All Acronyms Flashcards
(604 cards)
1
Q
3DES
A
triple digital encryption standard
2
Q
AAA
A
authentication
authorization
accounting
3
Q
ABAC
A
attribute-based access control
4
Q
ACL
A
access control list
5
Q
AES
A
advanced encryption standard
6
Q
AH
A
authentication header
7
Q
AI
A
artificial intelligence
8
Q
AIS
A
automated indicator sharing
9
Q
ALE
A
annualized loss expectancy
10
Q
AP
A
access point
11
Q
API
A
application programming interface
12
Q
ARO
A
annualized rate of occurrence
13
Q
ARP
A
address resolution protocol
14
Q
ASLR
A
address space layout randomization
15
Q
ATT&CK
A
adversarial tactics, techniques, and common knowledge
16
Q
AUP
A
acceptable use policy
17
Q
AV
A
antivirus
18
Q
BASH
A
bourne again shell
19
Q
BCP
A
business continuity planning
20
Q
BGP
A
border gateway protocol
21
Q
BIA
A
business impact analysis
22
Q
BIOS
A
basic input / output system
23
Q
BPA
A
business partnership agreement
24
Q
BPDU
A
bridge protocol data unit
25
BYOD
bring your own device
26
CA
certificate authority
27
CAC
common access card
28
CAPTCHA
completely automated public turing test to tell computers and humans apart
29
CAR
corrective action report
30
CASB
cloud access security broker
31
CBC
cipher block chaining
32
CBT
computer based training
33
CCMP
counter-mode/CBC-Mac Protocol
34
CCTV
closed-circuit television
35
CERT
computer emergency response team
36
CFB
cipher feedback
37
CHAP
challenge handshake authentication protocol
38
CIO
chief information officer
39
CIRT
computer incident response team
40
CIS
center for internet security
41
CMS
content management system
42
COOP
continuity of operation planning
43
COPE
corporate owned personal enabled
44
CP
contingency planning
45
CRC
cyclical redundancy check
46
CRL
certificate revocation list
47
CSO
chief security officer
48
CSP
cloud service provider
49
CSR
certificate signing request
50
CSRF
cross-site request forgery
51
CSU
channel service unit
52
CTM
counter-mode
53
CTO
chief technology officer
54
CVE
common vulnerabilities and exposures
55
CVSS
common vulnerability scoring system
56
CYOD
choose your own device
57
DAC
discretionary access control
58
DBA
database administrator
59
DDoS
distributed denial of service
60
DEP
data execution prevention
61
DER
distinguished encoding rules
62
DES
digital encryption standard
63
DHCP
dynamic host configuration protocol
64
DKIM
domain keys identified mail
65
DLL
dynamic link library
66
DLP
data loss prevention
67
DMARC
domain message authentication reporting and conformance
68
DMZ
demilitarized zone
69
DNAT
destination network address transaction
70
DNSSEC
domain name system security extensions
71
DoS
denial of service
72
DPO
data privacy officer
73
DRP
disaster recovery plan
74
DSA
digital signature algorithm
75
DSL
digital subscriber line
76
EAP
extensible authentication protocol
77
ECB
electronic code book
78
ECC
elliptic curve cryptography
79
ECDHE
elliptic curve diffie-hellman ephemeral
80
ECDSA
elliptic curve digital signature algorithm
81
EDR
endpoint detection and response
82
EFS
encrypted file system
83
EOL
end of life
84
EOS
end of service
85
ERP
enterprise resource planning
86
ESN
electronic serial number
87
ESP
encapsulated security payload
88
FACL
file system access control list
89
FDE
full disk encryption
90
FPGA
field programmable gate array
91
FRR
false rejection rate
92
FTP
file transfer protocol
93
FTPS
secured file transfer protocol (uses SSL/TLS)
94
GCM
galois counter mode
95
GDPR
general data protection regulation
96
GPG
gnu privacy guard
97
GPO
group policy object
98
GPS
global positioning system
99
gpu
graphics processing unit
100
GRE
generic routing encapsulation
101
HA
high availability
102
HDD
hard disk drive
103
HIDS
host-based intrusion detection system
104
HIPS
host-based intrusion prevention system
105
HMAC
hashed message authentication code
106
HOTP
HMAC based one time password
107
HSM
hardware security module
108
HTML
hypertext markup language
109
HTTP
hypertext transfer protocol
110
HTTPS
hypertext transfer protocol secure (over SSL/TLS) (secures entire communication session)
111
HVAC
heating, ventilation, air conditioning
112
IaaS
infrastructure as a Service
113
ICMP
internet control message protocol
114
ICS
industrial control systems
115
IDEA
international data encryption algorithm
116
IDF
intermediate distribution frame
117
IdP
identity provider
118
IDS
intrusion detection system
119
IEEE
institute of electrical and electronics engineers
120
IKE
internet key exchange
121
IM
instant messaging
122
IMAP4
internet message access protocol v4
123
IoC
indicators of compromise
124
IoT
internet of things
125
IP
internet protocol
126
IPSec
internet protocol security (secure tunneling layer 4 transport)
127
IR
incident response
128
IRC
internet relay chat
129
IRP
incident response plan
130
ISO
