Vocab Words Flashcards by Malerie Raynor

a senior position within an orgs security team with direct responsibility for protecting sensitive information and preventing unauthorized access to electronic data and the systems that protect it

Cybersecurity Analyst

How well did you know this?

Not at all

Perfectly

a location where security professionals monitor and protect critical information assets in an organization.

Security Operations Center (SOC)

How well did you know this?

Not at all

Perfectly

mitigates vulnerabilities and risk to ensure the confidentiality, integrity, availability, nonrepudiation, and authentication of data

Security Control

How well did you know this?

Not at all

Perfectly

category of security controls that is implemented as a system

Technical Controls

How well did you know this?

Not at all

Perfectly

category of security controls that are implemented primarily by people

Operational Controls

How well did you know this?

Not at all

Perfectly

category of security controls that provide oversight of the system

Managerial Controls

How well did you know this?

Not at all

Perfectly

control that eliminates or reduces likelihood that an attack succeeds

Preventative Controls

How well did you know this?

Not at all

Perfectly

a control that may not prevent or deter access, but will identify and record any attempted or successful intrusion

Detective Control

How well did you know this?

Not at all

Perfectly

control that eliminates or reduces the impact of an intrusion event

Corrective Control

How well did you know this?

Not at all

Perfectly

process where data is generated and is collected, processed, analyzed, and disseminated to provide insights of the security status of the system

Security Intelligence

How well did you know this?

Not at all

Perfectly

investigation, collection, analysis, and dissemination of information about emerging threats and threat sources to provide data about the threat landscape

Cyber Threat Intelligence

How well did you know this?

Not at all

Perfectly

method of obtaining information about a person or organization through public records, websites, and social media

Open-Source Intelligence (OSINT)

How well did you know this?

Not at all

Perfectly

not for profit group set up to share sector-specific threat intelligence and security best practices amongst its members

Information Sharing and Analysis Centers (ISACS)

How well did you know this?

Not at all

Perfectly

threat that can be identified using basic signature or pattern matching

*malware or documented exploits

Known Threat

How well did you know this?

Not at all

Perfectly

threats that cannot be identified using basic signature or pattern matching

Unknown Threat

How well did you know this?

Not at all

Perfectly

any unknown exploit in the wild that exposes a vulnerability and can create problems before anyone realizes something is wrong

Zero-Day Exploit

How well did you know this?

Not at all

Perfectly

malicious code that the malware author has attempted to hid through various techniques

Obfuscated Malware Code

How well did you know this?

Not at all

Perfectly

malware detection method that evaluates an object based on its intended actions before it can actually execute that behavior

Behavior Based Detection

How well did you know this?

Not at all

Perfectly

process of combining and modifying parts of an existing exploit code to create new threats that are not as easily identified by automated scanning

Recycled Threats

How well did you know this?

Not at all

Perfectly

malware that contains obfuscation techniques to circumvent signature matching and detection

Known Unknowns

How well did you know this?

Not at all

Perfectly

a classification of malware that contains completely new attack vectors and exploits

Unknown Unknowns

How well did you know this?

Not at all

Perfectly

those who wish to harm networks or steal secure data

Threat Actor

How well did you know this?

Not at all

Perfectly

uses other people’s tools to conduct their attacks as they don’t have the skills to make their own tools

Script Kiddie

How well did you know this?

Not at all

Perfectly

those who have authorized access to an orgs network, policies, and procedures and business practices

*can be intentional or unintentional

Threat Actor

How well did you know this?

