Acronyms 2 Flashcards
Control Plane
used to achieve zero trust
includes adaptive identity, threat scope reduction and secured zones
Data Plane
subject/system, policy engine, policy admin, and enforcement point
ensures policies are properly executed
Threat
anything that could cause harm, loss damage or compromise to our info tech systems
Vulnerability
any weakness in system design
- Software bugs
● Misconfigured software
● Improperly protected network devices
● Missing security patches
● Lack of physical security
Risk Management
Finding different ways to minimize the likelihood of an outcome and achieve the
desired outcome
Confidentiality
Refers to the protection of information from unauthorized access and disclosure
■ Ensure that private or sensitive information is not available or disclosed to
unauthorized individuals, entities, or processes
reasons for it
-maintain a business advantage
- achieve compliance
- protect personal privacy
Ways to ensure confidentiality
data masking, physical security, training, encryption and access controls
Integrity
Helps ensure that information and data remain accurate and unchanged from its
original state unless intentionally modified by an authorized individuals
Hashing
checksums
digital signatures
access controls
regular audits
Availability
Ensure that information, systems, and resources are accessible and operational
when needed by authorized user
authentication
Security measure that ensures individuals or entities are who they claim to be
during a communication or transactio
Syslog Server
used to achiev accounting
it aggregates logs from various network devices
SIEM
Security Information and Event Management Systems
Provides us with a real-time analysis of security alerts generated by
various hardware and software infrastructure in an organization
Technical Controls
Technologies, hardware, and software mechanisms that are implemented
to manage and reduce risks
Managerial Controls
Sometimes also referred to as administrative controls
● Involve the strategic planning and governance side of security
Operational controls
Procedures and measures that are designed to protect data on a
day-to-day basis
● Are mainly governed by internal processes and human actions
Physical Controls
Tangible, real-world measures taken to protect assets
Preventative Controls
Proactive measures implemented to thwart potential security threats or
breaches
Deterrent Controls
Discourage potential attackers by making the effort seem less appealing or more challenging
Detective Control
Monitor and alert organizations to malicious activities as they occur or
Corrective Controls
Mitigate any potential damage and restore our systems to their normal state
Compensating Controls
Alternative measures that are implemented when primary security controls are not feasible or effective
Directive Controls
Guide, inform, or mandate actions
● Often rooted in policy or documentation and set the standards for
behavior within an organization
Gap Analysis
Process of evaluating the differences between an organization’s current
performance and its desired performance
Technical Gap Analysis
infrastructure
Business Gap Analysis
POA&M
plan of action and milestones
used in gap analysis
Outlines the specific measures to address each vulnerability
● Allocate resources
● Set up timelines for each remediation task that is neede
Zero Trust
demands verification for every device, user, and transaction within the
network, regardless of its origin
Adaptive Identity
Relies on real-time validation that takes into account the
user’s behavior, device, location, and more
Threat Scope Reduction
Limits the users’ access to only what they need for their
work tasks because this reduces the network’s potential
attack surface
Policy Driven Access Control
Entails developing, managing, and enforcing user access
policies based on their roles and responsibilities
Secured Zones
Isolated environments within a network that are designed
to house sensitive data
Policy Engine
Cross-references the access request with its predefined
policies
Policy Admin
Used to establish and manage the access policies
Policy Enforcement Point
Where the decision to grant or deny access is actually
execute
Unskilled Attackers
Limited technical expertise, use readily available tools
Hacktavist
Driven by political, social, or environmental ideologies
Organized Crime
Execute cyberattacks for financial gain (e.g., ransomware, identity theft)
Nation State Actor
Highly skilled attackers sponsored by governments for cyber espionage or
warfare
Insider Threat
Security threats originating from within the organization
Shadow IT
IT systems, devices, software, or services managed without explicit organizational
approval
Honeypot
Decoy systems to attract and deceive attackers
Honeynet
Network of decoy systems for observing complex attacks
Honeyfiles
Decoy files to detect unauthorized access or data breaches
Honeytoken
Fake data to alert administrators when accessed or used
Threat Actor Intent
Specific objective or goal that a threat actor is aiming to achieve through their attack-
Threat Actor Motivation
underlying reasons or driving forces that push threat actor to carry out attack
data exfiltration
Unauthorized transfer of data from a computer
Espionage
Spying on individuals, organizations, or nations to gather sensitive or
classified information
Script Kiddie
