Security+ Acronyms I - Review Flashcards
1
Q
3DES?
A
Triple Digital Encryption Standard
- Deprecated and considered insecure.
- Replaced by AES
- Symmetric
- Applies the DES Cipher Algorithm 3 times to each Data Block.
2
Q
AAA?
A
Authentication, Authorization, Accounting
- Often used to describe RADIUS, or some other form of Networking Protocl that provides Authentication, Authorization, Accounting.
3
Q
ABAC?
A
Attribute-based Access Control
- Database and Identity service used to provide Identity Management
4
Q
ACL?
A
Access Control List
- Set of rules that allow/permit or deny any traffic flow through Routers.
- Looks at the packet to determine whether it should be allowed or denied.
- Works at Layer 3 to provide Security by filtering and controlling the flow of traffic from one Router to another.
5
Q
AES?
A
Advanced Encryption Standard
- Industry-standard for Data Security
- 128-bit, 192-bit, or 256-bit implementations (Strongest).
6
Q
AES256?
A
Advanced Encrption Standard 256-bit
- This is the 256-bit implementation of AES.
- 256 references the bit size of the Keys.
7
Q
AH?
A
Authentication Header
- Used to Authenticate origins of Packets of Data transmitted.
- These Headers don’t hide any Data from attackers, but they do provide proof that the Data Packets are from a trusted source and that the data hasn’t been tampered with.
- Helps protect against Replay Attacks.
8
Q
AI?
A
Artificial Intelligence
- For the Exam, be aware of what’s called Data Poisoning (or Tainted Training) and adversarial AI.
9
Q
AIS?
A
Automated Indicator Sharing
- DHS and CISA Free Program
- Enables organizations to share and receive machine-readable Cyber Threat Indicators (CTI) and Defensive Measures (DM) in Real-Time
- Useful to monitor and defend Networks against known threats.
10
Q
ALE?
A
Annualized Loss Expectancy
- IE: Can expect X number of devices to fail per year.
11
Q
AP?
A
Access Point
- Networking Hardware device that provides WIFI access, typically then connected via wire to the Router, or directly integrated in the Router itself.
12
Q
API?
A
Application Programming Interface
- APIs are used to allow applicationst o talk to one another.
- For Example: An application can query an API to retrieve data and then display that data or process it in some way.
13
Q
APT?
A
Advanced Persistent Threat
- Stealthy Threat Actor (usually Nation-State or State-Sponsored Groups) that gains unauthorized access to a system and remains undetected for a period of time.
14
Q
ARO?
A
Annualized Rate of Occurrence
- The calculated probability that a Risk will occur in a given year.
15
Q
ASLR?
A
Address Space Layout Randomization
- Prevent exploitation of memory corruption vulnerabilities.
16
Q
ASP?
A
Active Server Page
- Microsoft Server-Side scripting language and engine to create dynamic Web Pages.
- Superseded by ASP.NET in 2002.
17
Q
ATT&CK?
A
Adversarial Tactics, Techniques & Common Knowledge
- Knowledge base Framework of adversary tactics and techniques based on real-world observations.
- Helpful to build effective threat models and defenses against real threats.
18
Q
AUP?
A
Acceptable Use Policy
- Terms that users must accept in order to use a Network, System, Website, etc…
19
Q
AV?
A
Antivirus
- Antivirus Software
- Typically uses Signature-based detection
- Not effective against Zero-Day or Polymorphic Malware.
20
Q
BASH?
A
Bourne Again Shell
- Powerful UNIX Shell and command language.
- Used to issue commands that get executed, which can also be turned into Shell scripts.
- Often used for Automation.
21
Q
BCP?
A
Business Continuity Plan
- Plan used to create processes and systems of both prevention and recovery to deal with threats that a company faces.
- This plan outlines how a business can continue delivering products and services if crap hits the fan.
22
Q
BIA?
A
Business Impact Analysis
- Used to predict the consequences a business would face if there were to be a disruption.
23
Q
BGP?
A
Border Gateway Protocol
- The “Postal Service” of the Internet.
- BGP finds the best Route for Data to travel to reach its destination.
24
Q
BIOS?
A
Basic Input/Output System
- Firmware that performs hardware initialization when systems are booting up, and to provide runtime services for the OS and programs.
- First software to run when you power on a Computer System.
25
Q
BPA?
A
Business Partnership Agreement
- Defines a contract between two or more parties as to how a business should run.
26
Q
BPDU?
A
Bridge Protocol Data Unit
- Frames that have Spanning Tree Protocol information.
- Switches send BPDUs with a unique source MAC Address to multicast address with a destination MAC.
27
Q
BYOD?
A
Bring Your Own Device
- When employees use personal devices to connect to their organization’s Networks and access work-related Systems.
28
Q
CA?
A
Certificate Authority
- An organization that validates the identities of entities through Cryptographic Keys by issuing digital certificates.
- If you check the padlock on a Website (next to the domain name), you’ll see that it says “Connection is Secure” and then you can click on the “Certificate is Valid”. – You’ll then see info about the Certificate, Issued To, Issued By, as well as a Valid Date Range. – If you click the “Certification Path” Tab, you’ll see the details about the Issuer, AKA the Certificate Authority.
