105 Flashcards · All 5 Domains · Free

Security+ Flashcards

Flip cards to reveal definitions. Filter by domain. Track your progress.

Showing 105 cards
Known: 0
Review: 0
Domain 1 #1

The CIA Triad

Confidentiality + Integrity + Availability

The CIA Triad Domain 1

The three core principles of information security: Confidentiality (protecting data from unauthorized access), Integrity (ensuring data accuracy and completeness), and Availability (ensuring data is accessible when needed). The foundation of all security programs.

Domain 1 #2

Security Controls

Safeguards protecting information assets

Security Controls Domain 1

Safeguards or countermeasures designed to protect information assets. Categories include: Technical (firewalls, encryption), Managerial (policies, procedures), Operational (audits, training), and Physical (locks, cameras). Types include Preventive, Deterrent, Detective, Corrective, Compensating, and Directive.

Domain 1 #3

Non-repudiation

Sender cannot deny sending a message

Non-repudiation Domain 1

The assurance that an entity cannot deny having participated in a communication or transaction. Achieved through digital signatures and audit logging. If Alice signs a document with her private key, she cannot later deny having signed it.

Domain 1 #4

Gap Analysis

Current vs. desired security state comparison

Gap Analysis Domain 1

Assessment comparing current security posture against desired security objectives or compliance requirements. Identifies what controls are missing, weak, or need improvement. The gap between "where we are" and "where we need to be."

Domain 1 #5

Zero Trust Architecture

Never trust, always verify — no implicit trust

Zero Trust Architecture Domain 1

Security model based on "never trust, always verify." No implicit trust is granted to users, devices, or systems regardless of network location. Requires continuous verification. Key components: Policy Engine, Policy Administrator, and Policy Enforcement Point.

Domain 1 #6

Public Key Infrastructure (PKI)

Framework for managing digital certificates

Public Key Infrastructure (PKI) Domain 1

A framework of policies, procedures, hardware, software, and people used to create, manage, distribute, use, store, and revoke digital certificates. Enables secure communications, authentication, and digital signatures through asymmetric cryptography.

Domain 1 #7

Symmetric Encryption

Same key encrypts and decrypts — fast

Symmetric Encryption Domain 1

Encryption using the same key for both encryption and decryption. Fast and efficient for large amounts of data. Examples: AES (Advanced Encryption Standard), DES, 3DES. The key must be securely shared between parties, which is a challenge.

Domain 1 #8

Asymmetric Encryption

Public/private key pair — secure but slower

Asymmetric Encryption Domain 1

Encryption using a pair of mathematically related keys: a public key (shared openly) and a private key (kept secret). Used for key exchange, digital signatures, and secure communications. Examples: RSA, ECC, Diffie-Hellman. Slower than symmetric encryption.

Domain 1 #9

Hashing

One-way transformation to fixed-length digest

Hashing Domain 1

A one-way cryptographic function that transforms input data of any size into a fixed-length output (hash/digest). Cannot be reversed. Used to verify data integrity. Examples: SHA-256, SHA-3, MD5. Two identical inputs always produce the same hash.

Domain 1 #10

Digital Signatures

Verify authenticity and integrity of data

Digital Signatures Domain 1

Cryptographic mechanism to verify the authenticity and integrity of digital data. Created by encrypting a hash of the data with the sender's private key. Anyone with the sender's public key can verify the signature. Provides authentication, integrity, and non-repudiation.

Domain 1 #11

Certificate Authority (CA)

Trusted entity that issues digital certificates

Certificate Authority (CA) Domain 1

A trusted entity that issues, manages, and revokes digital certificates. The CA vouches for the identity of certificate holders. Certificates bind a public key to an identity. Examples: DigiCert, Let's Encrypt, GlobalSign. Root CAs are the ultimate trust anchors.

Domain 1 #12

Salting

Random data added before hashing to prevent attacks

Salting Domain 1

Adding a random value (salt) to a password before hashing to prevent identical passwords from producing the same hash. Defends against rainbow table and dictionary attacks. Each user gets a unique salt, stored alongside the hash.

Domain 1 #13

Steganography

Hiding data inside other data (secret in plain sight)

Steganography Domain 1

The practice of concealing data (messages, files) within other non-secret data or a physical object to hide the fact that communication is occurring. Unlike encryption, steganography hides the existence of the message, not just its content. Example: hiding text in an image's pixels.

Domain 1 #14

Tokenization

Replace sensitive data with non-sensitive placeholder

Tokenization Domain 1

Replacing sensitive data (e.g., credit card numbers) with a non-sensitive placeholder (token) that maps back to the original in a secure vault. The token has no mathematical relationship to the original data. Used in payment systems to protect cardholder data.

Domain 1 #15

Hardware Security Module (HSM)

Dedicated hardware for cryptographic key management

Hardware Security Module (HSM) Domain 1

A dedicated physical device that safeguards and manages digital keys for strong authentication and cryptographic processing. Provides tamper-evident hardware and performs encryption, decryption, and key generation. More secure than software-only solutions.