Individual with limited technical knowledge
Nation State Actor
Groups or individuals that are sponsored by a government to conduct cyber
operations against other nations, organizations, or individuals
False Flag Attack
Attack that is orchestrated in such a way that it appears to originate from a different source or group than the actual perpetrators, with the intent
to mislead investigators and attribute the attack to someone else
APT
Advanced Persistent Threat
Term that used to be used synonymously with a nation-state actor because of
their long-term persistence and stealth
-A prolonged and targeted cyberattack in which an intruder gains unauthorized
access to a network and remains undetected for an extended period while trying
to steal data or monitor network activities rather than cause immediate damage
Insider Threat
Cybersecurity threats that originate from within the organization
Threat Vector
Means or pathway by which an attacker can gain unauthorized access to a computer or network to deliver a malicious payload or carry out an unwanted
action
- the “how” of the attack
Ex. Message based threat vector
Attack Surface
Encompasses all the various points where an unauthorized user can try to enter
data to or extract data from an environment
-the “where” of the attack
Baiting
Leaving a malware-infected USB drive in a location where a target may find it
BlueBorne
Set of vulnerabilities in Bluetooth technology that can
allow an attacker to take over devices, spread malware, or
even establish an on-path attack to intercept communications without any user interaction
BlueSmack
Type of Denial of Service attack that targets Bluetooth-enabled devices by sending a specially crafted Logical Link Control and Adaptation Protocol packet to a
target device
TTPs
Tactics techniques and procedures of how a threat actor operates
Deception and Disruption Technologies
honeypots, bogus DNS entries, etc
Dynamic Page Generation purpose
Effective against automated scraping tools or bots trying to index or steal content from your organization’s website
Port Triggering
Security mechanism where specific services or ports on a network device remain closed until a specific outbound traffic pattern is detected
purpose of spoofing fake telemetry data
When a system detects a network scan is being attempted by an attacker, it can be configured to respond by sending out fake telemetry or network
data
Bollard
Robust, short vertical posts, typically made of steel or concrete, that are designed to manage or redirect vehicular traffic
Brute Force
Type of attack where access to a system is gained by simply trying all of the possibilities until you break through
Surveillance System
Organized strategy or setup designed to observe and report activities in a given
area. Can be as simple as a security guard.
PTZ System
Pan-Tilt-Zoom (PTZ) System
Infrared Sensors
Detect changes in infrared radiation that is often emitted
by warm bodies like humans or animal
Microwave Sensor
Detect movement in an area by emitting microwave pulses
and measuring their reflection off moving objects
Ultrasonic Sensors
Measures the reflection of ultrasonic waves off moving
objects
EMI
Electromagnetic Interference
Involves jamming the signals that surveillance system relies on to monitor the environment
Access Control Vestibule
Double-door system that is designed with two doors that are electronically
controlled to ensure that only one door can be open at a given time
Piggybacking
Involves two people working together with one person who has legitimate access intentionally allows another person who doesn’t have
proper authorization to enter a secure area with them
Tailgating
Occurs whenever an unauthorized person closely follows someone
through the access control vestibule who has legitimate access into the secure space without their knowledge or consent
NFC and RFID
RFID (Radio-Frequency Identification)
● NFC (Near-field Communication)
FAR
false acceptance rate
FRR
false rejection rate
CER
cross over error rate
Cipher Lock
■ Mechanical locks with numbered push buttons, requiring a correct combination
to open
■ Commonly used in high-security areas like server rooms
Social Engineering
Manipulative strategy exploiting human psychology for unauthorized access to
systems, data, or physical spaces
Impersonation
Pretending to be someone else
Pretexting
Creating a fabricated scenario to manipulate targets
Social Proof- Social engineering strategy
Psychological phenomenon where individuals look to the behaviors and actions of others to determine their own decisions or actions in similar
situations
Brand Impersonation
pretending to be Kohls on twitter
Typosquatting
Also known as URL hijacking or cybersquatting
Form of cyber attack where an attacker will register a domain name that is similar to a popular website but contain some kind of common typographical errors
Watering hole attack
Targeted form of cyber attack where attackers compromise a specific website or service that their target is known to use
Phishing
Sending fraudulent emails that appear to be from reputable sources with the aim of convincing individuals to reveal personal information, such as
passwords and credit card numbers
Spear Phishing
More targeted form of phishing that is used by cybercriminals who are
more tightly focused on a specific group of individuals or organizations
