Free CISSP Exam Flashcards

The three fundamental principles of information security: Confidentiality (protecting data from unauthorized access), Integrity (ensuring data accuracy and preventing unauthorized modification), and Availability (ensuring authorized users can access data when needed). This framework guides all security decisions and controls in an organization.

A layered security strategy that implements multiple security controls at different levels to protect assets. If one layer fails, additional layers continue to provide protection. Examples include combining firewalls, IDS/IPS, encryption, access controls, and security awareness training to create overlapping defensive barriers.

A security principle stating that users, processes, and systems should only have the minimum access rights necessary to perform their authorized functions. This reduces the attack surface and limits potential damage from compromised accounts or insider threats. Access should be granted on a need-to-know basis and regularly reviewed.

A framework for controlling access to resources. Authentication verifies user identity, Authorization determines what resources the authenticated user can access, and Accounting tracks user activities for auditing and billing purposes. Together, these ensure secure and traceable access management.

A security principle that divides critical functions among different people to prevent fraud and errors. No single person should have complete control over a critical transaction from start to finish. For example, the person who approves payments should not be the same person who processes them.

An access control principle where individuals are only given access to information required to perform their specific job duties. Works in conjunction with least privilege to minimize data exposure. Commonly used in classified environments and sensitive data handling scenarios.

Integrating security considerations from the initial design phase rather than adding them later. This proactive approach reduces vulnerabilities, lowers costs, and ensures security is built into systems, applications, and processes from the ground up. Also known as 'shift left' security.

Fail-safe defaults to a secure state when failure occurs (e.g., door unlocks during fire for safety). Fail-secure maintains security even during failure (e.g., door stays locked during power outage). The choice depends on whether safety or security is the priority in specific scenarios.

The potential for loss or damage when a threat exploits a vulnerability. Calculated as Risk = Threat × Vulnerability × Impact. Organizations must identify, assess, and manage risks through various strategies including avoidance, mitigation, transfer, or acceptance based on business priorities.

Any circumstance or event with the potential to cause harm to an asset through unauthorized access, destruction, disclosure, or modification. Threats can be natural (floods, earthquakes), human (hackers, insiders), or environmental (power failures). Understanding threats is essential for risk assessment.

A weakness in a system, process, or control that could be exploited by a threat. Vulnerabilities can exist in software (bugs, misconfigurations), hardware (outdated firmware), processes (weak procedures), or people (lack of training). Regular vulnerability assessments help identify and remediate weaknesses.

A comprehensive plan ensuring critical business functions continue during and after a disaster or disruption. Includes alternate work sites, backup personnel, communication plans, and procedures for maintaining operations. BCP focuses on the entire business, not just IT systems.

A documented process for recovering IT systems and data after a disaster. Includes backup strategies, recovery procedures, alternate processing sites (hot, warm, cold), and restoration priorities. DRP is a subset of BCP focused specifically on technology recovery.

RPO (Recovery Point Objective): maximum acceptable data loss measured in time (e.g., 1 hour of data). RTO (Recovery Time Objective): maximum acceptable downtime before systems must be restored. These metrics drive backup frequency and recovery strategies.

Encryption using the same key for both encryption and decryption. Fast and efficient for large amounts of data. Common algorithms include AES (Advanced Encryption Standard), DES, and 3DES. Main challenge is secure key distribution and management between parties.

Encryption using a public-private key pair. Data encrypted with the public key can only be decrypted with the private key, and vice versa. Slower than symmetric but solves key distribution problem. Common algorithms include RSA, ECC (Elliptic Curve Cryptography), and Diffie-Hellman.

A one-way cryptographic function that converts data into a fixed-length digest or fingerprint. Cannot be reversed to obtain original data. Used for integrity verification, password storage, and digital signatures. Common algorithms include SHA-256, SHA-3, and BLAKE2.

A cryptographic technique that provides authentication, integrity, and non-repudiation. The sender hashes a message and encrypts the hash with their private key. Recipients decrypt with the sender's public key and compare hashes to verify authenticity and detect tampering.

A framework for managing digital certificates and public-private key pairs. Components include Certificate Authorities (CAs) that issue certificates, Registration Authorities (RAs), certificate repositories, and revocation systems (CRL, OCSP). PKI enables secure communications, authentication, and digital signatures.

An electronic document that binds a public key to an identity using a trusted CA's digital signature. Contains subject name, public key, issuer, validity period, and usage constraints. Used in SSL/TLS, code signing, email encryption, and authentication.

Encryption at rest protects stored data on disks, databases, or backups (e.g., BitLocker, FileVault). Encryption in transit protects data moving across networks (e.g., TLS, VPN, IPsec). Both are essential for comprehensive data protection and compliance requirements.

Salt is random data added to passwords before hashing to prevent rainbow table attacks. Each password gets a unique salt stored with the hash. Pepper is a secret value added to all passwords before hashing, stored separately from the database, providing additional protection if the database is compromised.

A strict access control model where the system enforces access based on security labels and clearances. Users cannot change permissions. Common in military and government environments with classified information. Examples include SELinux and classified document systems.

An access control model where resource owners decide who can access their resources. Users can grant or revoke permissions at their discretion. Most common in commercial systems. Examples include file permissions in Windows and Unix/Linux systems.

Access control based on user roles within an organization. Users are assigned to roles, and roles are granted permissions. Simplifies administration by managing permissions at the role level rather than individual users. Widely used in enterprise environments.

A flexible access control model using attributes of users, resources, and environment to make access decisions. Attributes can include department, time of day, location, device type, and data classification. Enables fine-grained, context-aware access control policies.