Domain 1 #16

Trusted Platform Module (TPM)

Hardware chip for secure key storage on motherboard

Trusted Platform Module (TPM) Domain 1

A hardware chip on a computer's motherboard that securely stores cryptographic keys, certificates, and passwords. Enables features like BitLocker disk encryption, Secure Boot, and device health attestation. Bound to the specific hardware.

Domain 1 #17

Blockchain

Distributed immutable ledger using cryptographic chains

Blockchain Domain 1

A distributed, decentralized ledger technology where data is stored in cryptographically linked blocks. Each block contains a hash of the previous block, making tampering evident. Provides transparency, immutability, and decentralized trust without a central authority.

Domain 1 #18

Certificate Revocation List (CRL)

List of revoked digital certificates from a CA

Certificate Revocation List (CRL) Domain 1

A list maintained by a Certificate Authority containing serial numbers of digital certificates that have been revoked before their expiration date. Reasons include key compromise, CA compromise, or certificate holder change. Replaced in real-time by OCSP.

Domain 1 #19

Key Stretching

Make passwords harder to crack via repeated hashing

Key Stretching Domain 1

A technique to make passwords more resistant to brute-force attacks by applying a cryptographic function multiple times to derive a key, making each guess computationally expensive. Examples: PBKDF2, bcrypt, scrypt. Makes password cracking 10,000× slower.

Domain 2 #20

Threat Actor

Entity that poses a security threat

Threat Actor Domain 2

An entity that poses a potential threat to information security. Types include Nation-states (government-sponsored, highly sophisticated), Hacktivists (politically motivated), Organized Crime (financially motivated), Insider Threats (current/former employees), and Unskilled Attackers (script kiddies).

Domain 2 #21

Phishing

Fraudulent emails to steal credentials or data

Phishing Domain 2

A social engineering attack using fraudulent electronic communications (typically email) to trick recipients into revealing sensitive information or clicking malicious links. Variants: Spear phishing (targeted), Whaling (targets executives), Vishing (voice), Smishing (SMS), Pharming (DNS manipulation).

Domain 2 #22

Malware

Malicious software designed to harm systems

Malware Domain 2

Malicious software designed to disrupt, damage, or gain unauthorized access to systems. Types: Virus (attaches to files), Worm (self-replicating), Trojan (disguised as legitimate), Ransomware (encrypts data), Rootkit (hides in OS), Spyware (data collection), Keylogger (records keystrokes), RAT (remote control).

Domain 2 #23

Ransomware

Encrypts files and demands ransom payment

Ransomware Domain 2

Malware that encrypts victim's files or locks their system, demanding payment (usually cryptocurrency) for decryption keys. Delivered via phishing emails, malicious downloads, or RDP exploitation. Defense: regular backups, email filtering, patch management, and network segmentation.

Domain 2 #24

SQL Injection (SQLi)

Malicious SQL code injected into database queries

SQL Injection (SQLi) Domain 2

An attack where malicious SQL code is inserted into input fields to manipulate database queries. Can allow attackers to bypass authentication, access, modify, or delete data. Prevention: parameterized queries, prepared statements, input validation, and stored procedures.

Domain 2 #25

Cross-Site Scripting (XSS)

Malicious scripts injected into web pages

Cross-Site Scripting (XSS) Domain 2

An attack where malicious scripts are injected into web pages viewed by other users. Types: Stored (persisted in database), Reflected (from URL), DOM-based. Allows stealing cookies, session tokens, or redirecting users. Prevention: input sanitization, Content Security Policy (CSP), output encoding.

Domain 2 #26

Buffer Overflow

Writing beyond memory buffer to execute code

Buffer Overflow Domain 2

An attack where a program writes more data to a buffer than it can hold, overwriting adjacent memory. Can allow execution of arbitrary code or cause a crash. Exploits poor bounds checking in C/C++ programs. Prevention: input validation, safe coding practices, address space layout randomization (ASLR).

Domain 2 #27

Zero-Day Vulnerability

Unknown vulnerability with no available patch

Zero-Day Vulnerability Domain 2

A software vulnerability that is unknown to the vendor or has no patch available. "Zero days" refers to the zero days the vendor has had to fix it. Highly valuable to attackers. Defense includes defense-in-depth, behavior-based detection, and network segmentation.

Domain 2 #28

Denial of Service (DoS/DDoS)

Overwhelming a system to deny service to users

Denial of Service (DoS/DDoS) Domain 2

An attack that overwhelms a system or network with traffic to make it unavailable to legitimate users. DoS uses one source; DDoS uses many compromised systems (botnet). Types: volumetric (bandwidth), protocol (exploits protocols), application layer. Mitigation: rate limiting, scrubbing centers, CDN.

