Security+ Terminology Flashcards
3-leg perimeter
A type of DMZ where a firewall has three legs that connect to the LAN, the Internet, and the DMZ.
10 tape rotation
A backup rotation scheme in which ten backup tapes are used over the course of two weeks.
802.1X
An authentication technology used to connect devices to a LAN or WLAN. It is an example of port‐based network access control (NAC).
acceptable use
Often defined as a policy, acceptable use defines the rules that restrict how a computer, network, or other system may be used.
access control list (ACL)
A list of permissions attached to an object. ACLs specify what level of access a user, users, or groups have to an object. When dealing with firewalls, an ACL is a set of rules that applies to a list of network names, IP addresses, and port numbers.
access control model
Specifies methodologies by which admission to physical areas and, more importantly, computer systems, is managed and organized.
account expiration
The date when a user’s account they use to log on to the network expires.
accounting
The tracking of data, computer usage, and network resources. Often it means logging, auditing, and monitoring of the data and resources.
active interception
Normally refers to placing a computer between the sender and the receiver in an effort to capture and possibly modify information.
ad filtering
Ways of blocking and filtering out unwanted advertisements; pop‐up blockers and content filters are considered to be ad filtering methods.
Advanced Encryption Standard (AES)
An encryption standard used with WPA and WPA2. The
successor to DES/ 3DES and is another symmetric key encryption standard composed of three different
block ciphers: AES‐128, AES‐192, and AES‐256.
adware
Type of spyware that pops up advertisements based on what it has learned about the user.
algorithms
Well‐defined instructions that describe computations from their initial state to their final
state.
anomaly-based monitoring
Also known asstatistical anomaly‐based monitoring, establishes a performance baseline based on a set of normal network traffic evaluations.
AP isolation
Each client connected to the AP will not be able to communicate with each other, but they can each still access the Internet.
application black-listing
A method of disallowing one or more applications from use.
application firewall
A firewall that can control the traffic associated with specific applications. Works all the way up to the Application Layer of the OSI model.
application-level gateway (ALG)
Applies security mechanisms to specific applications, such as FTP and/or BitTorrent.
It supports address and port translation and checks whether the type of application traffic is allowed.
application white-listing
A method of restricting users to specific applications.
ARP poisoning
An attack that exploits Ethernet networks, and it may enable an attacker to sniff frames of information, modify that information, or stop it from getting to its intended destination.
asymmetric key algorithm
A type of cipher that uses a pair of different keys to encrypt and decrypt data.
attack vector
The path or means by which an attacker gains access to a computer.
audit trails
Records or logs that show the tracked actions of users, regardless of whether the users successfully completed the actions.
authentication
When a person’s identity is confirmed. Authentication is the verification of a person’s identity.
authorization
When a user is granted access to specific resources after authentication is complete.
availability
Data is obtainable regardless of how information is stored, accessed, or protected.
backdoors
Used in computer programs to bypass normal authentication and other security mechanisms in place.
back-to-back perimeter
A type of DMZ where the DMZ is located between the LAN and application‐ level gateway (ALG).
Applies security mechanisms to specific applications, such as FTP and/ or BitTorrent.
It supports address and port translation and checks whether the type of application traffic is allowed.
(Bonus: Blackout: When a total loss of power for a prolonged period occurs.)
blanket purchase agreement (BPA)
A service‐level agreement (SLA) that is reoccurring.
block cipher
A type of algorithm that encrypts a number of bits as individual units known as blocks.
bluejacking
The sending of unsolicited messages to Bluetooth‐enabled devices such as mobile phones and tablets.
bluesnarfing
The unauthorized access of information from a wireless device through a Bluetooth connection.
botnet
A group of compromised computers used to distribute malware across the Internet; the members are usually zombies.
broadcast storm
When there is an accumulation of broadcast and multicast packet traffic on the LAN coming from one or more network interfaces.
brownout
When the voltage drops to such an extent that it typically causes the lights to dim and causes computers to shut off.
brute-force attack
A password attack where every possible password is attempted.
buffer overflow
When a process stores data outside the memory that the developer intended to be used for storage. This could cause erratic behavior in the application, especially if the memory already had other data in it.
business impact analysis
The examination of critical versus noncritical functions, it is part of a business continuity plan (BCP).
butt set (or lineman’s handset)
A device that looks similar to a phone but has alligator clips that can connect to the various terminals used by phone equipment, enabling a person to listen in to a conversation.
