Secure design principles, cryptography fundamentals, and security model concepts tested on the CISSP exam.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What does the CIA triad stand for in information security?
Show answer
Confidentiality, Integrity, and Availability - the three core objectives of information security.- Define the principle of least privilege.
Show answer
Users and processes should have the minimum level of access necessary to perform their required functions.- What is defense in depth?
Show answer
A security strategy that uses multiple layers of controls to protect assets, so if one layer fails, others remain in place.- What does separation of duties accomplish?
Show answer
Prevents any single person from having enough authority to commit unauthorized actions by dividing critical functions among multiple individuals.- What is the Bell-LaPadula security model primarily designed to protect?
Show answer
Confidentiality, through rules that prevent reading data at higher classification levels (no read up) and prevent writing data at lower classification levels (no write down).- What are the core rules of the Biba integrity model?
Show answer
No read down (cannot read lower-integrity data) and no write up (cannot write to higher-integrity data), preventing less-trusted processes from corrupting higher-integrity data.- How does the Clark-Wilson model enforce integrity?
Show answer
Uses constrained data items, access control lists, and integrity verification procedures to ensure that only authorized users can make allowed modifications and all changes are logged.- What is symmetric encryption?
Show answer
Encryption method where the same key is used for both encrypting and decrypting data.- What is asymmetric encryption?
Show answer
Encryption method using two mathematically related keys: a public key for encryption and a private key for decryption.- What is the primary purpose of hashing in cryptography?
Show answer
To create a fixed-size fingerprint of data that uniquely represents the data, allowing verification that data has not been altered.- What is a digital signature used for?
Show answer
To provide authentication (proving who sent the message), non-repudiation (sender cannot deny sending it), and integrity (message has not been altered).- What is a Public Key Infrastructure (PKI)?
Show answer
A set of policies, procedures, and technical systems that create, manage, distribute, and revoke digital certificates and key pairs for secure communication.- What is the role of a Certificate Authority (CA) in PKI?
Show answer
Issues, validates, and signs digital certificates to bind public keys to entities, and maintains a certificate revocation list (CRL).- What is key management in cryptography?
Show answer
The entire lifecycle of generating, storing, protecting, rotating, and destroying cryptographic keys to maintain their security and availability.- What are the three factors of authentication?
Show answer
Something you know (passwords), something you have (tokens), and something you are (biometrics).
FlashKeepers