D320 Study Guide

Key Terms

Business Impact Analysis (BIA) – Determine the value of the assets that are protected to know how
much time, money, and effort to expend to protect them.

SPOF – Single Point of Failure

Quantitative – Risk assessment that uses specific numerical values

Qualitative – Risk assessment that uses nonnumerical categories that are relative in nature, such as
high, medium, and low.

Risk appetite – level, amount, or type of risk that the organization finds acceptable

Residual risk – The leftover risk left after applying countermeasures and controls

IAAS – Cloud customer has the most responsibility and authority. Cloud provider is only liable for the
underlying hardware.

PAAS – Cloud customer still loses more control because the cloud provider is responsible for installing,
maintaining, and administering the OS as well as underlying hardware.

SAAS – Cloud customer loses all control of the environment. Cloud provider is responsible for all of the
underlying hardware and software.

Homomorphic encryption – The process of processing data in the cloud while it’s encrypted (without
having to decrypt), never exposing it temporarily other than authorized users

Defense in depth – practice of having multiple overlapping means of securing an environment with a
variety of methods. Includes a blend of administrative, logical, technical, and physical controls.

Data owner – organization that has collected or created the data

Data custodian – person or entity that is tasked with the daily maintenance and administration of the
data

Data processor – Anything that can be done to data: copying it, printing it, destroying it, utilizing it

Data discovery – term that can be used to refer to several kinds of tasks; it might mean the organization
is attempting to create an initial inventory of data or that the organization is involved in electronic
discovery (e-discovery, legal terms of collecting electronic data as part of a lawsuit or investigation)

Label-based discovery – labels created by the data owner greatly aid any discovery

Metadata-based discovery – data about data, metadata is a listing of traits and characteristics about
specific data elements and sets.
Content-based discovery – discovery tools can be used to discover data by delving into the content of
datasets without labels or metadata assigned.

Structured data – data that is sorted according to meaningful, discrete types and attributes.

Unstructured data – content of various emails in a user’s sent folder

IRM (Information Rights Management) – the use of specific controls that act in concert with or in
addition to the organization’s other access control mechanisms to protect certain types of assets,
usually at the file level

Copyright – the legal protection for expressions of ideas (does not cover ideas, specific words, slogans,
recipes, or formulae

DMCA (Digital Millennium Copyright Act) – created to provide additional protections to creative works
in digital formats.

Trademarks – Applied to specific words and graphics (representation of an organization (it’s brand)).
Trademarks registered with the USPTO can use the ® symbol.

Patent – grants exclusivity in the production, sale, and importation of the patented property

PKI (Public Key Infrastructure) – a framework of programs, procedures, communication protocols, and
public key cryptography that enables a diverse group of individuals to communicate securely

File-based storage (File-level or File-based) – data stored and displayed just as with a file structure in
the traditional environment, as files and folders.

Block storage – a blank volume that the customer or user can put anything into. More flexible and
higher performance but requires a greater amount of administration.

Object-based storage – data stored as objects, not files or blocks. Includes metadata as well as the
actual production content.

CDN (Content Delivery Network) – form of data caching, for copies of data commonly requested by
users.

Transparent encryption – when the encryption key is stored on the same data store as the data
(database encryption key is stored in the database itself)

Randomization – replacement of data with random characters.

Hashing – using a one-way cryptographic function to create a digest of the original data

Shuffling – using different entries from within the same data set to represent the data.

Masking – hiding the data with useless characters

SIEM (Security Information and Event Management)

DLP (Data Leak Prevention) – tools used to monitor data egress that leaves production environment

Private Cloud – distributed computing environment with only one customer

Portability – the general level of ease or difficulty when transferring data out of a providers data center

Vendor Lock-In – when a provider uses proprietary data format or medium to store information and the
customer may not be able to move their data to another provider

Vendor Lock-Out – when the cloud provider goes out of business, is acquired by another company, or
ceases operation for any reason. The concern is whether the customer can still readily access and
recover their data

Hybrid Cloud – combination of two or more other models

Honeypot – tool used to detect, identify, isolate, and analyze attacks by distracting attackers (usually a
dummy machine with useless data)

Vulnerability Assessment – scan of the network in order to detect known vulnerabilities

Zero-Day Vulnerability – Unknown vulnerability that has yet been found and a patch released

SOC Report – part of the SSSAE reporting format created by the AICPA. Designed for compliance with
the Sarbanes-Oxley Act

ISO/IEC 27034-1 Standards for Secure Application Development - Provides an overview of application
security.

Organization Normative Framework (ONF) – framework for all components of application security
controls and best practices

Application Normative Frameworks (ANF) – subset of the ONF for each specific application.

Transport Layer Security (TLS) – Protocol designed to ensure privacy when communicating between
applications

Secure Socket Layer (SSL) – used to encrypt data transmissions between two endpoints. Deprecated in
2015 and replaced with TLS

Whole-Instance Encryption – whole-disk encryption

Volume Encryption – Only encrypts a partition on a hard drive instead of the whole disk

Cross-Site Scripting (XSS) – when an application allows untrusted data to be sent to a web browser
without proper validation or escaping

Injection – malicious user attempts to inject a string of some type into a field in order to manipulate the
application’s actions to reveal unauthorized data. SQL, LDAP, or OS injections

Cross-Site Request Forgery (CSRF) – manipulates a logged-on user’s browser to send a forged HTTP
request along with cookies to generate a request that a vulnerable application thinks is legitimate

White-Box Testing (Static Application Security Testing (SAST)) – reviewing the source code
Black-Box Testing (Dynamic Application Security Testing (DAST)) – testing the program functions, in
runtime.

API – used to allow other applications to consume web services from the application.

Nonrepudiation - no party to a transaction can later claim that they did not take part.

The American Institute of Certified Public Accountants (AICPA) - represents the accounting and audit
process

ISO 31000:2018 - is an international standard that focuses on designing, implementing, and reviewing
risk management processes and practices ions in the United States

NIST SP 800-37 is the Guide for Implementing the Risk Management Framework (RMF).

The CSA STAR program, initiated in 2011, was created in response to market demand for a single
consistent framework for evaluating cloud providers