Complete Study Material Flashcards
(324 cards)
1
Q
Typosquatting
A
relies on mistakes such as typos made by Internet users when inputting a website address into a web browser
2
Q
Pretexting
A
Pretexting is a type of social engineering attack that involves a situation, or pretext, created by an attacker in order to lure a victim into a vulnerable situation
3
Q
Pharming
A
Pharming is a more advanced method that manipulates DNS records, redirecting users to fake websites without their knowledge
4
Q
Watering Hole Attack
A
a targeted attack designed to compromise users within a specific industry or group of users by infecting websites they typically visit and luring them to a malicious site
5
Q
Influence Campaigns
A
a large-scale campaign launched by a threat actor, or group of threat actors, with a lot of power (like a hacktivist group, nation-state actor, or terrorist group) that seeks to shift public opinion
6
Q
Worms
A
A worm can self-replicate and spread to other computers
7
Q
Trojan
A
a type of malware that downloads onto a computer disguised as a legitimate program
8
Q
Rootkit
A
A rootkit is malicious software code that provides bad actors with “root” access to an endpoint device kernel or core system files
9
Q
Virus
A
A computer virus is a type of malicious software, or malware, that spreads between computers and causes damage to data and software
10
Q
Backdoor
A
a means of bypassing an organization’s existing security systems
11
Q
RAT
A
malware that can control a computer using desktop sharing and other administrative functions
12
Q
Logic Bomb
A
A logic bomb is malware that installs and operates silently until a certain
event occurs
13
Q
Password Spray
A
Password attack in which the same password is attempted across many accounts
14
Q
Brute Force
A
Password attack in which many passwords are attempted against an account to eventually gain access
15
Q
Rainbow Tables
A
Pre-built set of hashes. Requires different tables for different hashing methods
16
Q
Salt
A
Random data added to a password when hashing. Prevents the success of rainbow tables and significantly slows down brute force attacks
17
Q
Dictionary Attack
A
Password attacks where a “dictionary” or list of common words are used to guess an account’s password. Some password crackers can substitute letters for numbers and special characters (3/E, 1/!, A/@)
18
Q
Hash Collision
A
Occurs when two entirely unique input values have the same hash
19
Q
Downgrade Attack
A
Forces the system to downgrade their security measures, such as rolling back to vulnerable or un-patched versions.
20
Q
Birthday Attack
A
An example of a hash collision
21
Q
Mitigating Privilege Escalation
A
Patch vulnerabilities quickly, update security software, only allow data execution is certain areas, and randomize address space layout
22
Q
XSS
A
Cross-Site Scripting is a vulnerability found on web-based application, which allows an attacker to run scripts in a user input (such as text field) to obtain credentials, session IDs, cookies, etc.
Non-persistent (reflected) vs. Persistent (stored)
23
Q
SQL Injection
A
SQL Injection is an attack which allows the attacker to input SQL code into a text field to interact with the data stored in the SQL database. Input validation misconfiguration is typically the cause.
24
Q
Buffer Overflow
A
When a section of memory is able to spill over and overwrite another section of memory.
25
DLL Injection
Dynamic Link Library Injection copies a DLL into an existing/valid process, causing the process to execute with the DLL
26
Replay Attack
An attacker with access to raw network data is able to copy traffic and "replay" the data across the network to appear as someone else
Pass the hash is an example of a Replay Attack, where an attacker may be listening in on an authentication between a client and server and capture the hash, and pretend to be the user by sending the server those authentication details.
27
Server Side Request Forgery (SSRF)
Attacker finds a vulnerable web application and is able to send requests to the web server, causing it to perform the request on behalf of the attacker
28
Cross-Site Request Forgery (CSRF)
Takes advantage of the trust that a website has with the browser, allowing for an attacker to send requests to a web server on a victim's behalf.
