Deep Battle Cards A–D
Deep Card A — Vulnerability vs Threat vs Risk
Definition: Vulnerability = weakness/defect; Threat = potential adverse action/event; Risk = evaluated possibility of loss considering likelihood and impact/cost.
Purpose: move from a technical/process weakness to prioritized business response.
Inputs: weaknesses, threat conditions, likelihood, impact, asset sensitivity/value.
Output: prioritized risk + proportionate control/monitoring decision.
Scenario: unpatched function = vulnerability; attacker may exploit it = threat; probability × expected damage = risk.
Common confusion: treating any vulnerability as a complete risk assessment.
Exam trap: the “strongest” control is not automatically best; choose proportionate protection after risk assessment and legitimate-use needs.
Memory hook: Weakness → What might happen → What it could cost.
Deep Card B — Authentication vs Authorization vs Entitlement
Definition: Authentication verifies identity. Authorization grants permission. Entitlement is the complete data/capability scope opened by those grants.
Purpose: separate identity proof from permission and total effective exposure.
Scenario: employee login succeeds but role exposes executive salary data → Authentication is fine; Authorization/Entitlement is wrong.
Common confusion: assuming correct Authentication means access design is correct.
Exam trap: once identity is established, do not keep choosing Authentication for a permission problem.
Memory hook: Who → May do → Everything that opens.
Deep Card C — Confidentiality vs Regulation
Definition: Confidentiality = internally assigned need-to-know level. Regulation = external legal/contractual/industry allowed-to-know requirement.
Output: one highest confidentiality level + all applicable regulatory categories/actions.
Scenario: restricted pricing + PII + card data → one internal confidentiality level and multiple external categories.
Common confusion: treating regulation as a single highest level.
Exam trap: satisfying the strictest internal label does not erase other external obligations.
Memory hook: Confidentiality stacks upward; regulations stack together.
Deep Card D — Persistent vs Dynamic Masking
Definition: Persistent permanently alters values in the stored masked copy; Dynamic preserves underlying stored truth and changes the user-visible representation.
Scenario: test DB receives altered PII during extract → Persistent; call-center display shows ****1234 while source remains full → Dynamic.
Common confusion: assuming all masking changes source storage.
Exam trap: encryption and masking are not automatic synonyms.
Memory hook: Persistent changes the copy; Dynamic changes the view.
Source boundary: DAMA-DMBOK2 Revised, Chapter 7; controlling details in the risk, access, restriction, and masking sections.