Registered Information Security Specialist Examination — knowledge map
The 75 core concepts of Registered Information Security Specialist Examination and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (75)
Malware
A collective term for malicious software created to harm users, including viruses, worms, trojan horses, and ransomware. Infection routes are varied, including email attachments, visiting malicious sites, and USB drives.
Related: Ransomware
Digital signature
A technology that uses public-key cryptography to prove both that an electronic document was created by the claimed author (authenticity) and that the document has not been tampered with (integrity).
Targeted attack
An attack that aims at a specific organization or individual, for example through a targeted attack email disguised as being related to the recipient's work, in order to steal confidential information or damage systems — unlike scattershot attacks aimed at an unspecified large number of targets.
Tamper resistance
The ability of an IC card or security chip (such as a TPM) to protect internal secrets (keys, etc.) against attempts at physical disassembly, observation, or alteration. It is an implementation property that makes reading out information or tampering difficult against side-channel and physical attacks.
Related: Side-channel attack
Risk assessment
The process of identifying, analyzing, and evaluating risk by surveying the threats and vulnerabilities affecting information assets. It quantifies risk magnitude (likelihood times impact) as the basis for subsequent risk treatment decisions, forming the core of the Plan phase in the ISMS PDCA cycle.
Related: Risk treatment (reduction, avoidance, transfer, acceptance)、Information asset
OIDC federation (CI/CD)
A mechanism for external CI (e.g., GitHub Actions) to assume an AWS role without long-lived access keys. Register an OIDC identity provider in IAM, scope the trust policy by sub (repo/branch), and obtain temporary credentials via AssumeRoleWithWebIdentity—keyless and secure.
Prerequisites: Identity provider (IdP)
Sender domain authentication (SPF/DKIM/DMARC)
The three pillars of sender domain authentication. SPF lists which IPs may send for a domain; DKIM cryptographically signs mail to prove it's unaltered and from the claimed source; DMARC declares a policy (quarantine/reject) based on SPF/DKIM results plus where to send reports. Set via TXT records to fight spoofing/phishing, and it strongly affects spam filtering on the receiving side, including Google Workspace.
Prerequisites: Digital signature、Phishing
CSIRT
An organizational team dedicated to responding to computer security incidents. It handles detection, analysis, response, and prevention of recurrence, and often coordinates with external CSIRTs and related agencies.
Identity provider (IdP)
A corporate auth platform (Entra ID, Okta, etc.) that handles authentication via SAML SSO and, combined with SCIM/team sync, centrally manages accounts and groups.
Prerequisites: SAML SSO (single sign-on)
Act on the Protection of Personal Information
A law that requires businesses handling information that can identify a specific individual, such as name and date of birth, to specify the purpose of use, acquire data appropriately, implement safety-management measures, and restrict third-party disclosure without the individual's consent.
Phishing
A fraud technique that lures victims to fake emails or websites impersonating real companies or financial institutions, in order to steal IDs, passwords, or credit card information. Carefully checking the URL and domain is a basic countermeasure.
IPsec
A protocol suite that encrypts and authenticates traffic at the IP packet level, used to encrypt the path in site-to-site VPNs (on-prem to a cloud VNet/VPC). The tunnel won't establish unless both ends agree on encryption, integrity, and key-exchange settings.
Business email compromise (BEC)
A scam technique in which an attacker impersonates a business partner or executive by email to trick the target into wiring money to a fraudulent account or disclosing confidential information. Unlike malware-based attacks, it exploits gaps in business processes and manufactured urgency, similar to phishing but narrowly targeted. Requiring multi-person approval and phone verification when changing payment details is a common countermeasure.
Information asset
Information that has value to an organization and is subject to risk assessment, together with the systems that handle it. It covers not only the data itself — such as customer records or design documents — but also the equipment (servers, PCs) that stores or processes it, and related business processes. Building an inventory and rating importance (confidentiality, integrity, availability) is the starting point of asset management.
Related: Risk assessment
Risk treatment (reduction, avoidance, transfer, acceptance)
Four response strategies chosen based on risk assessment results. Reduction lowers likelihood or impact through controls; avoidance stops the activity causing the risk; transfer shifts the risk to a third party via insurance or outsourcing; acceptance tolerates the risk without further action when it falls within an acceptable range. The choice balances cost against effect.
