Glossary Flashcards
active decoy
A system designed to
distract potential attackers away from
an organization’s critical systems and
data. It creates a false environment
that looks like a real system, complete
with fake data, applications, and other
elements. The decoy system is closely
monitored to detect malicious activity
and provide early warning and detailed
insight into an attacker’s tactics and
techniques.
Address SpaceLayout Randomization
A technique that randomizes
where components in a running
application are placed in memory to
protect against buffer overflows.
Advanced Persistent Threat
An attacker’s ability to obtain, maintain, and diversify access to network systems using expoits and malware.
Adversarial Tactics, Techniques, and Common Knowledge
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and procedures.
Application Programming Interface
Methods exposed by a script or program that allow other scripts or programs to use it. For example, an API enables software developers to access functions of the TCP/IP network stack under a particular operating system.
Application Virtualization
A software dilivery model where the code runs on a server and is streamed to a client.
Arachni
An open-source web application scanner.
ARP Poisoning
A network-based attack where an attacker with an access to the target local network segment redirects an IP address to the MAC address of a computer that is not the intended recipient. This can be used to perfrom a variety of attacks, including DoS, Spoofing, and Man in the Middle.
Attack Surface
The points at which a network or application receive external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.
Beaconing
A means for a network node to advertise its presence and establish a link with oter nodes, such as the beacon management frame sent by an AP. Legitimate software and appliances do this, but it is also associated with Remote Access Trojans communicating with a Command & Control server.
Broken Authentication
A software vulnerability where the authentication mechanism allows an attacker to gain entry, such as displaying cleartext credentials, using weak session tokens or permitting brute force login requests.
Buffer Overflow
An attack in which data goes past the boundary of the destination buffer and begins to corrupt adjacent memory. THis can allow the attacker to crash the system or execute arbitrary code.
Burp Suite
A proprietary interception proxy and web application assessment tool.
Business Continuity
A collection of processes that enable an organiztation to maintain normal business operations in the face of some adverse event.
Cardholder data
Any type of personally identifiable information associated with a person who has a payment card, such as a credit or debit card
Center for Internet Security
A not-for-profit organization (founded partly by SANS). It publishes the well-known “Top 20 Critical Security Controls” (or system design recommendations)
Change management
The process through which changes to the configuration of information systems are implemented as part of the organization’s overall configuration management efforts.
closure meetings
Sessions held at the end of a project or phase in which you discuss and document areas for improvement and capture lessons learned for use in future projects.
Cloud access security broker
Enterprise management software desinged to mediate access to cloud services by users across all types of devices.
Cloud deployment model
Classifying the ownership and management of a cloud as public, private, community or hybrid.
Command and Control
Infrastructure of hosts and service with which attackers direct, distribute, and control malware over botnets.
Common configuration enumeration
A scheme for provisioning secure configuration checks across multiple sources developed by MITREE and adopted by NIST.
Common Platform Enumeration
A scheme for identifying hardware devices, operating systems, and applications developed by MITRE.
Common Protocol over non-standard port
Communicating TCP/IP application traffic, such as HTTP, FTP, or DNS, over a port that is not the well-known or registered port established for that protocol.
Common vulnerabilities and exposures
A scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.
Common Vulnerability Scoring System
A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.
compensating control
A security measaure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.
configuration baseline
Settings for services and policy configuration for a network appliance or for a server operating in a particular application role (web server, mail server, file/print server, and so on).
Container
An operating system virtualization deployment containing everything required to run a service, application, or microservice.
cookie
A text file used to store information about a user when they visit a website. Some sites use cookies to support user sessions.
Corrective control
A type of security control that acts after an incident to eliminate or minimize its impact.
credential stuffing
A brute force attack in which stolen user account names and passwords are tested against multiple websites.
