Acronyms 3 Flashcards
(159 cards)
1
Q
Group Policy
A
A set of rules and policies that can be applied to users or computer accounts
within an operating system
2
Q
Security Templates
A
A group of policies that can be loaded through one procedure
3
Q
Security Template
A
A group of policies that can be loaded through the Group Policy Editor
4
Q
GPO
A
group policy objective
Used to harden the operating system and establish secure baselines
5
Q
Baselining
A
A process of measuring changes in the network, hardware, or software
environment
6
Q
SELinux
A
security enhanced linux enforces MAC
7
Q
Context based permissions
A
Permission schemes that consider various properties to determine
whether to grant or deny access to a use
8
Q
SELinux user context
A
defines which users can access an onject
9
Q
SELinux role context
A
determines which roles can access an object
10
Q
Type context selinux
A
Essential for fine-grained access control, grouping objects with similar
security characteristics
11
Q
selinux Optional level context
A
Describes the sensitivity level of a file, directory, or process
12
Q
SELinux Modes
A
disabled, permissive enforcing
13
Q
SELinux Policy
A
Describes access permissions for users, programs, processes, files, and
devices
14
Q
Targeted SELinux policies
A
Only specific processes are confined to a domain, while others run
unconfined
15
Q
SELinux Strict Policies
A
Every subject and object operates under MAC, but it’s more
complex to set up
16
Q
Data Encryption
A
Process of converting data into a secret code to prevent unauthorized access
17
Q
Vercrypt
A
Tool that selectively encrypts partitions, like sensitive documents,
while leaving the OS partition unencryptedG
18
Q
GNU Privacy Guard
A
A tool that provides cryptographic privacy and authentication for
data communication
19
Q
Wireless Infrastructure Security
A
Crucial for securing wireless networks in organizations
20
Q
Secure Baseline
A
Standard set of security configurations and controls applied to systems,
networks, or applications to ensure a minimum level of security
21
Q
Wireless Access Point Placemant
A
WAPs allow wireless devices to connect to a wired network using Wi-Fi standards
22
Q
ESS
A
Extended service set
multiple WAPS work together to provide seamless network coverage
23
Q
Wireless Access Point Interference
A
Interference occurs when multiple WAPs use the same channels or overlapping
frequencies
24
Q
Site Surveys
A
Essential for planning and designing wireless networks
25
Heat maps
Graphical representations of
○ Wireless coverage
○ Signal strength
○ Frequency utilization
● Useful for troubleshooting
○ Coverage issues
○ Dead zones
○ Signal leakage
26
WEP
(Wired Equivalent Privacy)
Utilizes a static encryption key system
27
WPA
Wi-Fi Protected Access
28
WPA3
■ The latest and most secure wireless security protocol.
■ Uses AES for encryption and introduces new features.
■ Features
● Simultaneous Authentication of Equals (SAE)
○ Replaces the 4-way handshake with a Diffie-Hellman key
agreement
○ Protects against offline dictionary attacks
● Enhanced Open (Opportunistic Wireless Encryption)
○ Provides individualized data encryption even in open networks
○ Improves privacy and security in open Wi-Fi scenarios
● Updated Cryptographic Protocols
○ AES GCMP replaces AES CCMP used in WPA2
○ Supports both 128-bit and 192-bit AES for enhanced security
● Management Frame Protection
○ Ensures the integrity of network management traffic
○ Prevents eavesdropping, forging, and tampering with
management frames
29
SAE
Simultaneous Authentication of Equals
Replaces the 4-way handshake with a Diffie-Hellman key
agreement
○ Protects against offline dictionary attack
30
Enhanced Open
Opportunistic Wireless Encryption
provides encryption even in open networks
31
Management Frame protection
Ensures the integrity of network management traffic
Prevents eavesdropping, forging, and tampering with
management frame
32
AAA protocols
Important for centralized user authentication and access control
33
SAST
static code analysis
A method of debugging an application by reviewing and examining its
source code before running the program
34
DAST
dynamic code analysis
35
DAST Fuzzing
inputs random data to provoke crashes
36
Stress testing DAST
Evaluates system stability and reliability under extreme
conditions
37
Code signing
Confirms the software author's identity and integritySan
38
Sandboxing
Isolates running programs, limiting their access to resources
39
NAC
network access control
Used to protect networks from both known and unknown devices by scanning
devices to assess their security status before granting network access
40
NAC persistent agents
installed on devices in a corporate environment where the org controls and owns the device software
41
NAC non persistent agents
Common in environments with personal devices (e.g., college campuses);
users connect, access a web-based captive portal, download an agent for scanning and delete itself after insepction
42
Web filtering
