Your FREE ISC2 CC Flashcards 2026 – 200+ Cards

Confidentiality, Integrity, Availability — the three core goals of information security.

Preventing the unauthorized disclosure of data; protected by encryption and access controls.

Ensuring data is accurate and unaltered except by authorized parties; protected by hashing and change control.

Ensuring authorized users have timely, reliable access to systems and data; protected by redundancy and backups.

Disclosure, Alteration, Destruction — the opposite of CIA, naming the threats to each goal.

Proving a claimed identity with a credential (something you know, have, or are).

Assurance that a party cannot deny having performed an action; provided by digital signatures and logging.

The appropriate collection, use, and protection of personal information.

Confidentiality, Integrity, Availability, plus Authentication, Non-repudiation, and Privacy.

Anything of value to the organization that needs protection — data, hardware, software, or people.

Any potential event or actor that could cause harm by exploiting a vulnerability.

A weakness in a system, process, or control that a threat can exploit.

The likelihood that a threat will exploit a vulnerability, and the resulting impact on an asset.

Threat = potential cause of harm; vulnerability = weakness it exploits; risk = chance and impact of that happening.

The probability that a given threat will exploit a given vulnerability.

The magnitude of harm if a risk event occurs.

A function of likelihood × impact, requiring a threat, a vulnerability, and an asset of value.

Identify assets/threats/vulnerabilities, assess and prioritize, choose treatment, implement controls, monitor.

Avoid, Mitigate (reduce), Transfer, Accept.

Eliminating a risk by ceasing the activity that creates it.

Reducing risk to an acceptable level by implementing controls.

Shifting the financial impact of a risk to a third party, such as through insurance.

A documented, management-approved decision to tolerate a risk and its potential impact.

The risk that remains after controls are applied; senior management formally accepts it.

Senior management — they own risk and set the tone; security translates business goals into rules.

A safeguard that reduces risk to assets; categorized by type and by function.

A control implemented with technology — firewalls, encryption, antivirus, MFA, access control lists.

Policies, procedures, standards, and training that direct how people behave.

A tangible barrier protecting facilities and hardware — locks, fences, guards, badges, CCTV.

Technical (logical), Administrative (managerial), and Physical.

Stops an incident before it happens — a lock, a firewall rule, MFA.

Identifies an incident in progress or after the fact — CCTV, IDS, logs, audits.

Restores systems after an incident — backups, patches, antivirus removal.

Discourages an attacker — warning signs, visible guards, lighting.

Type = HOW it's built (technical/admin/physical); function = WHAT it does (preventive/detective/corrective/deterrent).

Technical type, preventive function — it filters traffic by rules before it's allowed in.

Physical type, detective and deterrent function — it records activity and discourages intruders.

Layering multiple, overlapping controls so that if one fails, others still protect the asset.

Regulation/law → policy → standard → procedure → guideline.

A high-level management statement of intent and goals; mandatory.

A specific mandatory requirement supporting a policy (e.g., 'use AES-256').

Detailed step-by-step instructions for a task; mandatory.

Recommended, discretionary best practice; the only non-mandatory document.

A rule imposed by a government or authority that the organization must obey.

Four canons, applied in order.

Protect society, the common good, necessary public trust and confidence, and the infrastructure.

Act honorably, honestly, justly, responsibly, and legally.

Provide diligent and competent service to principals.

Advance and protect the profession.

The earlier (lower-numbered) canon — protecting society outranks advancing the profession.

Acting on due diligence by implementing and maintaining reasonable controls — what a prudent person would do.

Doing the research and developing the plans/policies needed to protect the organization.

No single control is a silver bullet; layers force an attacker to defeat several independent defenses.

An alternative control used when the primary control isn't feasible, providing similar protection.

Ranking risk subjectively as high/medium/low — fast, but not expressed in dollars.

Assigning objective monetary values to risk (e.g., expected annual loss) to cost-justify controls.

