clean desk policy requires employees to clear their desks of all sensitive information, documents, and removable media when leaving their workstation. This prevents unauthorized access to confidential data by casual observers or during unattended periods. Don't leave sensitive papers out.