CySA+ Flashcards
Reaver
A specialized tool used to find WPA and WPA2 passphrases specifically on networks that support the Wi-Fi Protected Setup (WPS) feature.
Aircrack-ng
A suite of tools designed for wireless network testing. The tools in this suite can capture packets from wireless networks, conduct packet injection attacks, and crack preshared keys used on WEP, WPA, and WPA2 networks.
Hashcat
A general-purpose password cracking tool that may also be used on wireless networks.
CAN bus
Controller Area Network. A vehicle bus standard designed to allow microcontrollers and devices to communicate with each other’s applications without a host computer.
Common Platform Enumeration (CPE)
Provides a standard nomenclature for describing product names and versions.
Common Vulnerabilities and Exposures (CVE)
Provides a common nomenclature for describing security-related software flaws.
Common Vulnerability Scoring System (CVSS)
Provides a standardized approach for measuring and describing the severity of security-related software flaws.
FIPS 140-2
U.S. government standard that hardware security modules are certified against.
OpenFlow
Used to allow software-defined network (SDN) controllers to push changes to switches and routers, allowing flow control, network traffic partitioning, and testing of applications and configurations.
Host File
Used by operating systems to map a connection between an IP address and domain names before going to DNS.
Domain Generation Algorithm (DGA)
A program that generates a large list of domain names.
Register
A critical component of computer memory that stores data and instructions for quick processing. High volatility.
Cache
A chip-based computer component that makes retrieving data from the computer memory more efficient. High volatility.
Random Access Memory (RAM)
The hardware in a computing device where the operating system, application programs, and date in current use are kept so they can quickly be reached by the device’s processor.
Routing Table
A set of rules, often viewed in table format, that is used to determine where data packets traveling over an Internet Protocol (IP) network will be directed.
ARP Cache
A collection of Address Resolution Protocol entries that are created when an IP address is resolved to a MAC address.
Process Table
Contains an entry for each process present in they system. Each entry contains several fields that stores all the information pertaining to a single process.
Temporary Swap File
A special type of file used by the computer’s operating system to manage memory. When the computer’s RAM is full of running programs and data, the operating system may use a portion of the computer’s storage (hard drive or SSD) as virtual memory.
Mandatory Access Control (MAC)
Rely on the operating system to control what subjects can access and what actions they can perform.
Virtual Private Cloud (VPC)
A secure, isolated cloud environment hosted within a public cloud.
Cloud Access Security Broker (CASB)
Software tool that serves as intermediaries between cloud services users and cloud service providers. The positioning allows them to monitor user activity and enforce policy requirements.
auth.log (Linux)
In Linux, serves the purpose of recording authentication-related events, including user logins, logouts, and authentication attempts, providing a centralized location for monitoring and troubleshooting security-related activities on a system.
Gramm-Leach-Billey Act (GLBA)
Covers financial institutions, broadly defined. It requires that those institutions have a formal security program and designate an individual as having overall responsibility for the program.
The Health Insurance Portability and Accountability Act (HIPPA)
Includes security and privacy rules that affect healthcare providers, health insurers, and health information clearinghouses.
The Family Educational Rights and Privacy Act (FERPA)
Requires the educational institutions implement security and privacy controls for student educational records.
The Sarbanes-Oxley (SOX) Act
Applies to the financial records of publicly traded companies and requires that those companies have a strong degree of assurance around the IT systems that store and process those records.
Payment Card Industry Data Security Standard (PCI DSS)
Provides detailed rules about the storage, processing, and transmission of credit and debit card information. A contractual obligation that applies to credit card merchants and service providers.
Trusted Foundry Program
Started by the U.S. government to validate microelectronic suppliers throughout the supply chain.
Fuzz Testing (Fuzzing)
Sending invalid or random data to an application to test its ability to handle unexpected data.
Fault Injection
Directly inserts faults into error handling paths, particularly error handling mechanisms that are rarely used or might be otherwise missed during normal testing.
Jump Box
A system that resides in a segmented environment and is used to access and manage the devices in the segment where it resides. Span two different security zones.
Out-of-Band (NAC)
Leverage existing network infrastructure to have network devices communicate with authentication servers and then reconfigure the network to grant or deny access as needed. Example 802.1x.
In-Band (NAC)
Use dedicated appliances that sit between devices and the resources that they wish to access. The deny or limit network access to devices that do not pass the authentication process.
Purpose Limitation
Information should only be used for the reason it was collected.
Information Technology Infrastructure Library (ITIL)
A framework that offers a comprehensive approach to IT services management (ITSM) within the modern enterprise. It covers five core activities: services strategy, service design, services transition, service operation, continual service improvement.
Control Objectives for Information and Related Technologies (COBIT)
A set of best practices for IT governance developed by the Information Systems Audit and Control Association (ISACA). It divides information technology into four domains: plan and organize, acquire and implement, deliver and support, monitor and evaluate.