Not at all

Perfectly

politically motivated hacker who targets gov't, orgs, and individuals to advance their political ideologies

Hacktivist

group of attackers with exceptional capability, funding, and organizational with an intent to hack a network or system

Nation State

an attacker that establishes a long-term presence on a network in order to gather sensitive information

Advanced Persistent Threat (APT)

malicious software applications that are widely available for sale or easily obtainable and useable

Commodity Malware

vulnerability that is discovered or exploited before the vendor can issue a patch to fix it

Zero-Day vulnerability

infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets

Command and Control (C2)

blacklists of known threat sources, such as malware signatures, IP address ranges, and DNS domains

Reputation Data

a residual sign that an asset or network has been successfully attacked or is under attack

Indicator of Compromise (IoC)

the correlation of IoC's into attack patterns

Behavioral Threat Research

an APT's C2 application uses any port to communicate and jumps between different ports

Port Hopping

rapidly changes the IP address associated with a domain

Fast Flex DNS

unauthorized transfer of data from a computer or other device

Data Exfiltration

the stages by which a threat actor progresses a network intrusion *7-step process

Lockheed Martin Kill Chain

a knowledge base that lists and explains specific adversary tactics, techniques, and common knowledge or procedures

MITRE ATT&CK Framework

a framework for analyzing cybersecurity incidents and intrusions by exploring relationships between four core features: 1. adversary 2. capability 3. infrastructure 4. victim

Diamond Model of Intrusion Analysis

a standard terminology for IoC's and ways of indicating relationships between them that is included as part of the OASIS Cyber Threat Intelligence (CTI) framework.

STIX

a protocol for supplying codified information to automatic incident detection and analysis

TAXII

framework by Mandiant that uses XML-formatted files for supplying codified information to automate incident detection and analysis

Open IoC

a server platform for cyber threat intelligence sharing a proprietary format, supports Open IoC definitions, and can import/export STIX over TAXII *Open source

MISP

identifies and assesses the possible threat actors and attack vectors that pose a risk to the security of an app, network, or other systems

Threat Modeling

classification of the resources and expertise available to a particular threat actor

Adversary Capability

the part at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor

Attack Surface

a specific path by which a threat actor gains unauthorized access to a system

Attack Vector

is a cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring

Threat Hunting

open-source intelligence technique that uses google search operators to locate vulnerable web servers and applications

Google Hacking

added to the results page to alter the results, such as: $pws=0, $filler=0, &tbs=1

URL Modifier

a search engine optimized for identifying vulnerable internet attached devices *thermostat, IoT SCADA devices

Shodan.io

an OSINT technique used to gather email addresses from domain

Email Harvesting

a public listing of all registered domains and their registered administrators

Whois

replicating DNS databases across a set of DNS servers that is often used during the reconnaissance phase of an attack

DNS Zone Transfer

uses OSINT to gather information about a domain

DNS Harvesting

a technique use to copy the source code of website files to analyze for information and vulnerabilities

Website Harvesting

community driven database that keeps track of IP addresses reported for abusive behavior (hacking, phishing, spamming)

Abuse IPDB

portion of the internet not indexed by search engines, which includes private databases, subscription-based websites and other content that is not publicly accessible

Deep Web

a part of the deep web that's used for illegal activities

Dark Web

a way for companies to crowdsource security testing of their software services and applications to identify and address potential security issues

Bug Bounty

allows for the copying of ingress and/or egress communications form one or more switch ports to another

Switched Port Analyzer (SPAN)

hardware or software that records data from frames and passes it to the network media using a mirrored port or TAP device

Packet Sniffer

data network packet analyzer that runs under a CLI and displays TCP/IP that is transmitted or received on a network

tcpdump

an open-source GUI based packet analyzer used for network troubleshooting analysis, software, and communications protocol development and education

Wireshark

captures the entire packet, including the header and payload for all traffic

Full Packet Capture (FPC)

means of recording network traffic's meta data and statistics

Flow Collector

Cisco developed means of reporting network flow information to a structured database.

Net flow

hybrid tool that passively monitors a network like a sniffer and only logs data of potential intrests

Zeek (Bro)

method used by malware to evade block lists by dynamically generating domain names for C2 networks

Domain Generation Algorithm (DGA)

allows one trusted DNS server to communicate with other trusted DNS servers to search for an IP address and return it to the client *way to mitigate DGA's

Secure Recursive DNS Resolver

creates graphs showing traffic flows through the network interfaces of routers and switches by polling the appliances using SNMP

Multi Router Traffic Grapher (MRTG)

method used by malware to hide the presence of C2 networks by continuously changing the host IP addresses in domain records using domain generation algorithms

