Security+ Acronym Flashcards
A port based authentication protocol. It provides authentication when a user connects to a specific access point, or , in this context, a logical port.
It’s primary purpose is to secure the authentication process prior to a client actually gaining access to a network. While this protocol can be used in wired and wireless networks, it is often closely associated with wireless networks.
802.1x
Symmetric block cipher designed as an improvement over the weaknesses of DES. It encrypts data using the DES algorithm in 3 separate passes and uses multple keys.
It uses multiple keys and multiple passes, not as efficient as AES but still used in some applications when hardware does not support AES. It has key sizes of 56 bits, 112bits, or 168 bits.
3DES
Provides authentication, authorization and accounting. Authentication verifies a user’s identification. Authorization determines if a user should have access. Accounting tracks user access with logs.
RADIUS and TACACS+ are both considered this protocol because they provide all three services. They authenticate users who attempt remote access, determine if the user is authorized for remote access by checking a database, and then record the user’s activity. TACACS+ uses multiple challenges and responses during a session.
AAA
Identifies a user or group that is granted permission to a resource. They are contained within a DACL in NTFS.
ACE (Access Control Entry)
A strong symmetric block cipher it can use key sizes of 128bits, 192bits, or 256 bits. Because of its strengths, it has been adopted for a wide assortment of applications such as encrypting data on a USB drive. It is fast, and requires one pass to encrypt and decypt data.
AES (Advanced Encryption Standard)
A list of rules used to grant access to a resource. It can define what is allowed based on permissions or based on traffic.
ACL (Access Control List)
Identified with protocol ID number 51, being a part of IPSEC it provides authentication and integrity.
AH (Authentication Header)
Used to measure risk with annualized rate of occurrence (ARO) and single loss expectancy (SLE). This identifies the total amount of loss expected for a given risk. The calculation is SLE x ARO = this.
ALE (Annualized Loss Expectancy)
This provides access to a wired network to wireless clients. Many of these support isolation mode to segment wireless users from other wireless users.
AP (Access point or short for Wireless Access Point)
Used to measure risk with annualized loss expectancy (ALE) and single loss expectancy (SLE). This identifies how many times a loss is expected to occur in a year. The calculation is SLE x this = ALE
ARO (Annualized rate of occurrence)
Resolves IP addresses to MAC addresses.
ARP (Address Resolution Protocol)
These type of attacks can redirect traffic through an attacker’s system by sending false MAC address updates. VLAN segregation helps prevent the scope of these type of attacks within a network.
ARP (Address Resolution Protocol) Poisoning
Defines proper system usage. It will often describe the purpose of computer systems and networks, how users can access them, and the responsibilities of users when accessing the systems.
AUP (Acceptable Use Policy)
A plan that helps an organization predict and plan for potential outages of critical services or functions.
BCP (Business Continuity Plan)
Disaster recovery elements that provide the steps used to return critical functions to operation after an outage. The BIA is part of a this and the BIA drives decisions to create redundancies such as failover clusters or alternate sites.
BCP (Business Continuity Plan)
This identifies critical business or mission requirements and includes elements such as Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) but it does not identify solutions.
BIA (Business Impact Analysis)
An automated program or system used to perform one or more tasks. A malicious this is a group of computers called zombies and controlled through a command and control server.
BOTS (or Network Robots)
Attackers use malware to join computers to these. Zombies regularly check in with the command and control server and can launch DDoS attacks against other victims.
BOTS (or Network Robots)
This kind of activity often includes hundreds of outbound connections, and some of these use IRC channels.
BOTS (or Network Robots)
An organization that manages, issues, and signs certificates and is a part of PKI.
CA (Certificate Authority)
A specialized type of smart card used by the US DOD. It includes photo identification and and provides confidentiality, integrity, authentication, and non-repudiation for the users. It is similar to a PIV.
CAC (Common Access Card)
A standard that allows microcontrollers and devices to communicate with each other without a host computer.
CAN (Controller Area Network)
An encryption protocol based on AES used with WPA2 for wireless security. It is more secure than TKIP, used with the original release of WPA.
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol)
This is a detective control that provides video surveillance. Video survelliance provides reliable proof of a person’s location and activity. It can be used by an organization to verify if any equipment or data is being removed.
CCTV (Close Circuit Television)
A group of experts that respond to security incidents.
CERT (Computer Emergency Response Team)
AKA CIRT, SIRT, or IRT
Authentication mechanism where a server challenges a client.
CHAP (Challenge Handshake Authenticatation Protocol)
These three form the security Triad. The first part helps prevent the unauthorized disclosure of data. The second part provides assurances that data has not been modified, tampered with, or corrupted. The third part indicates the data and services are there when needed.
CIA (Confidentiality, Integrity, Availability)
Provides an alternate location for operations after a critical outage. A hot site includes personnel, equipment, software, and communications capabilities of the primary site with all the data up to date. A hot site can take over for a failed primary site within an hour. A cold site will have power and connectivity needed for this activation, but little else. A warm site is a compromise between a hot site and a cold site.