29
Q
CAC?
A
Common Access Card
- Smart Card for Active-Duty/Civilian Contractor Personnel
30
Q
CAPTCHA?
A
Complete Automated Public Turing Test to Tell Computers and Humans Apart
- These are the “problems” you have to solve from time to time to make sure that you are NOT a Robot.
- Typically used for forms (signup, login, purchase, search, etc…) to defend against Bots.
31
Q
CAR?
A
Corrective Action Report
- Lists defects that need to be rectified.
32
Q
CASB?
A
Cloud Access Security Broker
- Acts as an intermediary between the cloud and on-prem.
- Monitors all activity.
- Enforces Security policies.
33
Q
CBC?
A
Cipher Block Chaining
- CBC is a mode of operation for Block CIphers.
- Think of a CBC as building a chain from left to right.
- CBC does have vulnerabilities, including POODLE and Goldendoodle.
34
Q
CBT?
A
Computer-based Training
- An online, self-paced, and interactive training system.
Studends can set their own goals and learn at their own pace.
35
Q
CCMP?
A
Counter-Mode/CBC-Mac Protocol
- Encryption protocol designed for Wireless LAN products.
36
Q
CCTV?
A
Closed-Circuit Television
- Camera monitoring system, especially one that transmits back to a centralized location with a limited number of monitors.
- Could be monitored by Security personnel or simply set to record.
37
Q
CERT?
A
Computer Emergency Response Team
- Expert group that handles computer Security incidents.
- Could also be called CSIRT, which is short for COmputer Security Incident Response Team.
38
Q
CIRT?
A
Computer Incident Response Team
- Expert group that handles computer Security incidents.
- Could also be called CSIRT, which is short for COmputer Security Incident Response Team.
39
Q
CFB?
A
Cipher Feedback
- When a mode of operation uses the Ciphertext from the previous block in the chain.
- IE: Look up Cipher Feedback Mode (CFB)
40
Q
CHAP?
A
Challenge Handshake Authentication Protocol
- Authenticates a user or Network host to an authenticating entity.
- Provides protection against Replay Attacks.
- Requires that both the client and server know the Plaintext of the Secret, but it’s never sent over the Network.
41
Q
CIO?
A
Chief Information Officer
- Company executive responsible for implementing and managing IT.
- Mostly considered to be IT generalists.
- Useful way to think about it, CIO aims to improve processes within and for the company.
42
Q
CTO?
A
Chief Technology Officer
- CTO is different from CIO, and typically focuses on development, engineering, and research and development departments.
- Useful way to think about it, CTO uses technology to improve and create products and service for customers.
43
Q
CSO?
A
Chief Security Officer
- Executives that specialize in Security
- Much more focused of a responsibility than CIO.
44
Q
CIS?
A
Center for Internet Security
- Non-profit organization that helps put together, validate, and promote best practices to help people, businesses, and governments protect themselves against Cyber threats.
45
Q
CMS?
A
Content Management System
- IE: WordPress
46
Q
COOP?
A
Continuity of Operation Planning
- Effort for agencies to make sure they continue operations during a wide range of emergencies.
- Requires planning for various types of events such as natural or human-caused disasters.
47
Q
COPE?
A
Corporate Owned Personal Enabled
- Organization provides its employees with Mobile Computing Devices.
48
Q
CP?
A
Contingency Planning
- Used to restore systems and information in the event that systems become compromised.
49
Q
CRC?
A
Cyclical Redundancy Check
- Used to detect accidental changes in digital Networks and storage devices.
50
Q
CRL?
A
Certificate Revocation List
- List of Digital Certificates that have been revoked by the issuing Certificate Authority (CA).
51
Q
CSP?
A
Cloud Service Provider
- IE: AWS, GCP, Azure
52
Q
CSR?
A
Certificate Signing Request
- Contains information that the Certificate Authority (CA) will use to create your Certificate.
- Contains the Public Key for which the Certificate should be issued, and other identifying information.
53
Q
CSRF?
A
Cross-Site Request Forgery
- Unauthorized actions are performed on behalf of a legitimate user.
54
Q
CSU?
A
Channel Service Unit
- Device used for Digital Links to transfer data.
55
Q
CTM?
A
Counter-Mode
- Converts a Block CIpher into a Stream Cipher
- COmbines an IV with a counter and uses the result to encrypt each plaintext block.
56
Q
CVE?
A
Common Vulnerabilities and Exposures
- List of publicaly disclosed computer security flaws.
- These security flaws get assigned a CVE ID number which people can use to reference them.
57
Q
CVSS?
A
Common Vulnerability Scoring System
- Public framework used to rate the severity of security vulnerabilities.
- IE: If you find a vulnerability as a bug bounty or in your own organization’s systems, and you report that vulnerability, assigning a CVSS number to it will help decision makers understand the severity and impact so they can properly assign priority.
58
Q
CYOD?
A
Choose Your Own Device
- Employees can choose a Company-Assigned device from a limited number of Company Specified options.
