All Flashcards
1
Q
What is TOTP?
A
Time Based One Time Password Algorithm
2
Q
What is WPA2 and what does it use?
A
WiFi Protected Access 2. Uses CCMP.
3
Q
What is CCMP and what does it use?
A
Counter Mode Cipher Block Chaining Message Authentication Code Protocol. Uses AES and MIC with CBC-MAC. Used in WPA2.
4
Q
What is AES?
A
Advanced Encryption Standard.
5
Q
What is WPS and why is it bad?
A
WiFi Protected Setup. It uses a PIN which makes brute force easy. It was designed for easy device connections.
6
Q
MAC (address)
A
Media Access Control
7
Q
MAC (with respect to authentication)
A
Message Authentication Code
8
Q
What is MAC (with respect to access) and what does it do?
A
Mandatory Access Control. The OS controls who gets access based on security levels, GPO, etc.
9
Q
What is DAC and what does it do?
A
Discretionary Access Control. The owner controls who has access.
10
Q
What is ABAC and what does it do?
A
Attribute Based Access Control. Control is based on user attributes.
11
Q
What is MIC?
A
Message Integrity Check.
12
Q
What is CBC and describe it?
A
Cipher Block Chaining. Easy to implement. Each plaintext block is XORed with the previous ciphertext block.
13
Q
What is PSK?
A
Pre-shared key.
14
Q
What is typosquatting?
A
Changing the URL to a similar (but wrong) one.
15
Q
What is prepending?
A
Adding an extra letter to the beginning of a URL to send you somewhere else.
16
Q
What is pretexting?
A
Making up a situation to get information.
17
Q
What is pharming?
A
Redirect a real website to a bogus site.
18
Q
What is Vishing?
A
Voice phishing.
19
Q
What is Smishing?
A
SMS phishing.
20
Q
What is WAF?
A
Web Application Firewall.
21
Q
What is a rainbow table?
A
Optimized prebuilt set of hashes.
22
Q
What is disassociation?
A
Disassociate a device from WiFi.
23
Q
What is DNS poisoning?
A
Modify the DNS server to direct web traffic, often done by modifying the host file which takes precedence over DNS queries.
24
Q
What is reconstitution?
A
A plan to fix everything starting with the most important stuff. Can take many months.
25
What are precursors?
Early warning signs.
26
What is DLP?
Data Loss Prevention.
27
What is SIEM?
Security Information and Event Management.
28
What is IPS?
Intrusion Protection System.
29
What is IDS?
Intrusion Detection System.
30
What is CASB?
Cloud Access Security Broker.
31
What is Data Masking?
Data obfuscation, hiding some of the original data.
32
What is a DNS Sinkhole?
A DNS that hands out incorrect IP addresses.
33
What is COPE?
Corporate Owned Personally Enabled (device).
34
What is a blockchain?
Distributed ledger, everyone maintains the ledger.
35
What is Transference?
Risk management strategy, buy some insurance.
36
What is TTL and what is it?
Time to live. The amount of time or hops that a packet is set to exist inside a network before being discarded by the router.
37
What is key escrow?
Someone else holds the decryption keys.
38
What is 802.1X?
IEEE standard for port based nac (PNAC).
39
What is IEEE?
Institute of Electrical and Electronic Engineers.
40
What is TACACS+.
Terminal Access Controller Access Control System.
41
What is LDAP and LDAPS, what ports and protocols does each use, including the security protocol for LDAPS?
Lightweight Directory Access Protocol and Lightweight Directory Access Protocol Secure. LDAP uses TCP port 389 and LDAPS uses TCP port 636. LDAPS uses SSL for encryption.
Low Down All Pine on port 389. Lax Digs And Proper Six on ya port 636.
42
What is Kerberos?
Network authentication protocol. Authenticate once.
43
What is IPsec and what does it do?
Internet Protocol Security. It is a group of protocols for securing connections between devices. IPsec helps keep data sent over public networks in a secure manner. It is often used to set up VPNs and it works by encrypting IP packets along with authenticating the source where the packets came from.
44
What is SSL, what does it do, and what port does it use?
Secure Sockets Layer. A standard for securing an internet connection by encrypting data sent between a website and browser. Uses TCP port 443.
45
What is TLS and what port does it use?
An updated and more secure version of SSL. Still commonly referred to as SSL. Uses TCP port 443.
46
What is HTTPS, what does it do, and what port does it use?
Hypertext Transfer Protocol Secure. The secure version of HTTP. Uses TLS, formerly known as SSL. Uses two keys, a public and private key. The private key is controlled by the owner of a website and is kept private, and lives on a web server and is used to decrypt the information of the public key. The public key is available to everyone who wants to interact with the server in a secure way. Information that's encrypted by the public key can only be decrypted by the private key. Uses TCP port 443.
47
What is a stateful firewall?