international organization for standardization
131
ISP
internet service provider
132
ISSO
information systems security officer
133
ITCP
IT contingency plan
134
IV
initialization vector
135
KDC
key distribution center
136
KEK
key encryption key
137
L2TP
layer 2 tunneling protocol
138
LAN
local area network
139
LDAP
lightweight directory access protocol
140
LEAP
lightweight extensible authentication protocol
141
MaaS
Monitoring as a Service
142
MAC
mandatory access control
143
MAC
media access control
144
MAC
message authentication code
145
MAM
mobile application management
146
MAN
metropolitan area network
147
MBR
master boot record
148
MD5
message digest 5
149
MDF
main distribution frame
150
MDM
mobile device management
151
MFA
multi-factor authentication
152
MFD
multi-function device
153
MFP
multi-function printer
154
MITM
man in the middle
155
ML
machine learning
156
MMS
multimedia message service
157
MOA
memorandum of agreement
158
MOU
memorandum of understanding
159
MPLS
multi-protocol label switching
160
MSA
measurement systems analysis
161
MSCHAP
Microsoft challenge handshake authentication protocol
162
MSP
managed service provider
163
MSSP
managed security service provider
164
MTBF
mean time between failures
165
MTTF
mean time to failure
166
MTTR
mean time to recover
167
MTU
maximum transmission unit
168
NAC
network access control
169
NAS
network attached storage
170
NAT
network address translation
171
NDA
non-disclosure agreement
172
NFC
near field communication
173
NFV
network functions virtualization
174
NIC
network interface card
175
NIDS
network based intrusion detection system
176
NIPS
network based intrusion prevention system
177
NIST
national institute of standards and technology
178
NTFS
new technology file system
179
NTLM
new technology LAN manager
180
NTP
network time protocol
181
OAUTH
open authorization
182
OCSP
online certificate status protocol
183
OID
object identifier
184
OS
operating system
185
OSI
open systems interconnection
186
OSINT
open source intelligence
187
OSPF
open shortest path first
188
OT
operational technology
189
OTA
over the air
190
OTG
on the go
191
OVAL
open vulnerability assessment language
192
OWASP
open web application security project
193
P12
PKCS #12
194
P2P
peer to peer
195
PaaS
platform as a service
196
PAC
proxy auto configuration
197
PAM
privileged access management
198
white box test
tester possesses complete knowledge of the target environment, its architecture, design, and source code
199
grey box test
gives the tester partial knowledge - some information about the system's inner workings, but don't have access to all data and documents. test strikes a balance (view between an insider and an external attacker)
200
black box test
executed without any prior knowledge of the target knowledge. tester approaches the system from the outside (like an external attacker) with no insight to the system's inner workings.
201
passive test/assessment
involves observing and analyzing system operations without active engagement or intrusion. it's more about understanding the system behaviors rather than identifying specific vulnerabilities.
202
PAM
pluggable authentication modules
203
PAP
password authentication protocol
204
PAT
port address translation
205
PBKDF2
password based key derivation function 2
206
PBX
private branch exchange
207
PCAP
packet capture
208
PCI DSS
payment card industry data security standard
209
PDU
power distribution unit
210
PEAP
protected extensible authentication protocol
211
PED
personal electronic device
212
PEM
privacy enhanced mail
213
PFS
perfect forward secrecy
214
PFX
personal information exchange
215
PGP
pretty good privacy
216
PHI
personal health information
217
PII
personally identifiable information
218
PIV
personal identity verification
219
PKCS
public key cryptography standards
220
PKI
public key infrastructure
221
POP
post office protocol
222
POTS
plain old telephone service
223
PPP
point-to-point protocol
224
PPTP
point-to-point tunneling protocol
225
PSK
pre-shared key
226
PTZ
pan-tilt-zoom
227
QA
quality assurance
228
QoS
quality of service
229
PUP
potentially unwanted program
230
RA
recovery agent
231
RA
registration authority
232
RACE
research and development in advanced communications technologies in europe
233
RAD
rapid application development
234
RADIUS
remote authentication dial-in user server
235
RAID
redundant array of inexpensive disks
236
RAM
random access memory
237
RAS
remote access server
238
RAT
remote access trojan
239
RC4
Rivest cipher v4
240
RCS
rich communication services
241
RFC
request for comments
242
RFID
radio frequency identifier
243
RIPEMD
RACE integrity primitives evaluation message digest
244
ROI
return on investment
245
RPO
recovery point objective
246
RSA
rivest, shamir, & adleman
247
RTBH
remote triggered black hole
248
RTO
recovery time objective