A person or group that carries out a threat — e.g., hacktivists, insiders, nation-states, cybercriminals.

A risk posed by people inside the organization, whether malicious or careless.

A catalog of the organization's assets and their value — the starting point of risk management.

The framework of policies, roles, and oversight by which leadership directs security.

Acting with the care a reasonable, prudent person would in the same situation (due care + due diligence).

Keeping critical business functions operating during and after a disruption — the organization-wide plan.

The IT-focused subset of continuity: restoring systems, data, and infrastructure after a disaster.

BC keeps the whole business running; DR is the IT subset that restores technology.

A documented plan to keep critical functions running through a disruption.

A documented plan to restore IT systems and data after a disruptive event.

Identifies critical business functions and sets recovery objectives (MTD, RTO, RPO); the heart of continuity.

The longest a function can be unavailable before unacceptable harm; sets the ceiling for the RTO.

The target time to restore a system after a disruption; must be shorter than the MTD.

The maximum acceptable amount of data loss measured backward in time; drives backup frequency.

RTO = time to recover; RPO = data you can afford to lose.

RTO must always be shorter than the MTD.

A fully equipped recovery site with near-real-time failover; fastest recovery, most expensive.

A recovery site with hardware and connectivity; data restored on demand. Moderate cost and speed.

An empty recovery space with power and cooling only; cheapest, slowest to bring online.

Hot (fast, costly) → warm → cold (cheap, slow).

Backs up all selected data; fastest to restore (one set), slowest to back up.

Backs up changes since the last backup of any type; fast backup, slow restore.

Backs up changes since the last full backup; slower backup, faster restore.

Keep three copies of data, on two different media types, with one copy off-site.

Any observable occurrence on a system or network.

An event that actually or potentially harms the confidentiality, integrity, or availability of information.

Every incident is an event, but only some events harm security and become incidents.

The structured process to prepare for, detect, contain, eradicate, recover from, and learn from an incident.

A designated group that follows the IR plan to handle security incidents.

Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident Activity.

Build the IR plan, team, tools, and communications, and train staff — before anything happens.

Recognize and confirm an incident, determine its scope, and prioritize it.

Stop the spread, remove the cause, and restore systems to normal operation.

Hold a lessons-learned review and improve the plan and controls.

Containment — limit the damage before eradicating the cause.

The post-incident review that documents what happened and improves future response.

A discussion-based walkthrough of the incident or continuity plan to test it without disrupting operations.

Automatically switching to a standby system or site when the primary fails.

Duplicating critical components so a single failure doesn't cause an outage (supports availability).

Untested plans fail in a real disaster; testing finds gaps and trains the team before it matters.

BC keeps the business running through disruption; IR handles a specific security incident.

Determining the underlying cause of an incident so it can be fixed and prevented from recurring.

Granting users and processes only the minimum access needed to do their job, and nothing more.

Limiting access to the specific information required to perform a task.

Splitting a sensitive task so no single person can complete it alone, reducing fraud and error.

Authentication, Authorization, and Accountability.

Identification → Authentication → Authorization → Accountability.

A subject claiming an identity, such as entering a username — the first step of access control.

Determining what an authenticated identity is permitted to access and do.

Tying actions back to a specific identity through logging and monitoring.

Using two or more factors from different categories — something you know, have, and are.

A knowledge authentication factor — password, PIN, or passphrase.

A possession authentication factor — smart card, hardware token, or phone.

An inherence (biometric) authentication factor — fingerprint, iris, or face.

No — both are 'something you know,' so it's single-factor. MFA requires different categories.

Access decided by the data owner, e.g., file permissions and ACLs. Flexible but error-prone.

Access enforced by the system from labels and clearances; the most restrictive, used for classified data.

Access granted by job role rather than the individual; scales well in organizations.

DAC = owner decides; MAC = system enforces from labels; RBAC = by job role.

Mandatory Access Control (MAC) — the system, not the owner, decides based on labels and clearances.