Domain 2 #29

Man-in-the-Middle (MitM/On-Path)

Intercepting communications between two parties

Man-in-the-Middle (MitM/On-Path) Domain 2

An attack where the attacker intercepts and potentially alters communications between two parties without their knowledge. Examples: ARP poisoning, SSL stripping, DNS spoofing. Prevention: encryption (TLS), certificate pinning, VPNs, and mutual authentication.

Domain 2 #30

Social Engineering

Psychological manipulation to gain information or access

Social Engineering Domain 2

Psychological manipulation of people into performing actions or divulging confidential information. Exploits human nature rather than technical vulnerabilities. Techniques: phishing, pretexting (fabricated scenario), baiting, quid pro quo, tailgating/piggybacking. Prevention: security awareness training.

Domain 2 #31

Watering Hole Attack

Compromising websites frequented by target victims

Watering Hole Attack Domain 2

An attack where threat actors compromise websites frequented by their target audience (like watering holes animals visit). When victims visit the infected site, malware is delivered. Difficult to detect as the initial infection point is legitimate. Named after animals gathering at watering holes.

Domain 2 #32

Supply Chain Attack

Compromising trusted vendors to attack primary targets

Supply Chain Attack Domain 2

An attack targeting less secure elements in the supply chain (vendors, software providers, partners) to compromise a primary target. Example: SolarWinds attack where malicious code was inserted into a software update. Defense: vendor risk management, software signing, SBOM (Software Bill of Materials).

Domain 2 #33

Insider Threat

Security risk from authorized internal personnel

Insider Threat Domain 2

A security risk from current or former employees, contractors, or partners who have authorized access to systems. Can be malicious (intentional harm) or negligent (accidental). Detection: user behavior analytics (UBA), data loss prevention (DLP), separation of duties, least privilege.

Domain 2 #34

Password Spraying

Few common passwords tried against many accounts

Password Spraying Domain 2

An attack that tries a small number of commonly used passwords against a large number of accounts to avoid account lockout policies. Unlike brute force (many passwords against one account), spraying is slow and stealthy. Common targets: Office 365, VPNs, web portals.

Domain 2 #35

Rainbow Table Attack

Precomputed hash lookup table to crack passwords

Rainbow Table Attack Domain 2

A precomputed table of hash values for all possible passwords up to a certain length/character set. Used to crack unsalted password hashes quickly. Defense: salting passwords before hashing eliminates the effectiveness of rainbow tables entirely.

Domain 2 #36

Credential Stuffing

Using breached credentials to attack other services

Credential Stuffing Domain 2

Using large databases of stolen username/password combinations (from data breaches) to attempt login on other services, exploiting password reuse. Automated tools test millions of credentials. Defense: MFA, password managers, monitoring for unusual login patterns.

Domain 2 #37

Rootkit

Malware that hides itself deep in the OS

Rootkit Domain 2

Malware that hides its presence (and other malware) from the operating system and security tools by modifying OS components at a low level. Types: user-mode, kernel-mode, bootkits (infect MBR/bootloader). Very difficult to detect and remove. Often requires OS reinstall.

Domain 2 #38

Indicator of Compromise (IoC)

Evidence suggesting a security incident has occurred

Indicator of Compromise (IoC) Domain 2

Evidence that a security incident may have occurred or is occurring. Examples: unusual account activity, unexpected outbound traffic, modified system files, new privileged accounts, disabled security tools, out-of-cycle log entries, impossible travel. Used to detect and investigate breaches.

Domain 2 #39

Vulnerability Scanning

Automated identification of system weaknesses

Vulnerability Scanning Domain 2

Automated process of identifying, classifying, and prioritizing vulnerabilities in systems, networks, and applications. Tools: Nessus, OpenVAS, Qualys. Types: authenticated (with credentials, more thorough) vs. unauthenticated. Should be performed regularly and after significant changes.

Domain 2 #40

Penetration Testing

Authorized simulated attack to find vulnerabilities

Penetration Testing Domain 2

A simulated cyberattack against your systems to check for exploitable vulnerabilities. Types: Black box (unknown), White box (full knowledge), Gray box (partial). Phases: Reconnaissance, Scanning, Exploitation, Post-exploitation, Reporting. Requires written authorization.

Domain 2 #41

Access Control List (ACL)

List defining who can access what resources

Access Control List (ACL) Domain 2

A list of permissions that specifies which users, systems, or processes are allowed or denied access to objects (files, network segments, services) and what operations they can perform. Network ACLs filter traffic; filesystem ACLs control file access. Foundation of access control.

Domain 2 #42

Network Segmentation

Dividing networks into isolated segments to limit breach spread

Network Segmentation Domain 2

Dividing a network into smaller, isolated segments to reduce attack surface, limit lateral movement, and contain breaches. Implemented via VLANs, firewalls, and DMZ. Critical systems (SCADA, PCI) should be in separate segments. The principle: compromise of one segment should not compromise others.

