ISC2 Certified in Cybersecurity (CC): key terms

Flashcards for this exam ISC2 Certified in Cybersecurity (CC) guide

• 3-2-1 Backup RuleA backup guideline: keep three copies of data on two different media types with one copy offsite.Foundational
• Acceptable Use Policy (AUP)Policy defining permitted and prohibited uses of organizational systems, networks, and data by users.Foundational
• Access ControlSecurity mechanisms that determine who or what can view, use, or change resources, and under what conditions.Foundational
• Access Control VestibuleSmall space with two interlocking doors where only one opens at a time, preventing tailgating; formerly called a mantrap.Foundational
• Account LockoutDisabling an account temporarily or permanently after a set number of failed login attempts.Foundational
• AccountabilityThe ability to trace actions on a system to a unique, authenticated identity.Foundational
• Administrative ControlA security control based on policies, procedures, training, and personnel management.Foundational
• Advanced Encryption Standard (AES)NIST-standard symmetric block cipher (Rijndael) with a 128-bit block and 128-, 192-, or 256-bit keys.Foundational
• Annualized Loss Expectancy (ALE)Expected yearly monetary loss from a risk: ALE = SLE x ARO.Foundational
• Annualized Rate of Occurrence (ARO)Estimated number of times a specific threat event is expected to occur in one year.Foundational
• Anomaly-Based DetectionDetecting threats by identifying deviations from an established baseline of normal behavior.Foundational
• Asset InventoryA complete, current record of hardware, software, cloud resources and data assets an organization owns or uses.Foundational
• Asymmetric EncryptionEncryption using a mathematically related key pair: a public key to encrypt or verify and a private key to decrypt or sign.Foundational
• Attack SurfaceThe total set of points where an unauthorized user could try to enter or extract data from a system.Foundational
• AuthenticationVerifying that a user, device, or process is who or what it claims to be.Foundational
• Authentication FactorCategory of evidence used to prove identity: something you know, have, or are, plus contextual attributes.Foundational
• AuthorizationDetermining what an authenticated subject is permitted to access or do.Foundational
• AvailabilitySecurity goal ensuring authorized users have timely, reliable access to data and systems when needed.Foundational
• Backup TypesThe main backup methods: full, incremental and differential, plus snapshots and synthetic full backups.Foundational
• BaselineA documented reference of normal system, network or user behavior used to identify anomalies.Foundational
• Blue TeamThe defensive security team responsible for detecting, responding to and preventing attacks.Foundational
• BotnetA network of compromised devices remotely controlled by an attacker to perform coordinated tasks.Foundational
• Brute Force AttackSystematically trying all possible passwords or keys until the correct one is found.Foundational
• Business Continuity Planning (BCP)Planning to keep essential business functions operating during and after a disruption.Foundational
• Business Impact Analysis (BIA)An analysis that identifies critical business functions and the impact of their disruption over time.Foundational
• Certificate AuthorityTrusted entity that verifies identities and issues, signs, and revokes digital certificates.Foundational
• Chain of CustodyDocumentation that records every person who handled evidence, when, why and how, from collection to presentation.Foundational
• CIA TriadThe three core goals of information security: confidentiality, integrity, and availability.Foundational
• CiphertextThe unreadable, encrypted output of a cipher that requires the correct key to decrypt.Foundational
• Cold SiteAn alternate facility with basic infrastructure such as power and space but no ready equipment or data.Foundational
• Common Vulnerabilities and Exposures (CVE)A public dictionary of unique identifiers for publicly disclosed cybersecurity vulnerabilities.Foundational
• ComplianceConforming to laws, regulations, contracts, standards, and internal policies.Foundational
• ConfidentialitySecurity goal ensuring information is disclosed only to authorized people, processes, or systems.Foundational
• ContainmentThe incident response phase that limits the spread and impact of an incident while preserving evidence.Foundational
• Corrective ControlControl that reduces the impact of an event or restores systems after it occurs.Foundational
• Cryptographic KeyA secret or public value used by a cryptographic algorithm to transform data.Foundational
• CryptographyThe science of protecting information by transforming it so only intended parties can read or verify it.Foundational
• Data at RestData stored on persistent media such as disks, databases, backups, or cloud object storage.Foundational
• Data BreachA security incident resulting in confirmed unauthorized access to or disclosure of sensitive data.Foundational
• Data ClassificationCategorizing data by sensitivity and value to determine required protection and handling.Foundational
• Data CustodianRole responsible for implementing and maintaining the controls that protect data on behalf of the data owner.Foundational
• Data ExfiltrationThe unauthorized transfer of data out of an organization to an attacker-controlled location.Intermediate
