Definitions and pro-tips for the CAS-004 certification.
Address Space Layout Randomization (ASLR) is a security technique that randomly arranges the address space positions of key data areas of a process. This makes it difficult for an attacker to predict the memory address of specific functions or libraries, hindering the success of exploit code.
Air Gap is a security measure that ensures a computer or network is physically isolated from all other networks, including the internet. This creates a physical barrier that prevents remote attacks, making it essential for highly sensitive systems like industrial control systems.
An API Gateway is a management tool that sits between a client and a collection of backend services, acting as a reverse proxy to route requests and enforce security policies. It provides centralized functions like rate limiting, authentication, and protocol translation for microservices.
Attestation is the process by which a system proves its identity and integrity to another system or entity, often using a hardware root of trust. It provides a cryptographically signed statement of the system's current state, ensuring the boot process and software have not been tampered with.
Attribute-Based Access Control (ABAC) is an authorization model that grants access rights to users based on a combination of attributes. These attributes can include user characteristics, resource properties, environmental conditions, and specific action types, offering more granularity than RBAC.
Biba Integrity Model is a formal state transition model of computer security policy that focuses on maintaining data integrity. It operates on the principle of 'no write up, no read down,' preventing unauthorized users from modifying high-integrity data and preventing high-integrity subjects from reading low-integrity data.
Business Impact Analysis (BIA) is a systematic process used to determine the potential effects of an interruption to critical business operations as a result of a disaster or emergency. It identifies critical functions and establishes Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
Byzantine Fault Tolerance (BFT) is the property of a system that allows it to reach consensus even if some of its components fail or act maliciously. It ensures the reliability of distributed systems, such as blockchains, despite the presence of arbitrary or malicious faults.
Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority before their scheduled expiration date. Clients download this list periodically to ensure they are not trusting compromised or invalid certificates.
A Cloud Access Security Broker (CASB) is a software tool or service that sits between cloud service consumers and cloud service providers. It enforces security, compliance, and governance policies for cloud-based services, providing visibility into "shadow IT" and controlling data movement.
Cloud Security Posture Management (CSPM) is a set of tools used to identify and remediate risk by automating the identification of misconfigurations in cloud environments. It continuously monitors cloud infrastructure against security best practices and compliance standards to prevent data breaches caused by human error.
Cloud Workload Protection Platform (CWPP) is a security solution designed to protect workloads in various cloud environments, including virtual machines, containers, and serverless functions. It provides consistent visibility and control over workloads regardless of their location, focusing on vulnerability management and runtime protection.
Common Attack Pattern Enumeration and Classification (CAPEC) is a comprehensive dictionary of known patterns of attack used by adversaries. It provides a standardized way to describe attack methods, helping security professionals identify potential weaknesses and develop effective countermeasures.
Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. It provides a standardized way to identify specific platforms, allowing vulnerability scanners and databases to accurately match threats to specific assets.
Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of software vulnerabilities based on a numerical score. It evaluates metrics such as attack vector, complexity, and impact to help organizations prioritize remediation efforts effectively.
Confidential Computing is a cloud computing technology that protects data in use by performing computation in a hardware-based, isolated Trusted Execution Environment. It ensures that sensitive data is encrypted in memory, preventing unauthorized access from the hypervisor, operating system, or other system processes.
Container Orchestration is the automated process of managing the lifecycle of containers, including deployment, scaling, and networking. It ensures that containerized applications are available and healthy across a cluster of hosts, typically implemented using tools like Kubernetes to handle load balancing and resource allocation.
Continuous Integration/Continuous Deployment (CI/CD) is a set of operating principles and practices that enable software delivery teams to release updates frequently and reliably. It automates the build, test, and deployment phases, allowing security checks to be integrated directly into the pipeline for faster vulnerability detection.
Continuous Monitoring (ConMon) is the process of maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. It involves the automated collection and analysis of security data to ensure controls remain effective over time.
The Control Plane is the part of a network architecture that determines how packets should be forwarded by managing the routing tables and logic. In software-defined environments, the control plane is centralized, allowing administrators to dictate network behavior globally rather than configuring individual devices.
Cross-Domain Solution (CDS) is a specialized security mechanism that allows the controlled transfer of information between two or more security domains of different classification levels. It employs strict guards and filters to prevent data leakage and ensure that only authorized data crosses the boundary.
