Secure design principles, cryptography fundamentals, and security model concepts tested on the CISSP exam.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What does the CIA triad stand for in information security?
- Confidentiality, Integrity, and Availability - the three core objectives of information security.
- Define the principle of least privilege.
- Users and processes should have the minimum level of access necessary to perform their required functions.
- What is defense in depth?
- A security strategy that uses multiple layers of controls to protect assets, so if one layer fails, others remain in place.
- What does separation of duties accomplish?
- Prevents any single person from having enough authority to commit unauthorized actions by dividing critical functions among multiple individuals.
- What is the Bell-LaPadula security model primarily designed to protect?
- Confidentiality, through rules that prevent reading data at higher classification levels (no read up) and prevent writing data at lower classification levels (no write down).
- What are the core rules of the Biba integrity model?
- No read down (cannot read lower-integrity data) and no write up (cannot write to higher-integrity data), preventing less-trusted processes from corrupting higher-integrity data.
- How does the Clark-Wilson model enforce integrity?
- Uses constrained data items, access control lists, and integrity verification procedures to ensure that only authorized users can make allowed modifications and all changes are logged.
- What is symmetric encryption?
- Encryption method where the same key is used for both encrypting and decrypting data.
- What is asymmetric encryption?
- Encryption method using two mathematically related keys: a public key for encryption and a private key for decryption.
- What is the primary purpose of hashing in cryptography?
- To create a fixed-size fingerprint of data that uniquely represents the data, allowing verification that data has not been altered.
- What is a digital signature used for?
- To provide authentication (proving who sent the message), non-repudiation (sender cannot deny sending it), and integrity (message has not been altered).
- What is a Public Key Infrastructure (PKI)?
- A set of policies, procedures, and technical systems that create, manage, distribute, and revoke digital certificates and key pairs for secure communication.
- What is the role of a Certificate Authority (CA) in PKI?
- Issues, validates, and signs digital certificates to bind public keys to entities, and maintains a certificate revocation list (CRL).
- What is key management in cryptography?
- The entire lifecycle of generating, storing, protecting, rotating, and destroying cryptographic keys to maintain their security and availability.
- What are the three factors of authentication?
- Something you know (passwords), something you have (tokens), and something you are (biometrics).