Your FREE CISSP Flashcards 2026 – 350+ Cards

Confidentiality, Integrity, Availability — the three core goals of information security.

Preventing unauthorized disclosure of data; protected by encryption and access controls.

Ensuring data is accurate and unaltered except by authorized parties; protected by hashing and digital signatures.

Ensuring authorized users have timely, reliable access to systems and data.

Disclosure, Alteration, Destruction — the opposite of CIA; names the threats to each goal.

Assurance that data, a transaction, or a message is genuine and from its claimed source.

Assurance that a party cannot deny an action; achieved via digital signatures and logging.

Layering multiple, overlapping controls so that if one fails, others still protect the asset.

The framework of policies, roles, and oversight by which senior management directs and controls security.

Doing the research and developing the plans and policies needed to protect the organization.

Acting on due diligence — implementing and maintaining reasonable controls (the prudent person rule).

Acting with the care a reasonable, prudent person would in similar circumstances; reduces negligence liability.

A high-level management statement of intent and goals; mandatory and broad.

A mandatory, specific requirement that supports a policy (e.g., 'use AES-256').

Detailed, mandatory step-by-step instructions for a task.

A minimum required level of security that systems must meet.

A recommended, discretionary (optional) best practice.

The likelihood that a threat exploits a vulnerability, and the resulting impact on an asset.

Any potential event or actor that could harm an asset by exploiting a vulnerability.

The entity (person, group, or process) that carries out a threat.

A weakness in a system, process, or control that a threat can exploit.

An instance of being susceptible to loss from a threat exploiting a vulnerability.

Anything of value to the organization — data, systems, people, facilities, or reputation.

The monetary worth assigned to an asset, used in quantitative risk analysis.

The percentage of an asset's value lost if a specific risk event occurs.

Expected loss from one occurrence: SLE = Asset Value × Exposure Factor.

The expected number of times a risk event occurs in one year.

Expected yearly cost of a risk: ALE = SLE × ARO.

SLE = AV × EF (Asset Value times Exposure Factor).

ALE = SLE × ARO (Single Loss Expectancy times Annualized Rate of Occurrence).

Subjective ranking of risk (high/medium/low) using scenarios and judgment — fast, not dollar-based.

Objective, dollar-based risk analysis using AV, EF, SLE, ARO, and ALE.

The risk that remains after controls are applied; senior management formally accepts it.

The risk before any controls are applied (threats × vulnerabilities × asset value).

Reducing risk to an acceptable level by implementing controls.

Shifting the financial impact of a risk to a third party, such as insurance.

Eliminating a risk by ceasing the activity that creates it.

A documented, management-approved decision to tolerate a risk.

Discouraging a threat actor from acting (e.g., warnings, visible controls).

A countermeasure should never cost more than the asset (or the ALE reduction) it provides.

A control that reduces the likelihood or impact of a risk.

Policies, procedures, training, and personnel practices (management controls).

Hardware and software controls such as firewalls, encryption, and access control.

Controls that protect facilities and equipment (locks, fences, guards, cameras).

A control that stops an incident before it happens (e.g., a lock, MFA).

A control that identifies an incident in progress or after it (e.g., logs, IDS, cameras).

A control that restores systems after an incident (e.g., backups, patches).

A control that discourages a threat (e.g., warning signs, visible cameras).

An alternative control used when the primary one isn't feasible.

Systematically identifying and prioritizing threats to a system during design.

Threat model: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

A risk-rating model: Damage, Reproducibility, Exploitability, Affected users, Discoverability.

Structured sets of controls — e.g., NIST SP 800-53, ISO/IEC 27001/27002, COBIT.

International standard for an Information Security Management System (ISMS).

Code of practice giving guidance on information security controls.

A framework of five functions: Identify, Protect, Detect, Respond, Recover.

Protect society, the common good, necessary public trust, and the infrastructure.

Act honorably, honestly, justly, responsibly, and legally.

Provide diligent and competent service to principals.

Advance and protect the profession.

Canons are applied in order; when they conflict, the earlier (society) outranks the later (profession).

EU General Data Protection Regulation — protects personal data of EU residents; heavy fines for noncompliance.

U.S. law protecting the privacy and security of health information (PHI).

Gramm-Leach-Bliley Act — requires financial institutions to protect customers' personal financial data.

Sarbanes-Oxley Act — requires accurate financial reporting and internal controls for public companies.

Payment Card Industry Data Security Standard — protects cardholder data (industry standard, not law).

Grants exclusive rights to an invention for a limited time (about 20 years).

Protects words, symbols, or logos identifying goods/services.