A firewall that remembers the state of the session, and everything within a valid flow is allowed.
48
What is a Faraday cage?
A cage that blocks EMF. It is a mesh of conductive material that cancels the EMF effect on the interior, similar to how a microwave door blocks microwaves.
49
What is MSP?
Managed Service Provider. Can also be a cloud service provider, but not all cloud service providers are MSPs.
50
What is CMS?
Content Management System. Secure the access to data and protect it from outsiders.
51
What is MCM?
Mobile Content Management.
52
What is HSM?
Hardware Security Module. Common with MicroSD cards.
53
What is TPM?
Trusted Platform Module. A specification for cryptographic functions. Comes with unique keys burned in. Persistent memory for burned in keys. Versatile memory for storage keys and hardware information. Password protected. Cryptographic processor, random number generator.
54
What is UEFI?
Unified Extensible Firmware Interface.
55
What is XSS and the two types?
Cross-site Scripting. An exploitation in which information with one site is shared with another. Can be persistent (think sharing malicious social media link, everyone gets the payload) or non-persistent (aka reflected) (think using a search box to run a script).
56
What is ARO?
Annualized Rate of Occurrence. How likely is a risk to happen in a year?
57
What is SLE?
Single Loss Expectancy. How much monetary loss from a single event. I.e. how much money is lost from a single laptop theft?
58
What is ALE?
Annualized Loss Expectancy. ARO x SLE. How much expected loss in a year?
59
What is RTO?
Recovery Time Objective. Time to recover to a specific point. I.e. must be back to X% level of service within Y amount of time.
60
What is RPO?
Recovery Point Objective. How much data loss is acceptable?
61
What is CSRF?
Cross Site Request Forgery. AKA C-SRF (sea surf). The website trusts your browser and requests are made without your consent or knowledge.
62
What is SQL injection?
Add your own commands to an application's SQL query, like through a text box submission.
63
What is PCI DSS?
Payment Card Industry Data Security Standard.
64
What is SSL Stripping/ HTTP Downgrade?
Combines on-path attack with a downgrade attack. Attacker must sit in the middle of the conversation and modifies the data between the victim and web server.
65
What is RAT and what does it do?
Remote Access Trojan? Backdoor, allows for admin control.
66
What is a worm?
Takes advantage of a vulnerability and installs malware that includes a remote access backdoor.
67
What is SIMS?
Standard for Information Security Management Systems.
68
What is PIMS?
Privacy Information Management System.
69
What does ISO/ IEC 27001 describe?
Standard for Information Management Security (SIMS).
70
What does ISO/ IEC 27002 describe?
Code of practice for information security controls.
71
What does ISO/ IEC 27701 describe?
Privacy Information Management Systems.
72
What does ISO 31000 describe?
International standards for risk management practices.
73
What is GDPR?
General Data Privacy Regulation. Used by European Union.
74
What is CSA?
Cloud Security Alliance.
75
What is CCM?
Cloud Controls Matrix. Cloud-specific security controls. Controls are mapped to standards, best practices, and regulations.
76
What is SMTP and SMTPS, what do they do, and what ports do they use?
Simple Mail Transfer Protocol and Simple Mail Transfer Protocol Secure. Used by clients to deliver email to a server. Also used by servers to forward mail to their final destination. SMTP uses TCP port 25 and SMTPS uses TCP port 587.
Send Mail To Persons over 25 but under 587. We can send between 25 and 587 emails per day.
77
What is S/MIME and what does it do?
Secure/ Multipurpose Inter Mail Extensions. Uses public key encryption and digital signing of mail content.
The mime needs extensions because he can't speak on his own.
78
What is IMAP and IMAPS, what do they do, and what ports do they use?
Internet Message Access Protocol and Internet Message Access Protocol Secure. Retrieves email from a server. IMAP uses TCP port 143 and IMAPS uses TCP port 993.
79
What is CASB and what does it do?
Cloud Access Security Broker. Security policies in the cloud. Implemented as client software, local security appliances, or cloud based security solutions.
80
What is WEP?
Wired Equivalent Privacy. Not good.
81
What is EAP and what is it?
Extensible Authentication Protocol. An authentication framework. Integrates with 802.1X.
82
What is 802.1X?
An IEEE standard for port based network access control (PNAC). Uses a centralized authentication server and all users can use their normal credentials to authenticate to an 802.1X network.
83
What is PEAP, who developed it, and what does it do?
Protected Extensible Authentication Protocol. Protected EAP. Created by Cisco, Microsoft, and RSA Security. It encapsulates EAP in a TLS tunnel.
84
What is EAP-TLS?
EAP Transport Layer Security. Strong security that requires a digital certificate on the AS (authentication server) and all other devices.
EAP! I forgot the digital certificate on the AS!
85
What is AS?
Authentication Server.
86
What is EAP-TTLS?