Web filtering or content filtering is used to control or restrict the content users
can access on the internet
43
Agent based web filtering
nvolves installing an agent on each device
● Monitors and enforces web usage policies
● Effective for remote and mobile worker
44
Centralized proxy
Uses a proxy server as an intermediary between an organization’s end
users and the Internet
45
URL Scanning
Analyzes website URLs to check for matches in a database of known
malicious websites
46
Content Categorization
Classifies websites into categories (e.g., social media, adult content) and
blocks or allows categories based on policies
47
Block rules
Specific guidelines set by organizations to prevent access to certain
websites or categories, often used to address security threats
48
Reputation based filtering
Blocks or allows websites based on a reputation score determined by
third-party services, considering factors like hosting malware or phishing
49
DNS filtering
DNS filtering (Domain Name System filtering) blocks access to specific websites
by preventing the translation of domain names to their IP addresse
50
Email Security
Encompasses techniques and protocols to protect email content, accounts, and
infrastructure from unauthorized access, loss, or compromise
51
DKIM
domainkeys identified mail
Allows the receiver to verify the source and integrity of an email by
adding a digital signature to the email headers
52
SPF
sender policy framework
Prevents sender address forgery by verifying the sender's IP against
authorized IPs listed in the sender's domain DNS records
53
DMARC
Domain-based Message Authentication, Reporting and Conformance)
● DMARC detects and prevents email spoofing by setting policies for email
sending and handling failures
54
Email gateway protocol configuration
Email gateways serve as entry and exit points for emails, facilitating
secure and efficient email transmission
● They use SMTP (Simple Mail Transfer Protocol) to send and receive emails
● Email gateways handle email routing, email security, policy enforcement,
and email encryption
55
Spam filtering
Spam filtering detects and prevents unwanted and unsolicited emails from
reaching users' inboxes
56
EDR
endpoint detection and response
Category of security tools that monitor endpoint and network events and record
the information in a central database
57
FIM
file integrity monitoring
validates the integrity of operating system and application software files by
comparing their current state with a known, good baseline
58
XDR
extended detection and response
Security strategy that integrates multiple protection technologies into a single
platform
■ EDR is focused on the endpoints to detect and respond to potential threats
■ XDR is more comprehensive solution because it focuses on endpoints, but also
on networks, cloud, and email to detect and respond to potential threats
59
UBA
user behavior analytics
Advanced cybersecurity strategy that uses big data and machine learning to
analyze user behaviors for detecting security threats
60
UEBA
user behavior and entity behavior analytics
Technology similar to UBA but extends the monitoring of entities like routers,
servers, and endpoints in addition to user accounts
61
Secure protocols
■ Choose secure protocols to protect data in transit from unauthorized access
● Examples include HTTP vs. HTTPS, FTP vs. SFTP, Telnet vs. SSH
62
Telnet
app layer protocol that allows a user to log in from one computer to another on the same network, uses plaintext, use ssh instead
63
Well known ports
0-1023
64
REgistered ports
1024-49151
65
TCP
transmission control protocol Connection-oriented, ensuring data delivery without errors
66
UDP
user datagram protocol
Connectionless and faster, but doesn't guarantee data delivery
Suitable for applications prioritizing speed over accuracy, like streaming
video or gaming
67
Vulnerability Scanning
Automated probing of systems, networks, and applications to discover
potential vulnerabilities
68
Threat intelligence feeds
■ Provide valuable information about potential or current threats to an
organization's security
■ Continuous streams of data related to potential or current threats
■ Collected, analyzed, and disseminated by security researchers, organizations, or
automated tools
69
Threat intelligence
Continuous process to comprehend the specific threats an organization
faces
70
OSINT
open source intelligence
Collected from publicly available sources like reports, forums, news
articles, blogs, and social media
71
Dark web
A hidden part of the internet inaccessible through standard browsers
72
Responsible disclosure
Ethical practice for disclosing vulnerabilities in software, hardware, or onlines ervices
73
Bug bounty programs
Robust responsible disclosure programs incentivizing security researchers
74
False Negative vulnerability finding
very serious
75
CVE
common vulnerabilities and exposures
System that provides a standardized way to uniquely identify and
