acronyms Flashcards

(73 cards)

1
Q

pluggin

A

A component that adds a specific feature to software. Also referred to as an extension. example face ID on iphone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

feature

A

A distinctive characteristic of software or hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

platform

A

The environment in which a piece of software is executed. It may be the hardware, operating system, a web browser, or other underlying software.
For example, Microsoft Windows is a platform for Microsoft Word.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

operating system (OS):

A

Software that manages the computer hardware and software. It’s a system that sits between the applications and hardware.
Microsoft Windows is an example of an operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

utilities:

A

Applications designed to help analyze, configure, optimize, or maintain a computer. Unlike application software (which focuses on benefiting the user), utilities are used to support the computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Applications (apps)

A

A type of software that allows a user to perform specific tasks and activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

advanced persistent threat:

A

Also known as APT, is a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. The bad guy’s goal is to go undetected and steal data, rather than cause damage to the network or organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Zero-Day

A

the good guys had no warning; they had “zero-days” to do something about it. Because the bad guys exploited a security vulnerability before the good guys were aware of the security vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Exploit

A

Software or code—usually malicious—that takes advantage of a flaw or Security vulnerability. The purpose is to cause unintended or unanticipated behavior to occur with the software or hardware. Such behavior would be unauthorized access or control of a computer, or denial-of-service (DoS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

security vulnerability

A

A weakness on a network, computer, or software which allows a bad guy to gain access. A security vulnerability has three elements:
1).a flaw,
2). access to the flaw,
3). and capability to exploit that flaw.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

DoS attack

A

(Denial of Service) Bombarding the system to overload the computer to prevent users from getting on the site. When the attacks come from multiple sources, it’s called DDoS, “distributed denial-of-service.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data Breach

A

The intentional or unintentional release of secure information to an untrusted environment. Other terms for events like this are: unintentional information disclosure, data leak, and data spill.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

botnet

A

Short for “robot network,” it’s a collection of software robots, or “bots,” that live on infected computers, and are controlled by the bad guys. Botnets do many bad things like spew out spam, attack other computers, or send back confidential data to the botnet controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Rootkit

A

Malicious code that loads into the early loading stages of a computer. The code hides itself from the operating system and other applications that load in the later stages, like antivirus and system utilities. This gives the bad guy full access to alter the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Ransom ware

A

Vicious malware that locks users out of their devices or blocks access to files until a sum of money or ransom is paid. Attacks cause downtime, data loss, possible intellectual property theft, and data breaches. Ransomware is also referred to as “cryptoware.”
How it works: Once the malware is on the machine, it starts to encrypt all the data files it can find on the computer and on any computers it can access within the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Malware

A

Malicious software. Short for the term “malicious software.” It’s an umbrella term used to refer to the various types of viruses, worms and trojans, etc. Most malware is installed without the infected person ever realizing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Virus

A

A malicious computer program that infects a file. A true virus can only spread from one computer to another when its host (infected file) is sent to the target computer.
The word “virus” is incorrectly used as an umbrella term for many flavors of viruses, worms and trojans, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

worm

A

A self-replicating computer program. It sends copies of itself to other computers, and may do so without any user intervention. Unlike a virus, it doesn’t need to attach itself to an existing file. Worms almost always cause at least some harm to the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Trojan malware

A

Malware that is designed to make you think you’re performing a task that you want when your’e really letting a hacker in or downloading malicious software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

WPT

A

Weak Password Test- Checks their active directory for several different types of weak passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

USB

A

Universal Serial Bus- we also have a test that downloads software onto the users usb and they leave it in the office to see who plugs it in and who allows macros which is a mini program. then they are sent results after 7 days.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SMPT

A

Social media Phishing Test- Similar to a PST PRT see which users are likely to fall for social media related phishing attacks.
User selections either facebook, linked in, twitter, and then a landing page either one that reveals its a simulated phising or a login page for their login information for the social media platform. report will show how many people clicked on the link and how many people actually entered login information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SMS

A

Short Message Service-a text message. there is also a smishing: which is sms phising