Related: Risk assessment
Availability rate
The proportion of time a system operates correctly. Availability = MTBF ÷ (MTBF + MTTR); it rises as time-between-failures grows and repair time shrinks. A core availability metric, also used as an agreed SLA target (e.g., 99.9%).
Prerequisites: MTBF (mean time between failures)
Role-based access control (RBAC)
Authorization that grants permissions by assigning roles to identities at a scope; least privilege, inherited downward.
Security testing (SAST/DAST/SCA)
Vulnerability checks embedded in the pipeline. SAST = static source analysis, DAST = dynamic analysis of a running app, SCA (dependency scanning) = known OSS vulnerabilities, IaC/container image scanning = misconfig/image vulns. Place don’t-run checks left (early), dynamic checks right (post-deploy).
SQL injection
An attack technique that injects malicious SQL fragments into a web application's input fields to manipulate or view a database in unintended ways. It is prevented by using bind variables (placeholders) and validating input values.
SAML SSO (single sign-on)
Members authenticate at the IdP (Entra ID, Okta, etc.) before accessing GitHub. It handles authentication and lets you cut departed users centrally; auto-removal of accounts is SCIM’s job, not SAML alone.
CVSS (severity)
Common Vulnerability Scoring System—a standard scoring vulnerability severity. For prioritization, combine with EPSS (exploit probability), reachability, and asset criticality.
CWE
Common Weakness Enumeration—a classification of weakness "types" like SQL injection or buffer overflow (e.g., CWE-89). CVE is an "instance," CWE a "type."
Prerequisites: SQL injection
Internal control
The mechanisms and structures a company builds into its own business processes so that operations are carried out appropriately and efficiently. It aims to prevent fraud and ensure reliable financial reporting, and responsibility for establishing and operating it rests with management.
MTBF (mean time between failures)
For a repairable system, the average operating time from one failure to the next. A larger value means fewer failures and higher reliability. Computed as total operating time ÷ number of failures.
AH (Authentication Header)
One of the protocols composing IPsec; it provides integrity and source authentication for IP packets but does not encrypt (no confidentiality). Because it also authenticates the IP header, it conflicts with NAT, which rewrites addresses in transit; use ESP when confidentiality is required.
Prerequisites: IPsec
Botnet
A network of many devices infected with malware (bots) that are controlled together under the command of a C&C server. It is abused as a platform for DDoS attacks, spam distribution, and data theft; infected devices await commands via connect-back communication.
Prerequisites: Malware
Common Criteria (ISO/IEC 15408)
An international standard for evaluating the security functions of IT products, expressing the rigor of evaluation with an Evaluation Assurance Level (EAL). In Japan, JISEC operates as a third-party certification scheme based on this standard, objectively evaluating and certifying security functions including tamper resistance of products such as IC cards.
Prerequisites: Tamper resistance
Cyber kill chain
A model that organizes the stages of a targeted attack as reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives. It is used to consider effective defenses at each stage and analyze where the attack chain can be broken.
Prerequisites: Targeted attack
Fileless malware
Malware that leaves no executable file on disk and instead loads and runs code in the memory of legitimate system tools such as PowerShell or WMI. It evades signature-based (file hash/pattern) detection, so behavior-based monitoring is effective against it.
Prerequisites: Malware
IAST (Interactive Application Security Testing)
A method that detects vulnerabilities while measuring internal behavior (data flow and actually reached code paths) during application execution. Positioned between SAST (static code inspection) and DAST (external dynamic testing), it combines the strengths of both.
Prerequisites: Security testing (SAST/DAST/SCA)
PFS (Perfect Forward Secrecy)
The property that even if a long-term private key (such as a server certificate key) is later compromised, previously recorded encrypted traffic cannot be decrypted. It is achieved by agreeing session keys with ephemeral per-session keys such as DHE/ECDHE, and is satisfied by default in TLS 1.3.
Related: DHE / ECDHE (ephemeral key exchange)
Rainbow table attack
An attack that uses a precomputed table mapping plaintexts to hash values to quickly reverse a hash back to the original password. Hashing each password with a distinct salt invalidates such precomputed tables.
Side-channel attack
An attack that infers secrets such as keys by observing physical side information (timing, power consumption, electromagnetic emissions, sound) rather than a theoretical weakness of the cryptography itself. Tamper-resistant implementations suppress such side-information leakage.