• Data in TransitData moving across a network between systems, also called data in motion.Foundational
• Data OwnerSenior individual accountable for a data set, including its classification, access approval, and protection requirements.Foundational
• Defense in DepthLayering multiple, independent security controls so that the failure of one does not compromise the asset.Foundational
• Denial of Service (DoS)An attack that makes a system or network unavailable to legitimate users by exhausting resources or crashing services.Foundational
• Detection and AnalysisThe incident response phase focused on identifying potential incidents, validating them and determining scope and impact.Foundational
• Detective ControlControl that identifies and records an undesired event after or while it occurs.Foundational
• Deterrent ControlControl that discourages potential attackers or violators from attempting an action.Foundational
• Digital CertificateElectronic document signed by a CA that binds a public key to an identity such as a domain, person, or device.Foundational
• Digital SignatureCryptographic value created with a private key over a message hash that proves origin, integrity, and non-repudiation.Foundational
• Directive ControlControl that specifies required behavior, such as policies, standards, and procedures.Foundational
• Disaster Recovery Plan (DRP)A documented plan for restoring IT systems, data and infrastructure after a disruptive event.Foundational
• Discretionary Access Control (DAC)Access control model where the owner of a resource decides who may access it.Foundational
• Distributed Denial of Service (DDoS)A denial-of-service attack launched from many sources, often a botnet, to overwhelm a target.Foundational
• Due CareActing as a reasonable person would to protect assets, by implementing and maintaining appropriate safeguards.Foundational
• Due DiligenceInvestigation and analysis performed to understand risks before and while making decisions.Foundational
• EncryptionConverting plaintext into ciphertext using an algorithm and key so only authorized parties can read it.Foundational
• EradicationThe incident response phase that removes the threat, including malware, backdoors and compromised accounts, from the environment.Foundational
• ExploitCode or a technique that takes advantage of a vulnerability to cause unintended behavior, such as code execution.Foundational
• Fail-SafeFailure mode that defaults to a state protecting human life, often unlocking doors when power fails.Foundational
• Fail-SecureFailure mode where a system defaults to a locked or denied state, protecting assets when it fails.Foundational
• False Negative (FN)A failure to alert on activity that is actually malicious.Foundational
• False Positive (FP)An alert that flags benign activity as malicious.Foundational
• FirewallA device or software that permits or denies traffic between networks or hosts according to a security policy.Foundational
• GuidelineRecommended, non-mandatory advice for implementing policies and standards when no specific standard applies.Foundational
• HacktivistA threat actor who attacks to promote a political, social or ideological cause rather than for profit.Foundational
• Hash FunctionOne-way function that maps input of any size to a fixed-size digest, used to verify integrity.Foundational
• HoneypotA decoy system designed to attract attackers, detect intrusion attempts and study their techniques.Foundational
• Hot SiteA fully equipped alternate facility with current systems and data that can take over operations almost immediately.Foundational
• Hypertext Transfer Protocol Secure (HTTPS)HTTP carried inside TLS encryption, using TCP port 443 by default (and UDP 443 for HTTP/3).Foundational
• IdentificationThe act of a subject claiming an identity, such as entering a username, before it is authenticated.Foundational
• Identity and Access Management (IAM)Policies, processes, and technologies for managing digital identities and controlling their access to resources.Foundational
• ImpactThe magnitude of harm or consequence if a risk event occurs.Foundational
• Incident Response (IR)The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.Foundational
• Incident Response Plan (IRP)A documented set of policies, roles and procedures guiding how an organization responds to security incidents.Foundational
• Incident Response Team (CSIRT)The group responsible for handling security incidents, also called a computer security incident response team.Foundational
• Indicator of Compromise (IoC)Forensic evidence that a system or network has likely been breached, such as malicious hashes, IPs, domains or registry keys.Foundational
• Inherence FactorAuthentication factor based on something the user is, such as a fingerprint, face, iris, or voice.Foundational
• Insider ThreatA risk posed by a current or former employee, contractor or partner who misuses authorized access, maliciously or by accident.Foundational
• IntegritySecurity goal ensuring data and systems are accurate, complete, and not altered by unauthorized parties.Foundational
• Knowledge FactorAuthentication factor based on something the user knows, such as a password, PIN, or passphrase.Foundational
• Layered SecuritySynonym for defense in depth: multiple overlapping security measures protecting the same asset.Foundational
• Least PrivilegePrinciple of granting users and processes only the minimum access rights needed to perform their tasks.Foundational
