Glossary Flashcards
heat map risk matrix
A graphical table indicating the likelihood and impact of risk factors identified for a workflow, project, or department for reference by stakeholders.
lessons learned report (LLR)
An analysis of events that can provide insight into how to improve response and support processes in the future.
network log
A target for system and access events generated by a network appliance, such as a switch, wireless access point, or router.
File Transfer Protocol (FTP)
Application protocol used to transfer files between network hosts. Variants include S(ecure)FTP, FTP with SSL (FTPS and FTPES), and T(rivial)FTP. FTP utilizes ports 20 and 21.
quantitative risk analysis
A numerical method that is used to assess the probability and impact of risk and measure the impact.
provenance
In digital forensics, being able to trace the source of evidence to a crime scene and show that it has not been tampered with.
Internet header
A record of the email servers involved in transferring an email message from a sender to a recpient.
clean desk policy
An organizational policy that mandates employee work areas be free from potentially sensitive information; sensitive documents must not be left out where unauthorized personnel might see them.
capacity planning
A practice which involves estimating the personnel, storage, computer hardware, software, and connection infrastructure resources required over some future period of time.
port mirroring (SPAN)
Copying ingress and/or egress communications from one or more switch ports to another port. This is used to monitor communications passing over the switch.
Internet Protocol Security (IPSec)
Network protocol suite used to secure data through authentication and encryption as the data travels across the network or the Internet.
geographic dispersion
A resiliency mechanism where processing and data storage resources are replicated between physically distant sites.
mean time to repair/replace/recover (MTTR)
A metric representing average time taken for a device or component to be repaired, replaced, or otherwise recover from a failure.
logic bomb
A malicious program or script that is set to run under particular circumstances or in response to a defined event.
password best practices
Rules to govern secure selection and maintenance of knowledge factor authentication secrets, such as length, complexity, age, and reuse.
environmental attack
A physical threat directed against power, cooling, or fire suppression systems.
representational state transfer (REST)
A standardized, stateless architectural style used by web applications for communication and integration.
listener/collector
A network appliance that gathers or receives log and/or state data from other network systems.
pretexting
Social engineering tactic where a team will communicate, whether directly or indirectly, a lie or half-truth in order to get someone to believe a falsehood.
Remote Authentication Dial-in User Service (RADIUS)
AAA protocol used to manage remote and wireless authentication infrastructures.
network functions virtualization (NFV)
Provisioning virtual network appliances, such as switches, routers, and firewalls, via VMs and containers.
behavior-based detection
A network monitoring system that detects changes in normal operating data sequences and identifies abnormal sequences.
onboarding
The process of bringing in a new employee, contractor, or supplier.
information security policies
A document or series of documents that are backed by senior management and that detail requirements for protecting technology and information assets from threats and misuse.
cloud deployment model
Classifying the ownership and management of a cloud as public, private, community, or hybrid.
regulated data
Information that has storage and handling compliance requirements defined by national and state legislation and/or industry regulations.
proprietary information
Information created by an organization, typically about the products or services that it makes or provides.
cloning
The process of quickly duplicating a virtual machine’s configuration when several identical machines are needed immediately.
key length
Size of a cryptographic key in bits. Longer keys generally offer better security, but key lengths for different ciphers are not directly comparable.
data breach
When confidential or private data is read, copied, or changed without authorization. Data breach events may have notification and reporting requirements.
backup power generator
A standby power supply fueled by diesel or propane. In the event of a power outage, a UPS must provide transitionary power, as a backup generator cannot be cut in fast enough.
DNS sinkhole
A temporary DNS record that redirects malicious traffic to a controlled IP address.
availability
The fundamental security goal of ensuring that computer systems operate continuously and that authorized persons can access data that they need.
hybrid password attack
An attack that uses multiple attack methods, including dictionary, rainbow table, and brute force attacks, when trying to crack a password.
forgery attack
An attack that exploits weak authentication to perform a request via a hijacked session.
baseline configuration
A collection of security and configuration settings that are to be applied to a particular system or network in the organization.
non-transparent proxy
A server that redirects requests and responses for clients configured with the proxy address and port.
missing logs
A potential indicator of malicious activity where events or log files are deleted or tampered with.
address resolution protocol (ARP)
Broadcast mechanism by which the hardware MAC address of an interface is matched to an IP address on a local network segment.
brute force attack
A type of password attack where an attacker uses an application to exhaustively try every possible alphanumeric combination to crack encrypted passwords.
active reconnaissance
Penetration testing techniques that interact with target systems directly.
data controller
In privacy regulations, the entity that determines why and how personal data is collected, stored, and used.
playbook
A checklist of actions to perform to detect and respond to a specific type of incident.
e-discovery
Procedures and tools to collect, preserve, and analyze digital evidence.
