Acronyms & Terms Flashcards
1
Q
CRL
A
Certificate Revocation List
2
Q
RTO
A
Recovery Time Objective
3
Q
PBKDF2
A
Password-Based Key Derivation Function 2 Key stretching algorithm (combines password with a random value, AKA a salt, and hashes them to create much longer keys.) Another algorithm is Bcrypt.
4
Q
WIPS
A
Wireless Intrusion Prevention System
5
Q
ESB
A
Enterprise Service Bus
Implements a communication system between mutually interacting software applications in a service-oriented architecture.
6
Q
BIA
A
Business Impact Analysis
7
Q
UDDI
A
Universal Description Discovery and Integration
A platform-dependent, XML Protocol that includes a (XML-based) registry by which businesses worldwide can list themselves on the Internet, and a mechanism to register and locate web service applications.
8
Q
RTP
A
Real-time Transport Protocol
A network protocol for delivering audio and video over IP networks.
9
Q
QLAN
A
Audio over IP networking technology component of the Q-Sys audio signal processing platform from QSC Audio Products.
10
Q
SLA
A
Service Level Agreement
Commitment between a service provider and client.
11
Q
Diameter
A
AAA protocol proceeding RADIUS. Application layer.
12
Q
LEAP
A
Lightweight Extensible Authentication Protocol
A proprietary wireless LAN authentication method developed by Cisco.
13
Q
DAM
A
Database Activity Monitor
Tool to monitor, capture and record database events in near-real time and provide alerts about policy violations.
14
Q
COBO
A
Company-Owned Business Only
15
Q
SCEP
A
Simple Certificate Enrollment Protocol The protocol is designed to make the issuing of digital certificates as scalable as possible. The idea is that any standard network user should be able to request their digital certificate electronically and as simply as possible. These processes have usually required intensive input from network administrators, and so have not been suited to large scale deployments.
16
Q
RAD
A
Rapid Application Development
17
Q
DSA
A
Digital Signature Algorithm
A FIPS for digital signatures, based on the mathematical concept of modular exponentiations and the discrete logarithm problem.
18
Q
OTP
A
One-Time Password
19
Q
IA
A
Interoperability Agreement
20
Q
Jitter
A
The variations in transmission latency that can cause packet loss and degraded VoIP call quality.
21
Q
LUN Masking
A
Authorization process that makes Logical Unit Numbers available to some hosts and unavailable to others. Implemented primarily at the HBA level.
22
Q
FRR
A
False Rejection Rate
The probability of type 1 errors (false positive) in biometrics.
23
Q
VDI
A
Virtual Desktop Infrastructure
The process of running a user desktop inside a virtual machine that lives on a server in the datacenter.
24
Q
ICS
A
Industrial Control System
25
CAN
Controller Area Network
A robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other in applications without a host computer.
26
CYOD
Choose Your Own Device
27
PIP
Policy Information Point
28
ISO 27001
Specification for an information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical, and technical controls involved in an organization’s information risk management process.
Includes best practices for information security management.
29
Sandboxing
Limits the environment in which certain code can execute. Goal is to improve security by isolating an application from:
- Outside malware
- Intruders
- System resources
- Other applications
30
BPA
Business Partnership Agreement
31
PTZ
Pan-Tilt-Zoom
A camera that is capable of remote directional and zoom control.
32
NTLM
New Technology LANMAN
33
APT
Advanced Persistent Threat
A stealthy computer network attack in which a person or group gains unauthorized access to a network and remains undetected for an extended period of time.
34
RFC
Request For Change
Document used for the request/creation of new requirements.
35
Compensating Control
Also called an **alternative control**, is a mechanism that is put in place to satisfy the requirement for a security measure that is deemed too difficult or impractical to implement at the present time.
36
VLAN Hopping
An attack. Attacker tries to send or access data that belongs to other VLANs.
37
SDLM
Software Development Lifecycle Methodology
Or SDM?
38
REST
Representational State Transfer
- A format for HTTP.
- Simple way to organize interactions between independent systems.
- REST allows you to interact with minimal overhead with clients as diverse as mobile phones and other websites.
39
RFP
Request For Proposal
Identifies the requirements for security.