Often requires victim to perform an action such as clicking a link to pass on the forged request
29
Shimming
Shimming is inserting code into a system library or API
30
Refactoring
Refactoring code is the process of rewriting the internal processing of the code, without changing its external behavior
31
SSL Stripping / HTTP Downgrade
a type of cyber attack in which hackers downgrade a web connection from the more secure HTTPS to the less secure HTTP. This makes all communications unencrypted and sets the stage for a man-in-the-middle attack
32
SSL & TLS
Transport Layer Security (TLS) is the upgraded version of SSL that fixes existing SSL vulnerabilities. TLS authenticates more efficiently and continues to support encrypted communication channels
33
Race Condition
A race condition is an undesirable situation that occurs when a device or system attempts to perform two or more operations at the same time
34
Memory Vulnerabilities
Examples of Memory Vulnerabilities include Memory Leaks, NULL Pointer dereference, and Integer Overflow
35
Memory Leak
A memory leak occurs when a process allocates memory from the paged or nonpaged pools, but doesn't free the memory. As a result, these limited pools of memory are depleted over time, causing Windows to slow down. If memory is completely depleted, failures may result
36
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit
37
Integer Overflow
An integer overflow occurs when you attempt to store inside an integer variable a value that is larger than the maximum value the variable can hold
38
Directory Traversal
A directory traversal is an HTTP attack that allows attackers to gain access to restricted files
39
Improper Error Handling
Improper handling of errors can introduce a variety of security problems for a web site. The most common problem is when detailed internal error messages such as stack traces, database dumps, and error codes are displayed to the user (hacker)
40
Improper Input Handling
Improper input handling is one of the most common weaknesses identified across applications today. Poorly handled input is a leading cause behind critical vulnerabilities that exist in systems and applications
41
Resource Exhaustion
It's a type of attack that uses up the available resources on a device so that the application or the service that's being used by it is no longer accessible by others
42
Rogue Access Points
a wireless access point plugged into an organization's network that the security team does not know exists
43
Evil Twin
An evil twin attack is a cyberattack that works by tricking users into connecting to a fake Wi-Fi access point
44
Bluejacking
Bluejacking is when an attacker sends unsolicited messages to a victim's Bluetooth-enabled device
45
Bluesnarfing
accessing data through an unauthorized wireless connection
46
RF Jamming
RF Jamming, or Radio Frequency Jamming, is the concept of blocking a wireless device from communicating with other devices or a wireless
47
Interference
Unintentional jamming
48
RFID Attacks
RFID tags can be counterfeited, spoofed, sniffed, and even carry viruses that infect RFID readers and their associated networks
49
Near Field Communication (NFC)
Builds on RFID to enable two-way wireless communication. Similar vulnerabilities as RFID
50
Cryptographic nonce
A nonce is an arbitrary number used only once in a cryptographic communication, in the spirit of a nonce word. They are often random or pseudo-random numbers used in live data transmission to protect against replay attacks
51
Initialization Vector (IV)
An initialization vector (IV) is an arbitrary number that can be used with a secret key for data encryption to foil cyber attacks
52
On-Path Attacks
An on-path attack is an attacker that sits in the middle between two stations and is able to intercept, and in some cases, change that information that’s being sent interactively across the network
53
Media Access Control (MAC) Flooding
In a typical MAC Flooding attack, the attacker sends Ethernet Frames in a huge number. When sending many Ethernet Frames to the switch, these frames will have various sender addresses. The intention of the attacker is consuming the memory of the switch that is used to store the MAC address table. The MAC addresses of legitimate users will be pushed out of the MAC Table
54
Media Access Control (MAC) Cloning
MAC Cloning is the act of changing or impersonating the MAC address of a network interface card to match the MAC address of an authorized device on the network
55
DNS Poisoning
Domain Name System (DNS) poisoning happens when fake information is entered into the cache of a domain name server, resulting in DNS queries producing an incorrect reply, sending users to the wrong website
56
Domain Hijacking
Domain hijacking is the act of changing the registration of a domain name without the permission of the original owner
57
URL Hijacking
Another term for Typosquatting, which takes advantage of a user's ability to enter typos when navigating to a website
58
Threat Actor Types
Threat actor types include Insiders, Nation States, Hacktivists, Script Kiddies, Organized Crime, Competitors, and Hackers
59
Insiders
An employee with extensive internal resources and knowledge of vulnerable systems
60
Nation States
Government-funded entities with various political and economic motives
61
Hacktivists
groups of criminals who unite to carry out cyber attacks in support of political causes
62
Script Kiddies
novice hackers who use existing scripts and software to carry out cyberattacks
63
Organized Crime
Well-funded professional criminals with sophisticated knowledge, typically motivated by money.
64
Competitors
Motives include espionage, harming competitor reputation, stealing customer data and financial information
65
Open Source Intelligence (OSINT)
he collection and analysis of data gathered from open sources (covert sources and publicly available information; PAI) to produce actionable intelligence
66
Zero-Day Attacks
A zero-day exploit is a cyberattack vector that takes advantage of an unknown or unaddressed security flaw
67
Known vs Partially Known Environment
Used to describe the access/knowledge granted to an attacker during Pentest
68
Passive Footprinting
This involves gathering information about the target without direct interaction, such as OSINT or other publicly available data
69
Active Footprinting
the process of using tools and techniques, such as performing a ping sweep or using the traceroute command, to gather information on a target
70
Data Masking Techniques
Data Masking techniques include substituting, shuffling, encrypting data
71
Data at-rest
The data is on a storage device
72
Data in-transit
Data transmitted over the network
73
Data in-use
Data is actively processing in memory and almost always decrypted
74
Tokenization
Replace sensitive data with a non-sensitive placeholder. Common with credit card processing
75
Information Rights Management (IRM)
The concept of controlling how data is used; restrict data access to unauthorized persons
76
Web Application Firewall (WAF)
Helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet
77
Hot Site
A hot site is a DR location that is set up and ready to go -- that is, one can arrive and continue to work immediately.