Information Sharing and Analysis Center (ISAC)
A not-for-profit group set up to share sector-specific threat intelligence and security best practices among its members.
certificate signing request (CSR)
A Base64 ASCII file that a subject sends to a CA to get a certificate.
Kerberos
A single sign-on authentication and authorization service that is based on a time-sensitive, ticket-granting system.
advanced persistent threat (APT)
Threat actors with the ability to craft novel exploits and techniques to obtain, maintain, and diversify unauthorized access to network systems over a long period.
recovery time objective (RTO)
The maximum time allowed to restore a system after a failure event.
Extensible Authentication Protocol over LAN (EAPoL)
A port-based network access control (PNAC) mechanism that allows the use of EAP authentication when a host connects to an Ethernet switch.
access badge
An authentication mechanism that allows a user to present a smart card to operate an entry system.
layer 4 firewall
A stateful inspection firewall that can monitor TCP sessions and UDP traffic.
cable lock
Devices can be physically secured against theft using cable ties and padlocks. Some systems also feature lockable faceplates, preventing access to the power switch and removable drives.
NetFlow
Cisco-developed means of reporting network flow information to a structured database. NetFlow allows better understanding of IP traffic flows as used by different network applications and hosts.
chain of custody
Record of handling evidence from collection to presentation in court to disposal.
organized crime
A type of threat actor that uses hacking and computer fraud for commercial gain.
fencing
A security barrier designed to prevent unauthorized access to a site perimeter.
fraud
Falsifying records, such as an internal fraud that involves tampering with accounts.
access control vestibule
A secure entry system with two gateways, only one of which is open at any one time.
false rejection rate (FRR)
A biometric assessment metric that measures the number of valid subjects who are denied access.
Post Office Protocol (POP)
Application protocol that enables a client to download email messages from a server mailbox to a client over port TCP/110 or secure port TCP/995.
Memorandum of Agreement (MoA)
A legal document forming the basis for two parties to cooperate without a formal contract (a cooperative agreement). MOAs are often used by public bodies.
passive reconnaissance
Penetration testing techniques that do not interact with target systems directly.
malicious update
A vulnerability in a software repository or supply chain that a threat actor can exploit to add malicious code to a package.
financial data
Data held about bank and investment accounts, plus information such as payroll and tax returns.
key exchange
Any method by which cryptographic keys are transferred among users, thus enabling the use of a cryptographic algorithm.
cross-site scripting (XSS)
A malicious script hosted on the attacker’s site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site, circumventing the browser’s security model of trusted zones.
cookie
A text file used to store information about a user when they visit a website. Some sites use cookies to support user sessions.
Diffie-Hellman (DH)
A cryptographic technique that provides secure key exchange.
internet of things (IoT)
Devices that can report state and configuration data and be remotely managed over IP networks.
inline
Placement and configuration of a network security control so that it becomes part of the cable path.
data exfiltration
The process by which an attacker takes data that is stored inside of a private network and moves it to an external network.
canonicalization attack
An attack method where input characters are encoded in such a way as to evade vulnerable input validation measures.
journaling
A method used by file systems to record changes not yet made to the file system in an object called a journal.
due diligence
A legal principal that a subject has used best practice or reasonable care when setting up, configuring, and maintaining a system.
physical penetration testing
Assessment techniques that extend to site and other physical security systems.
business continuity (BC)
A collection of processes that enable an organization to maintain normal business operations in the face of some adverse event.
dependencies
Resources and other services that must be available and running for a service to start.
bluejacking
Sending an unsolicited message or picture message using a Bluetooth connection.
FTPS
A type of FTP using TLS for confidentiality.
control plane
In zero trust architecture, functions that define policy and determine access decisions.
incident response lifecycle
Procedures and guidelines covering appropriate priorities, actions, and responsibilities in the event of security incidents, divided into preparation, detection, analysis, containment, eradication/recovery, and lessons learned stages.
cyber threat intelligence (CTI)
The process of investigating, collecting, analyzing, and disseminating information about emerging threats and threat sources.
command and control (C2)
Infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets.
cryptography
The science and practice of altering data to make it unintelligible to unauthorized parties.
hardening
A process of making a host or app configuration secure by reducing its attack surface, through running only necessary services, installing monitoring software to protect against malware and intrusions, and establishing a maintenance schedule to ensure the system is patched to be secure against software exploits.
logical segmentation
Network topology enforced by switch, router, and firewall configuration where hosts on one network segment are prevented from or restricted in communicating with hosts on other segments.
detectability
A risk evaluation parameter that defines the likelihood of a company detecting a risk occurrence before it impacts the project, process, or end user.