Domain 3 #43

Cloud Service Models

IaaS, PaaS, SaaS — cloud deployment models

Cloud Service Models Domain 3

Three main service models: IaaS (Infrastructure as a Service — you manage OS+, provider manages hardware), PaaS (Platform as a Service — you manage apps, provider manages platform), SaaS (Software as a Service — provider manages everything). Shared responsibility model defines security ownership.

Domain 3 #44

Shared Responsibility Model

Dividing security duties between cloud provider and customer

Shared Responsibility Model Domain 3

In cloud security, responsibilities are divided between the cloud provider and the customer. The provider is responsible for "security OF the cloud" (hardware, facilities, network). The customer is responsible for "security IN the cloud" (data, identity, applications, OS configuration). Division varies by service model.

Domain 3 #45

Firewall

Controls network traffic based on security rules

Firewall Domain 3

A network security device or software that monitors and controls incoming and outgoing network traffic based on security rules. Types: Packet-filtering (layer 3-4), Stateful (tracks connections), Application/Layer 7 (NGFW), WAF (Web Application Firewall). The first line of network defense.

Domain 3 #46

DMZ (Demilitarized Zone)

Buffer zone network for public-facing services

DMZ (Demilitarized Zone) Domain 3

A network segment that sits between the internal network and the internet, creating a buffer zone for public-facing services (web servers, email servers, DNS). Traffic from internet can reach the DMZ, but not the internal network. Typically protected by firewalls on both sides.

Domain 3 #47

VPN (Virtual Private Network)

Encrypted tunnel for secure remote network access

VPN (Virtual Private Network) Domain 3

Creates an encrypted tunnel over a public network (like the internet), allowing remote users to securely access private network resources. Types: Site-to-site (connects entire networks), Remote access (individual users). Protocols: IPSec, SSL/TLS, OpenVPN, WireGuard.

Domain 3 #48

Intrusion Detection System (IDS)

Monitors and alerts on suspicious activity (passive)

Intrusion Detection System (IDS) Domain 3

A system that monitors network traffic or host activity for suspicious patterns and generates alerts. Does NOT block traffic — alert only. Types: NIDS (network), HIDS (host). Detection methods: Signature-based (known attacks) and Anomaly-based (deviations from baseline). Passive monitoring.

Domain 3 #49

Intrusion Prevention System (IPS)

Monitors and actively blocks suspicious activity

Intrusion Prevention System (IPS) Domain 3

An active security system that monitors network traffic and automatically blocks or rejects suspicious packets, connections, and traffic. Unlike IDS, it takes action. Sits inline with traffic flow. Can drop packets, reset connections, or block IP addresses. Risk of false positives blocking legitimate traffic.

Domain 3 #50

Data Classification

Organizing data by sensitivity to apply proper protections

Data Classification Domain 3

The process of organizing data into categories based on sensitivity and criticality to facilitate proper protection. Common levels: Public → Internal/Private → Sensitive/Confidential → Top Secret/Restricted. Classification determines what security controls are applied.

Domain 3 #51

Data Loss Prevention (DLP)

Prevents unauthorized transfer of sensitive data

Data Loss Prevention (DLP) Domain 3

Technology that detects and prevents unauthorized transfer or disclosure of sensitive data. Can monitor data at rest (stored), in motion (network), and in use (endpoints). Rules-based detection identifies PII, credit cards, IP addresses, etc. Prevents exfiltration, accidental leakage, or policy violations.

Domain 3 #52

High Availability

System design for minimal downtime and continuous operation

High Availability Domain 3

System design ensuring continuous operation with minimal downtime. Achieved through redundancy (no single points of failure), failover mechanisms (automatic switching to backup), load balancing (distributes traffic), and geographic distribution. Measured by "nines" uptime: 99.9% = ~8.7 hrs/year downtime.

Domain 3 #53

Disaster Recovery

Plans and procedures for recovering from a disaster

Disaster Recovery Domain 3

A plan and set of procedures for recovering and protecting IT infrastructure after a disaster. Key metrics: RTO (Recovery Time Objective — how long to restore), RPO (Recovery Point Objective — how much data loss is acceptable). Includes backup strategies and alternate site operations.

Domain 3 #54

Load Balancer

Distributes traffic across multiple servers for reliability

Load Balancer Domain 3

A device or software that distributes incoming network traffic across multiple servers to ensure no single server bears too much load. Improves application performance, reliability, and availability. Methods: Round robin, least connections, IP hash. Can also provide SSL termination and health checking.

Domain 3 #55

Infrastructure as Code (IaC)

Managing infrastructure through code/config files

Infrastructure as Code (IaC) Domain 3

Managing and provisioning infrastructure through machine-readable configuration files instead of manual processes. Tools: Terraform, Ansible, CloudFormation. Benefits: consistency, repeatability, version control, and rapid deployment. Security concern: secrets in code, misconfigured defaults.