COOP (Continuity of Operations Plan)
An error detection code used to detect accidental changes than can affect the integrity of data.
CRC (Cyclical Redundancy Check)
An access control model where all objects have owners and owners can modify permissions for the objects (files and folders). NTFS uses this model.
DAC (Discretionary Access Control)
A list of certificates that have been revoked. The CA that issued the certificate publishes this and this is public.
CRL (Certificate Revocation List)
List of Access Control Entries (ACE) in Microsoft’s NTFS. Each ACE includes a SID and a permission.
DACL (Discretionary Access Control List)
An attack on a system launched from multiple sources intended to make a computer’s resources or services unavailable to users. These attacks are often launched from Zombies in BotNets. These attacks are typically sustained, abnormally high network traffic. A performance baseline helps administrators detect these.
DDoS (Distributed Denial of Service)
A security feature in some operating systems. It helps prevent an application or service from executing code from a nonexecutable memory region.
DEP (Data Execution Prevention)
An older symmetric encryption standard used to provide confidentiality. This uses 56 bits and is considered cracked.
DES (Digital Encryption Standard)
A compiled set of code that can be called from other programs.
DLL (Dynamic Link Library)
A network based of this type of system can examine and analyze network traffic. It can detect if confidential company data or any PII data is included in e-mail and reduce the risk of internal users e-mailing sensitive data outside the organization.
DLP (Data Loss Protection)
Area between two firewalls separating the internet and the internal network. This provides a layer of protection for internet facing servers. It allways access to a server or service for internet users while segmenting and protecting access to the internal network.
DMZ (Demilitarized Zone)
Used to resolve host names to IP addresses. It is the primary name resolution service used on the internet and also internal networks
DNS (Domain Name System)
Port 53
DNS (Domain Name System)
Attemps to modify or corrupt cached DNS results.
DNS Poisoning
DNS poisoning attack that redirects a website’s traffic to another website.
DNS Pharming attack
An attack from a single source that attempts to disrupt the services provided by another system. Examples include SYN flood, smurf, and some buffer overflow attacks.
Denial of Service (DoS)
A document designed to help a company respond to disasters, such as hurricanes, floods, and fires. It includes a hierarchical list of critical systems and often prioritizes services to restore after an outage. Testing validates the plan. Recovered systems are tested before returning them to operation, and this can include a comparison to baselines. The final phase of this includes a review to identify any lessons learned and may include an update of the plan.
Disaster Recovery Plan (DRP)
This is an encrypted hash of a message. The sender’s private key encrypts the hash of the message to create this. The recipient decrypts the hash with the sender’s public key, and if successful, it provides authentication, non-repudiation, and integrity. Authentication identifies the sender. Integrity verifies the message has not been modified. Non-repudiation is used with online transactions and prevents the sender from later denying they sent the email.
DSA (Digital Signature Algorithm)
An authentication framework that provides general guidance for authentication methods. There is a lightweight and protected version of this.
EAP (Extensible Authentication Protocol)
An asymmetric encryption algorithm commonly used with smaller wireless devices such as PDAs and cell phones.
ECC (Elliptic Curve Cryptography)
A feature within NTFS on Windows Systems that supports encrypting individual files or folders for confidentiality.
EFS (Encrypting File System)
Interference caused by motors, power lines, and fluorescent lights. This type of shielding prevents signal emanation so it can prevent someone from capturing network traffic.
EMI (Electromagnetic Interference)
IPSec includes both AH (authentication header) and this to encrypt the data and provide confidentiality, authentication, and integrity. IPSec uses this in tunnel mode when used with VPNs. This is often identified with protocol ID 50.
ESP (Encapsulating Security Payload)
Protocol used to upload and download files. It utliizes port 20 and 21. It can use SSH for encryption over port 22.
FTP (File Transfer Protocol)
Free software that is based on the OpenPGP standard. It is similar to PGP but avoids and conflict with existing licensing by using open standards.
GPG (GNU Privacy Guard)
Used to upload and download files that uses SSL or TLS to encrypt traffic. Some implentations of this use ports 989 and 990.
FTPS (File Transfer Protocol Secure)
Used within Microsoft Windows to manage users and computers. It is implemented on a domain controller and administrator’s use it to create password policies, lock down the GUI, configure host-based firewalls etc.
GPO (Group Policy Object)
A tunneling protocol developed by Cisco Systems.
GRE (Generic Routing Encapsulation)
An IDS used to monitor an individual server or workstation. It protects local resources on the host such as the operating system files.
HIDS (Host Based Intrusion Detection System)
An extension of a host based IDS it is designed to react in real time to catch an attach in action.
HIPS (Host Based Intrusion Prevention System)
This is a fixed length string of bits similar to other hashing algorithms such as MD5 and SHA-1, but it also uses a secret key to add some randomness to the result.
HMAC (Hash-based Message Authentication Code)
A removable or external device that can generate, store, and manage RSA keys used in asymmetric encryption. High volume ecommerce sites use these to increase the performance of SSL sessions.
HSM (Hardware Security Module)
