Brainscape Glossarry Flashcards
PPTP
Point-to-Point Tunneling Protocol
Developed by Cisco and Microsoft to support VPNs over PPP and TCP/IP. PPTP is highly vulnerable to password cracking attacks and considered obsolete.
ATT&CK
Adversarial Tactics, Techniques, and Common Knowledge
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and procedures.
XaaS
anything as a service
Expressing the concept that most types of IT requirements can be deployed as a cloud service model.
ARP
ARP poisoning
A network-based attack where an attacker with access to the target local network segment redirects an IP address to the MAC address of a computer that is not the intended recipient. This can be used to perform a variety of attacks, including DoS, spoofing, and Man-in-the-Middle.
asymmetric algorithm
A cipher that uses public and private keys. The keys are mathematically linked, using either Rivel, Shamir, Adleman (RSA) or elliptic curve cryptography (ECC) algorithms, but the private key is not derivable from the public one. An asymmetric key cannot reverse the operation it performs, so the public key cannot decrypt what it has encrypted, for example. Also known as Elliptic Curve Cryptography or ECC.
attack surface
The points at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.
attack vector
A specific path by which a threat actor gains unauthorized access to a system. Also known as vector.
authenticator
A PNAC switch or router that activates EAPoL and passes a supplicant’s authentication data to an authenticating server, such as a RADIUS server.
automation
Using scripts and APIs to provision and deprovision systems without manual intervention.
Autopsy
The Sleuth Kit is an open-source collection of command line and programming libraries for disk imaging and file analysis. Autopsy is a graphical frontend for these tools and also provides a case management/workflow tool. Also known as Sleuth Kit.
availability
The fundamental security goal of ensuring that computer systems operate continuously and that authorized persons can access data that they need.
baseband radio
The chip and firmware in a smartphone that acts as a cellular modem.
baseline configuration
A collection of security and configuration settings that are to be applied to a particular system or network in the organization.
behavioral analysis
A network monitoring system that detects changes in normal operating data sequences and identifies abnormal sequences. Also known as behavior-based detection.
birthday attack
A type of password attack that exploits weaknesses in the mathematical algorithms used to encrypt passwords, in order to take advantage of the probability of different password inputs producing the same encrypted output. This means that different passwords may have the same hash; the attacker can use any of these passwords to gain access.
block cipher
A type of symmetric encryption that encrypts data one block at a time, often in 64-bit blocks. It is usually more secure, but is also slower, than stream ciphers.
blockchain
A concept in which an expanding list of transactional records listed in a public ledger is secured using cryptography.
blue team
The defensive team in a penetration test or incident response exercise.
bluejacking
Sending an unsolicited message or picture message using a Bluetooth connection.
bluesnarfing
A wireless attack where an attacker gains access to unauthorized information on a device using a Bluetooth connection.
boot attestation
Report of boot state integrity data that is signed by a tamper-proof TPM key and reported to a network server.
botnet
A set of hosts that has been infected by a control program called a bot that enables attackers to exploit the hosts to mount attacks. Also known as zombie.
BASH
Bourne again shell
A command shell and scripting language for Unix-like systems. bastion host A server typically found in a DMZ that is configured to provide a single service to reduce the possibility of compromise.
BPDU guard
Bridge Protocol Data Unit guard
Switch port security feature that disables the port if it receives BPDU notifications related to spanning tree. This is configured on access ports where any BPDU frames are likely to be malicious.
BYOD
bring your own device
Security framework and tools to facilitate use of personally-owned devices to access corporate networks and data.
brute force attack
A type of password attack where an attacker uses an application to exhaustively try every possible alphanumeric combination to crack encrypted passwords.
buffer overflow
An attack in which data goes past the boundary of the destination buffer and begins to corrupt adjacent memory. This can allow the attacker to crash the system or execute arbitrary code.
bug bounty
Reward scheme operated by software and web services vendors for reporting vulnerabilities.
BAS
building automation system
Components and protocols that facilitate the centralized configuration and monitoring of mechanical and electrical systems within offices and data centers.
BIA
business impact analysis
A systematic activity that identifies organizational risks and determines their effect on ongoing, mission-critical operations.