Protects original works of authorship (software, writing, art).

Confidential business information that gives a competitive edge, protected as long as it's kept secret.

A plan to keep critical business functions operating during and after a disruption.

Processes and procedures to restore IT systems and operations after a disaster.

Identifies critical functions and sets recovery objectives (MTD, RTO, RPO) — the heart of continuity planning.

The longest a function can be unavailable before unacceptable harm; drives the RTO.

The target time to restore a function after a disruption; must be less than the MTD.

The maximum acceptable amount of data loss, measured backward in time; drives backup frequency.

Time to verify systems and data after recovery before resuming normal operations.

Mean Time Between Failures — the average time a repairable component runs before failing.

Mean Time To Repair — the average time to restore a failed component.

The functions an organization must perform to survive; identified by the BIA.

Senior management must champion, fund, and ultimately own the BCP.

Labeling data by sensitivity so the right level of protection is applied.

Top Secret, Secret, Confidential, Unclassified (high to low sensitivity).

Common scheme: Confidential, Private, Sensitive, Public.

The senior business manager accountable for data; assigns classification and protection requirements.

Implements and maintains the controls protecting data day to day — usually IT.

Under privacy law, the entity that decides why and how personal data is processed.

A party that processes personal data on behalf of, and on the instructions of, the controller.

The person responsible for a system's operation and security throughout its lifecycle.

Responsible for data quality, definitions, and appropriate use within a business area.

An end user who accesses data to perform their job, following handling rules.

At rest (stored), in transit (moving), and in use (being processed in memory).

Stored data — protect with full-disk and database encryption.

Moving data — protect with TLS, IPsec, or VPNs.

Data being processed in memory — hardest to protect (e.g., secure enclaves).

Create, store, use, share, archive, and destroy — each stage needs appropriate protection.

Residual data left on media after deletion or formatting that may be recoverable.

Overwriting media so data can't be recovered by normal means; suitable for internal reuse.

Stronger sanitization (degaussing or multiple overwrites) to allow external release of media.

Physically destroying media (shred, pulverize, incinerate) for the most sensitive data.

Using a strong magnetic field to erase data from magnetic media; does not work on SSDs.

Guidelines for media sanitization defining Clear, Purge, and Destroy levels.

Technology that detects and blocks unauthorized exfiltration of sensitive data.

Selecting only the security controls from a baseline that apply to a given system.

Adjusting a baseline of controls to fit an organization's specific needs.

Defines how long data must be kept and when it must be securely destroyed.

Personally Identifiable Information — data that can identify a specific individual.

Protected Health Information — individually identifiable health data under HIPAA.

Removing identifiers so data can no longer be linked to an individual.

Replacing identifying fields with pseudonyms so re-identification needs separate, protected data.

Replacing sensitive data with a non-sensitive token, with the real value stored securely elsewhere.

Hiding parts of data (e.g., showing only the last 4 digits) to limit exposure.

Labeling = machine-readable classification; marking = human-readable classification on documents.

Applying classification, handling, and disposal rules to data from creation to destruction.

A maintained record of all assets and their owners — the basis for protecting them.

Data is subject to the laws of the country in which it is physically stored.

A formal statement of rules that a system enforces to meet a security policy.

Confidentiality model: no read up (Simple Security) and no write down (*-Property).

No read up — a subject can't read data above its clearance.

No write down — a subject can't write data to a lower level.

Integrity model: no read down (Simple Integrity) and no write up (*-Integrity).

No read down — a subject can't read data of lower integrity.

No write up — a subject can't write to a higher integrity level.

Integrity model using well-formed transactions and separation of duties (the access triple).

Confidentiality model that changes access dynamically to prevent conflicts of interest.

A model describing how rights can be passed (taken or granted) between subjects.

The abstract concept that mediates ALL access between subjects and objects.

The hardware/software that implements the reference monitor concept.

All hardware, software, and firmware that enforces a system's security policy.

The boundary separating the TCB from the rest of the system.

An international standard for evaluating product security, rated by EAL (1-7).

A Common Criteria rating from EAL1 (lowest) to EAL7 (highest) assurance.

Hierarchical privilege levels (Ring 0 = kernel, outer rings = user) isolating processes.

A hardware chip that securely stores keys and supports measured boot and disk encryption.

The science of protecting information using encryption, hashing, and related techniques.

Plaintext is readable data; ciphertext is the encrypted, unreadable form.

One shared secret key for encrypting and decrypting; fast but key distribution is hard.

A public/private key pair; slower but solves key exchange and enables signatures.

Advanced Encryption Standard — the dominant symmetric block cipher (128/192/256-bit keys).