IEEE 802.1X
A standard for encapsulating EAP communications over a LAN (EAPoL) or WLAN (EAPoW) to implement port-based authentication.
fake telemetry
Deception strategy that returns spoofed data in response to network probes.
reputational threat intelligence
Blocklists of known threat sources, such as malware signatures, IP address ranges, and DNS domains.
ARP poisoning
A network-based attack where an attacker with access to the target local network segment redirects an IP address to the MAC address of a computer that is not the intended recipient. This can be used to perform a variety of attacks, including DoS, spoofing, and on-path (previously known as man-in-the-middle).
mobile device management (MDM)
Process and supporting technologies for tracking, controlling, and securing the organization’s mobile infrastructure.
integrated penetration testing
A holistic approach that combines different types of penetration testing methodologies and techniques to evaluate an organization’s security operations.
maximum tolerable downtime (MTD)
The longest period that a process can be inoperable without causing irrevocable business failure.
access control list (ACL)
The collection of access control entries (ACEs) that determines which subjects (user accounts, host IP addresses, and so on) are allowed or denied access to the object and the privileges given (read-only, read/write, and so on).
internal threat
A type of threat actor who is assigned privileges on the system and causes an intentional or unintentional incident.
incident
An event that interrupts standard operations or compromises security policy.
eXtensible Markup Language (XML)
A system for structuring documents so that they are human and machine readable. Information within the document is placed within tags, which describe how information within the document is structured.
data subject
An individual that is identified by privacy data.
chief technology officer (CTO)
Company officer with the primary role of making effective use of new and emerging computing platforms and innovations.
offensive penetration testing
The “hostile” or attacking team in a penetration test or incident response exercise.
hot site
A fully configured alternate processing site that can be brought online either instantly or very quickly after a disaster.
caching engine
A feature of many proxy servers that enables the servers to retain a copy of frequently requested web pages.
internal/external
The degree of access that a threat actor possesses before initiating an attack. An external threat actor has no standing privileges, while an internal actor has been granted some access permissions.
guidelines
Best practice recommendations and advice for configuration items where detailed, strictly enforceable policies and standards are impractical.
hashing
A function that converts an arbitrary-length string input to a fixed-length string output. A cryptographic hash function does this in a way that reduces the chance of collisions, where two different inputs produce the same output.
Message Digest Algorithm v5 (MD5)
A cryptographic hash function producing a 128-bit output.
network attack
An attack directed against cabled and/or wireless network infrastructure, including reconnaissance, denial of service, credential harvesting, on-path, privilege escalation, and data exfiltration.
enterprise authentication
A wireless network authentication mode where the access point acts as pass-through for credentials that are verified by an AAA server.
machine learning (ML)
A component of AI that enables a machine to develop strategies for solving a task given a labeled dataset where features have been manually identified but without further explicit instructions.
endpoint log
A target for security-related events generated by host-based malware and intrusion detection agents.
community cloud
A cloud that is deployed for shared use by cooperating tenants.
annualized loss expectancy (ALE)
The total cost of a risk to an organization on an annual basis. This is determined by multiplying the SLE by the annual rate of occurrence (ARO).
fault tolerance
Protection against system failure by providing extra (redundant) capacity. Generally, fault-tolerant systems identify and eliminate single points of failure.
discretionary access control (DAC)
An access control model where each resource is protected by an access control list (ACL) managed by the resource’s owner (or owners).
file integrity monitoring (FIM)
A type of software that reviews system files to ensure that they have not been tampered with.
forensics
The process of gathering and submitting computer evidence for trial. Digital evidence is latent, meaning that it must be interpreted. This means that great care must be taken to prove that the evidence has not been tampered with or falsified.
blockchain
A concept in which an expanding list of transactional records listed in a public ledger is secured using cryptography.
identity and access management (IAM)
A security process that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets like networks, operating systems, and applications.
fail-open
A security control configuration that ensures continued access to the resource in the event of failure.
decentralized computing architecture
A model in which data processing and storage are distributed across multiple locations or devices.
continuity of operations plan (COOP)
Identifies how business processes should deal with both minor and disaster-level disruption by ensuring that there is processing redundancy supporting the workflow.
directive control
A type of control that enforces a rule of behavior through a policy or contract.
reaction time
The elapsed time between an incident occurring and a response being implemented.
environmental variables
In vulnerability assessment, factors or metrics due to local network or host configuration that increase or decrease the base likelihood and impact risk level.
host-based intrusion prevention system (HIPS)
Endpoint protection that can detect and prevent malicious activity via signature and heuristic pattern matching.