BPA
business partnership agreement
Agreement by two companies to work together closely, such as the partner agreements that large IT companies set up with resellers and solution providers.
cable lock
Devices can be physically secured against theft using cable ties and padlocks. Some systems also feature lockable faceplates, preventing access to the power switch and removable drives.
captive portal
A web page or website to which a client is redirected before being granted full network access.
capture the flag
Training event where learners must identify a token within a live network environment.
card cloning/skimming
Duplicating a smart card by reading (skimming) the confidential data stored on it. Also known as skimming.
carving
The process of extracting data from a computer when that data has no associated file system metadata.
cat command
Linux command to view and combine (concatenate) files.
CIS
Center for Internet Security
A not-for-profit organization (founded partly by SANS). It publishes the well-known “Top 20 Critical Security Controls” (or system design recommendations).
CA
certificate authority
A server that guarantees subject identities by issuing signed digital certificate wrappers for their public keys.
CRL
certificate revocation list
A list of certificates that were revoked before their expiration date.
CSR
certificate signing request
A Base64 ASCII file that a subject sends to a CA to get a certificate.
chain of custody
The record of evidence history from collection, to presentation in court, to disposal.
CHAP
Challenge Handshake Authentication Protocol
Authentication scheme developed for dial-up networks that uses an encrypted three-way handshake to authenticate the client to the server. The challenge-response is repeated throughout the connection (though transparently to the user) to guard against replay attacks.
change control
The process by which the need for change is recorded and approved.
change management
The process through which changes to the configuration of information systems are implemented, as part of the organization’s overall configuration management efforts.
checksum
The output of a hash function.
chmod
Linux command for managing file permissions.
CYOD
choose your own device
Enterprise mobile device provisioning model where employees are offered a selection of corporate devices for work and, optionally, private use.
CBC
cipher block chaining
An encryption mode of operation where an exclusive or (XOR) is applied to the first plaintext block
circuit-level stateful inspection firewall
A Layer 5 firewall technology that tracks the active state of a connection, and can make decisions based on the contents of network traffic as it relates to the state of the connection.
clean desk policy
An organizational policy that mandates employee work areas be free from potentially sensitive information; sensitive documents must not be left out where unauthorized personnel might see them.
CASB
cloud access security broker
Enterprise management software designed to mediate access to cloud services by users across all types of devices.
cloud deployment model
Classifying the ownership and management of a cloud as public, private, community, or hybrid.
Cloud Security Alliance
Industry body providing security guidance to CSPs, including enterprise reference architecture and security controls matrix.
cloud service model
Classifying the provision of cloud services and the limit of the cloud service provider’s responsibility as software, platform, infrastructure,
CSP
cloud service provider
A vendor offering public cloud service models, such as PaaS, IaaS, or SaaS.
code of conduct
Professional behavior depends on basic ethical standards, such as honesty and fairness. Some professions may have developed codes of ethics to cover difficult situations; some businesses may also have a code of ethics to communicate the values it expects its employees to practice. Also known as ethics.
code reuse
Potentially unsecure programming practice of using code originally written for a different context.
code signing
The method of using a digital signature to ensure the source and integrity of programming code.
cold site
A predetermined alternate location where a network can be rebuilt after a disaster.
collector
A network appliance that gathers or receives log and/or state data from other network systems.
collision
In cryptography, the act of two different plaintext inputs producing the same exact ciphertext output.
C&C
command and control
An infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets. Also known as C2.
CAC
common access card
A smart card that provides certificate-based authentication and supports two-factor authentication. A CAC is produced for Department of Defense employees and contractors in response to a Homeland Security Directive.
CN
common name
An X500 attribute expressing a host or user name, also used as the subject identifier for a digital certificate.
Common Vulnerabilities and Exposures
Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.
CVSS
Common Vulnerability Scoring System
A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.
community cloud
A cloud that is deployed for shared use by cooperating tenants.
compensating control
A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.
CAPTCHA
completely automated public turing test to tell computers and humans apart
An image of text characters or audio of some speech that is difficult for a computer to interpret. CAPTCHAs are used for purposes such as preventing bots from creating accounts or submitting forms.
confidentiality
The fundamental security goal of keeping information and communications private and protecting them from unauthorized access.