• Lessons LearnedA review conducted after an incident to identify what happened, what worked, what failed and how to improve.Foundational
• LikelihoodThe chance or probability that a risk event will occur within a time frame.Foundational
• Logic BombMalicious code that lies dormant until a specific condition, such as a date or event, triggers its payload.Foundational
• MalwareMalicious software designed to damage, disrupt, spy on or gain unauthorized access to systems or data.Foundational
• Managerial ControlControl category focused on governance and risk management activities such as policies, assessments, and planning.Foundational
• Mandatory Access Control (MAC)Access control model where a central authority enforces access based on security labels and clearances.Foundational
• Multifactor Authentication (MFA)Authentication requiring two or more factors from different categories.Foundational
• Nation-State ActorA threat actor sponsored or directed by a government, with high sophistication, funding and strategic goals.Foundational
• Need to KnowPrinciple that access to specific information is granted only when it is required for a person's duties.Foundational
• NIST Cybersecurity Framework (CSF)A NIST framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Foundational
• NIST SP 800-61The NIST publication providing guidance on computer security incident handling and response.Intermediate
• Non-repudiationAssurance that a party cannot credibly deny having performed an action, such as sending a message or signing a document.Foundational
• Operational ControlControl category primarily implemented and executed by people rather than systems.Foundational
• Organized Crime GroupA structured criminal enterprise that conducts cyberattacks primarily for financial gain.Foundational
• Patch ManagementThe process of acquiring, testing, deploying and verifying software updates to fix vulnerabilities and defects.Foundational
• Personally Identifiable Information (PII)Information that can be used to distinguish or trace an individual's identity, alone or combined with other information.Foundational
• PhishingA social engineering attack using fraudulent messages, typically email, to steal credentials, deliver malware or induce payments.Foundational
• Physical ControlControl that restricts or monitors physical access to facilities and assets.Foundational
• Physical SecurityProtecting facilities, hardware, and people from physical threats such as unauthorized entry, theft, and environmental hazards.Foundational
• PiggybackingEntering a secure area with the consent of an authorized person who lets the intruder in.Foundational
• PlaintextReadable, unencrypted data that is input to an encryption algorithm or output from decryption.Foundational
• Possession FactorAuthentication factor based on something the user has, such as a security key, smartphone, or smart card.Foundational
• Post-Incident ActivityThe final incident response phase covering lessons learned, reporting, evidence retention and process improvement.Foundational
• PreparationThe incident response phase in which an organization establishes capabilities, tools, plans and training before incidents occur.Foundational
• PretextingCreating a fabricated scenario or identity to persuade a target to disclose information or take an action.Foundational
• Preventive ControlControl designed to stop an undesired event from occurring.Foundational
• Private KeyThe secret half of an asymmetric key pair, used to decrypt data or create digital signatures.Foundational
• ProcedureDetailed, step-by-step mandatory instructions for performing a specific task in compliance with policy and standards.Foundational
• Public KeyThe shareable half of an asymmetric key pair, used to encrypt data for the owner or verify the owner's signatures.Foundational
• Public Key Infrastructure (PKI)Framework of CAs, policies, and technology for issuing, managing, and revoking digital certificates.Foundational
• RansomwareMalware that encrypts or locks a victim's data or systems and demands payment for restoration.Foundational
• RecoveryThe incident response phase that restores systems and operations to normal and verifies they are functioning securely.Foundational
• Recovery Point Objective (RPO)Maximum acceptable amount of data loss measured in time before a disruption.Foundational
• Recovery Time Objective (RTO)Maximum acceptable time to restore a service after a disruption.Foundational
• Residual RiskRisk that remains after controls and treatments have been applied.Foundational
• RiskThe combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.Foundational
• Risk AcceptanceFormal decision by an authorized risk owner to tolerate a risk without further treatment.Foundational
• Risk AvoidanceEliminating a risk by not starting or by discontinuing the activity that creates it.Foundational
• Risk MitigationRisk treatment that reduces likelihood or impact by implementing controls.Foundational
• Risk TransferenceShifting the financial impact of a risk to a third party, such as through insurance or contracts.Foundational
• Risk TreatmentSelecting and implementing options to modify risk: mitigate, transfer, avoid, or accept.Foundational
• Role-Based Access Control (RBAC)The Kubernetes authorization mode that grants permissions through Roles/ClusterRoles bound to users, groups, or service accounts.Intermediate