Domain 3 #56

Containerization

Packaging apps in isolated, portable containers

Containerization Domain 3

Technology that packages applications and their dependencies into isolated, lightweight, portable units called containers. Unlike VMs, containers share the host OS kernel. Tools: Docker, Kubernetes. Security concerns: container escape, image vulnerabilities, over-privileged containers.

Domain 3 #57

Software-Defined Networking (SDN)

Centralized, software-based network control and management

Software-Defined Networking (SDN) Domain 3

Network architecture that separates the control plane (decides where traffic goes) from the data plane (forwards traffic). Allows centralized, programmable network management via software. Benefits: flexibility, automation, easier network-wide policy enforcement, and dynamic configuration.

Domain 3 #58

VLAN (Virtual LAN)

Logical network segmentation on shared physical infrastructure

VLAN (Virtual LAN) Domain 3

A logical subdivision of a network that groups devices as if they were on separate physical switches, even if they share the same physical infrastructure. Provides network segmentation, improved security, and traffic isolation. Configured on managed switches using 802.1Q tagging.

Domain 3 #59

Hot Site / Cold Site / Warm Site

DR site types: Hot (immediate), Warm (partial), Cold (basic)

Hot Site / Cold Site / Warm Site Domain 3

Disaster recovery site classifications: Hot Site (fully operational, real-time data replication, immediate failover, most expensive), Warm Site (partially equipped, can be operational in hours/days), Cold Site (basic facility with power/cooling but no equipment, days/weeks to restore, cheapest).

Domain 3 #60

Backup Strategies

Full, incremental, and differential data backup methods

Backup Strategies Domain 3

Methods to protect data through copies: Full backup (complete copy, slow/expensive), Incremental (changes since last backup, fast/efficient), Differential (changes since last full, faster restore than incremental). Follow the 3-2-1 rule: 3 copies, 2 media types, 1 offsite location.

Domain 3 #61

RTO and RPO

RTO=max downtime, RPO=max data loss acceptable

RTO and RPO Domain 3

Key disaster recovery metrics: Recovery Time Objective (RTO) — the maximum acceptable downtime before operations must be restored. Recovery Point Objective (RPO) — the maximum acceptable amount of data loss measured in time. Example: RTO=4hrs, RPO=1hr means you must be back up within 4 hours with data from at most 1 hour ago.

Domain 4 #62

SIEM (Security Information and Event Management)

Centralized log collection and threat detection platform

SIEM (Security Information and Event Management) Domain 4

A platform that collects, aggregates, and analyzes security log data from multiple sources in real-time to detect threats and support incident response. Provides centralized visibility, correlation of events across systems, alerting, dashboards, and compliance reporting. Examples: Splunk, QRadar, Azure Sentinel.

Domain 4 #63

Vulnerability Management

Ongoing process of finding and fixing vulnerabilities

Vulnerability Management Domain 4

The continuous process of identifying, classifying, prioritizing, and remediating security vulnerabilities. Phases: Discovery → Assessment → Prioritization → Remediation → Verification → Reporting. Uses CVSS scores to prioritize. Not just scanning — includes patching, configuration, and compensating controls.

Domain 4 #64

Identity and Access Management (IAM)

Managing who can access what resources and how

Identity and Access Management (IAM) Domain 4

A framework of business processes, policies, and technologies that facilitates the management of digital identities and controlling what resources users can access. Includes authentication, authorization, user provisioning/deprovisioning, SSO, MFA, and privileged access management. The "right person, right resource, right time" principle.

Domain 4 #65

Multi-Factor Authentication (MFA)

Requiring 2+ factors to verify identity

Multi-Factor Authentication (MFA) Domain 4

Requiring two or more verification factors to authenticate: Something you know (password, PIN), Something you have (phone, smart card, token), Something you are (fingerprint, facial scan), Somewhere you are (location), Something you do (behavioral biometrics). Dramatically reduces account compromise risk.

Domain 4 #66

Incident Response Process

7-step structured approach to handling security incidents

Incident Response Process Domain 4

Structured approach to handling security incidents: 1) Preparation (plans, training), 2) Detection (IDS, SIEM alerts), 3) Analysis (scope and root cause), 4) Containment (isolate affected systems), 5) Eradication (remove root cause), 6) Recovery (restore operations), 7) Lessons Learned (improve). Based on NIST SP 800-61.

Domain 4 #67

Digital Forensics

Scientifically collecting and preserving digital evidence

Digital Forensics Domain 4

The application of scientific techniques to collect, preserve, analyze, and present digital evidence for legal proceedings. Key principles: Order of Volatility (RAM → running processes → disk → logs), Chain of Custody, Evidence Integrity (write blockers, hashing). Legal hold preserves evidence when litigation is anticipated.

