Acronyms Flashcards
AES
Advanced Encryption Standard
Annual Loss Expectancy (ALE) quantifies the potential annual financial loss to an asset due to risks or threats. It is calculated using the formula:
[ \text{ALE} = \text{SLE} \times \text{ARO} ]
Where:
SLE (Single Loss Expectancy): The expected monetary loss every time a risk event occurs.
ARO (Annual Rate of Occurrence): The expected number of times a risk event will occur in a year.
Purpose:
The ALE is used by organizations to:
Assess the potential financial impact of different security threats.
Prioritize risk management efforts based on the potential financial impact.
Make informed decisions about where to allocate resources for risk mitigation.
Application:
In practice, calculating the ALE helps organizations decide whether a security control is cost-effective. If the cost of a control is less than the ALE, it might be justified; if it’s more, the control might not be considered cost-effective.
Understanding and applying these concepts is fundamental for professionals preparing for the CompTIA Security+ certification, as it demonstrates a practical approach to managing and mitigating security risks in an organization.
3DES
Triple Data Encryption Standard
AAA
Authentication, Authorization, and Accounting
ABAC
Attribute-Based Access Control
ACL
Access Control List
AD
Active Directory
AES
Advanced Encryption Standard
AES256
Advanced Encryption Standard 256-bit
AH
Authentication Header
AI
Artificial Intelligence
AIS
Automated Indicator Sharing
ALE
Annualized Loss Expectancy -
Annual Loss Expectancy (ALE) quantifies the potential annual financial loss to an asset due to risks or threats. It is calculated using the formula:
[ \text{ALE} = \text{SLE} \times \text{ARO} ]
Where:
SLE (Single Loss Expectancy): The expected monetary loss every time a risk event occurs.
ARO (Annual Rate of Occurrence): The expected number of times a risk event will occur in a year.
Purpose:
The ALE is used by organizations to:
Assess the potential financial impact of different security threats.
Prioritize risk management efforts based on the potential financial impact.
Make informed decisions about where to allocate resources for risk mitigation.
Application:
In practice, calculating the ALE helps organizations decide whether a security control is cost-effective. If the cost of a control is less than the ALE, it might be justified; if it’s more, the control might not be considered cost-effective.
Understanding and applying these concepts is fundamental for professionals preparing for the CompTIA Security+ certification, as it demonstrates a practical approach to managing and mitigating security risks in an organization.
AP
Access Point
API
Application Programming Interface
APT
Advanced Persistent Threat
ARO
Annualized Rate of Occurrence
ARP
Address Resolution Protocol
ASLR
Address Space Layout Randomization
ASP
Active Server Pages
ATT&CK
Adversarial Tactics, Techniques, & Common Knowledge
AUP
Acceptable Use Policy
AV
Antivirus
BASH
Bourne Again Shell
BCP
Business Continuity Planning
BGP
Border Gateway Protocol
BIA
Business Impact Analysis
BIOS
Basic Input/Output System
BPA
Business Partnership Agreement
BPDU
Bridge Protocol Data Unit
BSSID
Basic Service Set Identifier
BYOD
Bring Your Own Device
CA
Certificate Authority
CAPTCHA
Completely Automated Public Turing Test to Tell Computers & Humans Apart
CAR
Corrective Action Report
CASB
Cloud Access Security Broker
CBC
Cipher Block Chaining
CBT
Computer-Based Training
CCMP
Counter-Mode/CBC-MAC Protocol
CCTV
Closed-Circuit Television
CERT
Computer Emergency Response Team
CFB
Cipher Feedback
CHAP
Challenge-Handshake Authentication Protocol
CIO
Chief Information Officer
CIRT
Computer Incident Response Team
CIS