reference known vulnerabilities in software and
hardware
76
EF
exposure factor
A quantifiable metric to estimate the percentage of asset damage
77
Risk Tolerance
The level of risk an organization is willing to accept
78
Exception
Temporarily relaxing or bypassing security controls or policies for operational business needs, with an understanding of associated risks
79
Exemption
A permanent waiver of security controls or policies due to specific
reasons, often for legacy systems
80
Remediation
Involve installing patches, reconfiguring devices, or other actions
81
Auditing
Involves systematic review of logs, configurations, and patches
82
Configuration auditing
Checks for misconfigurations or deviations
83
Verification
Final step in validating remediation
84
User verification
Ensures applications and services are functioning correctly
85
Vulnerability reporting
Process of documenting and communicating security weaknesses in software or
systems to individuals and organizations responsible for addressing the issues
86
Responsible disclosure
Ethical and judicious disclosure to affected stakeholders before public
announcement
87
Log aggregation
Collects and consolidates log data from various sources into a central
location
88
Alerting
Involves setting up notifications for specific events or conditions
89
Scanning
Regularly examines systems, networks, or applications to identify
vulnerabilities, misconfigurations, and issues
90
Archiving
Involves long-term storage of data, including
○ Log data
○ Performance data
○ Incident data
91
Quarantining
Isolates a system, network, or application suspected of being compromised
92
Alert Tuning
Adjusts alert parameters to reduce errors, false positives, and improve alert
relevance
93
SNMP
Simple Network Management Protocol
An Internet protocol used for collecting information from managed devices on IP
networks and modifying device behavior
■ Managed devices include the following
● Routers
● Switches
● Firewalls
● Printers
● Servers
● Client devices
94
SNMP Manager
A central system that collects and processes information from managed devices
Often set up as a server, especially in large enterprise environments
95
SNMP Agents
Networked devices that send information about themselves to the manager
96
SNMP SET
Manager-to-agent request to change variable values
97
SNMP GET
Manager-to-agent request to retrieve variable values
98
SNMP TRAP
Asynchronous notifications from agents to the manager to notify
significant events
99
OID
object identifier for SNMP messages
100
MIB
The manual or database that details what each sensor or control unit can report or control (like temperature readings, light levels, camera status).
101
SIEM
Security Information and Event Management)
A solution for real-time or near-real-time analysis of security alerts generated by
network hardware and application
102
Agent based SIEM
Software agents are installed on each system to collect and send log data
103
Agentless SIEM
Log data is collected directly from systems using standard protocol
Reduces maintenance but may not collect real-time or detailed data
104
ELK
elastic stack
A collection of free and open-source SIEM tools, including the following
○ Elasticsearch
○ Logstash
○ Kibana
105
Arcsight
siem tool
106
QRadar
SIEM
107
Antivirus Software
Protects systems against malware, including the following
● Viruses
● Worms
● Trojans
● Ransomware
● Spyware
Generates data like malware detection logs, system scans, and updates
■ Data sent to SIEM for aggregation and correlation
■ Helps identify security threats and system health
108
DLP System
data loss prevention system sends info to SIEM
109
NIDS and NIPS
send info to SIEM
110
SCAP
security content automation protocol
Suite of open standards that enhances the automation of vulnerability
management, measurement, and policy compliance evaluation of systems
deployed in an organization
helps with automating scanning for example
111
OVAL
open vulnerability and assessment language
XML schema for describing system security states and querying
vulnerability reports
has to do with SCAP
112
XCCDF
Extensible Configuration Checklist Description Format)
● XML schema for developing and auditing best-practice configuration
checklists and rules
● Allows improved automation
has to do with SCAP
113
ARF
asset reporting format
XML schema for expressing information about assets and their
relationships
● Vendor and technology neutral
● Flexible
● Suited for a wide variety of reporting application
has to do with SCAP
114
CCE
common configuration enumeration
Scheme for provisioning secure configuration checks across multiple
sources
● Provides unique identifiers for different system configuration issue
Books (Configuration Elements): Each book represents a specific configuration setting or issue in an IT environment.
Library Catalog (CCE): The library catalog provides a standardized format (CCE) for identifying and categorizing books (configuration elements) based on their subject, author, or genre.