CIA triad
confidentiality, integrity, and availability
The three principles of security control and management. Also known as the information security triad. or AIC triad.
containerization
A type of virtualization applied by a host operating system to provision an isolated execution environment for an application.
content filter
A software application or gateway that filters client requests for various types of internet content (web, FTP, IM, and so on).
context-aware authentication
An access control scheme that verifies an object’s identity based on various environmental factors, like time, location, and behavior.
continuous delivery
Software development method in which app and platform requirements are frequently tested and validated for immediate availability.
continuous deployment
Software development method in which app and platform updates are committed to production rapidly.
continuous integration
Software development method in which code updates are tested and committed to a development or build server/code repository rapidly.
continuous monitoring
The technique of constantly evaluating an environment for changes so that new risks may be more quickly detected and business operations improved upon. Also known as continuous security monitoring or CSM.
control risk
Risk that arises when a control does not provide the level of mitigation that was expected.
CAN bus
controller area network bus
A serial network designed to allow communications between embedded programmable logic controllers.
COBO
corporate owned, business only
Enterprise mobile device provisioning model where the device is the property of the organization and personal use is prohibited.
COPE
corporate owned, personally enabled
Enterprise mobile device provisioning model where the device remains the property of the organization, but certain personal use, such as private email, social networking, and web browsing, is permitted.
corrective control
A type of security control that acts after an incident to eliminate or minimize its impact.
correlation
Function of log analysis that links log and state data to identify a pattern that should be logged or alerted as an event.
counter mode CTM
An encryption mode of operation where a numerical counter value is used to create a constantly changing IV. Also referred to as CTM (counter mode) and CM (counter mode).
CCMP
counter mode with cipher block chaining message authentication code protocol
An encryption protocol used for wireless LANs that addresses the vulnerabilities of the WEP protocol.
credential stuffing
Brute force attack in which stolen user account names and passwords are tested against multiple websites.
crossover error rate
Biometric evaluation factor expressing the point at which FAR and FRR meet, with a low value indicating better performance.
XSRF
cross-site request forgery
A malicious script hosted on the attacker’s site that can exploit a session started on another site in the same browser. Also known as client-side request forgery or CSRF.
XSS
cross-site scripting
A malicious script hosted on the attacker’s site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site, circumventing the browser’s security model of trusted zones.
CE
cryptographic erase
A method of sanitizing a self-encrypting drive by erasing the media encryption key.
Cuckoo
Implementation of a sandbox for malware analysis.
curl command
Utility for command-line manipulation of URL-based protocol requests.
CTI
cyber threat intelligence
The process of investigating, collecting, analyzing, and disseminating information about emerging threats and threat sources. Also known as threat intelligence.
data at rest
Information that is primarily stored on specific media, rather than moving from one medium to another.
data breach
When confidential or private data is read, copied, or changed without authorization. Data breach events may have notification and reporting requirements.
data controller
In privacy regulations, the entity that determines why and how personal data is collected, stored, and used.
data custodian
An individual who is responsible for managing the system on which data assets are stored, including being responsible for enforcing access control, encryption, and backup/recovery measures.
data exfiltration
The process by which an attacker takes data that is stored inside of a private network and moves it to an external network.
data exposure
A software vulnerability where an attacker is able to circumvent access controls and retrieve confidential or sensitive data from the file system or database.
data governance
The overall management of the availability, usability, and security of the information used in an organization.
data in processing
Information that is present in the volatile memory of a host, such as system memory or cache.
data in transit
Information that is being transmitted between two hosts, such as over a private network or the Internet. Also known as data in motion.
DLP
data loss/leak prevention
A software solution that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks.
data masking
A deidentification method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data.
data minimization
In data protection, the principle that only necessary and sufficient personal information can be collected and processed for the stated purpose.
data owner
A senior (executive) role with ultimate responsibility for maintaining the confidentiality, integrity, and availability of an information asset.
DPO
data privacy officer
Institutional data governance role with responsibility
data processor
In privacy regulations, an entity trusted with a copy of personal data to perform storage and/or analysis on behalf of the data collector.
data remnant
Leftover information on a storage medium even after basic attempts have been made to remove that data. Also known as remnant.
data sovereignty
In data protection, the principle that countries and states may impose individual requirements on data collected or stored within their jurisdiction.
data steward
An individual who is primarily responsible for data quality, ensuring data is labeled and identified with appropriate metadata and that data is collected and stored in a format and with values that comply with applicable laws and regulations.