Center for Internet Security
CMS
Content Management System
COOP
Continuity of Operation Planning
COPE
Corporate Owned Personal Enabled
CP
Contigency Planning
CRC
Cyclical Redundancy Check
CRL
Certificate Revocation List
CSO
Chief Security Officer
CSP
Cloud Service Provider
CSR
Certificate Signing Request
CSRF
Cross-Site Request Forgery
CSU
Channel Service Unit
CTM
Counter-Mode
CTO
Chief Technology Officer
CVE
Common Vulnerabilities and Exposures
CVSS
Common Vulnerability Scoring System
CYOD
Choose Your Own Device
DAC
Discretionary Access Control
DBA
Database Administrator
DDoS
Distributive Denial of Service
DEP
Data Execution Prevention
DER
Distinguished Encoding Rule
DES
Digital Encryption Standard
DHCP
Dynamic Host Configuration Protocol
DHE
Diffie-Hellman Ephemeral
DKIM
Domain Keys Identified Mail
DLL
Dynamic Link Library
DLP
Data Loss Prevention
DMARC
Domain Message Authentication Reporting and Conformance
DMZ
Demilitarized Zone
DNAT
Destination Network Address Transaction
DNS
Domain Name Service (Server)
DNSSEC
Domain Name System Security Extensions
DoS
Denial of Service
DPO
Data Privacy Officer
DRP
Disaster Recovery Plan
DSA
Digital Signature Algorithm
DSL
Digital Subscriber Line
EAP
Extensible Authentication Protocol
ECB
Electronic Code Book
ECC
Elliptic Curve Cryptography
ECDHE
Elliptic Curve Diffie-Hellman Ephemeral
ECDSA
Elliptic Curve Digital Signature Algorithm
EDR
Endpoint Detection and Response
EFS
Encrypted File System
EOL
End of Life
EOS
End of Service
ERP
Enterprise Resource Planning
ESN
Electronic Serial Number
ESP
Encapsulated Security Payload
FACL
File System Access Control List
FAAS
Function As a Service
FDE
Full Disk Encryption
FPGA
Field Programmable Gate Array
FRR
False Rejection Rate
FTP
File Transfer Protocol
FTPS
Secured File Transfer Protocol
GCM
Galois Counter Mode
GDPR
General Data Protection Regulation
GPG
Gnu Privacy Guard
GPO
Group Policy Object
GPS
Global Positioning System
GPU
Graphics Processing Unit
GRE
Generic Routing Encapsulation
HA
High Availability
HDD
Hard Disk Drive
HIDS
Host-Based Intrusion Detection System
HIPS
Host-Based Intrusion Prevention System
HMAC
Hashed Message Authentication Code
HOTP
HMAC based One Time Password
HSM
Hardware Security Module
HTML
HyperText Markup Language
HTTP
Hypertext Transfer Protocol
HTTPS
Hypertext Transfer Protocol over SSL/TLS
HVAC
Heating, Ventilation, Air Conditioning
IaaS
Infrastructure as a Service
ICMP
Internet Control Message Protocol
ICS
Industrial Control Systems
IDEA
International Data Encryption Algorithm
IDF
Intermediate Distribution Frame
IdP
Identity Provider
IDS
Intrusion Detection System
IEEE
Institute of Electrical and Electronics Engineers
IKE
Internet Key Exchange
IM
Instant Messaging
IMAP4
Internet Message Access Protocol v4
IoC
Indicators of Compromise
IoT
Internet of Things
IP
Internet Protocol
IPSec
Internet Protocol Security
IR
Incident Response
IRC
Internet Relay Chat
IRP
Incident Response Plan
ISO
International Organization for Standardization
ISP
Internet Service Provider
ISSO
Information Systems Security Officer
ITCP
IT Contingency Plan
IV
Initialization Vector
KDC
Key Distribution Center
KEK
Key Encryption Key
L2TP
Layer 2 Tunneling Protocol
LAN
Local Area Network
LDAP
Lightweight Directory Access Protocol
LEAP
Lightweight Extensible Authentication Protocol
MaaS
Monitoring as a Service
MAC
Mandatory Access Control
MAC
Media Access Control
MAC
Message Authentication Code
MAM
Mobile Application Management
MAN
Metropolitan Area Network
MBR
Master Boot Record
MD5
Message Digest 5
MDF
Main Distribution Frame
MDM
Mobile Device Management
MFA
Multifactor Authentication
MFD
Multi-Function Device
MFP
Multi-Function Printer
MITM
Man in the Middle
ML
Machine Learning
MMS
Multimedia Message Service