EAP Tunneled Transport Layer Security. Supports other authentication protocols in a TLS tunnel. Requires a digital certificate on the AS. Does not require a certificate on every device. Builds a TLS tunnel using this digital certificate. Use any authentication method inside the TLS tunnel, including other EAPs, MS-CHAPv2, and anything else.
You can send anything in a tunnel.
87
What is EAP-MSCHAPv2?
Extensible Authentication Protocol - Microsoft Challenge Handshake Authentication Protocol version 2. Uses user account credentials in ADDS (Active Directory Domain Services) to authenticate wireless access clients instead of using smart cards or user and computer certificates for client authentication.
88
What is EAP-FAST?
EAP Flexible Authentication via Secure Tunneling. AS and supplicant share a protected access credential (PAC), aka shared secret.
89
What is PAC?
Protected Access Credential.
90
What is RADIUS and what does it do?
Remote Authentication Dial-In User Service. Centralized Authentication.
91
What is SOAR?
Security Orchestration, Automation, and Response.
92
What is PKI and what is it?
Public Key Infrastructure. Policies, procedures, hardware, software, people. Digital certificates: create, distribute, manage, store, revoke.
93
What is UTM and what is it?
Unified Threat Management. All-in-once security appliance.
94
What is RTOS and what is it?
Real Time Operating System. An OS with a deterministic processing schedule. Used in environments where a large number of events, mostly external to the computer system, must be accepted and processed in a short time or within certain deadlines. such applications are industrial control, telephone switching equipment, flight control, and real-time simulations.
95
What is SoC and what is it?
System on a Chip. Multiple components running on a single chip.
96
What is SED?
Self-Encrypting Drive.
97
What is MAC (with respect to authentication)?
Message Authentication Code.
98
What is MAC (with respect to access) and what does it do?
Mandatory Access Control. The OS controls the access through GPOs, etc.
99
What is CASB?
Cloud Access Security Broker. Can be used to apply security policies to cloud based implementations. Two common functions of a CASB are visibility into application use and data security policy use. Also verification of compliance with formal standards and the monitoring and identification of threats.
100
What is MSP?
Managed Service Provider. Can be a cloud service provider, but not all cloud service providers are MSPs.
101
What is FDE?
Full Disk Encryption.
102
What is SRTP, what does it do, what encryption standard does it commonly use, and what port does it use, what layer does it work on?
Secure Real-Time Transport Protocol. Used for secure VoIP. Commonly uses AES for confidentiality. Uses port 5061. Application layer protocol.
103
What is passive foot printing?
Learning as much as possible about a company from open sources.
104
What protocol does HTTPS and FTPS use?
TLS.
105
What is FTP and FTPS and what ports do they use?
File Transfer Protocol and File Transfer Protocol Secure. FTP uses TCP port 20 for data and TCP port 21 for control. FTPS uses TCP port 990 for control and TCP port 989 for data.
106
What is SSH, what does it do, and what port does it use?
Secure Shell. Used for secure remote connections. Uses TCP port 22.
107
What is DNSSEC?
DNS Security Extensions. Does not provide any confidentiality of data.
108
What is an incremental backup?
Backs up only the files that have been changed since the last incremental backup. For example, if you do a full backup on Monday, then an incremental backup on Tuesday and Wednesday, you will need to perform three restores. Monday, then whatever changed on Tuesday, then whatever changed on Wednesday.
109
What is a differential backup?
Backs up only the files that have been changed since the last full backup. For example, if you do a full backup on Monday, then an incremental backup on Tuesday and Wednesday, you will need to perform two restores. Monday, then Wednesday.
110
What is Trusted Boot?
This portion of the startup process verifies the OS kernel signature and starts the ELAM process.
111
What is ELAM?
Early Launch Anti-Malware.
ELAM backwards is MALE. Males are the early form of malware.
112
What is Measured Boot?
Occurs after the Trusted Boot process and verifies that nothing on the computer has been changed by malicious software or other processes.
113
What is Secure Boot?
A UEFI BIOS boot feature that checks the digital signature of the bootloader. The Trusted Boot Process occurs after the Secure Boot has completed.
114
What is POST?
Power On Self Test. Hardware check performed prior to booting an operating system.
115
What is SHA256 and what are some applications?
Secure Hash Algorithm with a message digest of 256 bits. Digital signature verification, password hashing, SSL handshakes in browsers, verifies a file was not corrupted during a file transfer.
116
What is integrity measurement?
Designed to check for the secure baseline of firewall settings, patch levels, and OS versions, and any other security components associated with the application.
117
What is a data custodian?
A person who manages access rights and sets security controls on the data.
118
What is a data processor?
A person who manages the operational use of the data but not the rights and permissions.
119
What is a data owner?
A person who makes business decisions regarding the data. Usually a higher level executive.
120
What is a privacy officer.
