Terminology Flashcards
Pen Testing (Penetration testing)
A penetration test, also known as a pen test, is a simulated cyber attack against your computer system to check for exploitable vulnerabilities.
Sequel Injection (SQL)
SQL injection is a code injection technique that might destroy your database. SQL injection is one of the most common web hacking techniques.
CIA Triad
Confidentiality, Integrity, Availability
Information Security
The state of being protected against the unauthorized use of information, especially electronic data, or the measures taken to achieve this.
Cyber Security
Cyber security is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks.
APT (Advanced Persistent Threats)
An advanced persistent threat (APT) is a sophisticated, sustained cyberattack in which an intruder establishes an undetected presence in a network in order to steal sensitive data over a prolonged period of time.
Attribution
Cyber-threat attribution is the identification of attacker responsible for a cyber-attack. It is a challenging task as attacker uses different obfuscation and deception techniques to hide its identity.
Surface Map / Attack Surface
Attack surface mapping is a cybersecurity technique that helps identify an organization’s attack surface. It is a process that spots the different points of vulnerability in a system and provides recommendations for reducing the attack surface. Attack surface mapping can be done manually or with automated tools.
Social Engineering
Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.
Firewall
A Firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization’s previously established security policies. At its most basic, a firewall is essentially the barrier that sits between a private internal network and the public Internet.
Zero Day Attack
The term “Zero-Day” is used when security teams are unaware of their software vulnerability, and they’ve had “0” days to work on a security patch or an update to fix the issue. “Zero-Day” is commonly associated with the terms Vulnerability, Exploit, and Threat.
Playbook
A cyber response playbook is a plan that outlines the steps you will take in the event of a security incident. Most organizations keep their incident response plans very simple and then augment specific types of incidents with cyber response playbooks.
Personal Identifying Information (PII)
Personally Identifiable Information; Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.
Defence in Depth
A defense-in-depth strategy, aka a security-in-depth strategy, refers to a cybersecurity approach that uses multiple layers of security for holistic protection. A layered defense helps security organizations reduce vulnerabilities, contain threats, and mitigate risk.
Zero-Trust
Zero trust network access (ZTNA) is a product or service that creates an identity- and context-based, logical access boundary around an application or set of applications. The applications are hidden from discovery, and access is restricted via a trust broker to a set of named entities.
CVE Rating
CVE is a glossary that classifies vulnerabilities. The glossary analyzes vulnerabilities and then uses the Common Vulnerability Scoring System (CVSS) to evaluate the threat level of a vulnerability. A CVE score is often used for prioritizing the security of vulnerabilities 1 - 10
Out of Bounds Error
Tries to access something outside of the bounds of the container
Bug Bounties
A bug bounty program, also called a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals for discovering and reporting software bugs.
Cyber security Scope
A frame within to search or detect - in scope or out of scope
Least privileged principle
The principle of least privilege (PoLP) is an information security concept which maintains that a user or entity should only have access to the specific data, resources and applications needed to complete a required task.
IAAA
identification, authentication, authorisation, and accountability (Auditing)
GRC
Governance, Risk, and Compliance
Legacy System
A legacy system is outdated computing software or hardware that is still in use, but its older technology won’t allow it to interact with newer systems.
API
Application program Interface
VPN
Virtual Private Network, routes all of your internet activity through a secure, encrypted connection, which prevents others from seeing what you’re doing online and from where you’re doing it. Basically, a VPN provides an extra layer of security and privacy for all of your online activities.
Fuzzing
Fuzz testing or fuzzing is an automated software testing method that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities. A fuzzing tool injects these inputs into the system and then monitors for exceptions such as crashes or information leakage.
Life and Limb Data
Data that may effect real world decision around safety ie weather data for boaties etc
Encryption
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext.
Cipher text
Ciphertext is encrypted text transformed from plaintext using an encryption algorithm. Ciphertext can’t be read until it has been converted into plaintext (decrypted) with a key. The decryption cipher is an algorithm that transforms the ciphertext back into plaintext.
Symmetric encryption
Symmetric encryption uses a unique key that must be shared between the people who need to receive the message
Asymmetric encryption
Asymmetric encryption uses a pair of public keys and a private key to encrypt and decrypt messages when they are communicated
encoding vs encryption
Encoding is for maintaining data usability and can be reversed by employing the same algorithm that encoded the content, i.e. no key is used. Encryption is for maintaining data confidentiality and requires the use of a key (kept secret) in order to return to plaintext.
non-repudiation
you said it, you cant deny it - no question
Plaintext
unencrypted text
cipher text
encrypted text
Hashing
A way of verifying a message has been sent and not tampered with. Hashing is the process of transforming any given key or a string of characters into another value. This is usually represented by a shorter, fixed-length value or key that represents and makes it easier to find or employ the original string.
PBKDF2
“In cryptography, PBKDF1 and PBKDF2 (Password-Based Key Derivation Function 1 and 2) are key derivation functions with a sliding computational cost, used to reduce vulnerability to brute-force attacks.[1]
PBKDF2 is part of RSA Laboratories’ Public-Key Cryptography Standards (PKCS) series, specifically PKCS #5 v2.0, also published as Internet Engineering Task Force’s RFC 2898. It supersedes PBKDF1, which could only produce derived keys up to 160 bits long.[2] RFC 8018 (PKCS #5 v2.1), published in 2017, recommends PBKDF2 for password hashing.”
NIST
National Institute of Standards and Technology at the U.S. Department of Commerce. The NIST Cybersecurity Framework helps businesses of all sizes better understand, manage, and reduce their cybersecurity risk and protect their networks and data.
Homomorphic encryption
Homomorphic encryption is the conversion of data into ciphertext that can be analyzed and worked with as if it were still in its original form. Homomorphic encryption enables complex mathematical operations to be performed on encrypted data without compromising the encryption.”
Diffie Hellman
Key exchange is a method of digital encryption that securely exchanges cryptographic keys between two parties over a public channel without their conversation being transmitted over the internet. The two parties use symmetric cryptography to encrypt and decrypt their messages.