Related: Tamper resistance
S/MIME
A standard that protects email bodies and attachments with public-key encryption and digital signatures. Encryption provides confidentiality, while signatures provide sender authenticity and tamper detection (integrity); its use requires PKI certificates.
EDR (Endpoint Detection and Response)
A mechanism that continuously monitors and records behavior on endpoints such as PCs and servers, detecting suspicious post-intrusion activity (process launches, network connections, file changes) and enabling isolation or investigation. Whereas antivirus is an entry-point control that detects known patterns, EDR assumes intrusion will happen and provides after-the-fact response and visibility.
Prerequisites: Layered defense (entry, internal, and exit controls)
Insider threat
Deliberate misconduct by someone inside the organization — an employee or contractor — who abuses legitimate access to exfiltrate or tamper with information or disrupt systems. It is harder to detect than external attacks and is often explained by the fraud triangle: motive (grievance, money), opportunity (excessive privilege), and rationalization. Access-log monitoring and separation of duties are the main countermeasures.
JPCERT/CC
A general incorporated association that accepts incident reports, supports response, and issues alerts for computer security incidents in Japan. As a neutral coordinating body independent of any specific government agency or company, it also serves as a hub for information sharing among CSIRTs at home and abroad.
Prerequisites: CSIRT
JVN (Japan Vulnerability Notes)
A portal jointly operated by JPCERT/CC and IPA that publishes vulnerability information and countermeasures for software used in Japan. Entries note the corresponding CVE ID and severity (CVSS) and serve as a primary reference for vulnerability response.
Prerequisites: CVSS (severity)、JPCERT/CC
Penetration testing
A test that attempts to break into a system using the same techniques and perspective as a real attacker, demonstrating that a discovered vulnerability is actually exploitable and how far the resulting damage could spread. Unlike vulnerability assessment, which exhaustively lists weaknesses, it digs deep into a specific attack path.
Related: Vulnerability assessment
Ransomware
Malware that encrypts files on an infected PC or server, rendering them unusable, and demands payment in exchange for decryption. In recent years, the dominant tactic is "double extortion" — threatening to leak exfiltrated data in addition to withholding the decryption key. Taking backups and keeping them isolated (offline) is an effective countermeasure.
Related: Malware
Residual risk
The risk that remains after risk treatment (reduction, avoidance, transfer) has been applied. Because risk can never be reduced to zero, management must judge whether the remaining level is acceptable and formally approve accepting it.
Prerequisites: Risk treatment (reduction, avoidance, transfer, acceptance)
Vulnerability assessment
A service or activity in which tools or specialists inspect web applications, network devices, or servers for known vulnerabilities. Its purpose differs from penetration testing — which tries to actually break in — in that vulnerability assessment aims to exhaustively list known weaknesses.
Related: Penetration testing
Hybrid cryptography
A scheme that combines the processing speed of symmetric-key cryptography with the secure key distribution of public-key cryptography. The data itself is encrypted with a symmetric key, and that symmetric key is then encrypted with the recipient's public key before being sent. Used in S/MIME, PGP, and TLS 1.2 and earlier (note that current TLS 1.3 uses (EC)DHE key exchange and no longer sends a symmetric key encrypted under a public key).
Prerequisites: Symmetric-key cryptography、S/MIME
DHCP
A protocol that automatically assigns the network settings a device needs — including an IP address — when it connects to the network, saving an administrator the trouble of manually configuring an IP address on every device.
ISMS (Information Security Management System)
A systematic management framework an organization operates to appropriately protect its information assets, spanning policy formulation, risk assessment, implementing countermeasures, and review (PDCA). A certification scheme based on the international standard ISO/IEC 27001 exists.
Prerequisites: Information asset、Risk assessment
MTTR (mean time to repair)
The average time from a failure until recovery. A smaller value means faster recovery and better maintainability. Computed as total repair time ÷ number of failures; it is part of the denominator in availability = MTBF ÷ (MTBF + MTTR), assessed together with MTBF (mean time between failures) for reliability and maintainability.
Prerequisites: Availability rate、MTBF (mean time between failures)
Code signing
Applying a digital signature to software or an installer so that users can verify the publisher's authenticity and that the file has not been tampered with after distribution. The signer signs the hash with their private key, and users verify it with the signer's public key (certificate).
