CEH Deck 3 Flashcards
Coninue Glossary decks
hash
A unique numerical string, created by a hashing algorithm on a given piece of data, used to verify data integrity.
Generally hashes are used to verify the integrity of files after download (comparison to the hash value on the site before download) and/or to store password values.
heuristic scanning
Method used by antivirus software to detect new, unknown viruses that have not yet been identified; based on a piece-by-piece examination of a program, heuristic scanning looks for a sequence or sequences of instructions that differentiate the virus from “normal” programs.
hashing algorithm
A one-way mathematical function that generates a fixed-length numerical string (hash) from a given data input. MD5 and SHA-1 are hashing algorithms.
Host-based IDS (HIDS)
Host-based IDS. An IDS that resides on the host, protecting against file and folder manipulation and other host-based attacks and actions.
information technology (IT) asset criticality
The level of importance assigned to an IT asset.
information technology (IT) asset valuation
The monetary value assigned to an IT asset.
inference attack
An attack in which the hacker can derive information from the cipher text without actually decoding it.
Sensitive information can be considered compromised if an adversary can infer its real value with a high level of confidence.
Lightweight Directory Access Protocol (LDAP)
An industry-standard protocol used for accessing and managing information within a directory service; an application protocol for querying and modifying data using directory services running over TCP/IP.
limitation of liability and remedies
A legal limit on the amount of financial liability and remedies the organization is responsible for taking on.
local area network (LAN)
A computer network confined to a relatively small area, such as a single building or campus.
logic bomb
A piece of code intentionally inserted into a software system that will perform a malicious function when specified conditions are met at some future point.
malware
A program or piece of code inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system.
Malware consists of viruses, worms, and other malicious code.
mandatory access control (MAC)
A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (that is, clearance) of users to access information of such sensitivity.
man-in-the-middle attack
An attack where the hacker positions himself between the client and the server to intercept (and sometimes alter) data traveling between the two.
mantrap
A small space having two sets of interlocking doors; the first set of doors must close before the second set opens.
Typically authentication is required for each door, often using different factors.
For example, a smartcard may open the first door, and a personal identification number entered on a number pad opens the second.
network access server
A device providing temporary, on-demand, point-to-point network access to users.
Network Address Translation (NAT)
A technology where you advertise one IP address externally and data packets are rerouted to the appropriate IP address inside your network by a device providing translation services.
In this way, IP addresses of machines on your internal network are hidden from external users.
Network Basic Input/Output System (NetBIOS)
An API that provides services related to the OSI model’s Session layer, allowing applications on separate computers to communicate over a LAN.
operating system attack
An attack that exploits the common mistake many people make when installing operating systems—that is, accepting and leaving all the defaults.
out-of-band signaling
Transmission using channels or frequencies outside those normally used for data transfer; often used for error reporting.
outsider associate
A untrusted outsider using open, or illicitly gained, access to an organization’s resources.
overt channel
A communications path, such as the Internet, authorized for data transmission within a computer system or network.
Packet Internet Groper (ping)
A utility that sends an ICMP Echo message to determine whether a specific IP address is accessible; if the message receives a reply, the address is reachable.
parameter tampering
An attack where the hacker manipulates parameters within the URL string in hopes of modifying data.