RBAC — assign access by role so staff inherit and lose permissions as their role changes.

A tangible control protecting facilities and hardware — locks, badges, guards, CCTV.

A two-door airlock allowing one person per authentication; stops tailgating.

Following an authorized person through a secure door without authenticating.

Being let through a secure door by an authorized person (with their awareness).

Verifying identity from a physical trait — fingerprint, iris, face, or voice.

How often a biometric system wrongly accepts an unauthorized user (a Type II error).

How often a biometric system wrongly rejects an authorized user (a Type I error).

One authentication that grants access to multiple systems.

An account with elevated rights (e.g., administrator) that needs extra protection and monitoring.

Granting access when a user joins or changes roles, and removing it promptly when they leave.

Technology-based control of access to systems and data — passwords, MFA, ACLs, encryption.

Authentication proves who you are; authorization decides what you're allowed to do.

A possession factor that generates or stores a credential (e.g., a one-time code).

Type I = false rejection (authorized user denied); Type II = false acceptance (impostor allowed).

Disabling an account after repeated failed logins to slow password-guessing attacks.

Granting elevated privileges only when needed and for a limited time, reducing standing access.

Physical protects facilities and hardware; logical protects systems and data via technology.

A seven-layer reference model: Physical, Data Link, Network, Transport, Session, Presentation, Application.

Physical — cables, signals, and hardware; hubs.

Data Link — MAC addresses, switches, and frames.

Network — IP addressing and routing; routers; IPsec.

Transport — TCP and UDP; port numbers.

Session — setting up, managing, and tearing down sessions.

Presentation — encryption, encoding, and formatting.

Application — the data the user interacts with (HTTP, DNS, SMTP).

Please Do Not Throw Sausage Pizza Away.

Layer 2 (Data Link) — forwards frames by MAC address.

Layer 3 (Network) — forwards packets by IP address.

A four-layer practical model: Network Access, Internet, Transport, and Application.

Transmission Control Protocol — connection-oriented, reliable, ordered delivery (Layer 4).

User Datagram Protocol — connectionless, fast, but unreliable (Layer 4).

TCP is reliable and connection-oriented; UDP is fast and connectionless.

32-bit IP addressing (about 4.3 billion addresses) — running out.

128-bit IP addressing — vastly more addresses than IPv4.

SSH — secure remote administration.

DNS — domain name resolution.

HTTP — unencrypted web traffic.

HTTPS (TLS) — encrypted web traffic.

RDP — Remote Desktop Protocol.

The current secure WiFi encryption standard; use it instead of legacy WEP.

An obsolete, insecure WiFi encryption standard that should never be used.

Malicious software — viruses, worms, trojans, ransomware, spyware.

Malware that attaches to a host file and spreads when a user runs it.

Malware that self-replicates across networks with no user action.

Malware disguised as legitimate software to trick the user into installing it.

Malware that encrypts data and demands payment for the decryption key.

Malware that secretly gathers information about a user or system.

A Denial-of-Service attack that floods a system from one source to make it unavailable.

A Distributed Denial-of-Service attack launched from many compromised machines (a botnet) at once.

DoS floods from one source; DDoS floods from many distributed sources, making it harder to block.

Intercepting and possibly altering traffic between two communicating parties.

Extracting information through physical signals such as power use, timing, or electromagnetic leaks.

A control that filters network traffic, allowing or blocking it based on a defined ruleset.

Intrusion Detection System — monitors traffic and alerts on suspicious activity but does not block it.

Intrusion Prevention System — detects and actively blocks malicious traffic.

IDS detects and alerts only; IPS detects and blocks.

A virtual LAN that logically segments a network to isolate traffic.

Dividing a network into zones to limit the spread of an attack and control traffic.

A screened subnet that exposes public-facing services while shielding the internal network.

A Virtual Private Network — an encrypted tunnel that secures traffic across an untrusted network.