DCHP snooping
A configuration option that enables a switch to inspect DHCP traffic to prevent MAC spoofing.
dd command
Linux command that makes a bit-by-bit copy of an input file, typically used for disk imaging.
DDoS attack
An attack that uses multiple compromised hosts (a botnet) to overwhelm a service with request or response traffic.
dead code
Code in an application that is redundant because it will never be called within the logic of the program flow.
deauthentication/disassociation
Spoofing frames to disconnect a wireless station to try to obtain authentication data to crack.
deception and disruption
Cybersecurity resilience tools and techniques to increase the cost of attack planning for the threat actor.
default account
Default administrative and guest accounts configured on servers and network devices are possible points of unauthorized access.
defense in depth
A security strategy that positions the layers of network security as network traffic roadblocks; each layer is intended to slow an attack’s progress, rather than eliminating it outright.
degaussing
The process of rendering a storage drive inoperable and its data unrecoverable by eliminating the drive’s magnetic charge.
deidentification
In data protection, methods and technologies that remove identifying information from data before it is distributed.
DMZ
demilitarized zone
A segment isolated from the rest of a private network by one or more firewalls that accepts connections from the Internet over designated ports.
DoS attack
denial of service attack
Any type of physical, application, or network attack that affects the availability of a managed resource.
deprovisioning
The process of removing an application from packages or instances.
DNAT
destination network address translation
NAT service where private internal addresses are mapped to one or more public addresses to facilitate Internet connectivity for hosts on a local network via a router.
detective control
A type of security control that acts during an incident to identify or record that it is happening.
deterrent control
A type of security
Diamond Model
A framework for analyzing cybersecurity incidents.
dictionary attack
A type of password attack that compares encrypted passwords against a predetermined list of possible password values.
differential backup
A backup type in which all selected files that have changed since the last full backup are backed up.
DH
Diffie-Hellman
A cryptographic technique that provides secure key exchange.
digital signature
A message digest encrypted using the sender’s private key that is appended to a message to authenticate the sender and prove message integrity.
DSA
Digital Signature Algorithm
public key encryption standard used for digital signatures that provides authentication and integrity verification for messages.
directory service
A network service that stores identity information about all the objects in a particular network, including users, groups, servers, client computers, and printers.
directory traversal
An application attack that allows access to commands, files, and directories that may or may not be connected to the web document root directory.
DRP
disaster recovery plan
A documented and resourced plan showing actions and responsibilities to be used in response to critical incidents.
DAC
discretionary access control
Access control model where each resource is protected by an Access Control List (ACL) managed by the resource’s owner (or owners).
DER
distinguished encoding rules
The binary format used to structure the information in a digital certificate.
diversity
Cybersecurity resilience strategy that increases attack costs by provisioning multiple types of controls, technologies, vendors, and crypto implementations.
domain hijacking
A type of hijacking attack where the attacker steals a domain name by altering its registration information and then transferring the domain name to another entity. Sometimes referred to as brandjacking.
DNS hijacking
Domain Name System hijacking
An attack in which an attacker modifies a computer’s DNS configurations to point to a malicious DNS server.
DNS poisoning
Domain Name System poisoning
A network-based attack where an attacker exploits the traditionally open nature of the DNS system to redirect a domain name to an IP address of the attacker’s choosing.
DNSSEC
Domain Name System Security Extensions
A security protocol that provides authentication of DNS data and upholds DNS data integrity.
downgrade attack
A cryptographic attack where the attacker exploits the need for backward compatibility to force a computer system to abandon the use of encrypted messages in favor of plaintext messages.
dump file
File containing data captured from system memory.
dumpster diving Dumpster
The social engineering technique of discovering things about an organization (or person) based on what it throws away.
DHCP spoofing
Dynamic Host Configuration Protocol spoofing
An attack in which an attacker responds to a client requesting address assignment from a DHCP server.
EAP-FAST
EAP Flexible Authentication via Secure Tunneling
An EAP method that is expected to address the shortcomings of LEAP.
EAP-TLS
EAP Transport Layer Security
An EAP method that requires server-side and client-side certificates for authentication using SSL/ TLS.