CAM table (Content Addressable Memory)
A table that is in a switch’s memory that contains ports and their corresponding MAC addresses.
CAPTCHA
A type of challenge‐response mechanism used primarily in websites to tell whether or not the user is human.
Stands for Completely Automated Public Turing test to tell Computers and Humans Apart.
certificate authority (CA)
The entity (usually a server) that issues digital certificates to users.
certificate revocation list (CRL)
A list of certificates no longer valid or that have been revoked by the issuer.
certificates
Digitally signed electronic documents that bind a public key with a user identity.
chain of custody
Documents who had custody of evidence all the way up to litigation or a court trial (if necessary) and verifies that the evidence has not been modified.
Challenge Handshake Authentication Protocol (CHAP)
An authentication scheme used by the Point‐to‐Point Protocol (PPP) that is the standard for dial‐up connections.
change management
A structured way of changing the state of a computer system, network, or IT procedure.
chromatic dispersion
The refraction of light as in a rainbow. If light is refracted in such a manner on fiber‐optic cables, the signal cannot be read by the receiver.
cipher
hint: alogorithm
An algorithm that can perform encryption or decryption.
circuit-level gateway
Works at the Session Layer of the OSI model and applies security mechanisms when a TCP or UDP connection is established; acts as a go‐between for the Transport and Application Layers in TCP/ IP.
closed-circuit television (CCTV)
A video system (often used for surveillance) that makes use of traditional coaxial‐based video components, but is used privately, within a building or campus.
cloud computing
A way of offering on‐demand services that extend the capabilities of a person’s computer or an organization’s network.
cluster
Two or more servers that work with each other.
cold site
A site that has tables, chairs, bathrooms, and possibly some technical setup (for example, basic phone, data, and electric lines), but will require days if not weeks to set up properly.
Common Vulnerabilities and Exposures (CVE) ®
An online list of known vulnerabilities (and patches) to software, especially web servers. It is maintained by the MITRE Corporation.
computer security audits
Technical assessments made of applications, systems, or networks.
confidentiality
Preventing the disclosure of information to unauthorized persons.
content filters
Individual computer programs that block external files that use Java‐Script or images from loading into the browser.
cookies
Text files placed on the client computer that store information about it, which could include your computer’s browsing habits and credentials.
Tracking cookies are used by spyware to collect information about a web user’s activities.
Session cookies are used by attackers in an attempt to hijack a session.
cross-site request forgery (XSRF)
An attack that exploits the trust a website has in a user’s browser in an attempt to transmit unauthorized commands to the website.
cross-site scripting (XSS)
A type of vulnerability found in web applications used with session hijacking.
crosstalk
When a signal transmitted on one copper wire creates an undesired effect on another wire; the signal “bleeds” over, so to speak.
crypto-analysis attack
A password attack that uses a considerable set of precalculated encrypted passwords located in a lookup table.
cryptographic hash functions
Hash functions based on block ciphers.
cryptography
The practice and study of hiding information.
data emanation (or signal emanation)
The electromagnetic field generated by a network cable or network device, which can be manipulated to eavesdrop on conversations or to steal data.
Data Encryption Standard (DES)
An older type of block cipher selected by the United States federal government back in the 1970s as its encryption standard; due to its weak key, it is now considered deprecated.
data loss prevention (DLP)
Systems that are designed to protect data by way of content inspection.