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SMB

A

Small and Medium Businesses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
SKU
Stock Keeping Unit-A unique identification number that defines an item at the identifiable inventory level
26
SEi
Social Engineering Indicators-A feature of KnowBe4's simulated phishing campaigns that shows a user the red flags they missed when clicking on a link in a simulated phishing campaign.
27
Email Spoofing
Spoofing (tricking or deceiving) computer systems or other computer users. Email spoofing involves sending messages from a bogus email address or faking the email address of another user (DD) and CEO fraud.
28
Phising prone percentage
The amount of people who click on the simulated phising link done by knowbe4 before the training.
29
Phising attack surface
The amount of email exposed on the internet.
30
Spear phising
Is an email attack that is specific to target one person with information used in the email aquirred through research on the target before they send the email
31
Phising
criminally fraudulent social engineering through email to access users sensitive information like login passwords, credit card information etc. by pretending to be something that its not.
32
7 reasons company would outsource SAT
Reduce costs- its cheaper Access to talent- we have trained professionals Geographic reach and scalability- its a SaaS which can be run anywhere Compliance- Help with efficiently becoming compliant in industry. Mitigate risk- Less risky to go with established system that is proven to work Business Focus- focus on what your business does and not on security. Leverage the cost of technology- Cheaper to use a system already in place than to hire and train someone within the company.
33
SAT
Security Awareness Training- Any training that raises the awareness of a user to potential threats, and how to avoid them. The Six Steps to Successful Security Awareness Training (SAT) Step 1: Have a security policy, and have each employee read and sign it. Step 2: Have all employees take mandatory SAT (online), with a clear deadline and reasons why they're taking the training. Step 3: Make SAT part of the onboarding process (the process of integrating new hires in a company). Step 4: Regularly test employees to reinforce the SAT's application. Step 5: Have employees who fail phishing tests meet privately with a supervisor or HR; reward employees with low failure rates. Step 6: Send regular security hints and tips via email to all employees.
34
SaaS
(Softwareasaservice)a method of software delivery and licensing in which software is accessed online via a subscription, rather than bought and installed on individual computers.example Knowbefore, google apps. etc
35
RIO
Return on Investment- The amount of money that is gained or lost with a purchase of for example knowbe4 Kmsat. A software as a service
36
Ran-sim
Ransomware Simulator-Uses 13 ransomware Infection scenarios to determine where they may be vulnerable to a ransomware attack. They also check if their antivirus is blocking Files that should be let through.
37
PST
Phishing Security Test- A simulated phising test in which the user enters which emails they want to be tested on. They pick a specific template they wish to use and the clicker is sent to a landing page. They take the amount of people who clicked on the link compared to the ones that didnt to get a Phish Prone percentage.
38
PRT
Phishing Reply Test- Phishing Test to see who replies to an email that is usually a doplgainer. It does not contain links it is only to see who will reply to the email.
39
PII
Personally Identifiable Information-Any information that can be used on its own or with other information to identify, contact, or locate a single person.
40
PHi
Protected Health Information-All recorded information about an individual's health status, including their health care coverage.
41
PCI-DSS
Payment Card Industry Data Security Standard-A document published by Payment Card Industry. The publication lists all requirements for securely handling credit cards and credit card information. Organizations who accept credit cards must be PCI compliant. One of the requirements includes security awareness training.
42
PCI
Payment Card Industry
43
PET
Password Exposure Test-users have exposed emails and.....passwords......publicly available on the web and checks the organization's Active Directory to see if they are using weak or compromised passwords that are part of a known data breach.
44
PAB
Phishing Alert Button- goes to IT to see if its actually a phising scam and deletes the email from the users inbox. if its determined to be a scam the IT can delete it from everyones email.
45
MSA
Mailserver Security Assessment- Checks to see how their mailserver filters emails. IF it allows our test emails through or if it blocks them.
46
MASA
Multi-factor Authentication Security Assessment- Checks to see if their multi-factor authentication is working properly or if it has any flaws that can be exploited.two...factor..authentication..
47
(SCORM):
(SCORM):Sharable Content Object Reference Model A technical standard that governs how online learning content and Learning Management Systems communicate with each other
48
LMS
Learning Management System-A system for the administration, documentation, tracking, reporting, and delivery of e-learning education courses or training programs. KMSAT (Kevin Mitnick Security Awareness Training) uses an LMS. Note: You are using an LMS right now while doing this course! It's called Bridge.
49
KCM
KnowBe4 Compliance Manager- KCM GRC is a project management and organization tool, specifically designed for risk and compliance related projects. It enables organizations to stay organized, stay prepared, and be able to demonstrate their processes and proof around these types of projects. Also a SaaS Most organizations track compliance using spreadsheets, word processors or self-maintained software such as Sharepoint (a platform designed by Microsoft, used for document management and storage). This is inefficient, error prone, costly, and risky. KCM GRC simplifies this process.