40
Data Deduplication
The process of removing redundant data to improve enterprise storage utilization.
41
RA (2)
Request Authority
Recovery Agent
42
SONET
Synchronous Optical Network Technologies (Fibre)
43
FCoE
Fibre Channel over Ethernet -encapsulates fibre frames over Ethernet. -Allows up to 10Gbps.
44
SOE
Standard Operating Environment
45
PBX
Private Branch Exchange
A telephone exchange or telephone switching system that is installed at, and serves, a private organization a large number of internal devices.
46
EDR
**Endpoint detection and response** (EDR) platforms are a category of endpoint security tools, built to provide endpoint visibility, and are used to detect and respond to cyber threats and exploits.
47
IDF
Intermediate Distribution Frame
A central office or customer premises, which cross-connects the user cable media to individual line circuits and may serve as a distribution point for multipair cables from the Main Distribution Frame (MDF) or Combined Distribution Frame (CDF) to individual cables connected to equipment in areas remote from these frames.
48
vSCAN
Vulnerability scanner using nmap and NSR.
49
SP
Service Provider
50
WWN
World Wide Name
51
TACACS
Terminal Access Controller Access-Control System -Developed by Cisco. -XTACACS = Extended (extension) -TACACS+ = Newer yet separate protocol from TACACS
52
EAL levels
Evaluation Assurance Level
1. Functionally tested
2. Structurally tested
3. Methodically tested and checked
4. Methodically designed, tested and reviewed
5. Semi-formally designed and tested
6. Semi-formally verified design and tested
7. Formally verified design and tested
53
ITSEC
Information Technology Security Evaluation Criteria
For evaluating computer security within products and systems.
Region: **Europe**
54
PCI-DSS
Payment Card Industry Data Security Standard
An information security standard for organizations that handle branded credit cards from the major card schemes.
55
SIEM
Security Information and Event Management
An approach to security management that combines SIM (Security Information Management) and SEM (Security Event Management) functions into one security management system.
56
IV
Initialization Vector
A fixed-size input to a cryptographic primitive that is typically required to be random or pseudorandom.
57
MDF
Main Distribution Frame
A signal distribution frame for connecting equipment (inside plant) to cables and subscriber carrier equipment (outside plant).
58
ESA
Enterprise Security Architecture
59
PEAP
Protected Extensible Authentication Protocol
60
IAX
Inter-Asterisk eXchange Communications protocol native to the Asterisk private branch exchange (PBX) software.
61
ASLR
**Address Space Layout Randomization** (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably jumping to, for example, a particular exploited function in memory, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries.
62
SIP
Session Initiation Protocol Used mainly with IP telephony.
63
PFS
Perfect Forward Secrecy
A feature of specific key agreement protocols that gives assurances your session keys will not be compromised even if the private key of the server is compromised.
64
COPE
Corporate-Owned, Personally-Enabled A business model in which an organization provides its employees with mobile computing devices and allows the employees to use them as if they were personally-owned notebook computers, tablets or smartphones.
65
PAP
Password Authentication Protocol
A password-based authentication protocol used by Point to Point Protocol (PPP) to validate users.
66
NAC
Network Access Control Steps taken to ensure that all security standards are met prior to connecting a device to the network.
67
ROI / Formula
Return On Investment. Net profit / Investment
68
OCSP
Online Certificate Status Protocol
Used for obtaining the revocation status of an X.509 digital certificate.
69
SRTP
Secure Real-time Transport Protocol
70
INE
Inline Network Encryptor
Device/software used to encrypt data prior to transmission or as the data flow is streamed.
71
PDP
Policy Decision Point
A component of a policy-based access control system that makes the determination of whether or not to authorize a user’s request, based on available info (attributes) and applicable security policies.
72
FDE
Full Disk Encryption
73
CRM
Customer Relationship Management
74
ISMS
Information Security Management System
An information security standard which specifies a management system that is intended to bring information security under management control and gives specific requirements.
75
ISL
Inter-Switch Link (Cisco Protocol) Wraps Ethernet frames with VLAN Information.
76
XACML
eXtensible Access Control Markup Language
Standard which defines a declarative fine-grained, attribute-based access control policy language, an architecture, and a processing model describing how to evaluate access requests according to the rules defined in policies.