Prerequisites: Digital signature
DHCP snooping
A switch feature that classifies ports as trusted (connected to a legitimate DHCP server) or untrusted (general endpoints) and discards DHCP server replies (OFFER/ACK) arriving on untrusted ports, preventing a rogue DHCP server from distributing a fake gateway (a man-in-the-middle attack).
Prerequisites: DHCP
DHE / ECDHE (ephemeral key exchange)
Performing Diffie-Hellman key exchange with an ephemeral key pair per session (ECDHE is the elliptic-curve variant). Because the long-term key is not used for key agreement, it achieves forward secrecy (PFS); it replaces static RSA key exchange as the basis of TLS 1.3.
Related: PFS (Perfect Forward Secrecy)
HMAC (keyed-hash message authentication code)
A scheme that generates a message authentication code (MAC) by combining a shared secret key with a hash function. The receiver recomputes it with the same key to verify integrity and that the message came from a party holding the key, providing integrity and authenticity without a public-key infrastructure.
Prerequisites: Hash function (tamper detection)
OAuth (authorization framework)
An "authorization" framework that delegates, as an access token, the permission for a third-party app to access resources on a user's behalf without handing over the password. Note it is not itself an authentication (identity-verification) mechanism; OpenID Connect layers authentication on top.
Prerequisites: OIDC federation (CI/CD)
RAT (Remote Access Trojan)
Malware with backdoor functionality that lets an attacker remotely control an infected host at will. After intrusion it is abused as a foothold for lateral movement to other internal hosts, data theft, or ransomware deployment.
Prerequisites: Malware、Ransomware
Salt and stretching
Hardening techniques for storing passwords as hashes. A salt appends a per-user random value to defeat rainbow-table attacks, and stretching (key stretching) repeats the hash computation many times to raise the cost of brute-force attacks.
Prerequisites: Rainbow table attack
Information security education and training
An ongoing effort that goes beyond drafting rules and regulations, using periodic group training, e-learning, and targeted-attack email drills to instill security awareness and behavior across all employees. It is central to the effectiveness of personnel-based controls, and keeping records of participation and measuring comprehension are key to preventing the program from becoming a formality.
Prerequisites: Targeted attack、Targeted-attack email drill
DLP (Data Loss Prevention)
A mechanism that monitors channels such as email, copying to USB drives, and uploads to cloud storage, detecting, warning about, or blocking the outbound movement of data matching patterns for confidential or personal information. It is used to prevent information leaks caused by insider misconduct or operator error.
Prerequisites: Insider threat
Statement of Applicability (SoA)
A document that specifies, for each control listed in Annex A of ISO/IEC 27001, whether it is applied or excluded in the organization and the rationale for that decision. It is drawn up based on risk assessment results and is a central artifact examined during ISMS certification audits.
Prerequisites: Risk assessment
Supply chain attack
An attack technique that infiltrates a target not directly but via a business partner, subcontractor, or the supplier of software/libraries it uses, where security is weaker. Typical examples include unauthorized access through a subcontractor or malware inserted into a software update. Assuring subcontractors' security levels through contracts and audits is a key countermeasure.
Prerequisites: Malware
Targeted-attack email drill
A training exercise in which employees are sent simulated targeted-attack emails that mimic real attacks, measuring open and click rates to raise awareness and reinforce response procedures. Results are aggregated to provide additional training for employees who opened the email and to reinforce the procedure for reporting suspicious mail.
Prerequisites: Targeted attack
Container virtualization
A lightweight virtualization approach in which multiple application runtime environments (containers) share the host OS kernel, with processes and file systems isolated via namespaces. Compared with hypervisor-based virtualization (which runs a full guest OS), it starts faster and has less overhead, but it depends on the host kernel, so it cannot run a kernel of a different OS type. Docker is a representative implementation.
Prerequisites: Virtualization
Hash function (tamper detection)
A function that computes a fixed-length value (a hash value) from data of arbitrary length. The same input always produces the same output, and even a tiny change drastically alters the value, which is why hash functions are used for tamper detection and password storage.
IKE policy
The Internet Key Exchange settings that define how an IPsec tunnel exchanges keys—encryption algorithm, hash, Diffie–Hellman group, and SA lifetime—must match on both the on-prem device and the cloud-side VPN gateway.