A person who sets privacy policies and implements privacy processes and procedures.
121
What is HSM?
Hardware Security Module. A high end cryptographic hardware appliance that can securely store keys and certificates for all devices.
122
What is PAP?
Password Authentication Protocol.
123
What is MS-CHAP?
Microsoft Challenge Handshake Protocol. An encrypted challenge is sent over the network. It is a three-way handshake. Challenege-response continues periodically. Commonly uses PPTP (Point to Point Tunneling Protocol). Don't use it, it's bad. Security issues with DES.
124
What is DES?
Data Encryption Standard. Don't use it, has security issues.
125
What is PPTP?
Point to Point Tunneling Protocol.
126
What is IPsec?
Internet Protocol Security. Security for OSI layer 3. Authentication and encryption for every packet. Features confidentiality and integrity, anti-replay. Two core protocols combined, AH and ESP.
127
What is AH and what does it do?
Authentication Header. Provides data integrity, origin authentication, replay attack prevention, keyed-hash mechanism. No confidentiality or encryption.
128
What is ESP and what does it do?
Encapsulating Security Payload. Provides confidentiality through encryption, limited traffic flow confidentiality, data integrity, and anti-replay protection.
129
What is CBC and what does it do?
Cipher Block Chaining. Each plaintext block is XORed with the previous ciphertext block.
130
What is a message digest?
A message digest is a fixed size numeric representation of the contents of a message, computed by a hash function.
131
What is hashing?
The process of transforming any given key or a string of characters into another value, i.e. a message digest.
132
What is salt and what does it defeat?
Random data fed as an additional input to a one-way function that hashes data. It defeats rainbow tables.
133
What is CTR and what does it do?
Counter. Block cipher mode / acts like a stream cipher. Encrypts successive values of a “counter”. Plaintext can be any size, since it’s part of the XOR i.e., 8 bits
at a time (streaming) instead of a 128-bit block.
134
What is GCM and what does it do?
Galois/ Counter Mode. Encryption with authentication. Very efficient encryption and authentication. Minimum latency and operation overhead. Commonly used in packetized data.
Galois was very fast and very efficient when it came to encrypting and authenticating.
135
What is SMS?
Short Message Service. Text messages.
136
What is MMS?
Multimedia Messaging Service. Like expanded text messages.
137
What is CSR?
Certificate Signing Request.
138
What is OCSP and what does it do?
Online Certificate Status Protocol. The browser can check for certificate revocation. An alternative to CRL. Checks validity in real time.
139
What is key escrow?
Someone else holds the decryption keys.
140
What is a Hierarchical CA?
A single CA issues certs to intermediate CAs.
141
What is SAE?
Simultaneous Authentication of Equals. A Diffie-Hellman derived key exchange with an authentication component. Everyone uses a different session key even with the same PSK. An IEEE standard, the dragonfly handshake.
Sae is the name of the dragonfly and Diffie-Hellman is his daddah. All dragonflies have different keys.
142
What is PFS and what does it do?
Perfect Forward Secrecy. Change the method of key exchange.
143
What is Diffie-Hellman?
Establishes a shared secret between two parties that can be used for communication for exchanging data over a public network.
144
What is ECC?
Elliptical Curve Cryptography. Asymmetric encryption. Need large integers composed of two or more large prime factors.
145
What is asymmetric encryption?
Uses a public key and private key. You can't derive the private key from the public key.
146
What is MITRE ATT&CK Framework?
Developed by MITRE corporation, determine the actions of an attacker such as point of intrusion, methods used to move around, and block future attacks.
147
What is the Diamond Model?
Intrusion analysis, apply scientific principles to intrusion analysis such as measurement, testability, and repeatability.
148
What is NIST RMF?
National Institute of Standards and Technology Risk Management Framework.
149
What is HIPS and what does it do?
Host Based Intrusion Prevention System. Recognizes and blocks known attacks. Uses signatures, heuristics, and behaviors. Secure OS and application configurations, and validate incoming service requests.
150
What is WAF and what does it do?
Web Application Firewall. Applies rules to HTTP/ HTTPS conversations. Allow or deny based on expected input. Major focus of PCI DSS.
What Are we Fucking sending over HTTP/HTTPS?
151
What is UTM?
Unified Threat Management. All-in-one security appliance.
152
What is PGP and what does it do?
Pretty Good Privacy. Security program that enables users to communicate securely by decrypting and encrypting messages, authenticating messages through digital signatures, and encrypting files. One of the first public key cryptography softwares.
153
What is ARP and what does it do?
Address Resolution Protocol. Connects an IP address to a MAC address in a LAN. Think ARP table.
154
traceroute
Determine the route a packet takes to the destination. Used in Mac and Linux. POSIX. Takes advantage of ICMP.
155
tracert
Determine the route a packet takes to the destination. Used in Windows. Takes advantage ICMP.