Data Loss Prevention (DLP) is a set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users. It identifies sensitive information through content inspection and prevents its unauthorized exfiltration via network, endpoint, or storage.
The Data Plane, also known as the forwarding plane, is the part of a network architecture responsible for moving actual user traffic based on instructions from the control plane. It focuses on high-speed packet switching and forwarding to ensure efficient data delivery across the network.
Data Sovereignty is the concept that digital data is subject to the laws and governance of the country in which it is physically located. This requires organizations to ensure that their data storage and processing practices comply with the local legal requirements of each jurisdiction.
Deception Technology is a proactive security strategy that deploys decoys, such as honeypots and honeytokens, to mislead attackers and detect unauthorized activity. By creating a fake attack surface, it lures adversaries into revealing their presence and techniques without risking actual production assets.
Defense in Depth is a security strategy that employs multiple layers of redundant defensive controls throughout an information system. If one security layer fails, others remain in place to protect the asset and slow down an attacker.
DevSecOps is the integration of security practices into the DevOps software development lifecycle from the start. It emphasizes "shifting left," automating security checks, and ensuring that security is a shared responsibility among development, security, and operations teams throughout the pipeline.
Discretionary Access Control (DAC) is an access control model where the owner of a resource determines who is granted access to that resource. It allows users to pass permissions to others at their own discretion, offering high flexibility but lower security.
Dynamic Application Security Testing (DAST) is a black-box security testing methodology that examines an application from the outside while it is running. It simulates external attacks to identify vulnerabilities such as SQL injection and cross-site scripting without needing access to the source code.
Elliptic Curve Cryptography (ECC) is a public-key encryption approach based on the algebraic structure of elliptic curves over finite fields. It provides the same level of security as RSA but with significantly smaller key sizes, which reduces computational overhead and power consumption during encryption.
Extended Detection and Response (XDR) is a security technology that integrates and correlates data from multiple security layers, including endpoints, networks, and cloud workloads. It provides a holistic view of threats, enabling faster detection and more effective response than siloed tools.
Fail-safe Defaults is a security design principle stating that the default access level for any user or process should be "deny all." This ensures that if a security mechanism fails or is not explicitly configured, the system remains secure by prohibiting access.
Formal Verification is a rigorous mathematical approach used to prove that a system's design or code meets its specified security properties and requirements. Unlike traditional testing, it provides a mathematical guarantee that certain vulnerabilities, such as race conditions or logic errors, cannot exist.
Hardware Root of Trust (RoT) is a source that is always trusted within a computing system, typically embedded in hardware to provide a secure foundation for all subsequent software layers. It is used to verify the integrity of the boot process through a chain of trust.
A Hardware Security Module (HSM) is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. It is designed to be tamper-resistant and is used to perform encryption and decryption functions in a highly secure environment.
Hardware-assisted Virtualization is a technology where the CPU provides specific hardware features, such as Intel VT-x or AMD-V, to offload virtualization tasks from the hypervisor. This improves performance and security by allowing the hypervisor to manage guest VMs more efficiently.
Homomorphic Encryption is a form of encryption that allows computations to be performed on encrypted data without first decrypting it. The result of the operation is also encrypted, and when decrypted, it matches the result of operations performed on the plaintext.
A Honeytoken is a piece of deceptive data, such as a fake database record, a dummy API key, or a fake user account, placed within a system to detect unauthorized access. When an attacker accesses or uses the token, it triggers an immediate alert, signaling a breach.
Identity Federation is a system that allows a user to use a single set of credentials to access applications and data across different security domains or organizations. It establishes a trust relationship between an identity provider and a service provider.
Infrastructure as Code (IaC) is the managing and provisioning of infrastructure through code instead of through manual processes. It allows security teams to define security baselines as templates, ensuring consistent deployments and enabling version control for the entire environment.
Inherent Risk is the raw level of risk that exists in the absence of any security controls or mitigation efforts. It provides a baseline for understanding the potential impact and likelihood of a threat before any countermeasures are applied.
Managed Detection and Response (MDR) is an outsourced security service that provides organizations with 24/7 threat monitoring, detection, and response capabilities. It combines EDR technology with human expertise from a professional security operations center (SOC).
Mandatory Access Control (MAC) is a strict access control mechanism where the system administrator defines access rights based on security labels and clearances. Users cannot modify the permissions of the objects they create, ensuring a centralized and non-discretionary security policy.