50
HIPAA
Health Insurance Portability and Accountability Act- requires healthcare organizations to protect personal health information (PHI).
51
EEC-Pro
Email Exposure Check pro- A super deep search even into word documents to see if emails have been exposed. Gives a Phishing attack surface which shows how many emails are out on the internet. Customers that buy the GOLD package get sent an EEC every month. The EEC has been upgraded to EEC Pro spring 2018 and delivers more information.
52
DST
Domain Spoof Test- To see if your company domain has been spoofed
53
CSO
Chief Security Officer
54
CSM
Customer Success Manager
55
CiSO
Chief Information Security Officer
56
CiO
Chief Information Officer
57
CARA
Compliance Audit Readiness Assessment-is a KCM-oriented complimentary web-based tool that helps the user gauge their organization’s readiness in meeting compliance requirements for the Cybersecurity Maturity Model Certification (CMMC) framework. CARA is a 5-minute self-assessment tool that will help the user define what technical controls are required for a given scope within the regulatory compliance framework. How it works: Users will receive a custom link to take their assessment. They then rate their organization's readiness for each requirement as Met, Partially Met, or Not Met. Next, they get an instant analysis and summary of potential gaps in your cybersecurity preparedness. Finally, they receive a custom report with control guidance suggestions to help them meet compliance. Results in a few minutes!
58
BPi
Browser Password Inspector-checks the user passwords saved in the web browser against your Active Directory for threats related to weak, reused, and old passwords in use. Checks passwords saved in chrome or other browsers and then sees if they are part of a data breach and if they are still active and being used in the company.
59
ASAP
Automated Security Awareness Program-starts with answering seven questions about your goals and organization (on a questionnaire). ASAP will then create a program and a schedule of tasks for you automatically. The tasks will be based on best-practices in an easy calendar view on how to achieve your security awareness goals and deploy your program.
60
Directory
Like physical folders, a directory organizes files or data on a hard drive or in a program. Directories can contain other directories, which are then called sub-directories. Software that stores all resources on a network. Example resources are: users, groups, permissions, devices, and management policies. A directory is also referred to as a directory service. Example: When a directory is given a username, it will return the profile of the user, which may include permissions for data access, as well as employee information.
61
Server
A computer or program that manages access to centralized resources. For example, a file server would store and manage all the user files for a group of computers and users.
62
console
A user interface that manages and controls software and/or hardware. KnowBe4 customers access our products through a console
63
API
Application Program Interface-A set of clearly defined methods of communication between software.
64
ADI
Active Directory Integration-the process of incorporating directory services — a suite of tools for managing users, groups, and resources — into a network of computers.
65
compliance
The action of meeting requirements of accepted practices, specific standards, laws, prescribed rules and regulations or That state of having met required regulations for the industry one is in.
66
whitelist:
A list of trusted email addresses, domains and/or internet addresses that are permitted to pass through a system or filter.
67
White paper
A report that describes how a technology or product solves a problem. It's a marketing and technical document that doesn't go too far in either direction.
68
HTTP and HTTPS
Hypertext Transfer Protocol One of the protocols (specific code language) used to transfer information (like a webpage) over the Internet. HTTPS is Secure which has encrypted code to make is safer to transfer the information from one source to another.
69
Scim
(System for Cross-domain Identity Management): This is an integration service for user provisioning. SCIM integration allows one to import their users and groups from their identity provider into their KnowBe4 Console.
70
AD
Active Directory-A directory service developed by Microsoft for use on Windows operating systems. If you were in charge of all the users and computers on a network that are using a Windows server, you would use Active Directory to set up the users, their passwords and what devices they could access. It is MicroSoft’s name for their directory.
71
Cloud Computing
cloud computing: The practice of using remote servers on the Internet to store, manage, and process data, rather than a local server or a personal computer. Cloud servers get all the latest software and security updates, making them less vulnerable to attack. Example: The use of Google Apps (Gmail, docs, calendar, etc.)
72
Defense In Depth
A security discipline that refers to having layers of protection in an IT infrastructure. It is designed this way so that security is not dependent on any single layer, especially in the event of an attack. Policies, Procedures, and Awareness: Published policies, implemented security procedures, and trained employees. Perimeter: A firewall to prevent unauthorized access to the network. Internal Network: Software or hardware tools that scan the network for attackers and traffic that shouldn't be there. Host: The individual computers on the network, running antivirus. Application: Correct configurations, securely written code, and access privileges. Data: Encrypting confidential data, or password protecting databases.
73
AIDA
Artificial Intelligence Driven Agent-A tool that uses artificial intelligence (AI) to automatically create integrated campaigns that send emails, text, and voicemail to an employee, simulating a multi-vector social engineering attack.