● Has a higher success rate
Whaling
Form of spear phishing that targets high-profile individuals, like CEOs or
CFOs
BEC
Business email compromise
Sophisticated type of phishing attack that usually targets businesses by
using one of their internal email accounts to get other employees to perform some kind of malicious actions on behalf of the attacke
Vishing
voice phishing
Smishing
SMS phishing
Anti-phishing campaign
part of security awareness training
Fraud
Wrongful or criminal deception that is intended to result in financial or personal
gain for the attacker
Identity Fraud
using someone else’s cc #
Identity Theaft
fully impersonating someone else
Scams
fraudulent or deceptive act or operation
Invoice Scam
In which a person is tricked into paying for a fake invoice for a
product or service that they did not actually order
Influence campaign
Coordinated efforts to affect public perception or behavior towards a particular
cause, individual, or group
Misinformation
False or inaccurate information shared without harmful intent
Disinformation
Involves the deliberate creation and sharing of false information with the intent to deceive or mislead
Diversion Theft
Involves manipulating a situation or creating a distraction to steal
valuable items or information
Hoax
Malicious deception that is often spread through social media, email, or
other communication channels
● Often paired with phishing attacks and impersonation attacks
Dumpster Diving
involves searching through trash to find valuable information
● Commonly used to find discarded documents containing personal or
corporate information
● Use clean desk and clean desktop policie
Malware
Malicious software designed to infiltrate computer systems and potentially damage them without user consent
Types of malware
Viruses
■ Worms
■ Trojans
■ Ransomware
■ Spyware
■ Rootkits
■ Spam
Viruses
Made up of malicious code that’s run on a machine without the user’s knowledge and this allows the code to infect the computer whenever it has been
run
Worms
standalone programs replicating and spreading to other computers without any user interaction
Trojans
Disguise as legitimate software, grant unauthorized access
Ransomeware
Encrypts user data, demands ransom for decryption
Boot sector virus
One that is stored in the first sector of a hard drive and is then loaded into memory whenever the computer boots up
Macro Virus
Form of code that allows a virus to be embedded inside another
document so that when that document is opened by the user, the virus is executed
Program Virus
Try to find executables or application files to infect with their malicious code
Multipartite Virus
Combination of a boot sector type virus and a program virus
Encrypted Virus
Designed to hide itself from being detected by encrypting its malicious code or payloads to avoid detection by any antivirus software
Polymorphic Virus
Advanced version of an encrypted virus, but instead of just encrypting the
contents it will actually change the viruses code each time it is executed by altering the decryption module in order for it to evade detection
Metamorphic Virus
Able to rewrite themselves entirely before it attempts to infect a given file
Stealth Virus
Technique used to prevent the virus from being detected by the anti-virus software
Armored Virus
Have a layer of protection to confuse a program or a person who’s trying to analyze it
RAT
Remote access trojan
Widely used by modern attackers because it provides the attacker with remote
control of a victim machine
Botnet
Network of compromised computers or devices controlled remotely by malicious
actor
Zombie
Name of a compromised computer or device that is part of a botnet
Command and control node
Computer responsible for managing and coordinating the activities of other nodes or devices within a network
DDoS
Occurs when many machines target a single victim and attack them at the
exact same time
Rootkit
Designed to gain administrative level control over a given computer system
without being detected
Ring 3
outermost ring where user level permissions are used
Ring 0
highest permission levels
Kernel Mode
located in ring 0
Allows a system to control access to things like device drivers, your sound card, your video display or monitor, and other similar things
DLL
dynamic link library
Collection of code and data that can be used by multiple programs
simultaneously
DLL Injection
Technique used to run arbitrary code within the address space of another process by forcing it to load a dynamic-link library
Shim
Piece of software code that is placed between two components and that
intercepts the calls between those components and can be used redirect them
Backdoor
Originally placed in computer programs to bypass the normal security and authentication functions
Remote Access Trojan (RAT) acts just like a backdoor in our modern networks
Easter Egg
a hidden feature or novelty within a program that is typically inserted by the software developers as an inside joke
Logic Bomb
Malicious code that’s inserted into a program, and the malicious code will only
execute when certain conditions have been met
Keylogger
Piece of software or hardware that records every single keystroke that is made
on a computer or mobile device
can be software or hardware keylogger
Spyware
Malicious software that is designed to gather and send information about a user
or organization without their knowledge