Older symmetric ciphers; DES (56-bit) is broken, 3DES is deprecated.

A widely used asymmetric algorithm based on the difficulty of factoring large numbers.

Elliptic Curve Cryptography — asymmetric crypto giving strong security with smaller keys.

A key-exchange algorithm that lets two parties derive a shared secret over an insecure channel.

A one-way function producing a fixed-length digest used to verify integrity (e.g., SHA-256).

A secure hashing algorithm producing a 256-bit digest; used for integrity and signatures.

Older hash functions now considered insecure (collision attacks) — avoid for security.

A hash of a message encrypted with the sender's PRIVATE key — gives integrity, authenticity, non-repudiation.

Encrypt with the RECIPIENT's public key; only their private key can decrypt.

Sign with YOUR private key; anyone can verify with your public key.

The framework of certificate authorities, certificates, and policies that manages public keys.

A trusted entity that issues and signs digital certificates binding a key to an identity.

A signed document binding a public key to an identity, issued by a CA.

Using asymmetric encryption to exchange a fast symmetric session key (e.g., TLS).

Random data added to a password before hashing to defeat precomputed (rainbow) attacks.

A keyed hash providing integrity and authenticity of a message.

Storing a copy of cryptographic keys with a trusted third party for recovery.

Session keys that, if compromised, don't expose past or future sessions.

Block ciphers encrypt fixed-size blocks (AES); stream ciphers encrypt bit/byte by byte (RC4).

A cryptosystem should be secure even if everything but the key is public.

Crime Prevention Through Environmental Design — using layout to deter crime.

A two-door entry that allows only one person at a time, preventing tailgating.

Water (sprinklers) for general areas; clean-agent gas for equipment rooms to avoid damage.

An enclosure that blocks electromagnetic signals (and emanations like TEMPEST).

Standards to prevent data leakage via electromagnetic emanations from equipment.

A seven-layer model: Physical, Data Link, Network, Transport, Session, Presentation, Application.

Cables, signals, and hubs; transmits raw bits.

MAC addresses and switches; frames on the local network.

IP addressing and routing; routers and IPsec operate here.

End-to-end delivery; TCP and UDP, port numbers.

Establishes, manages, and tears down sessions.

Data translation, encoding, and encryption formatting.

User-facing protocols: HTTP, DNS, SMTP.

A four-layer model: Link, Internet, Transport, Application — maps onto OSI.

TCP is connection-oriented and reliable (handshake); UDP is connectionless and fast.

SYN, SYN-ACK, ACK — establishes a reliable TCP connection.

Forwards frames using MAC addresses within a local network.

Forwards packets between networks using IP addresses.

A device or software that filters traffic between networks based on rules.

Tracks the state of connections and allows return traffic for established sessions.

Filters traffic by IP, port, and protocol without tracking connection state.

Adds application awareness, IPS, and deep packet inspection to a firewall.

An intermediary that forwards requests on behalf of clients, hiding internal hosts.

A screened subnet between the internet and the internal network for public-facing servers.

A logical network segment that isolates traffic at Layer 2 for security and performance.

Dividing a network into zones to limit lateral movement and contain breaches.

An encrypted tunnel that protects traffic over an untrusted network.

A Layer 3 protocol suite that secures IP traffic; used for VPNs (AH and ESP).

AH provides integrity/authentication; ESP provides confidentiality (encryption) plus integrity.

Transport Layer Security — encrypts application traffic (HTTPS); successor to SSL.

Secure Shell — encrypted remote administration; replaces Telnet.

Telnet, FTP, HTTP, SNMPv1/2, and WEP transmit data in the clear — avoid them.

Wi-Fi security protocols; WPA3 is the current standard with stronger encryption.

An obsolete, broken Wi-Fi security protocol — never use it.

An IDS detects and alerts on attacks; an IPS detects and actively blocks them.

Network Access Control — enforces policy (e.g., patch state) before allowing a device on the network.

Distributed Denial of Service — overwhelming a target with traffic from many sources.

An attacker intercepts and possibly alters communication between two parties.

Forging ARP replies to associate the attacker's MAC with another host's IP.

Corrupting DNS records to redirect users to malicious sites.

Decoupling network control from forwarding, managed centrally by software.

A port-based network access control standard requiring authentication before access.

Carrying multiple traffic types over one network (e.g., VoIP, FCoE) — security implications.

A model that trusts no one by default; verifies every request regardless of network location.

Fine-grained segmentation down to individual workloads, a key Zero Trust technique.

A subject claiming an identity (e.g., a username) — the first step of access control.