Point-to-Point Tunneling Protocol (PPTP)
Developed by Cisco and Microsoft to support VPNs over PPP and TCP/IP. PPTP is highly vulnerable to password cracking attacks and considered obsolete.
cloud computing
Computing architecture where on-demand resources provisioned with the attributes of high availability, scalability, and elasticity are billed to customers on the basis of metered utilization.
jump server
A hardened server that provides access to other hosts.
full disk encryption (FDE)
Encryption of all data on a disk (including system files, temporary files, and the pagefile) can be accomplished via a supported OS, third-party software, or at the controller level by the disk device itself.
phishing
An email-based social engineering attack in which the attacker sends email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim.
data owner
A senior (executive) role with ultimate responsibility for maintaining the confidentiality, integrity, and availability of an information asset.
legal data
Documents and records that relate to matters of law, such as contracts, property, court cases, and regulatory filings.
authentication, authorization, and accounting (AAA)
A security concept where a centralized platform verifies subject identification, ensures the subject is assigned relevant permissions, and then logs these actions to create an audit trail.
level of sophistication/capability
A formal classification of the resources and expertise available to a threat actor.
distributed denial-of-service (DDoS)
An attack that involves the use of infected Internet-connected computers and devices to disrupt the normal flow of traffic of a server or service by overwhelming the target with traffic.
bollards
Sturdy vertical posts installed to control road traffic or designed to prevent ram-raiding and vehicle-ramming attacks.
near-field communication (NFC)
A standard for two-way radio communications over very short (around four inches) distances, facilitating contactless payment and similar technologies. NFC is based on RFID.
out of band management (OOB)
Accessing the administrative interface of a network appliance using a separate network from the usual data network. This could use a separate VLAN or a different kind of link, such as a dial-up modem.
impersonation
Social engineering attack where an attacker pretends to be someone they are not.
preventive control
A type of security control that acts before an incident to eliminate or reduce the likelihood that an attack can succeed.
closed/proprietary
Software code or security research that remains in the ownership of the developer and may only be used under permitted license conditions.
digital certificate
Identification and authentication information presented in the X.509 format and issued by a certificate authority (CA) as a guarantee that a key pair (as identified by the public key embedded in the certificate) is valid for a particular subject (user or host).
likelihood
In qualitative risk analysis, the chance of an event that is expressed as a subjectively determined scale, such as high or low.
compensating control
A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.
data exposure
A software vulnerability where an attacker is able to circumvent access controls and retrieve confidential or sensitive data from the file system or database.
non-repudiation
The security goal of ensuring that the party that sent a transmission or created data remains associated with that data and cannot deny sending or creating that data.
credential replay
An attack that uses a captured authentication token to start an unauthorized session without having to discover the plaintext password for an account.
disinformation
A type of attack that falsifies an information resource that is normally trusted by others.
centralized computing architecture
A model where all data processing and storage is performed in a single location.
reporting
A forensics process that summarizes significant contents of digital data using open, repeatable, and unbiased methods and tools.
data retention
The process an organization uses to maintain the existence of and control over certain data in order to comply with business policies and/or applicable laws and regulations.
Common Vulnerabilities and Exposures (CVE)
A scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.
asset
A thing of economic value. For accounting purposes, assets are classified in different ways, such as tangible and intangible or short term and long term. Asset management means identifying each asset and recording its location, attributes, and value in a database.
acceptable use policy (AUP)
A policy that governs employees’ use of company equipment and Internet services. ISPs may also apply AUPs to their customers.
credentialed scan
A scan that uses credentials, such as usernames and passwords, to take a deep dive during the vulnerability scan, which will produce more information while auditing the network.
computer-based training (CBT)
Training and education programs delivered using computer devices and e-learning instructional models and design.
air-gapped
A type of network isolation that physically separates a host from other hosts or a network from all other networks.
account lockout
Policy that prevents access to an account under certain conditions, such as an excessive number of failed authentication attempts.
authorization
The process of determining what rights and privileges a particular entity has.
recovery point objective (RPO)
The longest period that an organization can tolerate lost data being unrecoverable.
exception handling
An application vulnerability that is defined by how an application responds to unexpected errors that can lead to holes in the security of an app.
encryption level
Target for data-at-rest encryption, ranging from more granular (file or row/record) to less granular (volume/partition/disk or database).
concurrent session usage
A potential indicator of malicious activity where an account has started multiple sessions on one or more hosts.