Authentication requiring two or more independent factors: something you know (password), something you have (token, phone), something you are (biometrics), somewhere you are (location), or something you do (behavior). Significantly reduces risk of unauthorized access even if one factor is compromised.

Authentication mechanism allowing users to access multiple applications with one set of credentials. Improves user experience and reduces password fatigue. Common protocols include SAML, OAuth 2.0, and OpenID Connect. Risk: compromised credentials affect all connected systems.

Authentication using unique physical or behavioral characteristics. Physical: fingerprints, iris/retina scans, facial recognition. Behavioral: voice patterns, typing rhythm, gait. Measured by False Acceptance Rate (FAR), False Rejection Rate (FRR), and Crossover Error Rate (CER).

Lists specifying which users or systems have access to specific resources and what operations they can perform. Used in firewalls, routers, file systems, and applications. Can be based on IP addresses, user accounts, or groups. Require regular review and maintenance.

A network security device that monitors and controls incoming and outgoing traffic based on security rules. Types include packet filtering, stateful inspection, proxy, and next-generation firewalls (NGFW). Placed at network boundaries to enforce security policies and segment networks.

IDS (Intrusion Detection System) monitors network traffic and alerts on suspicious activity but doesn't block it. IPS (Intrusion Prevention System) actively blocks detected threats in real-time. Both use signature-based, anomaly-based, or behavior-based detection methods.

Creates an encrypted tunnel over public networks for secure remote access or site-to-site connections. Types include IPsec (network layer), SSL/TLS VPN (application layer), and WireGuard. Provides confidentiality, integrity, and authentication for data in transit.

A security model based on 'never trust, always verify' principle. Assumes no implicit trust regardless of network location. Requires continuous verification of users and devices, microsegmentation, least privilege access, and monitoring all traffic. Addresses modern threats and cloud environments.

Dividing a network into smaller segments or zones to limit lateral movement and contain breaches. Implemented using VLANs, subnets, firewalls, and access controls. Critical systems should be isolated from general user networks. Reduces attack surface and improves security monitoring.

A network segment that sits between the internal network and the internet, hosting public-facing services like web servers, email servers, and DNS. Protected by firewalls on both sides. If compromised, attackers still cannot directly access the internal network.

A centralized platform that collects, correlates, and analyzes security logs and events from across the infrastructure. Provides real-time monitoring, alerting, dashboards, and forensic analysis. Essential for detecting threats, investigating incidents, and meeting compliance requirements.

Decoy systems designed to attract and detect attackers. Honeypots are individual systems, while honeynets are networks of honeypots. Used for threat intelligence, early warning, and studying attacker techniques. Must be isolated to prevent attackers from using them as a pivot point.

A structured approach to handling security incidents: 1) Preparation (plans, tools, training), 2) Identification (detect and verify), 3) Containment (limit damage), 4) Eradication (remove threat), 5) Recovery (restore systems), 6) Lessons Learned (improve processes). Documentation is critical throughout.

A centralized team responsible for monitoring, detecting, analyzing, and responding to security incidents 24/7. Uses SIEM, threat intelligence, and security tools to protect the organization. Includes analysts, incident responders, and threat hunters working in shifts.

The process of collecting, preserving, analyzing, and presenting digital evidence for legal proceedings. Follows strict chain of custody procedures. Key principles: don't alter original evidence, document everything, use forensically sound tools. Types include disk, network, memory, and mobile forensics.

Continuous process of identifying, evaluating, prioritizing, and remediating security vulnerabilities. Includes regular scanning, patch management, configuration reviews, and risk assessment. Uses CVSS scores to prioritize based on severity, exploitability, and business impact.

The process of testing, approving, and deploying software updates to fix vulnerabilities and bugs. Requires balancing security needs with system stability. Critical patches should be prioritized and deployed quickly. Includes maintaining an inventory of systems and testing patches before production deployment.

A formal process for controlling changes to systems and infrastructure to prevent unauthorized modifications and reduce outages. Includes change requests, approval workflows, testing, documentation, and rollback plans. Ensures changes are reviewed for security implications before implementation.

Authorized simulated cyberattack to identify exploitable vulnerabilities. Types: black box (no knowledge), white box (full knowledge), gray box (partial knowledge). Phases include reconnaissance, scanning, exploitation, post-exploitation, and reporting. Requires written authorization and rules of engagement.

Systematic identification and evaluation of security weaknesses using automated scanning tools. Less invasive than penetration testing. Produces reports with vulnerability severity ratings (CVSS scores) and remediation recommendations. Should be performed regularly and after significant changes.

A systematic evaluation of an organization's security posture against established standards, policies, or regulations. Can be internal or external. Reviews controls, policies, procedures, and compliance. Results in findings and recommendations for improvement. Different from assessments as it focuses on compliance.

EU regulation protecting personal data and privacy. Applies to any organization processing EU residents' data. Key requirements: consent, data minimization, right to erasure, breach notification within 72 hours, Data Protection Officer (DPO). Violations can result in fines up to 4% of global revenue.

US law protecting patient health information (PHI). Requires administrative, physical, and technical safeguards. Key rules: Privacy Rule (patient rights), Security Rule (electronic PHI protection), Breach Notification Rule. Applies to healthcare providers, insurers, and business associates.

ISO 27001 is an international standard for information security management systems (ISMS), providing a certifiable framework. NIST Cybersecurity Framework provides guidelines for managing cybersecurity risk with five functions: Identify, Protect, Detect, Respond, Recover. Both help organizations structure comprehensive security programs.