Infrastructure as Code (IaC)
The process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. A major feature of all major IaaS environments (AWS, Microsoft Azure, and Google Cloud Platform).
File Transfer Protocol (FTP)
Provides the ability to transfer files between systems but does not incorporate security features.
Secure File Transfer Protocol (SFTP)/FTP-Secure
Secure methods to transfer files between systems.
-top (Linux)
Linux command that shows processes, their PID (process ID), the user who is executing the process, and the command used to start it. It also provides a real-time view of the memory usage for a system on a per-process basis.
-ps (Linux)
Linux command that provides information about processes and their CPU and memory utilization.
chmod (Linux)
Linux command that changes permissions of a file or directory. It allows you to control who can read, write, and execute a file.
Simple Network Management Protocol (SNMP)
A protocol for collecting information like status and performance about devices on a network.
-cat (Linux)
Linux command used to concatenate and display the contents of one or more files. It is often used to quickly view the contents of a file by printing them to the terminal.
Switched Port Analyzer (SPAN Port)
A dedicated port on a switch that takes a mirrored copy of network traffic from within the switch and sends it to another port for analysis.
Address Resolution Protocol (ARP)
The procedure for mapping a dynamic IP address to a permanent physical MAC address in a local area network (LAN).
lsof (Linux)
Linux command that lists open files and the processes that opened them.
The Wayback Machine
A digital archive of information on the internet that allows users to view historic versions of websites.
Common Platform Enumeration (CPE)
Provides common nomenclature for describing product names and versions.
Common Vulnerability Scoring System (CVSS)
Provides a standardized approach for measuring and describing the severity of security-related software flaws.
Open Vulnerability and Assessment Language (OVAL)
A language for specifying low-level testing procedures used by checklists.
-sV
A flag on Nmap used for version detection.
Banner Grabbing
The process of collecting information about a service by examining the details provided in its initial response, typically containing software and version information.
Border Gateway Protocol (BGP)
A set of rules that determines the best network routes for data transmissions on the internet.
Simple Mail Transfer Protocol (SMTP)
A TCP/IP protocol used in sending and receiving emails. Uses port 25.
/var
In Linux, a directory that is used to store variable data, such as log files, temporary files, and other data that may change during the normal operation of the system.
John the Ripper Modes
- Incremental: The most powerful, tries all possible character combinations as defined by settings entered at the start.
- Single Crack Mode: Tries to use login names with various modifications, good for initial testing.
- External Mode: Relies on functions that are custom written to generate passwords. Useful in an organization has custom password policies.
- Wordlist: Uses a dictionary file along with mangling rules to test for common passwords.
Acceptable Use Policy (AUP)
Provides network and system users with clear direction on permissible uses of information resources.
Account Management Policy
Describes the account life cycle from provisioning through active use and decommissioning.
SOCKS4
A protocol that facilitates TCP traffic between a client and server through a proxy. Supported by Nmap.
Disposition
A phase in the SDLC that occurs when a product or system reaches the end of its life.
Network Address Translation (NAT)
A method used in networking to map private IP addresses of devices within a local network to a single public IP address, allowing them to access the internet.
MITRE’s ATT&CK Framework (Adversarial Tactics, Techniques, and Common Knowledge)
Includes detailed descriptions, definitions, and examples for the complete threat lifecycle, from initial access through execution, persistence, privilege escalation, and exfiltration.
The Diamond Model of Intrusion Analysis
Describes a sequence where an adversary deploys a capability targeted at an infrastructure against a victim.
Lockheed Martin’s Cyber Kill Chain
A framework that uses seven stages to describe an attack.
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command and Control (C2)
- Actions on Objectives
Purging
A method of sanitization that applies physical or logical techniques that render target data recovery infeasible using state of the art laboratory techniques.
Persistent Cross-Site Scripting
The malicious script comes from the website database.
Reflected Cross-Site Scripting
The malicious script comes from the current HTTP request.
DOM-Based Cross-Site Scripting
The vulnerability exists in the client-side code rather than the server-side code.
Hping
A command-line network tool that provides the functionality for crafting and sending custom TCP/IP packets.
Responder
A python script that is a hybrid between passive and active reconnaissance. Initially it passively monitors the network waiting for systems to send broadcast requests out intended for devices running networked services. Once a request is passively identified, it switches to active mode and attempts to hijack the connection and gather information from the broadcasting system and its users.
Field-Programmable Gate Arrays (FPGAs)
Computer chips that allow the end user to reprogram their function, making them quite useful for embedded systems.
Embedded Systems
Computers integrated into the operation of another device, such as a vehicle, camera, or multifunction printer.
Real-Time Operating Systems (RTOs)
Slimmed-down operating systems designed to work quickly on IoT devices in a low-power environment.
System on a Chip (SOC)
An entire embedded system packaged onto a single chip, often including a processor, memory, networking interfaces, and power management on the chip.
Controller Area Network bus (CAN bus)
Specialized networks designed to facilitate communication between embedded systems without the overhead of a TCP/IP network.