Document Object Model (DOM)
When attackers send malicious scripts to a web app’s client-side implementation of JavaScript to execute their attack solely on the client.
open-source intelligence (OSINT)
Publicly available information plus the tools used to aggregate and search it.
provisioning
The process of deploying an account, host, or application to a target production environment. This involves proving the identity or integrity of the resource, and issuing it with credentials and access permissions.
information-sharing organization
Collaborative groups that exchange data about emerging cybersecurity threats and vulnerabilities.
physical attack
An attack directed against cabling infrastructure, hardware devices, or the environment of the site facilities hosting a network.
passwordless
Multifactor authentication scheme that uses ownership and biometric factors, but not knowledge factors.
escalation
In the context of support procedures, incident response, and breach-reporting, escalation is the process of involving expert and senior staff to assist in problem management.
network monitoring
Auditing software that collects status and configuration information from network devices. Many products are based on the Simple Network Management Protocol (SNMP).
password spraying
A brute force attack in which multiple user accounts are tested with a dictionary of common passwords.
device placement
Considerations for positioning security controls to protect network zones and individual hosts to implement a defense in depth strategy and to meet overall security goals.
horizontal privilege escalation
When a user accesses or modifies specific resources that they are not entitled to.
remote access Trojan (RAT)
Malware that creates a backdoor remote administration channel to allow a threat actor to access and control the infected host.
DevSecOps
A combination of software development, security operations, and systems operations, and refers to the practice of integrating each discipline with the others.
metadata
Information stored or recorded as a property of an object, state of a system, or transaction.
AES Galois Counter Mode Protocol (GCMP)
A high performance mode of operation for symmetric encryption. Provides a special characteristic called authenticated encryption with associated data, or AEAD.
non-credentialed scan
A scan that uses fewer permissions and many times can only find missing patches or updates.
account policies
A set of rules governing user security information, such as password expiration and uniqueness, which can be set globally.
procedure
Detailed instructions for completing a task in a way that complies with policies and standards.
attack surface
The points at which a network or application receive external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.
indicator of compromise (IoC)
A sign that an asset or network has been attacked or is currently under attack.
heat map
In a Wi-Fi site survey, a diagram showing signal strength and channel uitilization at different locations.
data plane
Functions that enforce policy decisions configured in the control plane and facilitate data transfers.
project stakeholder
A person who has a business interest in the outcome of a project or is actively involved in its work.
Encapsulating Security Payload (ESP)
IPSec sub-protocol that enables encryption and authentication of the header and payload of a data packet.
data loss prevention (DLP)
A software solution that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks.
disassociation attack
Spoofing frames to disconnect a wireless station to try to obtain authentication data to crack.
credential harvesting
Social engineering techniques for gathering valid credentials to use to gain unauthorized access.
endpoint detection and response (EDR)
A software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats.
Internet Key Exchange (IKE)
Framework for creating a security association (SA) used with IPSec. An SA establishes that two hosts trust one another (authenticate) and agree on secure protocols and cipher suites to use to exchange data.
factors
In authentication design, different technologies for implementing authentication, such as knowledge, ownership/token, and biometric/inherence. These are characterized as something you know/have/are.
Extensible Authentication Protocol (EAP)
Framework for negotiating authentication methods that enable systems to use hardware-based identifiers, such as fingerprint scanners or smart card readers, for authentication and to establish secure tunnels through which to submit credentials.
password attack
Any attack where the attacker tries to gain unauthorized access to and use of passwords.
distinguished name (DN)
A collection of attributes that define a unique identifier for any given resource within an X.500-like directory.
IP Flow Information Export (IPFIX)
Standards-based version of the Netflow framework.
penetration testing
A test that uses active tools and security utilities to evaluate security by simulating an attack on a system. A pen test will verify that a threat exists, then will actively test and bypass security controls, and will finally exploit vulnerabilities on the system.