77
CASB
Cloud Access Security Broker
On-premises or cloud based software that sits between cloud service users and cloud applications, and monitors all activity and enforces security policies.
78
802.1q
AKA Dot1q. Networking standard that supports VLANs on an IEEE 802.3 Ethernet network.
79
SDN
Software Defined Networking
An approach to cloud computing that facilitates net management and enables programmatically efficient net configuration in order to improve net performance and monitoring.
3 parts to SDN architecture: Control, Data, and Management Planes.
2 APIs: Northbound connects application layer to control layer.
Southbound connects control later to infrastructure layer.
80
SWT
Simple Web Token
81
TSIG
Transaction Signature Interoperability Group
82
Key Escrow
The backup and storage of certificates by a third party.
83
GLBA
Gramm-Leach-Bliley Act aka Financial Services Modernization Act of 1999.
84
ORB
Object Request Broker
A middleware which allows program calls to be made from one computer to another via a computer network, providing transparency through remote procedure calls.
85
CISO
Chief Information Security Officer
86
ROT 3 Cipher
Caesar "Rotation" cipher.
87
IC3
Internet Crime Complaint Center
(FBI/Internet Crime Center)
88
JSON
JavaScript Object Notation
89
PKCS
Public Key Cryptography Standards
Designed and published by RSA Security LLC.
90
TCO
Total Cost of Ownership
Goes beyond considering just acquisition costs.
91
WAC
Web Access Control
92
SCP
Secure Copy Protocol
(Linux, based on SSH)
93
VNC
Virtual Network Computing
A graphical desktop sharing system that uses the Remote Frame Buffer (RFB) Protocol to remotely control another computer.
94
MSS
Managed Security Service
Net security services outsourced to a service provider (MSSP).
95
FAR
False Acceptance Rate
The probability of type 2 errors (false negative) in biometrics.
96
MDM
Mobile Device Management
97
Bell-LaPadula Model
State machine model used for enforcing access control in government and military applications. A formal state transition system of computer security policy that describes a set of access control rules which use security labels on objects and clearance for subjects.
**Confidentiality-based**
98
AJAX
Asynchronous JAVA and XML
Technique for creating better, faster and more interactive web applications with the help of XML, HTML, CSS, and Java Script.
99
DSCP
Differentiated Services Code Point aka DiffServ Computer networking architecture that specifies a simple and scalable mechanism for classifying and managing network traffic and providing QoS on modern IP networks.
100
AH
Authentication Header
IPSEC protocol which provides a mechanism for authentication only. Provides data integrity, data origin authentication, and an optional replay protection service.
101
eGRC
Electronic Government Regulatory and Compliance
102
KPI
Key Performance Indicator
A type of performance measurement. KPIs evaluate the success of an organization or of a particular activity (such as projects, programs, products and other initiatives) in which it engages.
103
OVAL
Open Vulnerability Assessment Language
An international, information security, community standard to promote open and publicly available security content, and to standardize the transfer of this information across the entire spectrum of security tools and services.
104
PSP
Provisioning Service Point
Also called SPML Server or simple “provider”, this software component takes the request from the client, processes it, and returns it with a (SPML) response.
105
SOX
Sarbanes-Oxley Act
AKA: Public Company Accounting Reform and Investor Protection Act.
106
WSDL
Web Services Description Language
107
MOU
Memo of Understanding
Agreement between two (bilateral) or more (multilateral) parties. Specifies the **maximum amount of outage time**.
108
NOS
Network Operating System
109
ERP
**Enterprise resource planning** (ERP) is the integrated management of core business processes, often in real-time and mediated by software and technology.
110
WIDS
Wireless Intrusion Detection System
111
KRI
Key Risk Indicator
A measure used in management to indicate how risky an activity is. Key risk indicators are metrics used by organizations to provide an early signal of increasing risk exposures in various areas of the enterprise.
112
SOA (2)
Start of Authority
Service-Oriented Architecture
113
SAS70
Statement on Auditing Standards No. 70
An authoritative auditing standard developed by the American Institute of Certified Public Accounts (AICPA).