Supervisory Control and Data Acquisition (SCADA) systems
A type of industrial control system that monitors and manages processes in manufacturing, infrastructure, and other industries. They collect real-time data from sensors and devices, allowing operators to control and supervise industrial processes from a centralized location.
Industrial Control Systems (ICS)
Computer-based systems that monitor and control industrial processes, machinery, and infrastructure.
Programmable Logic Controllers (PLCs)
Specialized hardware controllers designed to operate in an IoT environment. Often use a specialized communication protocol called Modbus to communicate with sensors and other IoT components over wired serial infrastructure.
Integer Overflow
A variant of buffer overflow where the result of an arithmetic operation attempts to store an integer that is too large to fit in the specified buffer.
Back-Off Algorithm
A method that adds delays to a system’s retry attempts when competing for a shared resource, reducing conflicts and enhancing overall efficiency in networking and distributed systems.
STIX
A standardized language for describing and sharing information about cybersecurity threats in a structured and machine-readable format.
TAXII
A protocol used for sharing cyber threat intelligence and indicators of compromises (IoCs) between different organizations and security systems in a standardized way.
Apple File System (APFS)
Apple’s file system for its devices like macOS, iOS, watchOS and tvOS. It manages how data is stored, organized, and accessed on Apple devices, offering features such as enhanced encryption, snapshots, and improved performance.
FAT32/NTFS
Types of file systems used to organize and store data on computer storage devices.
File System
A method or structure used by operating systems to organize and store data on a storage device, such as a hard drive or flash drive. It defines how files are names, accessed, and stored, providing framework for managing data on the storage medium.
Data Carving
A forensic technique used to recover fragmented or deleted files from storage media by identifying and extracting data based on file signatures and patterns, bypassing traditional file system structures. Its purpose is to retrieve lost or deleted information during digital forensic investigation.
U.S. Government Information Classification Scheme
Confidential, Secret, Top Secret
Network Interface Card (NIC)
A hardware component, typically a circuit board or chip, which is installed on a computer so it can connect to a network.
Remote Attestation
A security process where one system remotely verifies the integrity and trustworthiness of another system, confirming that it runs the expected software without direct access. This ensures trust between networked systems.
Measured Boot Process
A process that involves securely verifying and recording each set of a computer’s startup sequence. Hashing functions are utilized to generate fixed-size representations (hashes) of different components in this process, facilitating the verification of their integrity and ensuring the system has not been tampered with.
Unified Extensible Firmware Interface (UEFI)
A modern firmware standard. It serves as an interface between the computer’s operating system and firmware, offering features like secure boot, faster startup, and enhanced hardware support.
Address Space Layout Randomization (ASLR)
A security technique that involves randomizing the memory address where system components and executables are loaded. This helps prevent attackers from predicting the location of specific functions or vulnerabilities in a computer’s memory, making it more challenging to exploit software vulnerabilities.
NX (No Execute) Bit
A security feature in computer processors that designate certain areas of memory as non-executable. It helps prevent the execution of code in specific regions, making it more difficult for malicious software to exploit vulnerabilities by executing code in data storage areas.
File Command (Linux)
A Linux command used to determine and display the type of a file. It examines the file’s content and provides information about its format, helping users identify the file type, such as text, executable, or specific data format.
Time of Check/Time of Use (TOC/TOU)
A security vulnerability that occurs when there’s a time gap between checking the status of a resource and using it. During this gap, the resource’s status may change, leading to potential security vulnerabilities.
strepy ()
In C programming, a standard library function that copies the contents for one string (source) to another (destination). It does not check if the destination string hads enough space to accommodate the source string, could cause buffer overflow.
main ()
In C programming, a special function that serves as the entry point of the program, where execution begins and ends.
printf ()
In C programming, a standard library function that is primarily used to display information on the screen.
scanf ()
In C programming, a standard library function used for reading input from the input from the standard input, typically the keyboard. It is used to accept data form the user.
VMware
Develops virtualization software. Virtualization software creates an abstraction layer over computer hardware that allows the hardware elements of a single computer (processors, memory, storage, etc.) to be divided into multiple virtual computers, commonly called virtual machines (VMs). Each VM runs its own operating system and behaves like an independent computer.
Hypervisor
The software component that enables virtualization, allowing multiple operating systems to run on a single physical machine concurrently. It manages and allocates the resource of the host system to create and run multiple virtual machines, each operating independently as if it were running on its own dedicated hardware.
Active Directory (AD)
A directory service developed by Microsoft that stores and organizes information about network resources, including users, computers, and other devices in a hierarchical database. It provides centralized authentication, authorization, and management of network resources in a Window’s domain environment, simplifying tasks such as user login, access control, and resource administration.
FIPS 140-2
A U.S. government standard outlining security requirements for cryptographic modules, ensuring their effectiveness in safeguarding sensitive information. It’s widely adopted globally in government and various industries.
OpenFlow
A network communication protocol used between controllers and forwarders in an SDN architecture.