EAP-TTLS
EAP Tunneled Transport Layer Security
An EAP method that enables a client and server to establish a secure connection without mandating a client-side certificate.
east-west traffic
Design paradigm accounting for the fact that data center traffic between servers is greater than that passing in and out (north-south).
edge computing
Provisioning processing resource close to the network edge of IoT devices to reduce latency.
e-discovery
Procedures and tools to collect, preserve, and analyze digital evidence.
elasticity
The property by which a computing environment can instantly react to both increasing and decreasing demands in workload.
ECC
elliptic curve cryptography
An asymmetric encryption algorithm that leverages the algebraic structures of elliptic curves over finite fields to derive public/private key pairs.
ESP
Encapsulating Security Protocol
IPSec sub-protocol that enables encryption and authentication of the header and payload of a data packet.
EOL
end of life
Product life cycle phase where sales are discontinued and support options reduced over time.
EOSL
end of service life
Product life cycle phase where support is no longer available from the vendor.
EDR
endpoint detection and response
A software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats.
EPP
endpoint protection platform
A software agent and monitoring system that performs multiple security tasks.
ERM
enterprise risk management
The comprehensive process of evaluating, measuring, and mitigating the many risks that pervade an organization.
entropy
A measure of disorder. Cryptographic systems should exhibit high entropy to better resist brute force attacks.
error handling
Coding methods to anticipate and deal with exceptions thrown during execution of a process.
escrow
In key management, the storage of a backup key with a third party.
evil twin
A wireless access point that deceives users into believing that it is a legitimate network access point.
XOR
Exclusive OR
An operation that outputs to true only if one input is true and the other input is false.
execution control
The process of determining what additional software may be installed on a client or server beyond its baseline to prevent the use of unauthorized software.
exploitation framework
Suite of tools designed to automate delivery of exploits against common software and firmware vulnerabilities.
EF
exposure factor
In risk calculation, the percentage of an asset’s value that would be lost during a security incident or disaster scenario.
EAP
Extensible Authentication Protocol
Framework for negotiating authentication methods that enables systems to use hardware-based identifiers, such as fingerprint scanners or smart card readers, for authentication.
EAPoL
Extensible Authentication Protocol over LAN
A port-based network access control (PNAC) mechanism that allows the use of EAP authentication when a host connects to an Ethernet switch.
extranet
A private network that provides some access to outside parties, particularly vendors, partners, and select customers.
failover
A technique that ensures a redundant component, device, or application can quickly and efficiently take over the functionality of an asset that has failed.
fake telemetry
Deception strategy that returns spoofed data in response to network probes.
FAR
false acceptance rate
Biometric assessment metric that measures the number of unauthorized users who are mistakenly allowed access.
false negative
In security scanning, a case that is not reported when it should be.
false positive
In security scanning, a case that is reported when it should not be.
FRR
false rejection rate
Biometric assessment metric that measures the number of valid subjects who are denied access.
Faraday cage
A wire mesh container that blocks external electromagnetic fields from entering into the container.
federation
A process that provides a shared login capability across multiple systems and enterprises. It essentially connects the identity management services of multiple systems.
FC
Fibre Channel
High speed network communications protocol used to implement SANs.
FPGA
field programmable gate array
A processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture.
FIM
file integrity monitoring
A type of software that reviews system files to ensure that they have not been tampered with.
FTPS
File Transfer Protocol Secure
A type of FTP using TLS for confidentiality.
fingerprint scanner
Biometric authentication device that can produce a template signature of a user’s fingerprint then subsequently compare the template to the digit submitted for authentication.
first responder
The first experienced person or team to arrive at the scene of an incident.
fog computing
Provisioning processing resource close to the network edge of IoT devices to reduce latency.
FTK
Forensic Toolkit
A commercial digital forensics investigation management and utilities suite, published by AccessData.
full backup
A backup type in which all selected files, regardless of prior state, are backed up. full tunnel VPN configuration where all traffic is routed via the VPN gateway.
FDE
full disk encryption
Encryption of all data on a disk (including system files, temporary files, and the pagefile) can be accomplished via a supported OS, third-party software, or at the controller level by the disk device itself.
fuzzing
A dynamic code analysis technique that involves sending a running
application random and unusual input so as to evaluate how the app responds.
gait analysis
Biometric mechanism that identifies a subject based on movement pattern.