Proving a claimed identity with a credential (knowledge, possession, or inherence).

Determining what an authenticated identity is permitted to access and do.

Tying actions back to a specific identity through logging and auditing.

Authentication, Authorization, and Accounting — the pillars of access control.

Knowledge factor: password, PIN, or passphrase.

Possession factor: smart card, hardware token, or phone.

Inherence (biometric) factor: fingerprint, iris, or face.

Using two or more factors from DIFFERENT categories — know, have, are.

Two of the same factor type (password + security question) is still single-factor.

False Acceptance Rate — wrongly accepting an unauthorized person (a security failure).

False Rejection Rate — wrongly rejecting an authorized person (a usability failure).

Crossover Error Rate — where FAR equals FRR; lower CER means a better biometric system.

Granting users and processes only the minimum access needed — and nothing more.

Limiting access to the specific information required to perform a task.

Splitting a sensitive task so no single person controls it end to end.

Periodically moving staff between roles to detect fraud and reduce dependence.

Requiring time off so fraud that depends on continuous presence is exposed.

The data owner decides who gets access (file permissions, ACLs).

The system enforces access from labels and clearances; rigid and high-security.

Access granted by job role rather than the individual; scales in enterprises.

Access decided by attributes and policy (user, resource, time, location) — most granular.

Global rules applied to everyone (e.g., a firewall ruleset, time-of-day limits).

A list specifying which subjects may access an object and with what rights.

A list of the objects a specific subject is allowed to access (subject-centric).

One authentication grants access to multiple systems.

A symmetric-key SSO protocol using tickets and a Key Distribution Center (KDC).

Key Distribution Center — issues tickets; comprises the Authentication Server and TGS.

Ticket-Granting Ticket — proves a user authenticated, used to request service tickets.

Security Assertion Markup Language — XML standard for web SSO and federation.

An authorization framework that lets apps access resources without sharing passwords.

An authentication layer on top of OAuth 2.0 for federated login.

Linking identity across organizations so one set of credentials works across trusted domains.

The system that authenticates users and asserts identity to service providers.

Creating and removing user access; timely deprovisioning prevents orphan accounts.

Controlling, monitoring, and securing accounts with elevated rights.

Verifying that a person is who they claim before issuing credentials.

Securely creating, maintaining, and terminating sessions (timeouts, tokens).

Granting elevated access only when needed and for a limited time.

Disabling an account after repeated failed logins to slow brute-force attacks.

A broad review of a system's controls and risk posture against requirements.

An independent, systematic evaluation of controls against a standard or policy.

An automated check that identifies known weaknesses without exploiting them.

An authorized, simulated attack that actively exploits weaknesses to show real impact.

A scan finds the holes; a pen test proves what an attacker could do with them.

The tester has no prior knowledge of the target (simulates an outside attacker).

The tester has full knowledge of the target (architecture, source, credentials).

The tester has partial knowledge of the target.

The written scope, limits, and authorization for a penetration test.

Analyzing source code for flaws without running it.

Testing a running application from the outside for vulnerabilities.

Examining source code (manually or with tools) to find security and quality flaws.

Feeding malformed or random input to find crashes and security flaws.

Testing how a system behaves under intentional misuse or attack scenarios.

Measuring how much of the code or requirements the tests exercise.

Scripted, simulated user interactions used to test and monitor systems.

Examining logs to detect anomalies, policy violations, and incidents.

An attestation on controls relevant to financial reporting.

An attestation on controls for security, availability, processing integrity, confidentiality, privacy.

A general-use, public summary version of a SOC 2 report.

Type I = controls at a point in time; Type II = controls' operating effectiveness over a period.

KPI measures performance toward a goal; KRI measures risk exposure (an early warning).

Discover, prioritize, remediate, and verify vulnerabilities continuously.

Common Vulnerability Scoring System — a 0-10 severity score for vulnerabilities.

Common Vulnerabilities and Exposures — a standardized identifier for a known vulnerability.

Internal simulates an insider/compromised host; external simulates an internet attacker.

Periodically reviewing accounts and entitlements to enforce least privilege.

Checklist, tabletop, simulation, parallel, and full-interruption tests of recovery plans.

A discussion-based walkthrough of a plan with no system disruption.

Bringing recovery systems online alongside production to verify they work, without cutover.

Shutting down production to fully exercise recovery — most realistic, most risky.

The day-to-day work of running, monitoring, and defending security controls.

An event that actually or potentially harms the confidentiality, integrity, or availability of assets.

An event is any observable occurrence; an incident is an event that causes or threatens harm.