78
Cold Site
a cold site is essentially available space with little, if anything, set up in it. When you arrive at a cold backup site, you need to set up the equipment, make all connections, load the software, etc
79
Warm Site
a facility where equipment is available and set up for you, but you must load or restore your latest data to the system
80
DNS Sinkhole
a mechanism aimed at protecting users by intercepting DNS request attempting to connect to known malicious or unwanted domains and returning a false, or rather controlled IP address
81
Cloud Deployment Models
Cloud models include Public, Community, Private, and Hybrid deployments
82
Public Cloud Deployment Model
Available to everyone over the internet
83
Community Cloud Deployment Model
Resources shared by several organizations
84
Private Cloud Deployment Model
Your own virtualized local data center
85
Hybrid Cloud Deployment Model
Combination of Public & Private
86
Cloud Computing
Computing on demand with massive data storage capacity. Often fast implementation with smaller startup costs. Could come with limited bandwidth/latency issues and is difficult to protect data
87
Fog Computing
Cloud that's closed to your data, commonly referred to as an extension of the cloud. Data is processed locally, minimizing security concerns
88
Edge Computing
Processing data on an edge server close to the user, oftentimes processing the data on the device itself
89
Elasticity
the ability of a system to adapt and manage resources according to workload requirements
90
Containerization
Containerization is a type of virtualization in which all the components of an application are bundled into a single container image and can be run in isolated user space on the same shared operating system
91
Virtual Desktop Infrastructure (VDI)
the hosting of desktop environments on a central server. It is a form of desktop virtualization, as the specific desktop images run within virtual machines (VMs) and are delivered to end clients over a network
92
Software Defined Networking (SDN)
an approach to networking that uses software-based controllers or application programming interfaces (APIs) to communicate with underlying hardware infrastructure and direct traffic on a network
93
Software Defined Visibility (SDV)
Network visibility made available through security devices
94
Federation
Interconnected digital business networks with the ability to transparently send data and messages between parties, such that all the networks function as one network
95
Attestation
Providing proof of something
96
Time-based One-Time Password (TOTP)
a string of dynamic digits of code, whose change is based on time
97
HMAC-based One-Time Password (HOTP)
an event-based OTP where the moving factor in each code is based on a counter
98
Biometric False Acceptance Rate (FAR)
FAR occurs when we accept a user whom we should actually have rejected
99
Biometric False Rejection Rate (FRR)
FRR is the problem of rejecting a legitimate user when we should have accepted him
100
Crossover Error Rate (CER)
describes the point where the False Reject Rate (FRR) and False Accept Rate (FAR) are equal
101
AAA Framework
authentication, authorization, and accounting. AAA is a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services
102
Redundant Array of Independent Disks (RAID)
RAID (redundant array of independent disks) is a way of storing the same data in different places to provide increased speed, fault tolerance, and redundancy. Multiple disks/drives working in parallel.
103
RAID 0
Striping without parity - Great performance, but is not fault-tolerant. If one drive fails, all data in RAID 0 is lost. Requires two drives
104
RAID 1
Mirroring - Great r/w speed. In the event of a drive failure, data does not have to be rebuilt, just copied to the replacement drive from the still-functional mirror drive. Requires two drives
105
RAID 5
Striping with parity. RAID 5 is the most common secure RAID level, ideal for mission critical storage. If a drive fails, you have access to all data even while failed drive is being replaced. Requires 3+ drives
106
RAID 10
Combines characteristics of RAID 1 and RAID 0. If something goes wrong with one of the disks, the rebuild time is very fast. Half of storage capactity goes to mirroring, so this is expensive redundancy.
107
NIC Teaming
Network Interface Card (NIC) teaming is a common technique of grouping physical network adapters to improve performance and redundancy. NIC teaming maintains a connection to multiple physical switches but uses a single IP address. This ensures readily available load balancing and instant fault tolerance
108
Uninterruptable Power Supply (UPS)
a device that provides backup power to electrical systems during power outages or fluctuations. It helps to ensure uninterrupted operation and protect sensitive equipment from potential damage
109
Power Distribution Units (PDU)
a device with multiple power outlets that provides electrical protection and distributes power to IT equipment within a rack
110
Full Backups
A full backup is the most complete type of backup where you clone all the selected data
111
Incremental Backups
The first backup in an incremental backup is a full backup. The succeeding backups will only store changes that were made to the previous backup
112
Differential Backups
This type of backup involves backing up data that was created or changed since the last full backup
113
High Availability (HA)
High availability (HA) is the ability of a system to operate continuously without failing for a designated period of time
114
System on a Chip (SoC)
Embedded system that has multiple components running on a single chip. Limited off the shelf security options.
115
Internet of Things (IoT)
Smart devices, wearable technology, facility automation sensors for heating and cooling, lighting, etc.
