Abbreviations Flashcards
AES
Cryptography
Advanced Encryption Standard
AH
Authentication Header
Wireless Technology
ATIM
Announcement Traffic Indication Messages
ALE
Annual Loss Expectancy
SLE times ARO
SLE times ARO
APT
Advanced Persistant Threat
ARO
GRC
Annual rate of Occurance
number of times a loss can occur within an year
ARP
Address Resolution Protocol
C2
Command to Control
CASB
Cloud Access Security Broker
CCM
Cloud Controls Matrix
CSA CCM - Cloud Security Aliance CCM - to assess the security posture of an organisation
CCMP
Cipher Block Chaining Message Authentication Code Protocol
Counter Mode Cipher Block Chaining Message Authentication Code Protocol (Counter Mode CBC-MAC Protocol) or CCM mode Protocol (CCMP)
CER
Cross Error Rate
used to determine the effectiveness of a control
CHAP
Challenge Handshake Authentication Protocol
CIS-RAM
Center for Internet Security - Risk Assessment Method
to evaluate the overall security posture
CRL
issued by Certificate Authority(CA)
Certificate Revocation List
CSF
Cybersecurity Framework
NIST CSF - security policy to assess and improve the ability to prevent, detect and respond to cybersecurity attacks
CVE
Common Vulnerabilities and Exposures
CVSS
Common Vulnerability Scoring System
DDoS
Distributed Denial of Service
DES
Data Encryption Standard
DLP
Data Loss Prevention
DNS
Domain Name System
EAP
Extensible Authentication Protocol
802.1x - allows multiple authentication methods to permit users access LAN &WLAN
EAP-AKA
EAP Authentication and Key Agreement
EAP-EKE
EAP Encrypted Key Exchange
EAP-FAST
EAP Flexible Authentication via Secure Tunneling
Cisco Proprietory - designed to replace LEAP
EAP-GTC
EAP Generic Token Card
EAP-IKEv2
EAP Internet Key Exchange v2
EAP-NOOB
Nible out-of-band Authentication for EAP
EAP-PSK
EAP Pre-Shared Key
EAP-SIM
EAP Subscriber Identity Module
EAP-TLS
EAP Transport Layer Security
EAP-TTLS
EAP Tunneled Transport Layer Security
ECDHE
Elliptic Curve Diffie-Hellman Ephemeral
EF
Exposure Factor
This is the percentage of the asset value that would be lost as a result of a threat. This is used to calculate SLE. SLE = Asset Value X EF
ESP
Encapsulation Security Payload
FAR
False Acceptance Rate
FRR
False Rejection Rate
FTPES
Explicit FTP over SSL
FTPS
FTP over SSL
GDPR
General Data Protection Regulation
Regulation in EU
GRC
Governance, risk and compliance
HIPAA
Health Insurence Portability & Accountability Act
HIPS
Host based Intrusion Prevention System
HMAC
Hash-based message authentication code
HOTP
HMAC-Based One-Time Password Algorithm
HPKP
HTTP Public Key Pinning
an obsolete Internet security mechanism delivered via an HTTP header
HSM
Hardware Security Module
HVAC
Heating, Ventilation & Air Conditioning
IA
Information Assurance
IaaS
Infrastructure as a Service
IAM
Identity & Access Management
ICMP
Internet Control Message Protocol
Supporting protocol in the Internet protocol suite.
It is used by network devices, including routers, to send error messages and operational information
ICV
Integrity Check Value
IDS
Intrusion Detection System
IPS
Intrusion Prevention System
ISFW
Internal Segmentation Firewall
LEAP
Lightweight EAP
MDA
Message Digest Algorithm
Also known as md5
The MD5 hashing algorithm is a one-way cryptographic function that accepts a message of any length as input and returns as output a fixed-length digest value to be used for authenticating the original message.
MitM
Man-in-the-Middle
MoU
Done before any engagement.
Memorandum of Understanding
used during the priliminary discussions stage between two merging/parterning businesses
MTBF
Mean Time Between Failures
provides a measure of a system’s average reliability and is measured in hours. This is used to measure for repairable assets
MTTF
Mean Time To Failure
used to measure the non-repairable assets
MTTR
Mean Time To Recover
is the average time it takes to restore a system after an outage.
NFC
Near Field Communication
NFC doesn’t provide encryption, so eavesdropping and MitM attacks are possible.
NGFW
Next Generation Firewall
NIST
National Institute of Standards & Technology
OCSP
It is an Internet Protocol (IP) that certificate authorities (CAs) use to determine the status of secure sockets layer/transport layer security (SSL/TLS) certificates
Online Certificate Status Protocol
OIDC
an authenticaiton protocol
Open ID Connect
is an authentication protocol, providing authenticaiton for federated applications
OSINT
Open Source Intelligence
PaaS
Platform as a Service
PAP
It is a basic authenticaiton mechanism.
Password Authentication Protocol
an unsophisticated authentication method used as the basic authentication mechanism in HTTP. It relies on clear-text password exchange.
PAT
in layer 3
Port Address Translation
Similar to NAT
PCI-DSS
GRC
Payment Card Industry Data Security Standard
PEAP
Protected EAP
PFS
Cryptography
Perfect Forward Secrecy
PII
GRC
Personally Identifiable Information
POP3
PostOffice Protocol V3
PPP
Point-to-Point Protocol
PUP
Potentially Unwanted Program
QoS
Quality of Service
802.1p
RADIUS
Remote Authentication Dial Up
used primarily for network access control
RASP
Security mechanism
Runtime Application Self Protection
RBAC
Technical Control
Role Based Access Control
RCE
Remote Code Execution
RoR
Rate of Return
RPO
Recovery Point Objective
identifies a point in time that data loss is acceptable. In the event of a system failure, the company may lose some data, but the RPO is the last seven days.
RRset
Resource Records set
RSA
Cryptography
Rivest, Shamir, Adleman
Widely used, but it’s no more secure
RTO
GRC
Recovery Time Objective
identifies the maximum time it takes to recover a system in the event of an outage. for example Eight hours to restore represent the RTO.
RTP
Real-time Transport Protocol
S/MIME
Secure Multipart Internet Message Extensions
to sign & encrypt mail messages using an email certificate
SaaS
Software as a Service
SECaas
Security as a Service
SED
Cryptography
Self Encrypting Drive
SFTP
Secure Shell FTP
In Cryptography
SHA
Secure Hash Algorithm
SHA & salt are part of key stretching process
SIP
Session Initiation Protocol
SLE
GRC
Single Loss Expectancy
cost of any single item loss. SLE = AV X EF
SOAR
Security Orchestration, Automation & Response
SoC
System on a Chip
SOC
Security Operations Center
SRTP
Secure RTP
Used for Video and VOIP calls
SSO
Single Sign-On
SSRF
Server Side Request Forgery
SWG
Secure Web Gateway
TACACS+
Terminal Access Controller Access-Control System Plus
specifically designed for network administration of routers. TACACS+ performs authentication, authorization, and accounting functions better than RADIUS
TEAP
Tunnel Extensible Authentication Protocol
TLS
Transport Layer Security
TOTP
Time based One Time Password Algorithm
TPM
Trusted Platform Module
TTP
Tactics, Techniques & Procedures
UBA
User Behaviour Analytics
UTM
Unified Threat Management
WAP
Wireless Application Protocol
WAS
Web Application Security
XSS
Cross-Site Scripting
ZTNA
Zero Trust Network Access
PMK
Cryptography
Pairwise Master Key
BSS
Basic Service Set
IBSS
Independent BSS