156
nslookup
Lookup names and IP addresses. Deprecated, use dig instead (not native to Windows). Windows and POSIX.
157
dig
Domain Information Groper. More advanced domain information than nslookup.
158
ipconfig
TCP/ IP information. Windows.
159
ifconfig
TCP/ IP information. Mac and Linux.
160
Nmap
Network Mapper. Find and learn more about network devices, port scan, OS system scan (what OS is in use), service scan (what services are on this device).
161
ping
Test reachability and round trip time of packets. Uses ICMP. Windows, Mac, Linux.
162
pathping
Combines ping and traceroute. Windows. First phase runs a traceroute and builds a map. Second phase measures round trip time and packet loss at each hop.
163
hping and give an example.
TCP/IP packet assembler/analyzer. A ping that can send almost anything. Send crafted frames. BE CAREFUL! Easy to flood and Dos. Uses ICMP, TCP, UDP. Example: #hping3 --destport 80 10.1.10.1
164
netstat, and what are the common switches?
Network statistics. -a, -b, -n Windows, Mac, Linux.
165
netstat -a
Show all active connections.
166
netstat -b
Show binaries.
167
netstat -n
Do not resolve names.
168
netcat
Many different functions, "read" or "write" to the network. Open a port and receive some traffic. listen on a port, transfer data, scan ports and send data to a port. Become a backdoor, run a shell from a remote device. An alternative is Ncat.
169
IP scanners
Search the network for IP addresses. Avoid doing work on an IP address that isn't there. Many different techniques. ARP (if on the local subnet), ICMP requests (ping), TCP ACK, ICMP timestamp requests.
170
arp -a
View the local ARP table.
171
route (command)
View the device's routing table. Windows = route print. Mac and Linux = netstat -r.
172
curl
Client URL. Retrieve data using a URL. Web pages, FTP, emails, databases, etc. Grab the raw data (think about the "Inspect" tool on a webpage).
173
theHarvester
Gather OSINT.
174
sn1per
Combine many recon tools into a single framework.
175
scanless
Run port scans from a different host. Port scan proxy. Many different services, choose the option for scan origination. Your IP is hidden as the scan source.
176
dnsenum
Enumerate DNS information. Find hostnames. View host information from DNS servers.
177
Nessus
Industry leader in vulnerability scanning.
178
Cuckoo
Sandbox for malware.
179
head (command)
View the first part of the file. -n specifies the number lines. Example: head -n 5 syslog
180
tail (command)
View the last part of the file. -n specifies the number of lines. Example: tail -n 5 syslog
181
cat (command)
Concatenate. Link together in a series. Example: cat file1.txt file2.txt
182
grep (command)
Find text in a file. Search through many files at a time.
183
chmod
Change mode of a file system object. r=read, w=write, x=execute. Can also use octal notation (ex., 744). Example: chmod 744 first.txt (this sets user to read, write, execute, group to read only, other to read only)
184
logger (command)
Add entries to the system log. Syslog.
185
SSH
Shell and script environment.
Secure Shell. Encrypted console communication over TCP port 22. Looks and acts the same as Telnet.
186
Windows Powershell
Shell and script environment. Command line for sys admins.
187
Python
Shell and script environment.
General purpose scripting language.
188
OpenSSL
A shell and script environment. Toolkit and crypto library for SSL/TLS.
189
Tcpreplay
Packet tool. A suite of packet replay utilities.
190
tcpdump
Packet tool. Capture packets from the command line.
191
Wireshark
Packet tool. Graphical packet analyzer.
192
dd
Forensic tool. Create a bit-by-bit copy of a drive.
193
Create and restore a disk image with dd (type out the command).
Create
dd if=/dev/sda of=/tmp/sda-image.img
Restore
dd if=/tmp/sda-image.img of=/dev/sda
194
memdump
Forensic tool. Copy information in system memory to the standard output stream.
195
Winhex
Forensic tool. A universal hexadecimal editor for Windows. Edit disks, files, RAM. Clone disks, secure wipes, and more.
196
FTK imager
Forensic tool. Forensic drive imaging tools. Windows executable.
Forensic ToolKit to find who drive through my window.
197
Autopsy
The Sleuth Kit is an open source collection of command line and programming libraries for disk imaging and file analysis. Autopsy is a graphical frontend for these tools.
198
What is an exploitation framework and give one example?
A pre-built toolkit for exploitations. Metasploit is an example.
199
What is a password cracker?
Program to crack passwords. Username/ password combinations. Brute forcing a hash file. Limited by password complexity, hashing method, CPU power. Can increase with GPU.
200
What is entropy?
Password complexity/ strength.
201
What is data sanitization?
Completely removing data from a device.
202
Write the syntax and an example of setting permissions using chmod.
chmod [options] [mode] [File_name]
chmod 744 file.txt (
203
Explain the modes of chmod. I.e, how many positions of numbers are in the mode, what group is which position, and what do the number assignments mean for each position?