Unique Identifier (CCE-ID): Each book is assigned a unique catalog number (CCE-ID) for easy reference and retrieva
115
CPE
common platform enumeration
Identifies hardware devices, operating systems, and applications
116
CVSS
common vulnerability scoring system
Used to provide a numerical score reflecting the severity of a vulnerability (0 to
10
117
SCAP Benchmarks
Sets of security configuration rules for specific products to establish
security baselines
● Provide a detailed checklist that can be used to secure systems to a
specific baseline
118
FPC
full packet capture for network analysis
119
Flow analysis
Focuses on recording metadata and statistics about network traffic, saving
storage space
■ Doesn’t include the actual content, just the metadata
■ Rapidly generates visualizations to map network connections, traffic types and
session volumes
120
Flow Collector
Records metadata and statistics about network traffic
Collects information about the following
● Type of traffic
● Protocol used
● Data volume
121
NEtflow
Cisco-developed protocol for reporting network flow information
also known as IPFIX
122
Zeke
Hybrid tool for network monitoring
Monitors traffic like NetFlow but logs full packet captures based on interest
123
MRTG
multi router traffic grapher
Creates graphs displaying network traffic flows through routers and switches
124
SPOG
dingle pane of glass
125
Disk Imaging and Analysis
Creating a bit-by-bit copy (image) of a storage device, examining content
126
Incident
An act violating a security policy
127
Phases of Incident Response
7 phases
prep
detect
analyze
contain
eradicate
recover
post incident activity
128
Incident response team
The core team includes cybersecurity professionals with incident response
experience
129
RCA
root cause analyiss
130
TTX
tabletop exervise
discussion abased
lacks hands on activity
131
simulation
Goes beyond tabletop discussions, involving realistic, hands-on scenarios
132
Digital Forensics
Systematic process of investigating and analyzing digital devices and data to
uncover evidence for legal purposes
133
Chain of Custody
Documented and verifiable record that tracks the handling,
transfer, and preservation of digital evidence from the moment it
is collected until it is presented in a court of law
134
File Carving
Focuses on extracting files and data fragments from
storage media without relying on the file system
135
Legal Hold
Issued when litigation is expected and preserves potentially relevant
electronic data
● Ensures evidence is not tampered with, deleted, or lost
136
E Discovery
Process of identifying, collecting, and presenting electronically stored
information for potential legal proceedings
137
Order of Volatility
Guides the sequence of collecting data, from most volatile (CPU registers and
cache) to least volatile (archival media)
138
Log Files
Records events and messages in operating systems, software, and network
devices
139
JournalCTL
Linux command-line utility for querying and displaying logs from the Journal
Daemon (SystemD's logging service
140
NXLog
Multi-platform, open-source log management tool
Identifies security risks and analyzes logs from server, OS, and applications
141
Netflow
Network protocol for collecting active IP network traffic data
■ Provides information on source, destination, volume, and paths
142
SFlow
Open-source alternative to NetFlow
143
MEtadata
data that describes other data
144
Dashboards
Graphical displays of information across multiple systems
145
Splunk
A big data platform for ingesting various types of data, including security and
incident response data
■ Collects data from firewalls, applications, endpoints, operating systems, intrusion
detection systems, intrusion prevention systems, antivirus software, and
networks
146
Automated reports
Generated by computer systems to provide information about various aspects of
a network's security
147
MD5/SHA Checksum
Serves as unique digital fingerprint for file identification, including potential
malware
148
SOAR
Security Orchestration, Automation, and Response
Class of security tools for incident response, threat hunting, and security
configurations
■ Purpose
● Orchestrate and automate runbooks, deliver data enrichment
Integrating SIEM and SOAR for advanced security capabilities
149
runbook
Automated version of a playbook with defined interaction points for human
analysis
150
CI
continuous integration
developers merge code changes into a central repository
151
Release
Process of finalizing and preparing new software or updates
Enabling software installation and usage
152
Deployment
Involves automated process of software releases to users
153
CI/CD
continuous integration and elivery
stops short of deploying to production
154
Continuous deployment
Takes CI/CD further by automatically deploying code changes to testing
and production environments
155
API
Set of rules and protocols used for building and integrating application software
156
REST
(Representational State Transfer)
○ REST uses standard HTTP methods, status codes, URIs, and MIME
types for interactions
○ Primarily uses JSON for data transfer
157
SOAP
(Simple Object Access Protocol)
○ SOAP has a structured message format in XML
○ Known for robustness, additional security features, and
transaction compliance
○ Suitable for enterprise-level web services with complex
transactions and regulatory compliance requirements
158
CURL
API testing tool
A tool for transferring data to or from a server using various supported
protocols
159