They are meant to stop the leakage of confidential data, often concentrating on communications.
default account
An account installed by default on a device or within an operating system with a default set of user credentials that are usually insecure.
defense in depth
The building up and layering of security measures that protect data from inception, on through storage and network transfer, and lastly to final disposal.
demilitarized zone (DMZ)
A special area of the network (sometimes referred to as a subnetwork) that houses servers of host information accessed by clients or other networks on the Internet.
denial-of-service (DoS)
A broad term given to many different types of network attacks that attempt to make computer resources unavailable.
dictionary attack
A password attack that uses a prearranged list of likely words, trying each of them one at a time.
differential backup
Type of backup that backs up only the contents of a folder that have changed since the last full backup.
Diffie-Hellman
Key exchange Invented in the 1970s, it was the first practical method for establishing a shared secret key over an unprotected communications channel.
digital signature
A signature that authenticates a document through math, letting the recipient know that the document was created and sent by the actual sender and not someone else.
directory traversal
Also known as the ../ (dot dot slash) attack
A method of accessing unauthorized parent directories.
disaster recovery plan
A plan that details the policies and procedures concerning the recovery and/ or continuation of an organization’s technology infrastructure.
discretionary access control (DAC)
An access control policy generally determined by the owner.
distributed denial-of-service (DDoS)
An attack in which a group of compromised systems attack a single target, causing a DoS to occur at that host, usually using a botnet.
diversion theft
When a thief attempts to take responsibility for a shipment by diverting the delivery to a nearby location.
DNS poisoning
The modification of name resolution information that should be in a DNS server’s cache.
due care
The mitigation action that an organization takes to defend against the risks that have been uncovered during due diligence.
due process
The principle that an organization must respect and safeguard personnel’s rights.
dumpster diving
When a person literally scavenges for private information in garbage and recycling containers.
Easter egg
A platonic extra added to an OS or application as a sort of joke; the harmless cousin of the logic bomb.
due diligence
Ensuring that IT infrastructure risks are known and managed.
domain name kiting
The process of deleting a domain name during the five‐day grace period (known as the add grace period, or AGP) and immediately reregistering it for another five‐day period to keep a domain name indefinitely and for free.
disk duplexing
When each disk is connected to a separate controller.
eavesdropping
When a person uses direct observation to “listen” in to a conversation.
electromagnetic interference (EMI)
A disturbance that can affect electrical circuits, devices, and cables due to electromagnetic conduction or radiation.
elliptic curve cryptography (ECC)
A type of public key cryptography based on the structure of an elliptic curve.
encryption
The process of changing information using an algorithm (or cipher) into another form that is unreadable by others— unless they possess the key to that data.
ethical hacker
An expert at breaking into systems and can attack systems on behalf of the system’s owner and with the owner’s consent.
evil twin
A rogue wireless access point that uses the same SSID as a nearby legitimate access point.
explicit allow
When an administrator sets a rule that allows a specific type of traffic through a firewall, often within an ACL.
explicit deny
When an administrator sets a rule that denies a specific type of traffic access through a firewall, often within an ACL.
Extensible Authentication Protocol (EAP)
Not an authentication mechanism in itself but instead
defines message formats. 802.1X would be the authentication mechanism and defines how EAP is encapsulated within messages.
fail-open mode
When a switch broadcasts data on all ports the way a hub does.
failover clusters
Also known as high‐availability clusters, these are designed so that a secondary server can take over in the case that the primary one fails, with limited or no downtime.
false negative
When a system denies a user who actually should be allowed access to the system— for example, when an IDS/ IPS fails to block an attack, thinking it is legitimate traffic.
false positive
When a system authenticates a user who should not be allowed access to the system— for example, when an IDS/ IPS blocks legitimate traffic from passing on to the network.
false rejection
When a biometric system fails to recognize an authorized person and doesn’t allow that
person access.