Mean Time to Recover (MTTR) is a key performance indicator that measures the average time required to troubleshoot and repair a failed system and return it to full operational status. It is a critical metric for assessing the effectiveness of incident response and recovery procedures.
Microsegmentation is a security technique that divides a data center or cloud environment into small, isolated security zones to limit lateral movement of threats. It applies granular security policies to individual workloads or virtual machines, regardless of their network location.
OAuth 2.0 is an open-standard authorization framework that allows a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner or by allowing the application to obtain access on its own. It uses access tokens instead of sharing credentials.
Online Certificate Status Protocol (OCSP) is an internet protocol used for obtaining the revocation status of an X.509 digital certificate. Unlike Certificate Revocation Lists (CRLs), OCSP provides real-time status checks by querying the Certificate Authority's responder directly.
OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 protocol that allows clients to verify the identity of the end-user based on the authentication performed by an Authorization Server. It provides a standardized way to perform authentication using ID tokens.
Perfect Forward Secrecy (PFS) is a cryptographic property that ensures a session key derived from a set of long-term keys will not be compromised if one of those long-term keys is stolen in the future. It achieves this by generating a unique session key for every single communication session.
Policy Decision Point (PDP) is the logical entity within a Zero Trust Architecture that evaluates a request against defined security policies to determine if access should be granted. It acts as the brain of the access control system, analyzing user identity, device health, and context.
Privileged Access Management (PAM) is a cybersecurity strategy and set of technologies used to secure, manage, and monitor high-level permissions for administrative accounts. It focuses on reducing the attack surface by implementing just-in-time access, password vaulting, and session recording for critical system accounts.
Public Key Infrastructure (PKI) is a framework of roles, policies, hardware, and software used to create, manage, distribute, use, store, and revoke digital certificates. It enables the secure exchange of information by linking public keys with identities through a trusted Certificate Authority.
Qualitative Risk Analysis is a risk assessment technique that evaluates the probability and impact of a threat using descriptive scales, such as "Low," "Medium," or "High." It relies on expert judgment and subjective experience rather than precise numerical data to prioritize risks.
Quantitative Risk Analysis is a risk assessment method that assigns numerical values to risks to calculate potential financial loss. It typically uses formulas such as Single Loss Expectancy (SLE) multiplied by Annual Rate of Occurrence (ARO) to determine the Annual Loss Expectancy (ALE).
Recovery Point Objective (RPO) is the maximum amount of data, measured in time, that an organization can afford to lose during a disaster recovery event. It determines the necessary frequency of backups to ensure data loss remains within acceptable limits.
Recovery Time Objective (RTO) is the maximum tolerable length of time that a computer, system, network, or application can be down after a failure or disaster occurs. It defines the target time for restoring business processes to an operational state.
Residual Risk is the amount of risk that remains after all security controls and mitigation strategies have been implemented. It represents the gap between the inherent risk of a process and the level of risk achieved after applying countermeasures.
Risk Appetite is the amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. It serves as a high-level guide for decision-making, helping security leaders determine when to mitigate, transfer, avoid, or accept specific technical risks.
Risk Tolerance is the specific, measurable level of variation an organization is willing to accept around a particular risk appetite. It provides the granular boundaries for individual projects or operational activities to ensure they remain within the broader risk appetite.
Role-Based Access Control (RBAC) is an access control mechanism that assigns permissions to specific roles within an organization rather than to individual users. Users are then assigned to these roles, simplifying the management of permissions as personnel change positions or responsibilities.
Secure Access Service Edge (SASE) is a network architecture that converges SD-WAN capabilities with cloud-native security functions like SWG, CASB, and ZTNA. It delivers security services directly to the user at the edge, reducing latency and improving security for remote workforces.
Secure Boot is a security standard developed by the UEFI Forum that ensures a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). It verifies the digital signatures of the bootloader and kernel to prevent rootkits and boot-level malware from executing.
Secure Multi-Party Computation (SMPC) is a subfield of cryptography that enables multiple parties to jointly compute a function over their inputs while keeping those inputs private. No single party can see the other parties' data, only the final computed result.
Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables Single Sign-On (SSO) by allowing a user to authenticate once and access multiple independent systems.