A model that trusts no user or device by default and continuously verifies every access request.

Software as a Service — the provider delivers ready-to-use applications over the internet.

Platform as a Service — the provider delivers a platform to build and run applications.

Infrastructure as a Service — the provider delivers virtualized compute, storage, and networking.

The provider secures the cloud itself; the customer secures their data, access, and configuration.

A network of compromised machines controlled by an attacker, often used for DDoS.

Network Address Translation — maps private internal IPs to a public IP, hiding internal addressing.

An intermediary that forwards and can filter or cache traffic between clients and servers.

Limits the blast radius of an attack and contains threats to one zone.

Faking a source identity such as an IP or email address to bypass controls or deceive a target.

Capturing network traffic to read data, especially when it's unencrypted.

Transport Layer Security — encrypts traffic in transit (the 'S' in HTTPS).

A hardware address that identifies a device on a local network (used at OSI Layer 2).

Data stored on a disk or in a database; protected with full-disk or database encryption.

Data moving across a network; protected with TLS, IPsec, or a VPN.

Data decrypted in memory while being processed — the hardest state to protect.

At rest (stored), in transit (moving), and in use (being processed).

Converting data into an unreadable form so only authorized parties with the key can read it.

Uses one shared secret key for both encrypting and decrypting (e.g., AES); fast but key distribution is hard.

Uses a public/private key pair (e.g., RSA); slower, but solves key exchange and enables signatures.

Symmetric = one shared key, fast; asymmetric = key pair, slower, solves key exchange.

Advanced Encryption Standard — the widely used symmetric encryption algorithm.

A widely used asymmetric (public-key) encryption and digital-signature algorithm.

A one-way function producing a fixed-length digest used to verify integrity (e.g., SHA-256).

Encryption is reversible with a key (confidentiality); hashing is one-way (integrity).

A hash encrypted with the sender's private key, giving integrity, authenticity, and non-repudiation.

Encrypt for confidentiality with the recipient's public key; sign for authenticity with your own private key.

Labeling data by sensitivity (public, internal, confidential, restricted) so the right protection applies.

Recording and reviewing system activity to detect, investigate, and respond to problems.

Security Information and Event Management — centralizes and correlates logs for detection and analysis.

Reducing a system's attack surface — remove unneeded services, close ports, disable defaults, patch.

A minimum required level of secure configuration to harden a system toward.

Recording, controlling, and approving changes to system settings to keep a known-good state.

A controlled process for evaluating, testing, approving, and documenting changes to systems.

Applying vendor updates promptly to close known vulnerabilities.

A policy defining how employees may use organizational systems and data.

Rules governing the use of personal devices for work to protect organizational data.

Rules for password length, complexity, rotation, and reuse to strengthen authentication.

Rules for how data is stored, transmitted, shared, retained, and destroyed by classification.

Manipulating people into divulging information or taking actions that compromise security.

A social-engineering attack using fraudulent messages to trick users into revealing credentials or installing malware.

A targeted phishing attack aimed at a specific person or organization using personalized details.

Phishing that targets high-value executives such as a CEO or CFO.

Social engineering by voice call (vishing) or SMS text (smishing).

Educating users to recognize and avoid threats such as phishing and social engineering.

Security awareness training, backed by email filtering and MFA so stolen credentials alone aren't enough.

Removing data so it can't be recovered — overwriting, degaussing, or physical destruction.

Configure systems to provide only essential capabilities, disabling unneeded ports, services, and software.

You can't detect or investigate what you can't see; logs provide accountability and detection.

Blocking everything by default and allowing only what's explicitly permitted.

No single person controls a critical operational task end to end, reducing fraud.

Rules for how long data is kept and when it's securely destroyed.

Security controls on devices — antivirus/EDR, hardening, patching, encryption.

The ongoing process of identifying, prioritizing, and remediating weaknesses.

Run services and grant accounts only the minimum rights needed, limiting damage from compromise.