There are three positions: Owner, Group, and Other.
R = Read
W = Write
X = Execute
Setting a Y will result in Z:
0 = none
1 = X
2 = W
3 = W,X
4 = R
5 = R,X
6 = R,W
7 = R,W,X
204
What is the boot order?
POST-> Secure Boot-> Trusted Boot-> Measures Boot
205
What is a bootloader?
AKA boot manager, bootstrap loader. Program responsible for booting a computer. Acts as an intermediate between hardware and software. Loads the OS into memory.
206
FRR
False Rejection Rate. Example, don't make biometrics too sensitive.
207
HOTP
HMAC-based One Time Password.
208
FAR
False Acceptance Rate. Example, biometrics are not sensitive enough.
209
CSR
Certificate Signing Request.
210
EDR
Endpoint Detection and Response. Detect a threat, investigate a threat, respond to a threat. Uses behavioral analysis, machine learning, and process monitoring. Lightweight on the endpoint.
211
SAAE SOC2
Statement on Standards for Attestation Engagements.
AICPA (American Institute of Certified Public Accountants) auditing standard Statement on Standards for Attestation Engagements number 18 (SSAE 18)
Think about when I had to review those long ass reports at MSGCU.
212
CSA CCM
Cloud Security Alliance Cloud Controls Matrix
213
CCM
Cloud Controls Matrix.
214
CSA
Cloud Security Alliance.
215
Proxy
Sits between the users and the external network. Receives the user requests and sends on their behalf. Useful for caching information, access control, URL filtering, content scanning.
NAT is a proxy. Most proxies in use are application proxy.
216
ICS
Industrial Control System.
217
SCADA
Supervisory Control and Data Acquisition (system).
218
OCSP Stapling
OCSP Stapling improves performance by positioning a digitally-signed and time-stamped version of the OCSP response directly on the webserver. This stapled OCSP response is then refreshed at predefined intervals set by the CA. The stapled OCSP response allows the web server to include the OCSP response within the initial SSL handshake, without the need for the user to make a separate external connection to the CA.
219
Certificate Pinning
Certificate pinning embeds or “pins” a certificate inside of an application.
When the application contacts a service, the service certificate will
be compared to the pinned certificate.
220
Certificate Chaining
Certificate chain (or Chain of Trust) is made up of a list of certificates that start from a server's certificate and terminate with the root certificate. If your server's certificate is to be trusted, its signature has to be traceable back to its root CA.
221
CRL
Certificate Revocation List.
222
HA
High Availability.
223
What is a Runbook?
A set of steps required to complete a task.
224
EDR
Endpoint Detection and Response.
225
Transitive Trust
A transitive trust states that if Domain A trusts Domain B, and Domain B trusts Domain C, then Domain A trusts Domain C. This trust relationship is not associated with the authentication process that occurs in any of these domains.
226
Pivot (point)
A pivot point is a point used for pen testing access, a jumping off point.
227
ECB
Electronic Code Book. A block cipher mode where each block is encrypted with the same key. In most use cases ECB is too simple to ensure data confidentiality. Don't use it!
228
PEAP
Protected Extensible Authentication Protocol. Builds a TLS tunnel that encapsulates EAP to ensure a protected authentication process.
229
HMAC and what is it commonly used with.
Hash-based Message Authentication Code. Commonly used with AH in IPsec.
230
DAC
Discretionary Access Control. An owner decides which users can access data through permissions.
231
WPA3
WiFi Protected Access 3. Uses GCMP block cipher mode. GCMP provides data confidentiality with AES and MIC.
232
AAA
Authentication, Authorization, and Accounting.
233
ABAC
Attribute Based Access Control. User is granted permissions based on their own attributes.
234
ACE
Access Control Entities.
Ace was the Entity that Controlled access to the doors.
235
ACL
Access Control List
236
Active Defense
The practice of responding to a threat by destroying or deceiving a threat actor's capabilities.
237
Adversarial AI
Using AI to identify vulnerabilities and attack vectors to circumvent security systems.
238
AES
Advanced Encryption Standard. Symmetric 128, 192, or 256 bit block cipher based on the Rijndael algorithm. Replaced DES.
239
Agile model
A software development model that focuses on iterative and incremental development to account for evolving requirements and expectations.
240
AIS
Automated Indicator Sharing. Threat intelligence data feed operated by the DHS.
241
DHS
Department of Homeland Security.
242
Application Aware Firewall
A layer 7 firewall technology that inspects packets at the Application layer.
243
Application Firewall
Software designed to run on a server to protect a particular application such as a web server or SQL server.
244
APT
Advanced Persistent Threat. An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.
245
Arduino
Open-source platform producing programmable circuit boards for education and industrial prototyping.