Prerequisites: IPsec
Segregation of duties
A basic internal-control principle that prevents fraud and error by dividing a sequence of duties — such as approval, execution, recording, and custody — among multiple people rather than concentrating them in one person.
Prerequisites: Internal control
Symmetric-key cryptography
An encryption method that uses the same key (a shared secret key) for both encryption and decryption. Processing is fast, but the key must be shared securely with each communication partner, making key management increasingly complex as the number of partners grows.
Virtualization
Technology that uses software to create multiple virtual computers (virtual machines) on a single physical computer (server virtualization); storage, network, and desktop resources can likewise be virtualized. It allows hardware resources to be used efficiently and enables consolidation and flexible reconfiguration.
Elliptic Curve Cryptography (ECC)
Public-key cryptography whose security rests on the hardness of the discrete logarithm problem over elliptic curves. It achieves strength equivalent to RSA with a shorter key length, so it is used where processing load or key size is constrained; it appears as ECDSA for signatures and ECDHE for key exchange.
Prerequisites: DHE / ECDHE (ephemeral key exchange)
TPM (Trusted Platform Module)
A tamper-resistant dedicated hardware chip that generates and stores cryptographic keys and records boot-configuration measurements into PCRs (platform configuration registers) to verify integrity (measured boot). It protects keys in isolation from software and is used for tasks such as disk-encryption key management.
Prerequisites: Tamper resistance
WebAuthn (passwordless authentication)
A W3C-standardized web authentication API for passwordless login based on public-key cryptography, part of FIDO2. An authenticator (biometric sensor or security key) holds the private key and only the public key is registered with the server, making it resistant to phishing and password leakage.
Prerequisites: Phishing
Pseudonymized information and anonymized information
Both are processing categories under the Act on the Protection of Personal Information, but they serve different purposes. Pseudonymized information is processed so the individual cannot be identified unless cross-referenced with other data; it is intended for internal analytical use, with some relaxed restrictions on using it for other purposes without consent, but third-party provision is generally prohibited. Anonymized information is processed so the individual cannot be identified and the data cannot be restored, allowing it to be provided to third parties without consent.
Prerequisites: Act on the Protection of Personal Information
CSIRT operations and SOC
While the CSIRT is the command center for incident response, the SOC (Security Operation Center) is the operational team that monitors logs and alerts around the clock to detect threats and perform initial analysis. Smaller organizations often outsource this monitoring to an MSSP (managed security service provider) rather than building it in-house.
Prerequisites: CSIRT
Act on Electronic Signatures and Certification Business
A law providing that an electronic record bearing an electronic signature meeting certain requirements (able to be created only by the signer, allowing detection of alteration, etc.) is presumed to have been created authentically. It is the legal basis for electronic contracts carrying the same legal effect as paper contracts.
Prerequisites: Digital signature
Principle of least privilege and RBAC
The principle of least privilege grants users only the minimum access needed for their duties; RBAC (role-based access control) implements it by assigning permissions to job roles rather than to individuals. This makes it easier to review access on transfer or departure and limits the risk of over-provisioned privileges.
Prerequisites: Role-based access control (RBAC)
Layered defense (entry, internal, and exit controls)
A design philosophy premised on the idea that intrusion can never be prevented with 100% certainty, combining entry controls (firewalls/WAF to block intrusion itself), internal controls (privilege management and EDR to contain damage after intrusion), and exit controls (DLP and proxies to stop data exfiltration) in multiple layers, avoiding over-reliance on any single measure.
Special care-required personal information
A category under the Act on the Protection of Personal Information covering data such as race, creed, medical history, and criminal record, which requires especially careful handling to prevent unjust discrimination or prejudice against the individual. Acquiring it generally requires the individual's consent, and it is subject to stricter protection than ordinary personal information.
Prerequisites: Act on the Protection of Personal Information
Vendor (outsourcing) management
The practice of confirming and managing, through contracts (NDAs, SLAs), pre-selection evaluation, and periodic audits, that an outsourcing partner maintains a security level equal to or better than the commissioning organization's own, when business operations or system development/operation are outsourced. It aims to prevent information leaks or supply chain attacks originating from the vendor.
Prerequisites: Supply chain attack