Domain 4 #68

Chain of Custody

Documentation trail proving evidence integrity

Chain of Custody Domain 4

Chronological documentation showing the collection, handling, and transfer of evidence from initial acquisition to courtroom presentation. Critical for maintaining evidence admissibility. Any gap or break can render evidence inadmissible. Documents: who, what, when, where, and why at every step.

Domain 4 #69

Role-Based Access Control (RBAC)

Permissions assigned by job role, not individual user

Role-Based Access Control (RBAC) Domain 4

Access control model where permissions are assigned to roles, and users are assigned to roles based on their job functions. Simplifies permission management in large organizations. Principle of least privilege: users should only have access needed for their role. Example: "Nurse" role has access to patient records, not billing.

Domain 4 #70

Principle of Least Privilege

Grant only the minimum access necessary for the job

Principle of Least Privilege Domain 4

Users, programs, and systems should be granted only the minimum access rights required to perform their legitimate functions. Reduces attack surface and limits damage from compromised accounts. Implemented through RBAC, just-in-time access, and regular access reviews. Core security principle.

Domain 4 #71

Patch Management

Systematic process of applying security updates

Patch Management Domain 4

The systematic process of identifying, acquiring, testing, and installing patches (software updates) to fix security vulnerabilities and bugs. Critical process: unpatched systems are a primary attack vector. Challenges: testing compatibility, legacy systems, and patch fatigue. Zero-day patches require emergency procedures.

Domain 4 #72

Security Baseline

Minimum security standard all systems must meet

Security Baseline Domain 4

A documented minimum level of security controls that must be applied to systems in an organization. Provides a consistent security foundation and starting point. Examples: CIS Benchmarks, DISA STIGs. Deviation from baseline indicates a misconfiguration or potential compromise.

Domain 4 #73

SOAR (Security Orchestration, Automation, and Response)

Automates security workflows and incident response

SOAR (Security Orchestration, Automation, and Response) Domain 4

Technology that combines security orchestration, automation, and incident response into a unified platform. Automates repetitive tasks, reduces response time from hours to minutes, and coordinates actions across security tools. Allows analysts to focus on higher-level analysis. Works with SIEM for detection + response.

Domain 4 #74

Endpoint Detection and Response (EDR)

Continuous monitoring and response for endpoint threats

Endpoint Detection and Response (EDR) Domain 4

Security solution that continuously monitors endpoints (laptops, servers, mobile devices) for signs of malicious activity. Records endpoint behavior for forensic analysis, can detect and respond to advanced threats that bypass traditional antivirus. Provides visibility into what's happening on every endpoint.

Domain 4 #75

Email Security Controls

SPF + DKIM + DMARC to prevent email spoofing

Email Security Controls Domain 4

Technical controls to protect email: SPF (Sender Policy Framework — authorizes sending servers), DKIM (DomainKeys Identified Mail — email signing for integrity), DMARC (Domain-based Message Authentication, Reporting, and Conformance — combines SPF+DKIM with policy). Together prevent spoofing and phishing.

Domain 4 #76

Single Sign-On (SSO)

Log in once to access multiple applications

Single Sign-On (SSO) Domain 4

Authentication scheme allowing users to log in once and access multiple applications without re-authenticating. Improves user experience and reduces password fatigue. Technologies: SAML, OAuth 2.0, OpenID Connect. Security concern: SSO becomes a high-value target — compromise means access to everything.

Domain 4 #77

Privileged Access Management (PAM)

Control and monitor administrator/privileged account access

Privileged Access Management (PAM) Domain 4

Security solution for controlling, monitoring, and auditing privileged account access (admin/root accounts). Features: credential vaulting, just-in-time access, session recording, and access approval workflows. Critical because privileged accounts can bypass normal security controls. Reduces insider threat risk.

Domain 4 #78

Separation of Duties

No single person controls an entire critical process

Separation of Duties Domain 4

Security control ensuring no single person has complete control over a critical process or system. Requires multiple people to complete high-risk tasks. Example: the person who approves a financial transaction cannot also execute it. Prevents fraud, errors, and insider attacks.

Domain 4 #79

Secure Protocols

Network protocols with built-in encryption and authentication

Secure Protocols Domain 4

Network protocols with built-in encryption and authentication. Key protocols: HTTPS (HTTP over TLS, port 443), SSH (secure remote access, port 22), SFTP (secure file transfer, port 22), SNMP v3 (secure network management), TLS 1.2/1.3 (transport security), DNSSec (secure DNS). Replace their insecure counterparts.

Domain 4 #80

Log Management

Collecting and analyzing logs for security and compliance

Log Management Domain 4

Collection, storage, analysis, and retention of log data from various systems for security monitoring, forensics, and compliance. Log sources: firewalls, IDS/IPS, OS events, applications, authentication. Considerations: centralization (SIEM), retention periods, integrity protection, and alerting on critical events.