Secure Recursive DNS Resolver

activity that is performed to identify whether a link is already flagged on an existing reputation list and if not, to identify what malicious scripts or activity might be coded within it

URL Analaysis

set of requests methods to indicate the desired action to be performed for a given resource

HTTP Methods

the header value returned by a server when a client requests a URL

HTTP Response Codes

mechanism to encode 8-bit characters that have specific meaning in the context of URLs

Percent Encoding

list of permitted and denied network connections based on IP addresses, ports, or applications in use

Access Control List (ACL)

linux based firewall that uses syslog file format for its logs

Iptables

windows-based firewall that uses W3C extended log file format

Windows Firewall

occurs when a firewall is under-resourced and cannot log data fast enough therefore some data is missed

Blinding Attack

physical or logical sub network that contains and exposes an organizations external facing services to an untrusted network like the internet

Screened Subnet

reconnaissance technique to enumerate firewall configuration and attempt to probe hosts behind it

Firewalking

applies ACL rules to outgoing traffic to prevent malware form communicating to C2 servers

Egress Filtering

means of mitigating DoS or intrusion attacks by silently dropping traffic

Black Hole

unused physical network ports or unused IP address space within a local network often used by attackers

Dark Nets

DoS attack mitigation strategy that directs the traffic that is flooding a target IP address to a different network for analysis

Sinkhole

a server that mediates the communication between a client and another server. Can filter or modify communications, and provides caching services to improve performance

Forward Proxy

a server that redirects requests and responses for clients configured with the proxy address and port

Non-transparent Proxy

a server that redirects requests and responses without the client being explicitly configured to use it

Transparent Proxy

a type of proxy server that protects severs from direct contact with client requests

Reverse Proxy

a firewall that protects software running on web services and their backend databases form code injection and DoS attacks

Web Application Firewall (WAF)

a software and/or hardware system that scans, audits, and monitors, the security infrastructure for signs of attacks in progress

Intrusion Detection System (IDS)

a software and/or hardware system that scans, audits, and monitors the security infrastructure for signs of attacks in progress and can actively block an attack

Intrusion Prevention System (IPS)

blocking of unauthorized application service ports on hosts and firewalls, or the physical/ remote access ports used to allow a host to communicate on the local network

Port Security

applying an access control lists to a switch or access print so that only clients with approved MAC addresses can connect to it

MAC Filtering

collective protocols, policies, and hardware that authenticates and authorizes access to a network at the device level

Network Access Control (NAC)

a standard for encapsulating EAP (Extensible Authorization Protocol) communications over a LAN or wireless LAN and provides port-based authentication

802.1x

a type of IDS and IPS that monitors a computer system for unexpected behavior or changes to the system on an endpoint

Host Based IDS/IPS (HIDS/ HIPS)

a software agent and monitoring system that performs multiple security tasks such as anti-virus, HIDS/HIPS, firewall, DLP, and file encryption

Endpoint Protection Platform (EPP)

software that collects system data and logs for analysis by a monitoring system to provide early detection of threats

Endpoint Detection and Response (EDR)

a system that can provide automated identification of suspicious activity by user accounts and computer hosts

User and Entity Behavior Analytics (UEBA)

a computing environment isolated from a host system to guarantee that the environment runs in a controlled secure fashion and that communication between the hosts and sandbox are usually prohibited

Sandboxing

the process of analyzing the structure of hardware or software to reveal more about how it functions

Reverse Engineering

a computer program that translates machine language into assembly language

Disassembler

first two bytes of a binary header that indicates its file type

File Signature (Magic Numbers)

Method of compression in which an executable is mostly compressed and the port that isn't contains the code to decompress the executable

Program Packer

malware designed to install or run other types of malware embedded in a payload on an infected host

Dropper

piece of code that connects to the Internet to reference additional tools after the initial infection by a dropper

Downloader

any lightweight code designed to run an exploit on the target

Shellcode

exploit technique that runs malicious code with the identification number of a legitimate process

Code Injection

a suite of tools designed to assist with troubleshooting issues with Windows, many of the tools are suited to investigating security issues

Sysinternal