• Security Awareness Training (SAT)Education that teaches staff to recognize and report security threats such as phishing and social engineering.Foundational
• Security BenchmarkA consensus-based configuration standard specifying secure settings for systems and applications.Intermediate
• Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
• Security EventAny observable occurrence in a system or network that may have security relevance.Foundational
• Security IncidentAn occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of information or systems, or violates security policy.Foundational
• Security Information and Event Management (SIEM)A platform that collects, normalizes, correlates and analyzes log data from across an environment to detect and investigate threats.Foundational
• Security Operations Center (SOC)A centralized team and facility that monitors, detects, analyzes and responds to cybersecurity incidents around the clock.Foundational
• Security PerimeterThe boundary separating trusted components from untrusted ones, either within a system or around a network.Foundational
• Security PolicyHigh-level management statement of intent, direction, and requirements for protecting information assets.Foundational
• Security StandardMandatory requirement specifying uniform use of technologies, configurations, or methods to support policy.Foundational
• Segregation of Duties (SoD)Dividing critical tasks among different people so no single person can both commit and conceal errors or fraud.Foundational
• Separation of Duties (SoD)Dividing a critical task among multiple people so no single individual can complete it alone.Foundational
• Shadow ITHardware, software or cloud services used inside an organization without the approval or knowledge of IT and security.Foundational
• Signature-Based DetectionDetecting threats by matching known patterns, such as file hashes or byte sequences, against a database of signatures.Foundational
• Single Loss Expectancy (SLE)Expected monetary loss from one occurrence of a threat event: SLE = Asset Value x Exposure Factor.Foundational
• Single Point of Failure (SPOF)Component whose failure stops the entire system because no redundant alternative exists.Foundational
• Social EngineeringManipulating people into revealing information, granting access or performing actions that compromise security.Foundational
• Spear PhishingA targeted phishing attack crafted for a specific individual or group using personal or organizational details.Foundational
• Symmetric EncryptionEncryption in which the same secret key is used to both encrypt and decrypt data.Foundational
• Tabletop Exercise (TTX)A discussion-based exercise in which participants walk through a simulated incident scenario to test plans and roles.Foundational
• TailgatingGaining physical access by following an authorized person through a secured entrance without their knowledge.Foundational
• Technical ControlControl implemented through hardware, software, or firmware that enforces security automatically.Foundational
• ThreatAny potential cause of an unwanted incident that may harm an asset, such as an actor, event, or circumstance.Foundational
• Threat ActorAn individual or group that carries out or intends to carry out malicious activity against an organization's systems or data.Foundational
• Threat Actor MotivationThe underlying reason a threat actor attacks, such as financial gain, espionage, ideology, revenge, disruption or war.Foundational
• Threat VectorThe path or means by which a threat actor gains access to a target, such as email, removable media or vulnerable software.Foundational
• Transport Layer Security (TLS)The cryptographic protocol that secures application traffic with encryption, integrity and certificate-based authentication; successor to SSL.Foundational
• Trojan HorseMalware disguised as legitimate software that performs hidden malicious actions once the user runs it.Foundational
• True Positive (TP)An alert that correctly identifies real malicious activity.Foundational
• Unskilled AttackerA low-sophistication threat actor who relies on pre-built tools and exploits written by others.Foundational
• Virtual Private Network (VPN)Encrypted tunnel that securely connects remote users or sites across an untrusted network.Foundational
• VirusMalware that attaches to a host file or program and replicates when that host is executed, requiring user action to spread.Foundational
• VishingVoice phishing that uses phone calls or voicemail to manipulate victims into revealing information or taking action.Foundational
• VulnerabilityA weakness in an asset, control, or process that a threat could exploit.Foundational
• Vulnerability ManagementThe continuous process of identifying, assessing, prioritizing, remediating and verifying security weaknesses.Foundational
• Vulnerability ScanningAutomated testing of systems and applications to identify known vulnerabilities, missing patches and misconfigurations.Foundational
• Warm SiteAn alternate facility with some equipment and connectivity in place but requiring data restoration and configuration before use.Foundational
• WhalingSpear phishing aimed at senior executives or other high-value individuals.Foundational
• WormSelf-replicating malware that spreads across networks without user interaction by exploiting vulnerabilities.Foundational
• Zero-Day VulnerabilityA vulnerability unknown to the vendor or without an available patch, which attackers may exploit before defenders can fix it.Foundational