Bloatware
Any software that comes pre-installed on a new computer or smartphone that
you, as the user, did not specifically request, want, or need
Malware Exploitation Technique
Specific method by which malware code penetrates and infects a targeted system
Fileless Malware
is used to create a process in the system memory without
relying on the local file system of the infected hos
Fileless Malware Stage 1 Dropper or Downloader
Dropper - Specific malware type designed to initiate or run other malware forms within a payload on an infected host
Downloader - Retrieve additional tools post the initial infection facilitated by a dropper
Shellcode
Broader term that encompasses lightweight code meant to
execute an exploit on a given targe
Actions on Objectives Phase
Threat actors will execute primary objectives to meet core
objectives like
■ data exfiltration
■ file encryption
concealment
hiding tracks
■ erasing log files
■ hiding any evidence of malicious activity
Living off the Land
A strategy adopted by many Advanced Persistent Threats
and criminal organizations
■ the threat actors try to exploit the standard tools to
perform intrusions
Impossible Travel
Refers to a scenario where a user’s account is accessed from two or more
geographically separated locations in an impossibly short period of time
Data Protection
Safeguarding information from corruption, compromise, or loss
Data Sovereignty
Information subject to laws and governance structures within the nation it is
collected
DLP
data loss prevention
Data Classification
Based on the value to the organization and the sensitivity of the information,
determined by the data owner
Sensitive Data
Information that, if accessed by unauthorized persons, can result in the loss of
security or competitive advantage for a company
Commerical Public Data
No impact if released; often publicly accessible data
Commerical Sensitive Data
Minimal impact if released, e.g., financial data
Commerical Private Data
Contains internal personnel or salary information
Commerical Confidential Data
Holds trade secrets, intellectual property, source code, etc.
Commerical Critical Data
Extremely valuable and restricted information
Government Unclassified Data
Generally releasable to the public
Government Sensitive but unclassified data
Includes medical records, personnel files, etc.
Government confidential data
Contains information that could affect the government
Government Secret data
Holds data like military deployment plans, defensive postures
Government top secret data
Highest level, includes highly sensitive national security information
Data Ownership
Process of identifying the individual responsible for maintaining the
confidentiality, integrity, availability, and privacy of information assets
Data Owner
A senior executive responsible for labeling information assets and ensuring they are protected with appropriate controls
Data Controller
Entity responsible for determining data storage, collection, and usage purposes
and methods, as well as ensuring the legality of these processes
Data Processor
A group or individual hired by the data controller to assist with tasks like data
collection and processing
Data Steward
Focuses on data quality and metadata, ensuring data is appropriately labeled and
classified, often working under the data owner
Data Custodian
Responsible for managing the systems on which data assets are stored, including
enforcing access controls, encryption, and backup measures
Privacy Officer
Oversees privacy-related data, such as personally identifiable information (PII),
sensitive personal information (SPI), or protected health information (PHI),
ensuring compliance with legal and regulatory frameworks
Data at Rest
Data stored in databases, file systems, or storage systems, not actively moving
FDE
full disk encryption
Data in Transit
Data actively moving from one location to another, vulnerable to interception
SSL and TLS
Secure Sockets layer and Transport layer security. It secures and encrypts communciaion over networks
VPN
virtual private network
Creates secure connections over less secure networks like the
internet
IPSec
Secures IP communications by authenticating and encrypting IP
packets
Data in use
Data actively being created, retrieved, updated, or deleted
Regulated Data
Controlled by laws, regulations, or industry standards GDPR, HIPPA
PII
Personal Identification Information
PHI
Protected Health Information
Trade Secrets
Confidential business information giving a competitive edge (e.g., manufacturing
processes, marketing strategies, proprietary software)
IP
intellectual property
Creations of the mind (e.g., inventions, literary works, designs)
Human readable data
Understandable directly by humans (e.g., text documents, spreadsheets)
Non human readable data
Requires machine or software to interpret (e.g., binary code, machine language)
contains sensitive information that
Data Sovereignty
■ Digital information subject to laws of the country where it’s located
■ Gained importance with cloud computing’s global data storage
GDPR (General Data Protection Regulation)
Protects EU citizens’ data within EU and EEA borders
■ Compliance required regardless of data location
■ Non-compliance leads to significant fines
Geofencing
Virtual boundaries to restrict data access based on location
Hashing
■ Converts data into fixed-size hash values