116
Field Programmable Gate Array (FPGA)
Integrated circuit that's configured after manufacturing, often programmed in the field. Problems don't require hardware replacements
117
SCADA / Industrial Control Systems (ICS)
Large-scale multi-site systems. PCs manage facilities and equipment. No access from outside
118
Multifunction Devices (MFD)
All-in-one devices such as printers, scanners, fax machines. Logs stored on the local device.
119
Real-Time Operating System (RTOS)
Deterministic processing schedule. Commonly used in industrial equipment, automobiles, and military environments
120
Narrowband
Communication of analog signals over narrow range of frequencies, used for longer distance communication by IoT devices
121
Baseband
Generally a single cable with digital signal, either 0 or 100% utilization of bandwidth.
122
5G
5th Generation cellular networking with significant impact to IoT devices, allowing larger data transfers, faster monitoring and additional processing
123
Faraday Cage
A mesh conductive metal cage used to block electromagnetic fields
124
Screened Subnet / DMZ
Also known as a DMZ, this sits between the internal network and public internet, providing public access to select public resources
125
USB Data Blocker
Allows power supply but rejects data transfer
126
Air Gap
Term used to describe a physical separation between networks
127
Hot / Cold Aisles
Aisles at a data center used to control air flow to optimize cooling and conserve energy
128
Degaussing
the destruction of the data on a data storage device by removing its magnetism
129
Pulping
Process of removing ink from paper, breaking the paper down into pulp, and re-using the recycled paper.
130
Key Stretching
Taking an input password and running it through a hashing algorithm multiple times. "Hashing the hash".
131
Homomorphic Encryption (HE)
the conversion of data into ciphertext that can be analyzed and worked with as if it were still in its original form.
132
Elliptic Curve Cryptography (ECC)
Use curves instead of large prime numbers. Uses smaller keys and requires less data transmission and storage. Great for allowing asymmetric encryption capabilities on IoT and mobile devices
133
Perfect Forward Secrecy (PFS)
An encryption system that changes the keys used to encrypt and decrypt information frequently and automatically
134
Steganography
the practice of representing information within another message or physical object, such as hiding data in an image.
135
Stream Ciphers
Encypts and stores 1 byte of plain-text at a time. High speed, low complexity. Used commonly in symmetric encryption. Often combines keys with an Initialization Vector
136
Block Ciphers
Encrypts/stores a block of bits at a time, typically 64 or 128-bits. Padding added to fill incomplete blocks.
137
Electronic Codebook (ECB)
The simplest encryption mode, using a single encryption key for every block in the series.
138
Cipher Block Chaining (CBC)
Another encryption method, where each block is XORed with previous ciphertext block, adding additional randomization. Initialization Vector added to first block prior to encryption. Each subsequent block uses the previous ciphertext as the IV.
139
Blockchain
Distributed ledger used to keep track of a particular event.
Process begins with a transaction, which is copied to each device participating in the blockchain. Once verified, it's added into the existing block of transactions. Hashing is used with each transaction. The hash is then added to the block, which allows for validation that nothing has changed, and the block is added to the chain of existing blocks, available for all participating nodes.
140
Secure Real-Time Transport Protocol (SRTP)
Secure Real-time Transport Protocol (SRTP) is a network protocol for delivering audio and video over IP networks (VOIP). Utilizes a broad range of UDP ports.
141
Secure Network Time Protocol (SNTP)
Simple Network Time Protocol (SNTP) is an Internet Protocol (IP) used to synchronize the clocks of networks of computers. SNTP is over port 123.
142
Secure/Multipurpose Internet Mail Extensions (S/MIME)
A set of specifications for securing electronic mail. S/MIME is based upon the widely used MIME standard and describes a protocol for adding cryptographic security services through MIME encapsulation of digitally signed and encrypted objects
143
Simple Mail Transfer Protocol (SMTP)
SMTP is used for email transmissions over port 25. SMTPS (SMTP Secure) provides encryption and is over port 587.
144
Internet Protocol Security (IPSec)
a set of communication rules or protocols for setting up secure connections over a network utilizing encryption and authentication
145
Authentication Header (AH)
The IPSec component that provides integrity through hashing the packet. The AH gets added to the data being sent across the network.
146
Encapsulation Security Payload (ESP)
The IPSec component that provides encryption functionality. Adds ESP headers and trailers to the data
147
File Transfer Protocol Secure (FTPS)
Uses SSL to encrypt information sent over FTP. FTP is over port 20 and 21.
148
Remote Desktop Protocol (RDP)
RDP enables users to remotely connect to their desktop computers from another device over port 3389.
149
SSH File Transfer Protocol (SFTP)
Uses SSH to encrypt information sent over FTP client. SFTP utilizes SSH using port 22.
150
Lightweight Directory Access Protocol (LDAP)
Protocol used to access a centralized directory. LDAPS is a non-standard version of LDAP using SSL for encryption. LDAP is over port 389 and 636
151
Domain Name System Security Extensions (DNSSEC)
Security features added to DNS protocol. Allows validation of information received from a DNS server through the use of digital signatures.