GCM
Galois/Counter Mode
A mode of block chained encryption that provides message authenticity for each block.
GDPR
General Data Protection Regulation
Provisions and requirements protecting the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single Market are restricted unless protected by like-for-like regulations, such as the US’s Privacy Shield requirements.
geofencing
The practice of creating a virtual boundary based on real-world geography.
geolocation
The identification or estimation of the physical location of an object, such as a radar source, mobile phone, or Internet-connected computing device.
grep command
Linux command for searching and filtering input. This can be used as a file search tool when combined with ls.
group account
A group account is a collection of user accounts that are useful when establishing file permissions and user rights because when many individuals need the same level of access, a group could be established containing all the relevant users.
GPO
Group Policy Object
On a Windows domain, a way to deploy per-user and per-computer settings such as password policy, account restrictions, firewall status, and so on.
hardening
The process of making a host or app configuration secure by reducing its attack surface, through running only necessary services, installing monitoring software to protect against malware and intrusions, and establishing a maintenance schedule to ensure the system is patched to be secure against software exploits.
HSM
hardware security module
An appliance for generating and storing cryptographic keys. This sort of solution may be less susceptible to tampering and insider threats than software-based storage.
HMAC
hash-based message authentication code
A method used to verify both the integrity and authenticity of a message by combining a cryptographic hash of the message with a secret key.
hashcat
Command-line tool used to perform brute force and dictionary attacks against password hashes.
hashing
A function that converts an arbitrary length string input to a fixed length string output. A cryptographic hash function does this in a way that reduces the chance of collisions, where two different inputs produce the same output. Also known as message digest.
head command
Linux utility for showing the first lines in a file.
heat map
In a Wi-Fi site survey, a diagram showing signal strength at different locations.
heuristic analysis heuristic
A method that uses feature comparisons and likenesses rather than specific signature matching to identify whether the target of observation is malicious.
HA
high availability
The property that defines how closely systems approach the goal of providing data availability 100 percent of the time while maintaining a high level of system performance.
HOTP
HMAC-based One-time Password
An algorithm that generates a one-time password using a hash-based authentication code to verify the authenticity of the message.
homomorphic encryption
Method that allows computation of certain fields in a dataset without decrypting it.
honeypot honeynet
A host, network, or file set up with the purpose of luring attackers away from assets of actual value and/or discovering attack strategies and weaknesses in the security configuration. Also known as honeyfile.
horizontal privilege escalation
When a user accesses or modifies specific resources that they are not entitled to.
host-based firewall
A software application running on a single host and designed to protect only that host. Also known as personal firewall.
hot site
A fully configured alternate network that can be online quickly after a disaster.
hot/cold aisle
Arrangement of server racks to maximize the efficiency of cooling systems. Also known as cold/hot aisle.
HTML5 VPN
Using features of HTML5 to implement remote desktop/VPN connections via browser software (clientless).
hybrid cloud
A cloud deployment that uses both private and public elements.
IAM
identity and access management
A security process that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets like networks, operating systems, and applications.
identity fraud
The invention of fake personal information or the theft and misuse of an individual’s personal information.
identity provider
In a federated network, the service that holds the user account and performs authentication.
IEEE 802.1X
A standard for encapsulating EAP communications over a LAN (EAPoL) to implement port-based authentication.
implicit deny
A basic principle of security stating that unless something has explicitly been granted access, it should be denied access.
IRP
incident response plan
Specific procedures that must be performed if a certain type of event is detected or reported.
incremental backup
A backup type in which all selected files that have changed since the last full or incremental backup (whichever was most recent) are backed up.
IoC
indicator of compromise
A sign that an asset or network has been attacked or is currently under attack.
industrial camouflage
Methods of disguising the nature and purpose of buildings or parts of buildings.
ICS
industrial control system
A network managing embedded devices (computer systems that are designed to perform a specific, dedicated function).
ISAC
Information Sharing and Analysis Center
Not-for-profit group set up to share sector-specific threat intelligence and security best practices amongst its members.
IaaS
Infrastructure as a Service
A computing method that uses the cloud to provide any or all infrastructure needs.