Domain 4 #81

Asset Management

Inventorying and managing all organizational assets

Asset Management Domain 4

Inventory and lifecycle management of all hardware, software, and data assets. Foundation for many security processes: you cannot protect what you don't know you have. Includes tracking hardware, software licenses, data classification, and decommissioning. Tools: CMDB, ITAM. Critical for vulnerability and patch management.

Domain 5 #82

Risk Management

Identifying, assessing, and responding to security risks

Risk Management Domain 5

The process of identifying, assessing, and responding to threats to organizational assets. Steps: Risk Identification → Risk Assessment (qualitative or quantitative) → Risk Response → Monitoring. Key formulas: SLE = Asset Value × Exposure Factor; ALE = SLE × ARO. Aims to reduce risk to acceptable levels.

Domain 5 #83

Risk Response Strategies

Accept, Avoid, Transfer, or Mitigate identified risks

Risk Response Strategies Domain 5

Four approaches to handling identified risks: Accept (acknowledge and live with it), Avoid (eliminate the risk-causing activity), Transfer (shift risk to a third party — insurance, outsourcing), Mitigate (implement controls to reduce probability or impact). Residual risk remains after controls are applied.

Domain 5 #84

Business Impact Analysis (BIA)

Evaluating business impact of disasters to plan recovery

Business Impact Analysis (BIA) Domain 5

Process to identify and evaluate the potential effects of a disaster or disruption on critical business functions. Determines priorities for recovery. Key outputs: critical business functions identification, RTO and RPO for each function, and financial impact estimates. Forms the basis for business continuity planning.

Domain 5 #85

Business Continuity Plan (BCP)

Ensuring business operations continue during disruptions

Business Continuity Plan (BCP) Domain 5

A proactive plan to ensure critical business functions continue during and after a disaster. Broader than disaster recovery (which focuses on IT). Covers people, processes, and facilities. Includes alternate work locations, communication plans, and manual backup procedures. Tested through tabletop exercises and simulations.

Domain 5 #86

GDPR (General Data Protection Regulation)

EU data privacy regulation with strict requirements

GDPR (General Data Protection Regulation) Domain 5

EU regulation governing data privacy and protection of EU residents' personal data. Key requirements: lawful basis for processing, data subject rights (access, erasure, portability), breach notification within 72 hours, data protection by design, and appointing a DPO. Applies to any organization processing EU data. Fines up to €20M or 4% of global revenue.

Domain 5 #87

HIPAA (Health Insurance Portability and Accountability Act)

US healthcare data privacy and security law

HIPAA (Health Insurance Portability and Accountability Act) Domain 5

US law protecting the privacy and security of Protected Health Information (PHI). Three rules: Privacy Rule (patient rights, data use), Security Rule (administrative, physical, technical safeguards for ePHI), Breach Notification Rule (report breaches within 60 days). Applies to covered entities and business associates.

Domain 5 #88

PCI-DSS

Security standard for organizations handling payment cards

PCI-DSS Domain 5

Payment Card Industry Data Security Standard — requirements for organizations that handle credit card data. 12 main requirements covering: network security, cardholder data protection, vulnerability management, access control, monitoring, and security policy. Quarterly vulnerability scans and annual penetration testing required.

Domain 5 #89

Security Policy

Formal document defining security requirements and rules

Security Policy Domain 5

A formal document that defines an organization's security requirements, objectives, and responsibilities. Types: Acceptable Use Policy (AUP), Information Security Policy, Incident Response Policy, Password Policy, BYOD Policy, Remote Access Policy. Must be approved by leadership, communicated to all staff, and enforced.

Domain 5 #90

Service Level Agreement (SLA)

Contract defining service quality and performance standards

Service Level Agreement (SLA) Domain 5

A contract between a service provider and customer that defines expected service quality, availability, and performance standards. In security: defines uptime requirements, incident response times, data protection obligations, and audit rights. Non-compliance may trigger penalties or contract termination.

Domain 5 #91

NIST Cybersecurity Framework (CSF)

NIST framework: Identify, Protect, Detect, Respond, Recover

NIST Cybersecurity Framework (CSF) Domain 5

Voluntary framework developed by NIST for improving critical infrastructure cybersecurity. Five functions: Identify (understand risks), Protect (implement safeguards), Detect (identify incidents), Respond (take action), Recover (restore capabilities). Widely used for risk management and security program structure.

Domain 5 #92

Qualitative vs Quantitative Risk Assessment

Qualitative=subjective scales, Quantitative=financial numbers

Qualitative vs Quantitative Risk Assessment Domain 5

Qualitative assessment uses subjective scales (High/Medium/Low) and expert judgment — faster but less precise. Quantitative assessment uses numerical values (SLE, ALE, ARO) to calculate financial impact — more precise but requires accurate data. Most organizations use a combination of both approaches.