152
Simple Network Management Protocol Version 3 (SNMPv3)
Provides secure access to devices by authenticating and encrypting data packets over the network. SNMP is over port 161 and 162.
153
Next Generation Firewall (NGFW)
A security appliance that processes network traffic and applies rules to block potentially dangerous traffic. Allows for IPS, deep packet inspection, and application control, in addition to features provided by standard firewalls.
154
Boot Integrity
Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running
155
Secure Boot
This is a feature of the Unified Extensible Firmware Interface (UEFI) that helps ensure that only trusted software is loaded during the boot process. It prevents the loading of malware or unauthorized operating systems during the boot sequence.
156
Trusted Boot
Trusted Boot is a broader term that encompasses the concept of using trusted hardware and software components to ensure the integrity of the boot process. This can include technologies such as Secure Boot and Measured Boot, as well as the use of hardware-based security features like TPMs
157
Measured Boot
Measured Boot is a feature that creates a record, or measurement, of the boot process. This record is then stored in a trusted location such as a Trusted Platform Module (TPM). By comparing this measurement with a known good measurement, it's possible to detect any unauthorized changes to the boot process
158
Fuzzing
an automated software testing method that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities
159
Static Application Security Testing (SAST)
a testing methodology that analyzes source code to find security vulnerabilities that make your organization's applications susceptible to attack
160
Full Disk Encryption (FDE)
Full-disk encryption (FDE) is a security method for protecting sensitive data at the hardware level by encrypting all data on a disk drive
161
Self-Encrypting Drive (SED)
All of the data written to the storage medium is encrypted by the disk drive before being written and decrypted by the disk drive when it is read
162
East-West Traffic
refers to network traffic that occurs within an organization's internal network
163
North-South Traffic
network traffic that enters or exits an organization's internal network
164
VPN Concentrator
A hardware device that creates and helps to manage multiple VPN connections remotely by creating safe tunnels on a large scale
165
Full Tunnel VPN
This means that every data packet, whether browsing a website, accessing emails, or streaming media, is encrypted and passed through the VPN before reaching its final destination on the internet
166
Split Tunnel VPN
only specific traffic is sent through the VPN tunnel, while the rest of the traffic is directly routed to the internet without passing through the VPN server
167
IPSec Transport Mode
Sends original IP Header with the data, but the data is surrounded by an IPSec Header and Trailer. IP Header remains in the clear.
168
IPSec Tunnel Mode
IP Header and Data are both encrypted. The original IP Header and Data are surrounded an IPSec Headers and Trailer, and a new IP header will be used to send across the network.
169
802.1D Loop Protection
Also known as Spanning Tree Protocol (STP), this prevents loops and selects the best LAN path, providing redundancy of a link were to fail.
170
MAC Filtering
MAC address filtering allows you to block traffic coming from certain known machines or devices
171
Unified Threat Management (UTM) / All-in-One Security Appliance
Unified threat management (UTM) refers to when multiple security features or services are combined into a single device within your network. Using UTM, your network’s users are protected with several different features, including antivirus, content filtering, email and web filtering, anti-spam, and more
172
Proxy
A proxy server is an intermediary server that retrieves data from an Internet source, such as a webpage, on behalf of a user. Protects the client
173
Reverse Proxy
A server that sits in front of one or more web servers to intercept and inspect incoming client requests before forwarding them to the web server. Protects the server
174
Hardware Security Module (HSM)
a physical computing device that safeguards and manages secrets (most importantly digital keys), performs encryption and decryption functions for digital signatures, strong authentication and other cryptographic functions
175
Jump Server
a secure computer that spans two or more networks, allowing users to connect to it from one network, and then “jump“ to another network
176
Wired Equivalent Privacy (WEP)
Earliest security protocol used for securing wireless networks. No longer used due to vulnerabilities.
177
Wifi-Protected Access (WPA)
Wireless security protocol developed to solve the problems with WEP. Utilizes TKIP (Temporal Key Integrity Protocol) to dynamically change keys. TKIP has vulnerabilities of it's own.
178
Wifi-Protected Access II (WPA2)
Wireless security protocol designed to improve upon WPA. Requires stronger encryption method AES, strong enough to resist brute-force attacks.
179
Wifi-Protected Access 2 Pre-Shared Key (WPA2 PSK)
WPA2-PSK stands for Wi-Fi Protected Access 2 – Pre-Shared Key. It uses the same passphrase for all devices.
180
Simultaneous Authentication of Equals (SAE)
key exchange protocol designed to establish a shared secret between two devices and securing the key exchange process as part of the WPA3 security standard.
181
Diffie-Hellman
Diffie–Hellman key exchange establishes a shared secret between two parties that can be used for secret communication for exchanging data over a public network
182
802.1X
a network authentication protocol that requires client authentication for access to a network. The clients identity is determined based on the credentials or certificate they provide, which is validated by an authentication server using the RADIUS protocol.