114
DOM
Document Object Model
A cross-platform and language-independent API that treats an HTML, XHTML, or XML document as a tree structure wherein each node is an object representing a part of the document.
115
SDL
Security Development Lifecycle
A software development process used and proposed by Microsoft to reduce software maintenance costs and increase reliability of software concerning software security related bugs.
116
WAF
Web Application Firewall
117
SOAP
Simple Object Access Protocol
A messaging protocol specification for exchanging structured information in the implementation of web services in computer networks.
118
HSM
Hardware Security Module
A physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing.
119
LUN (2)
Logical Unit Number
Link Uninhibit (SS7)
120
SPIT
Spam over Internet Telephony
121
TKIP
Temporal Key Integrity Protocol
122
Biba Model
A formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Uses the following: “This property states that an object at one level of integrity is not permitted to write to an object of higher integrity.”
123
JWT
JSON Web Token
124
DLP
Data Loss Prevention
A strategy for making sure that end users do not send sensitive or critical information outside the corporate network.
125
ECC
Elliptical Curve Cryptography
126
TOS
Type of Service
127
SIP
Session Initiation Protocol
A signaling protocol used for initiating, maintaining, and terminating real-time sessions that include voice, video, and messaging applications.
128
SRTM
Software Requirements Traceability Matrix
A grid that allows documentation and easy viewing of what is required for a system’s security. Necessary for technical projects that call for security to be included.
129
NDP
Neighbor Discovery Protocol
Protol that replaced ARP in IPv6.
130
MTD
Maximum Tolerable Downtime
131
DEP
Data Execution Prevention
A Windows security feature that monitors programs to ensure they use system memory safely and closes them when they don’t. This guards against security threats attempting to execute code from system memory.
132
SOC
Security Operations Center
133
PST
Provisioning Service Target
134
IDM
Identity Management
135
WAYF
Where Are You From
A service that guides a user to his or her identity provider.
136
HMAC
Hashed Message Authentication Code
A specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key.
137
KDC
Key Distribution Center
138
LDAP
Lightweight Directory Access Protocol
An open, vendor-neutral industry standard application protocol for accessing and maintaining distributed directory information services over an IP network.
139
RFQ
Request For Quote
140
DPI
Deep Packet Inspection
A form of packet filtering that examines the data part (and possibly the header) of a packet as it passes an inspection point.
141
SOCKS
SocketSecure
Circuit proxy server with commercial freeware implementation.
Protocol that is intended to act as a circuit level proxy for applications.
Layer 5 of OSI model.
Can act as VPN if encryption is supported.
Port 180.
142
IAVA
Information Assurance Vulnerability Alert
143
OLA
Operating Level Agreement
144
TCSEC
Trusted Computer System Evaluation Criteria
US DoD standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system.
Region: **USA**
145
CSRF
Cross-Site Request Forgery
An attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.
146
SPML
Service Provisioning Markup Language
An OASIS-approved standard intended to provide an CML framework for managing the provisioning and allocation of identity information and system resources within and between organizations.
147
Kerberos
A computer network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
“Customers will have delegated access to multiple digital services.”
148
HBA (2)
Host Bus Adapter: Connects a computer to other network and storage devices.
Host-Based Authentication
149
RBAC
Rule/Role-Based Access Control
150
RPO
Recovery Point Objective
151
FERPA
Family Educational Rights and Privacy Act
Federal law that protects the privacy of student educational records.
152
TOTP
Time-based One Time Password
153
FIM
File Integrity Monitoring
154
CIA (2)
Cryptographic Information Application
Confidentiality, Integrity, Availability
155
POCE
Personally Owned Corporate Enabled
156
PEP
Policy Enforcement Point
157
RC4
Rivest Cipher 4 The only widely used stream cipher. Known to be insecure.
158
EICAR Test File
European Institute for Computer Antivirus Research file to test virus detection software.
159
SAML
Security Assertions Markup Language
An XML standard for exchanging authentication and authorization data between security domains—between an identity provider and a service provider.
“Authentication to cloud-based corporate portals will feature single sign-on.”