246
ARP Inspection
An optional security feature of a switch that prevents excessive ARP replies from flooding a network segment.
247
ARP Poisoning aka ARP Spoofing
Change the ARP table to redirect traffic to a different MAC address.
248
Asymmetric Algorithm (public key)
A cipher that uses public and private keys. Uses either RSA or ECC, but the private key is not derivable from the public one.
249
Attack Surface
The points at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.
250
Attack Vector
A specific path by which a threat actor gains unauthorized access to a system.
251
Authenticator
A PNAC switch or router that activates EAPoL and passes a supplicant's authentication data to an AS such as a RADIUS server.
252
EAPoL
Extensible Authentication Protocol over LAN.
253
BAS
Building Automation System. Components and protocols that facilitates the centralized configuration and monitoring of mechanical and electrical systems withing offices and data centers.
254
Baseband Radio
The chip and firmware in a smartphone that acts as a cellular modem.
255
Baseline Configuration
A collection of security and configuration settings that are to be applied to a particular system or network in the organization.
256
bash
Bourne again shell. A command shell and scripting language for Unix-like systems.
257
Bastion Host
A server typically found in a DMZ that is configured to provide a single service to reduce the possibility of a compromise.
A bastion does one thing.
258
Behavioral Analysis
A network monitoring system that detects changes in normal operating data sequences and identifies abnormal sequences. AKA behavior-based detection.
259
BIA
Business Impact Analysis. A systematic activity that identifies organizational risks and determines their effect on ongoing, mission critical operations.
260
Birthday Attack
A type of password attack that exploits weaknesses in the mathematical algorithms used to encrypt passwords, in order to take advantage of the probability of different password inputs producing the same encrypted output.
261
Block Cipher
A type of symmetric encryption that encrypts data one block at a time, often in a 64-bit block. It is usually more secure but slower than stream ciphers.
262
Blue Team
The defensive team in an exercise.
263
bluesnarfing
A wireless attack attack where the attacker gains access to information on a device using a Bluetooth connection.
264
boot attestation
Report of boot state integrity data that is signed by a tamper-proof TPM key and reported to a network server.
265
BPA
Business Partnership Agreement. Agreement by two companies to work together closely. Like Quizitive.
266
BPDU guard
Bridge Protocol Data Unit guard. Switch port security feature that disables the port if it receives BPDU notifications related to spanning tree. This is configured on access ports where any BPDU frames are likely to be malicious.
267
buffer overflow
An attack in which data goes past the boundary of the destination buffer and begins to corrupt adjacent memory. This can allow for system crashes or execution of arbitrary code.
268
bug bounty
Reward for reporting vulnerabilities.
269
C&C
Command and Control. AKA C2. An infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets.
270
CA
Certificate Authority. A server that guarantees subject identities by issuing signed digital certificate wrappers for their public keys.
271
CAC
Common Access Card. A smart card that provides certificate-based authentication and supports 2FA.
272
CAN bus
controller area network bus. A serial network designed to allow communications between embedded programmable logic controlers.
273
CAPTCHA
completely automated public Turing test to tell computers and humans apart.
274
Captive portal
A web page or website to which a client is redirected before being granted full network access.
275
capture the flag
Training event where learners must identify a token within a live network environment.
276
carving
The process of extracting data from a computer when that data has no associated file system metadata.
277
CASB
Cloud Access Security Broker. Enterprise management software designed to mediate access to cloud services by users across all types of devices.
278
CBC
Cipher Block Chaining. An encryption mode of operation where and XOR is applied to the first plaintext block.
279
CCMP and what does it do?
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol. An encryption protocol used for wireless LANs that address the vulnerabilities of WEP protocol.
280
CE
Cryptographic Erase. A method of sanitizing a self-encrypting drive by erasing the media encryption key.
It keeps erasing my memory of this acronym.
281
Chain of Custody
The record of evidence history from collection, to presentation in court, to disposal.
282
change control
the process by which the need for change is recorded and approved.
The approval process.
283
change management
The process through which changes to the configuration of information systems are implemented, as part of the organization's overall configuration management efforts.
284
CHAP
challenge handshake authentication protocol.
Developed for dial-up networks.
Uses an ecrypted three-way handshake to authenticate the client to the server.
The challenge-response is repeated throughout the connection.
285
checksum
The output of a hash function. chmod Linux command for managing file permissions.
286
CIA triad
Confidentiality, Integrity, Availability. The three principles of security control and mangement.
287
circuit-level stateful inspection firewall.
A Layer 5 firewall tech that tracks the active state of a connection, and can make decisions based on the contents of network traffic as it relates to the state of the connection.
288
CIS
Center for Internet Security. A not for profit.
289
Cloud deployement model
Classifying the ownership and managment of a cloud as public, private, community, or hybrid.
290
Cloud service model
classifying the provision of cloud services and the limit of cloud service provider's responsibility.