183
Wifi Protected Access 3 (WPA3)
WPA3 introduces the "Simultaneous Authentication of Equals" (SAE) or Dragonfly protocol
184
Wifi-Protected Setup (WPS)
A feature designed to make the process of connecting to a secure wireless network from a computer or other device easier
185
Extensible Authentication Protocol (EAP)
a framework for providing authentication that allows for the use of many different authentication methods for secure network access technologies - Generally 4 Common versions - LEAP, FAST, PEAP, and EAP-TLS.
186
EAP Flexible Authentication via Secure Tunneling (EAP FAST)
a version of EAP that enables mutual authentication between a client and an authentication server via a secure tunnel. Does not require use of certificates.
187
Protected Extensible Authentication Protocol (PEAP)
version of EAP that enables mutual authentication between a client and authentication server. Authentication server utilizes digital certificates to provide authentication, whereas the client provides standard credentials.
188
EAP Transport Layer Security (EAP-TLS)
version of EAP that enables mutual authentication between a client and authentication server through the use of digital certificates on both sides.
189
MSCHAPv2
a widely used authentication protocol primarily used for securing remote access connections in Virtual Private Networks (VPNs). MSCHAPv2 is used to verify the identity of a user or device trying to establish a connection to a network or a remote server
190
Mobile Device Management (MDM)
Mobile device management (MDM) is the administration of mobile devices, such as smartphones, tablet computers, and laptops
191
Rooting/Jailbreaking/Sideloading
Gaining access to the operating system to install custom firmware. Provides uncontrolled access
192
Hotspot/Tethering
the linking of a computer or other device to a smartphone in order to connect to the internet
193
Corporate Owned, Personally Enabled (COPE)
Corporate owned devices given to users that they can also use for personal use
194
Cloud Access Security Broker (CASB)
ensure regulatory compliance and data protection, govern cloud usage across devices and cloud applications, and protect against threats
195
Next-Gen Secure Web Gateway (SWG)
secure web gateways are a mix of tools specifically designed to protect users and their devices while browsing the internet beyond examining URLs and GET requests
196
Trusted Platform Module (TPM)
a physical or embedded security technology (microcontroller) that resides on a computer's motherboard or in its processor. TPMs use cryptography to help securely store essential and critical information on PCs to enable platform authentication
197
Challenge-Handshake Authentication Protocol (CHAP)
an identity checking protocol that periodically re-authenticates the user during an online session
198
TACACS
Terminal Access Controller Access-Control System, is a network protocol that was developed by Cisco and controls user access to devices like routers, NAS, and switches, separating authentication and allowing fine-grained access control
199
Kerberos
Kerberos is a computer network security protocol that authenticates service requests between two or more trusted hosts across an untrusted network, like the internet. Enables SSO
200
Security Assertion Markup Language (SAML)
an open standard that allows you to use one set of credentials to log into many different websites
201
OAuth
a widely adopted authorization framework that allows you to consent to an application interacting with another on your behalf without having to reveal your password
202
Mandatory Access Control (MAC)
A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information
203
Discretionary Access Control (DAC)
A means of providing access to an object at the discretion of the owner.
204
Role-Based Access Control (RBAC)
restricts network access based on a person's role within an organization
205
Attribute-Based Access Control (ABAC)
an authorization model that evaluates attributes (or characteristics), rather than roles, to determine access
206
Rule-Based Access Control
used to manage access to locations, databases and devices according to a set of predetermined rules and permissions that do not account for the individual's role within the organization
207
Public Key Infrastructure (PKI)
The set of hardware, software, policies, processes, and procedures required to create, manage, distribute, use, store, and revoke digital certificates and public-keys
208
Digital Certificates
A digital certificate is a file or electronic password that proves the authenticity of a device, server, or user through the use of cryptography and the public key infrastructure (PKI)
209
Certificate Authority
a trusted entity that issues Secure Sockets Layer (SSL) certificates after the registration authority has authorized the requestor's ability to do so.
210
Registration Authority
A trusted entity that establishes and vouches for the identity and authorization of a client requesting a certificate, proving they allowed to request certificates for the domain in question.
211
Online Security Status Protocol (OCSP)
provides a mechanism, as a supplement to checking against a periodic certificate revocation list (CRL), to obtain timely information regarding the revocation status of a certificate
212
Certificate Revocation List (CRL)
a list of digital certificates that have been revoked by the CA (Certificate Authority) before their scheduled expiration date
213
Root Certificate
The public key certificate that identifies the root CA. The root certificate issues other certificates. Access to the root certificate allows for the creation of any trusted certificate.
214
Privacy-Enhanced Mail (PEM)
Base64 encoded DER certificate, generally the format provided by CAs, readable in ASCII format.
215
PKCS #12
Container format - can be used to store many X.509 certificates in a single .p12 or .pfx file. Often used to transfer a private and public key pair.
216
PKCS #7
217
Distinguished Encoding Rules (DER)
Certificate format designed to transfer syntax. Binary format (not human readable).