Faraday cage
An enclosure formed by conducting material or by a mesh of such material; it blocks out external static electric fields and can stop emanations from cell phones and other devices within the cage from leaking out.
federated identity management (FIM)
When a user’s identity is shared across multiple identity management systems.
fire suppression
The process of controlling and/ or extinguishing fires to protect people and an organization’s data and equipment.
firewall
A part of a computer system or network designed to block unauthorized access while permitting authorized communications. It is a device or set of devices configured to permit or deny computer applications based on a set of rules and other criteria.
first responders
People who perform preliminary analysis of the incident data and determine whether the incident is an incident or just an event, and the criticality of the incident.
flood guard
Security feature implemented on some firewalls to protect against SYN floods and other flooding attacks. Also known as attack guards.
fork bomb
An attack that works by creating a large number of processes quickly to saturate the available processing space in the computer’s operating system. It is a type of wabbit.
Fraggle
A type of DoS similar to the Smurf attack, but the traffic sent is UDP echo traffic as opposed to ICMP echo traffic.
full backup
Type of backup where all the contents of a folder are backed up.
fuzz testing (fuzzing)
When random data is inputted into a computer program in an attempt to find vulnerabilities.
grandfather-father-son
A backup rotation scheme in which three sets of backup tapes must be defined— usually they are daily, weekly, and monthly, which correspond to son, father, and grandfather.
grayware
A general term used to describe applications that are behaving improperly but without serious consequences; often describes types of spyware. Group Policy is used in Microsoft environments to govern user and computer accounts through a set of rules.
hardening
The act of configuring an OS securely, updating it, creating rules and policies to help govern the system in a secure manner, and removing unnecessary applications and services.
hardware security module (HSM)
A physical device that deals with the encryption of authentication processes, digital signings and payment processes.
hash
A summary of a file or message. It is generated to verify the integrity of the file or message.
hash function
A mathematical procedure that converts a variable‐sized amount of data into a smaller block of data.
hoax
The attempt at deceiving people into believing something that is false.
honeynet
One or more computers, servers, or an area of a network, used to attract and trap potential attackers to counteract any attempts at unauthorized access of the network.
honeypot
Generally is a single computer but could also be a file, group of files, or an area of unused IP address space used to attract and trap potential attackers to counteract any attempts at unauthorized access of the network.
host-based intrusion detection system (HIDS)
A type of system loaded on an individual computer;
it analyzes and monitors what happens inside that computer— for example, if any changes have been
made to file integrity.
hot and cold aisles
The aisles in a server room or data center that circulate cold air into the systems and hot air out of them.
Usually, the systems and cabinets are supported by a raised floor.
hot site
A near duplicate of the original site of the organization, complete with phones, computers, networking devices, and full backups.
hotfix
Originally, a hotfix was defined as a single problem fixing patch to an individual OS or application that was installed live while the system was up and running, and without a reboot necessary.
However, this term has changed over time and varies from vendor to vendor.
HTTP proxy (web proxy)
Caches web pages from servers on the Internet for a set amount of time.
hypervisor
The portion of virtual machine software that allows multiple virtual operating systems (guests) to run at the same time on a single computer.
identification
When a person is in a state of being identified. It can also be described as something that identifies a person such as an ID card.
identity proofing
An initial validation of an identity.
incident management
The monitoring and detection of security events on a computer network and the execution of proper responses to those security events.
incident response
A set of procedures that an investigator follows when examining a computer security incident.
incremental backup
Type of backup that backs up only the contents of a folder that have changed since the last full backup or the last incremental backup.
information assurance
The practice of managing risks that are related to computer hardware and software systems.
information security
The act of protecting information from unauthorized access.
It usually includes an in‐depth plan on how to secure data, computers, and networks.
Infrastructure as a Service (IaaS)
A cloud computing service that offers computer networking, storage, load balancing, routing, and VM hosting.
input validation (data validation)
A process that ensures the correct usage of data.