■ Irreversible one-way function
■ Commonly used for password storage
Tokenization
Replace sensitive data with non-sensitive tokens. Original data stored securely in a separate database. Often used in payment processing for credit card protection
Obfuscation
Make data unclear or unintelligible
Segmentation
Divide network into separate segments with unique security controls
DLP
Data loss prevention
Aims to monitor data in use, in transit, or at rest to detect and prevent data theft
can be hardware or software
Types of DLP systems
endpoint DLP (installed on laptops)
Network DLP
Storage DLP
Cloud based DLP
Risk Identification
Proactive process recognizing potential risks
Risk Analysis
Evaluate likelihood and potential impact
Qualitative or quantitative methods
Risk Monitoring
Monitor residual risks, identify new risks, and review risk management
effectiveness
Risk Reporting
Communicate risk information and effectiveness of risk management to
stakeholders
● Various forms
○ Dashboards
○ Heat Maps
○ Detailed Reports
Qualitative Risk Analysis
Assess and prioritize risks based on likelihood and impact
Quantitative Risk Analysis
Numerically estimate probability and potential impact
Ad hoc risk assessment
Conducted as needed, often in response to specific events or situations
One time risk assessment
Conducted for specific projects or initiatives
BIA
Business Impact Analysis
Evaluates effects of disruptions on business functions
Identifies and prioritizes critical functions
Determines required recovery time for functions
RTO
recovery time objective
Maximum acceptable time before severe impact
RPO
Recovery point objective
Maximum acceptable data loss measured in time
MTTR
mean time to repair
MTBF
mean time between failures
Risk Reigster
Records identified risks, descriptions, impacts, likelihoods, and mitigation actions
Risk Impact
Low medium or high
Risk liklihood
probability of risk occurrence rated on a scale numerical or descriptive
Risk outcome
result if it occurs
Risk level or threshold
Determined by combining the impact and likelihood
Prioritizes risks (e.g., high, medium, low)
Risk Tolerance/Risk acceptance
An organization or individual’s willingness to deal with uncertainty in
pursuit of their goals
● Maximum amount of risk they are willing to accept
● Acceptance without countermeasures
Risk Appetite
Willingness to pursue or retain risk
expansionary, conservative etc
KRIs
key risk indicators
Risk Owner
Responsible for managing the risk
Monitors, implements mitigation actions, and updates Risk Register
EF
exposure factor
Proportion of asset lost in an event (0% to 100%)
SLE
single loss expectancy
Monetary value expected to be lost in a single event
Asset value x EF
ARO
annualized rate of occurence
ALE
Annualized Loss Expectancy (ALE))
SLE x ARO
Risk transference
Shifts risk to another party
Common methods
○ Insurance
○ Contract indemnity clauses
Contract Indemnity Clause
■ A contractual agreement where one party agrees to cover
the other’s harm, liability, or loss stemming from the
contract
Risk Acceptance
Acknowledge and deal with risk if it occurs
Exemption
(excludes party from a rule
Exception
(allows party to avoid rule under specific conditions)
Risk Avoidance
Change plans or strategies to eliminate a specific risk
Risk Mitigation
Take steps to reduce likelihood or impact of risk
● Common strategy involving various actions
Residual Monitoring
The likelihood and impact of the risk after mitigation,
transference, or acceptance measures have been taken on the initial risk
Control Risk
Assessment of how a security measure has lost effectiveness over time
Risk reporting
Communicating information about risk management activities to stakeholders
Third Party Vendor Risks
Potential security and operational challenges from external collaborators
MSP
managed service provider
Manage IT services on behalf of organizations
CHIPS Act of 2022
U.S. federal statute providing funding to boost semiconductor research and
manufacturing in the U.S.
■ Aims to reduce reliance on foreign-made semiconductors, strengthen the
domestic supply chain, and enhance security
Semiconductor
Essential components in a wide range of products, from smartphones and
cars to medical devices and defense systems
Vendor Assessment
■ Process to evaluate the security, reliability, and performance of external entities
■ Crucial due to interconnectivity and potential impact on multiple businesses
Vendors
provide goods or services
Suppliers
Involved in production and delivery of products or parts
Penetration Testing
Simulated cyberattacks to identify vulnerabilities in supplier systems
Right to Audit Clause
Contract provision allowing organizations to evaluate vendor’s internal processes
for compliance
Due dilligence
A rigorous evaluation that goes beyond surface-level credentials
● Includes the following
○ Evaluating financial stability
○ Operational history
○ Client testimonials
○ On-the-ground practices to ensure cultural alignmen
Vendor Questionnaires
Comprehensive documents filled out by potential vendors
Rules of Engagement
Guidelines for interaction between organization and vendors
Vendor Monitoring
Mechanism used to ensure that the chosen vendor still aligns with organizational
needs and standards
Feedback Loops
Involve a two-way communication channel where both the organization
and the vendor share feedback