Domain 5 #93

SLE, ARO, ALE Formulas

SLE=one loss, ARO=frequency, ALE=annual expected loss

SLE, ARO, ALE Formulas Domain 5

Key risk quantification formulas: SLE (Single Loss Expectancy) = Asset Value × Exposure Factor (EF) — cost of one incident. ARO (Annualized Rate of Occurrence) — expected frequency per year. ALE (Annualized Loss Expectancy) = SLE × ARO — expected annual cost. Used to justify security control costs (control cost should be < ALE).

Domain 5 #94

NDA (Non-Disclosure Agreement)

Legal agreement to keep information confidential

NDA (Non-Disclosure Agreement) Domain 5

Legal contract establishing confidential relationship between parties, protecting sensitive information shared during business dealings. Commonly used with employees, contractors, vendors, and business partners. Defines what information is confidential, obligations of receiving party, duration, and consequences of breach.

Domain 5 #95

Penetration Testing Types

Black/white/gray box by knowledge level

Penetration Testing Types Domain 5

Classifications by knowledge: Black box (tester has no prior knowledge — simulates external attacker), White box (full knowledge of infrastructure, source code — most thorough), Gray box (partial knowledge — simulates insider or partner). Also: Red team (adversarial simulation), Blue team (defenders), Purple team (combined).

Domain 5 #96

Security Awareness Training

Teaching employees to recognize and respond to threats

Security Awareness Training Domain 5

Ongoing education program to help employees recognize and respond to security threats. Key topics: phishing recognition, social engineering, password security, physical security, data handling, and reporting procedures. Includes simulated phishing campaigns to test awareness. Required by many regulations (HIPAA, PCI-DSS).

Domain 5 #97

Compliance

Adhering to laws, regulations, and security standards

Compliance Domain 5

Adhering to laws, regulations, standards, and contractual obligations relevant to the organization. Frameworks: GDPR, HIPAA, PCI-DSS, SOX, ISO 27001, NIST. Compliance does not equal security, but security supports compliance. Requires documentation, technical controls, training, and regular audits.

Domain 5 #98

Audit

Systematic independent examination of security controls

Audit Domain 5

A systematic, independent examination to evaluate whether security controls, processes, and policies are properly designed and operating effectively. Types: Internal (self-assessment), External (independent third party), Regulatory (by regulatory authority). Produces findings, recommendations, and compliance assessment.

Domain 5 #99

Data Privacy

Protecting individuals' rights over their personal data

Data Privacy Domain 5

The right of individuals to control how their personal information is collected, used, and shared. Organizations must implement privacy principles: data minimization, purpose limitation, storage limitation, transparency, data subject rights. Privacy and security are related but distinct — you can have security without privacy, not vice versa.

Domain 5 #100

Acceptable Use Policy (AUP)

Policy defining acceptable use of IT resources

Acceptable Use Policy (AUP) Domain 5

A policy defining acceptable behaviors and prohibited actions when using organizational IT resources (computers, internet, email, software). Sets expectations, protects the organization legally, and reduces risk. Users typically sign AUP during onboarding. Violations can result in disciplinary action.

Domain 5 #101

Third-Party Risk Management

Managing security risks from vendors and partners

Third-Party Risk Management Domain 5

The process of identifying, assessing, and mitigating risks associated with vendors, suppliers, and business partners who have access to your systems or data. Steps: vendor assessment, contractual controls (right to audit, security requirements), ongoing monitoring, and termination procedures. Supply chain risk is a major concern.

Domain 5 #102

Tabletop Exercise

Discussion-based practice of incident response scenarios

Tabletop Exercise Domain 5

A discussion-based session where team members talk through their response to a hypothetical emergency scenario without actually executing procedures. Tests understanding of incident response plans, identifies gaps, and improves coordination. Low cost, no operational disruption. Example: "What would you do if we discovered ransomware right now?"

Domain 5 #103

Security Operations Center (SOC)

24/7 team monitoring and responding to security threats

Security Operations Center (SOC) Domain 5

A centralized function staffed with security analysts that continuously monitors, detects, analyzes, and responds to cybersecurity incidents. The heart of an organization's security operations. Uses SIEM, IDS/IPS, threat intelligence, and EDR tools. 24/7 operation for enterprise organizations.

Domain 5 #104

Threat Intelligence

Knowledge about threats used to make security decisions

Threat Intelligence Domain 5

Evidence-based knowledge about existing or emerging threats that can be used to make informed security decisions. Types: Strategic (high-level trends for executives), Tactical (TTPs — Tactics, Techniques, Procedures), Operational (specific attack details), and Technical (indicators of compromise, malware hashes, IPs). Sources: ISACs, government feeds, commercial vendors.

Domain 5 #105

Data Retention Policy

Policy defining how long data must be kept

Data Retention Policy Domain 5

A policy specifying how long different categories of data must be kept before secure deletion. Driven by legal requirements (IRS=7 years, HIPAA=6 years, GDPR=minimum necessary), operational needs, and compliance. Must balance storage costs with legal obligations. Secure destruction methods: shredding, degaussing, cryptographic erasure.