218
OCSP Stapling
OCSP status is "stapled" into the SSL/TLS handshake
219
Certificate Pinning
You can "pin" the expected certificate or public key to an application. If the expected key doesn't match, the application can device what to do in response (shut down, etc).
220
Key Escrow
Third-party holds the decryption/private keys. Often a legitimate business arrangement.
221
Hierarchical CA
Single CA issues certs to intermediate CAs.
222
Web of Trust
Decentralized alternative to traditional PKI. Trust unknown certificates based on others who have verified and established relationship with them
223
Certificate Chaining
List all the certs between server and root CA. Any certificate between the SSL certificate and the root certificate is an intermediate certificate.
224
Tracert/Traceroute
Determine the route a packet takes to a destination. Used to identify where a network issue may lie
225
Nslookup/DiG
Lookup information from DNS servers, such as IP addresses
226
Pathping
combines ping and traceroute commands. First phase runs a traceroute to build a map, then measures round trip time and packet loss at each hop.
227
hping
228
netstat
Returns network statistics, such as active connections and binaries
229
netcat
allows you to listen on a port, transfer data, scan ports and send data to a port
230
nmap
Network Mapper, used to discover information about network devices, such as open ports, services, versions, OS, etc.
231
arp (command)
views the local ARP table. The ARP table associates an IP address to a MAC address.
232
curl
request or send data over a URL
233
scanless
Allows you to run port scans sourced from a separate host. Essentially a port scan proxy, hiding your true source IP
234
dnsenum
Enumerate DNS information to find host names, view services, etc.
235
Nessus
Industry leader in vulnerability scanning. Used to identify known vulnerabilities and offers extensive reporting.
236
Cuckoo
A sandbox solution for malware testing in a safe environment. Offers reporting on network traffic, memory analysis, and API calls.
237
theHarvester
Used to gather OSINT, can scrape information from Google or Bing to find things like associated IP addresses, list of people from LinkedIN, email contacts
238
sn1per
Suite that combines many recon tools into a single framework, including dnsenum, metasploit, nmap, theHarvester, and more
239
head
command to view the first x lines of a file
240
tail
command used to view the last x lines in a file
241
cat
command used to copy file contents to the screen or to another file
242
grep
command to find text in a file (essentially CTL-F within a file)
243
chmod
command to change mode of a file system object, r/w/x
-rwxrw-r-- would signify the owner of the file has r/w/x permissions, the group would have r/w, and everyone else would have r
244
logger
command used to manually add entries to a system log
245
OpenSSL
A toolkit and crypto library for SSL/TLS, used to build certificates and manage SSL/TLS communication
246
tcpreplay
A suite of packet replay utilities that can be used to replay and edit packet captures
247
tcpdump
Captures packets from the commandline and displays packets on the screen, can write output to a file. CLI version of wireshark.
248
Wireshark
Graphical version of tcpdump. Used to analyze packets and view traffic patterns
249
dd
command used to create a disk image or copy of a drive, or restore from an image
250
memdump
command used to copy information in system memory
251
Winhex
A universal hexadecimal editor used to edit disks, files, RAM. Offers disk cloning and secure wipe capabilities
252
FTK Imager
Forensic drive imaging tool
253
Autopsy
Perform digital forensics of hard drives to view and recover data.
254
Metasploit
Very common exploitation framework used to attack known vulnerabilities and build custom attacks
255
The Social-Engineer Toolkit (SET)
Well known exploitation framework
256
Reconstitution
The recovery phase of the incident response process.
257
IR Process
Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident Activities
258
Tabletop
Talk through the drill's logistics and steps that would be taken. "What would we do"
259
Simulation
Testing performed with an actual simulated event
260
Walkthrough
One step further than a Tabletop - Test processes and procedures prior to an event to identify faults and missing steps
261
MITRE ATT&CK Framework
Framework used to identify and understand actions of an attacker, as well as security techniques to mitigate them.
262
Diamond Model
Model used to document and better understand an intrusion. Identify relationship between the Adversary, Capability, Victim, and Infrastructure.
263
Cyber Kill Chain
Recon - Weaponization - Delivery - Exploit - Installation - C&C - Actions on objectives
264
System Logs
Operating system logs, file system information, and can include security events
265
Application Logs
Logs specific to an application
266
Security Logs
Logs containing information related to blocked/allowed traffic flows, exploit attempts, blocked URL categories, and DNS sinkhole traffic. Typically created by IPS, firewalls, and proxies.
267
Web Logs
Logs related to web server access, exploit attempts and server activity such as startup and shudown
268
DNS Logs
Logs related to DNS queries - includes IP address of the request, can identify queries to known bad sites, and log results of those queries (blocked/allowed)
269
Authentication Logs
Logs related to accounts logging into a system, success/failures, & source IP. Can be used to identify brute force activity.
270
Dump Files
Dump files store all contents of memory associated with an application or process
271
NetFlow
Method of gathering network stats from switches, routers, etc. Consolidated onto a NetFlow server and analyzed from a management console.