Identify and confirm that an incident has occurred.

Contain the incident to limit damage.

Reduce the impact and stop the spread.

Notify stakeholders and required authorities.

Restore systems to normal operation.

Fix the root cause so the incident can't recur.

Review the response and improve the plan and controls.

Limiting the scope and damage of an incident before eradication and recovery.

Incident handling guide: Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident.

Computer Security Incident Response Team — the group that handles incidents.

Security Information and Event Management — aggregates and correlates logs for detection and analysis.

Security Orchestration, Automation, and Response — automates incident handling workflows.

Recording events and watching them to detect, investigate, and prove activity.

A threshold of activity that, when exceeded, triggers an alert (e.g., failed logins).

Watching outbound traffic to detect data exfiltration.

A controlled process for requesting, evaluating, approving, and documenting system changes.

Maintaining known-good, documented configurations and baselines for systems.

Identifying, testing, and deploying software updates to fix vulnerabilities.

Backs up all selected data; fastest to restore, slowest to back up.

Backs up changes since the last backup of any type; fast backup, slow restore.

Backs up changes since the last full backup; slower backup, faster restore.

Keep 3 copies, on 2 media types, with 1 copy offsite.

Redundant Array of Independent Disks — combines disks for redundancy and/or performance.

RAID 1 mirrors disks; RAID 5 stripes with parity, tolerating one disk failure.

A fully equipped alternate site with near-real-time failover; fastest, most expensive.

An alternate site with hardware and connectivity; data restored on demand; moderate cost.

An alternate site with power and space only; cheapest, slowest to bring online.

A fully mirrored, always-on duplicate of the primary site (highest cost).

Documentation of who handled evidence and when, preserving its integrity.

Original documents/evidence are preferred over copies in legal proceedings.

Physical objects; written records; witness statements — types of evidence.

Collect the most volatile data first (CPU/RAM) before disk and archives.

The process of identifying and producing electronic data for legal proceedings.

A contract defining the expected level of service and remedies.

A decoy system designed to attract and study attackers.

Permitting only approved applications or addresses; everything else is blocked.

Running untrusted code in an isolated environment to contain harm.

The phased process of building software: requirements, design, build, test, deploy, maintain.

Building security into every phase of development rather than testing for it at the end.

Moving security activities earlier in development, where flaws are cheaper to fix.

A sequential, phase-by-phase development model; rigid, suits stable requirements.

Iterative development in short sprints; flexible and delivers frequently.

Integrating development and operations for continuous, automated delivery.

Embedding automated security testing throughout DevOps CI/CD pipelines.

An iterative model with heavy risk analysis in each cycle.

Continuous Integration / Continuous Delivery — automated build, test, and deployment pipelines.

Identifying threats early (e.g., STRIDE) so the design mitigates them.

A model rating process maturity from initial to optimizing.

Building Security In Maturity Model — measures a software security program against peers.

Software Assurance Maturity Model — a framework to assess and improve secure development.

A community list of the most critical web application security risks.

The #1 OWASP risk — users acting outside their intended permissions.

Untrusted input is interpreted as a command or query (e.g., SQL injection).

Inserting malicious SQL via unvalidated input to read or alter a database.

Injecting malicious scripts into web pages viewed by other users.

Tricking a logged-in user's browser into making unwanted requests.

Checking and sanitizing all input — the primary defense against injection attacks.

Using prepared statements with bound parameters to prevent SQL injection.

Encoding data before rendering it to prevent XSS.

Writing past a buffer's bounds to corrupt memory or execute code; prevented by bounds checking.

Time-of-check to time-of-use — a flaw exploiting the gap between checking and using a resource.

Deducing sensitive information from data you are allowed to see.

Combining individually harmless pieces of data into sensitive information.

Storing different data at different classification levels to prevent inference.

Atomicity, Consistency, Isolation, Durability — properties of reliable transactions.

Organizing data to reduce redundancy and improve integrity.

Precompiled SQL stored in the database; can reduce injection risk and centralize logic.

Protecting source control with access control, signing, and secret scanning.

Vulnerabilities introduced through third-party libraries and dependencies.

Scanning dependencies for known vulnerabilities and license issues.

Isolating code (e.g., applets, plugins) so it can't harm the host.

Documented rules (e.g., OWASP, CERT) for writing safe code.

Hidden developer access that must be removed before release.

Encapsulation, inheritance, and polymorphism affect how data is protected in code.

Protecting APIs with authentication, authorization, rate limiting, and input validation.

Re-running tests after changes to ensure new code didn't break existing functionality.

Digitally signing software so users can verify its source and integrity.