291
CN
Common Name. An X500 attribute expressing a host or username, also used as the subject identifier for a digital certificate.
292
COBO
Corporate Owned Business Owned (device).
293
code of conduct
Code on how to act.
294
code reuse
Potentially unsecure programming practice of using code originally written for a different context.
295
code signing
The method of using a digital signature to ensure the source and integrity of the programming code.
296
collector
A network appliance that thathers or receives log and or state data from other network systems.
297
collision
the act of two different plaintext inputs producing the same exact ciphertext output.
298
context-aware authentication
an access control scheme that verifies an object's identity based on various environmental factors like time location and behavior.
299
continuous deployment
software development method in which app and platform requirements are frequently tested and validated for immediate availability.
300
continuous deployement
software development method in which app and platform updates are committed to production rapidly.
301
continuous integration
software development method in which code updates are tested and committed to a development or build server/code repository rapidly.
302
control risk
risk that arises when a control does not provide the level of mitigation that was expected.
303
CTM
counter mode. an encryption mode of operation where a numerical counter value is used to create a constantly changing IV. AKA CM (counter mode)
304
credential stuffing
brute force attack in which stolen user account names and passwords are tested against multiple websites.
305
CRL
certificate revocation list. A list of certificates that were revoked before their expiration date.
306
crossover error rate
where FAR and FRR meet.
307
CTI
cyber threat intelligence
308
CVE
Common Vulnerabilities and Exposures.
309
CVSS
Common vulnerability scoring system. A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.
310
CYOD
Choose your own device.
311
data at rest
information that is primarily stored on specific media rather than moving from one medium to another
312
data controller
the entity that determines why and how personal data is collected, stored, and used.
313
data in processing
information that is present in the volitile memory of a host such as sysem memory or cache.
314
data in transit
information being transmitted between two hosts.
315
data masking
a deidentification method where generic or placeholder labels are usbstituted for real data whle preserving the structure oof the original data
316
data minimization
only necessary and sufficient personal information can be collected.
317
data remnant
leftover information on a storage medium after basic sanitation attempts
318
data sovereignty
the principle that countries and states may impose indivdual requirements on data collected or stored within their jurisdiction.
319
data steward
a person who is primarily responsible for data quality, ensuring data is labeled and identified with the appropriate meta data.
320
DHCP snooping
a configuration option that enables a switch to inspect DHCP traffic to prevent MAC spoofing.
321
defense in depth
multi-layered secruity.
322
deidentification
methods that remove identifying information from data before it is distributed.
323
DER
Distinguished encoding rules. The binary format used to structure the information in a digital certificate.
324
detective control
A type of security control that acts during an incident to identify or record what is happening.
325
deterrent control
A type security control that discourages intrusion attempts.
326
DH
Diffie-Hellman. A technique that provides a secure key exchange.
327
DHCP spoofing
An attack in which an attacker responds to a client requesting address assignment from a DHCP server.
328
DiffServe
The Differentiated Services Code Point (DSCP) field is used to indicate a priority value for layer 3 packet to facilitate QoS or Class of Service Scheduling (CoS).
329
digital signature
A message digest encrypted using the sender's private key that is appended to a message to authenticate the sender and prove message integrity.
330
directory serivce
A network service that stores identity information about all the objects in a particular network.
331
directory traversal
An application attack that allows access to commands, files, and directories.
332
diversity
Cybersecurity resilience strategy that increases attack costs by providing multiple types of controls, technologies, vendors, and crypto implementations.
333
DMZ
Demilitarized zone. A segment isolated from the rest of the private network by one or more firewalls that accepts connections from the internet over designated ports.
334
DNAT
Destination network address translation. A NAT service where private internal addresses are mapped to one or more public addresses to facilitate internet connectivity for hosts on a local network via a router.
335
DNS hijacking
An attack which an attacker modifies a computer's DNS configurations to point to a malicious DNS server.
336
DNS poisoning
An attack where the attacker exploits the open nature of the DNS system to redirect a dmain name to the wrong IP address. Often done by editing the host file.
337
DNSSEC
DNS Security Extensions. A security protocol that provides authentication of DNS data upholds DNS data integrity.
338
domain hijacking
The attacker steals a domain name by altering its registration information then transfers the domrain name to another entity. AKA brandjacking.
339
downgrade attack
a cryptographic attack where the attacker exploits the need for backwards compatibility to force a computer to abandon the user of encrypted messages in favor of plaintext messages.
340
DPO
Data privacy officer. Data governance role with responsibility for compliant collection and processing of personal and sensitive data.
341
DRP
Disaster recovery plan.
342
DSA
Digital signature algorithm. Public key encryption standard used for digital signatures that provides authentication and integrity verification for messages.
343
What is a login banner?
A text displayed by a host server containing details like software type and version running in a system or server.
344