Security Assessment and Authorization (A&A) is the process of evaluating a system's security controls to ensure they are implemented correctly and operating as intended. Once the assessment is complete, an authorizing official grants an Authority to Operate (ATO) based on the residual risk.
Security Development Lifecycle (SDL) is a software development process that integrates security activities into every phase of the development cycle, from requirements to maintenance. It emphasizes early vulnerability detection through activities like secure coding standards, static analysis, and comprehensive security testing.
Security Information and Event Management (SIEM) is a solution that provides real-time analysis of security alerts generated by applications and network hardware. It aggregates log data from various sources, correlates events, and provides a centralized dashboard for security monitoring and reporting.
Security Orchestration, Automation, and Response (SOAR) is a stack of compatible software programs that allow an organization to collect data about security threats and respond to low-level security events without human assistance. It streamlines incident response through automated playbooks and orchestration.
Security Technical Implementation Guides (STIGs) are configuration standards developed by the Defense Information Systems Agency (DISA) to harden IT products and systems. They provide specific, actionable checklists to ensure that software and hardware are configured securely to minimize the overall attack surface.
Service Mesh is a dedicated infrastructure layer for facilitating service-to-service communication between microservices, typically using a sidecar proxy. It manages traffic, provides observability, and implements security policies like mTLS without requiring changes to the application code.
Shared Responsibility Model is a cloud security framework that delineates which security tasks are handled by the cloud service provider (CSP) and which are the responsibility of the customer. The division of duties varies depending on the service model (IaaS, PaaS, or SaaS).
Software Bill of Materials (SBOM) is a formal, structured record containing the details and supply chain relationships of various components used in building software. It allows organizations to manage security risks by identifying known vulnerabilities within third-party libraries and open-source dependencies.
Software-Defined Networking (SDN) is a network architecture approach that decouples the network control plane from the forwarding plane. This allows network administrators to manage network services through abstraction, enabling centralized programmatic control of network traffic and improving agility and scalability across complex enterprise environments.
Software-Defined Perimeter (SDP) is a security framework that hides infrastructure from unauthorized users by creating a virtual boundary. It utilizes a "black cloud" approach where resources are invisible to the public internet until the user is authenticated and authorized via a controller.
Static Application Security Testing (SAST) is a white-box security testing method that analyzes application source code, byte code, or binaries without executing the program. It is used early in the development lifecycle to find structural security flaws and coding errors.
Threat Hunting is a proactive security exercise where analysts search through networks and datasets to detect malicious activities that have evaded existing automated security tools. It involves forming a hypothesis about a threat and then searching for evidence of that threat.
A Threat Intelligence Platform (TIP) is a software solution that collects, aggregates, and organizes threat data from multiple sources to provide actionable insights into emerging threats. It helps security teams correlate indicators of compromise (IoCs) and prioritize their defense efforts.
Threat Modeling is a structured process used to identify, quantify, and address security risks associated with an application or system during the design phase. It involves decomposing the system, identifying potential threats using frameworks like STRIDE, and determining appropriate mitigations to reduce risk.
A Trusted Execution Environment (TEE) is a secure area of a main processor that guarantees code and data loaded inside to be protected with respect to confidentiality and integrity. It provides an isolated environment that runs parallel to the main operating system to handle sensitive operations.
A Trusted Platform Module (TPM) is a specialized chip on an endpoint device that stores cryptographic keys and provides hardware-based security functions. It is used for secure boot processes, disk encryption, and verifying the integrity of the system's boot state.
User and Entity Behavior Analytics (UEBA) is a security process that uses machine learning and algorithms to track patterns of behavior for users and devices. By establishing a baseline of normal activity, UEBA can detect anomalies that may indicate a compromised account or insider threat.
Zero Knowledge Proof (ZKP) is a cryptographic method that allows one party to prove to another party that they possess a specific piece of information without revealing the information itself. This enhances privacy by eliminating the need to transmit passwords or sensitive secrets.
Zero Trust Architecture (ZTA) is a security framework based on the principle of "never trust, always verify." It requires strict identity verification for every person and device attempting to access resources on a private network, regardless of whether they are sitting within or outside the network perimeter.
We're adding new exams every week. Let us know what you're studying for, and we'll bump it up our priority list! (Typical turnaround: 2-3 days)
Your feedback has been submitted successfully. We appreciate your help in making Cert Sensei better!