272
IP Flow Information Export (IPFIX)
Newer version of NetFlow. Provides flexibility on what data is collected
273
Sampled Flow (sFlow)
Embedded in switches/routers to capture a portion of network traffic
274
Metadata
Data that describes other data sources. Example - Email headers
275
Order of Volatility
Ask the question - how long does data stick around? Most volatile data includes CPU registers/cache > Router Table/ARP cache, process table, kernel statistics, memory > Temp File systems > Disk
276
Snapshot
A point-in-time system image, typically in relation to Virtual Machines.
277
Artifacts
Digital items left behind. Commonly found in logs, flash memory, cache files, recycle bins
278
Corrective Controls
Designed to mitigate damage. Think backups and IPS.
279
Deterrent Controls
Doesn't prevent, but may discourage intrusion. Think warning signs/login banners.
280
Compensating Controls
Doesn't prevent an attack, but provides restoration through other means. Think re-imaging, hot sites, or backups.
281
Physical Controls
Fences, locks, etc.
282
General Data Protection Regulation (GDPR)
European Union regulation on information privacy in the European Union
283
Payment Card Industry Data Security Standard (PCI DSS)
Standard for protecting credit cards
284
NIST Risk Management Framework (RMF)
6 steps to risk management. Categorize > Select > Implement > Assess > Authorize > Monitor
285
NIST Cybersecurity Framework (CSF)
Identify, Protect, Detect, Respond, and Recover
286
International Organization for Standardization (ISO)
n/a
287
ISO 27001
Standard for information security management systems
288
ISO 27002
Code of practice for information security controls
289
ISO 27701
Focuses on privacy information management systems
290
ISO 31000
Standards for risk management practices
291
Cloud Security Alliance (CSA)
Non-profit organization focusing cloud security
292
CSA Cloud Controls Matrix (CSA CCM)
Controls are mapped to standards, best practices, and regulations to follow in the cloud.
293
SOC 2 Type 1
Audit will test controls at a particular date and time
294
SOC 2 Type 2
Audit will test controls over a period of 6+ months
295
Acceptable Use Policies
Defines how technologies should be used
296
Non-Disclosure Agreements
Confidentiality agreement that limits information that can legally be shared to ensure privacy
297
Job Rotation
People rotate job roles, creating less of an opportunity for someone to take advantage of a security issue
298
Split Knowledge
No single person has all the knowledge/details
299
Dual Control
Two people must be present in-person to perform a business function
300
Service Level Agreement (SLA)
Sets a minimum set of service terms, such as uptime or response time
301
Memorandum of Understanding (MOU)
Informal letter of intent/expectations, not a signed legal contract.
302
Measurement System Analysis (MSA)
Provides a way for a company to evaluate and assess the quality of the process used in measurement systems.
303
End of Life (EOL)
When a manufacturer stops selling a product. End of Service Life refers to when support ends patches and updates are no longer provided.
304
Inherent Risk
Risk that exists in the absence of security controls
305
Residual Risk
Inherent Risk combined with effectiveness of security controls.
306
Annualized Rate of Occurrence (ARO)
Describes the likelihood of a risk occurring
307
Single Loss Expectancy (SLE)
How much money is lost if a single event were to occur
308
Annualized Loss Expectancy (ALE)
Calculated by multiplying ARO x SLE
309
Recovery Time Objective (RTO)
Describes how long it takes to get back up and running to a certain service level
310
Mean Time Between Failures (MTBF)
Predict time between outages
311
Mean Time To Repair (MTTR)
Time required to fix an issue
312
Personally Identifiable Information (PII)
Data that can be tied back to an individual, such as name, address, biometric information, telephone number
313
Protected Health Information (PHI)
Health records associated with an individual. Health status, insurance details, payments, etc.
314
Data Controller
Manages the purpose and means by which personal data is processed
315
Data Processor
Processes data on behalf of the data controller (often a third party or different group)
316
Data Custodian/Steward
Responsible for data accuracy, privacy and security.
317
Data Protection Officer
Responsible for the organization's overall data privacy policies.
318
Session Hijacking
Session ID (often stored in cookies) is stolen by an attacker and is able to pose as the victim without username or passwords.
Prevent this by use of End to End encryption
319
Infrastructure as a Service
Outsourcing equipment/hardware. You're still responsible for the management of data and the OS/application running on the equipment
320
Platform as a Service
Middle ground of IaaS and SaaS. Provides a platform, including hardware and OS for you to develop your own application.
321
Software as a Service
On-demand software. Everything is managed and configured by the provider.
322
Anything as a Service
A broad description of any service delivered over the internet.
323
Counter Mode (CTR)
Block cipher mode that acts like a stream cipher. Utilizes a incremental counter to create each block of ciphertext.
324
Galois/Counter Mode (GCM)
Combines Counter Mode (CTR) with Galois authentication. Commonly used in wireless connections and IPSEC.
