Cissp Study Terms

Front 1

Availability

Back 1

Reliable and timely access to data and resources is provided to authorized individuals.

Front 2

Integrity

Back 2

Accuracy and reliability of the information and systems are provided and any unauthorized modification is prevented.

Front 3

Confidentiality

Back 3

Necessary level of secrecy is enforced and unauthorized disclosure is prevented

Front 4

Shoulder surfing

Back 4

Viewing information in an unauthorized manner by looking over the shoulder of someone else.

Front 5

Social engineering

Back 5

Gaining unauthorized access by tricking someone into divulging sensitive information.

Front 6

Vulnerability

Back 6

Weakness or a lack of a countermeasure. For example, out dated anti-virus software

Front 7

Threat agent

Back 7

Entity that can exploit a vulnerability. For example, a virus

Front 8

Threat

Back 8

The danger of a threat agent exploiting a vulnerability. For example, criminal activity

Front 9

Risk

Back 9

The probability of a threat agent exploiting a vulnerability and the associated impact.

Front 10

Control

Back 10

Safeguard that is put in place to reduce a risk, also called a countermeasure. For example, updated AV software

Front 11

Exposure

Back 11

Presence of a vulnerability, which exposes the organization to a threat.

Front 12

Threat Model

Back 12

Threat agent -> gives rise to Threat -> exploits Vulnerability -> leads to Risk -> can damage -> Asset -> and causes an Exposure -> can be countermeasured by a Safeguard

Front 13

Control types

Back 13

Administrative, technical, and physical

Front 14

Control functionalities

Back 14

1) Deterrent
2) Preventive
3) Corrective
4) Recovery
5) Detective
6) Compensating

Front 15

Deterrent

Back 15

Discourage a potential attacker

Front 16

Preventive

Back 16

Stop an incident from occurring

Front 17

Corrective

Back 17

Fix items after an incident has occurred

Front 18

Recovery

Back 18

Restore necessary components to return to normal operations

Front 19

Detective

Back 19

Identify an incident’s activities after it took place

Front 20

Compensating

Back 20

Alternative control that provides similar protection as the original control

Front 21

Defense-in-depth

Back 21

Implementation of multiple controls so that successful penetration and compromise is more difficult to attain