160
ELA
Enterprise License Agreement
161
KPI
Key Performance Indicator
162
DKIM
DomainKeys Identified Mail
An email authentication method designed to detect forged sender addresses in emails.
163
CERT
Computer Emergency Response Team
164
ESP
Encapsulating Security Payload
IPSEC protocol. Provides data confidentiality (encryption) and authentication (data integrity, data origin authentication, and replay protection).
165
Block Ciphers
DES (64bits), 3DES, IDEA, RC5, AES (aka Rijndael) Blowfish, CAST, SAFER Stronger than stream ciphers. Encrypts in fixed-length “blocks”.
166
Pivoting
A method used by penetration testers that uses the compromised system to attack other systems on the same network to avoid restrictions such as firewall configurations, which may prohibit direct access to all machines.
167
SCSI
Small Computer System Interface A set of standards for physically connecting and transferring data between computers and peripheral devices.
168
Helix
A forensics and incident response live CD based on Knoppix distribution.
169
NGFW
NextGen FireWall
Packet filtering, NAT/PAT, stateful inspection, VPN support.
170
NIST
National Institute of Standards and Technology
A physical sciences laboratory, and non-regulatory agency of the US Department of Commerce. It’s mission is to promote innovation and industrial competitiveness.
Responsible for the creation of lists of known vulnerabilities in OSs.
171
NLA
Network Level Authentication
172
SSDLC
Security System Development Life Cycle
173
BCP
Business Continuity Planning
174
CIRT
Computer Incident Response Team
175
SSO
Single Sign-On
176
MTBF
Mean Time Between Failures
177
XSS
Cross-Site Scripting Vulnerability/attack. AKA “Confused Deputy Attack”
178
SPIM
Spam over Internet Message
179
CredSSP
Credential Security Support Provider (Protocol)
An authentication provider that processes authentication requests for other applications.
180
MSA
Master Service Agreement
Contract reached between parties, in which the parties agree to most of the terms that will govern future transactions or future agreements.
181
MTTR
Mean Time To Recovery
182
NX/XN Bit
The NX bit (**no-execute**) is a technology used in CPUs to segregate areas of memory for use by either storage of processor instructions (code) or for storage of data, a feature normally only found in Harvard architecture processors. However, the NX bit is being increasingly used in conventional von Neumann architecture processors, for security reasons. (**XN = execute never**)
183
XSRF
Cross-Site Request Forgery
184
IKE
Internet Key Exchange
Protocol used to set up a Security Association (SA) in the IPSec protocol suite.
185
MAC (2)
Mandatory Access Control (deals with classification)
Message Authentication Code
186
UAT
User Acceptance Testing
187
EV
Extended Validation (certificate)
188
GRC
Governance, Risk, and Compliance.
A company’s coordinated strategy for managing the broad issues of corporate governance, enterprise risk management (ERM) and corporate compliance with regard to regulatory requirements.
189
L2TP
Layer 2 Tunneling Protocol
Used to support VPNs or as part of the delivery of services by ISPs.
190
ACM
Access Control Matrix
The table structure of an ACL.
191
Side Loading
A term similar to “upload" and “download", but in reference to the process of transferring between two local devices, in particular between a computer and a mobile device.
192
DAC
Discretionary Access Control
A type of Access Control used as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong.
193
SCADA
Supervisory Control and Data Acquisition A control system architecture that uses computers, networked data communications and GUIs for high-level process supervisory management.
194
oAuth
An open standard for access delegation, commonly used as a way for internet users to grant websites or apps access to their info on other websites but without giving them the passwords. (Amazon, google, IG, FB, etc)
“Where users are attached to the corporate network, SSO will be utilized.”
195
PSK
Pre-Shared Key
196
SAFER
Secure And Fast Encryption Routine Family of block ciphers.
197
IDP
Identity Provider
198
CIFS
Common Internet File System
A network file system protocol used for providing shared access to files and printers between machines on the network.
199
ISA
Interconnection Security Agreement
200
KRI
Key Result Indicator
201
CCMP
Counter-Mode / CBC (Cipher Block Chaining)-MAC (Message Authentication Code) Protocol
An encryption protocol designed for WLAN products that implements the standards of the IEEE 802.11i amendment to the original IEEE 802.11 standard.