249
RTOS
real-time operating system
250
RTP
real-time transport protocol
251
S/MIME
secure/multipurpose internet mail extensions
252
SaaS
software as a service
253
SAE
simultaneous authentication of equals
254
SAML
security assertions markup language
255
SAN
storage area network
256
SAN
subject alternative name
257
SCADA
system control and data acquisition
258
SCAP
security content automation protocol
259
SCEP
simple certificate enrollment protocol
260
SDK
software development kit
261
SDLC
software development life cycle
262
SDLM
software development life cycle methodology
263
SDN
software defined networking
264
SDV
software defined visibility
265
SED
self-encrypting drives
266
SEH
structured exception handler
267
SFTP
secured file transfer protocol (uses SSH)
268
SHA
secure hashing algorithm
269
SHTTP
secure hypertext transfer protocol (secures individual messages) (largely obsolete)
270
SIEM
security information and event management
271
SIM
subscriber identity module
272
SIP
session initiation protocol
273
SLA
service level agreement
274
SLE
single loss expectancy
275
S/MIME
secure/multipurpose internet mail exchanger
276
SMS
short message service
277
SMTP
simple mail transfer protocol
278
SMTPS
simple mail transfer protocol secure
279
SNMP
simple network management protocol
280
SOAP
simple object access protocol
281
SOAR
security orchestration, automation, response
282
SoC
system on chip
283
SOC
security operations center
284
SPF
sender policy framework
285
SPIM
spam over internet messaging
286
SQL
structured query language
287
SQLi
SQL injection
288
SRTP
secure real-time protocol
289
SSD
solid state drive
290
SSH
secure shell
291
SSL
secure sockets layer
292
SSO
single sign on
293
STIX
structured threat information exchange
294
STP
shielded twisted pair
295
SWG
secure web gateway
296
TACACS+
terminal access controller access control system +
297
TAXII
trusted automated eXchange of indicator information
298
TCP/IP
transmission control protocol/internet procotol
299
TGT
ticket granting ticket
300
TKIP
temporal key integrity protocol
301
TLS
transport layer security
302
TOTP
time-based one time password
303
TPM
trusted platform module
304
TSIG
transaction signature
305
TTP
tactics, techniques, and procedures
306
UAT
user acceptance testing
307
UAV
unmanned aerial vehicle
308
UDP
user datagram protocol
309
UEFI
unified extensible firmware interface
310
UEM
unified endpoint management
311
UPS
uninterruptible power supply
312
URI
uniform resource identifier
313
URL
universal resource locator
314
USB
universal serial bus
315
UTM
unified threat management
316
UTP
unshielded twisted pair
317
VBA
visual basic
318
VDE
virtual desktop environment
319
VDI
virtual desktop infrastructure
320
VLAN
virtual local area network
321
VLSM
variable length subnet masking
322
VM
virtual machine
323
VoIP
voice over IP
324
VPC
virtual private cloud
325
VPN
virtual private network
326
VTC
video teleconferencing
327
WAF
web application firewall
328
WAP
wireless access point
329
WEP
wired equivalent privacy
330
WIDS
wireless intrusion detection system
331
WIPS
wireless intrusion prevention system
332
WORM
write once read many
333
WPA
WiFi protected access
334
WPS
WiFi protected setup
335
WTLS
wireless TLS
336
XaaS
anything as a service
337
XML
extensible markup language
338
XOR
exclusive or
339
XSRF
cross-site request forgery
340
XSS
cross-site scripting
341
Layer 1
physical
342
Layer 2
data
343
Layer 3
network
344
Layer 4
transport
345
Layer 5
session
346
Layer 6
presentation
347
Layer 7
application
348
UDP
connectionless (no handshake)
unreliable (does not guarantee delivery or order)
faster (due to lack of reliability overhead)
video and audio streaming (online gaming)
349
TCP
connection-oriented (requires handshake)
reliable (guarantees delivery and order)
slower (due to reliability mechanisms)
web browsing, email, file transfer
350
IEEE 802.1x
network authentication standard that uses Extensible Authentication Protocol (EAP) to verify and grant access to network ports
351
Port 20/21
FTP
file transfer protocol
20 used to transfer files (data port)
21 is control port
TCP
352
FTP port
20/21
TCP
353
Port 22
SSH
secure shell
designed to transmit data through a remote connection
TCP
354
SSH port
22
TCP
355
Port 23
telnet
for unencrypted text communications
TCP
356
Telnet port
23
TCP
357
Port 25
SMTP
simple mail transfer protocol
internet mail protocol used to send outgoing mail from email clients to mail servers
TCP
358
SMTP port
25
TCP
359
Port 43
WHOIS
provides domain level information
TCP/UDP
360
WHOIS port
43
TCP/UDP
361
Port 49
TACACS+
CISCO proprietary protocol used for AAA services
TCP
362
TACACS+ port
49
TCP
363
Port 53
DNS
Domain Name System
used to associate IP addresses with domain names
UDP
364
DNS port
53
UDP
365
Port 67/68
DHCP
dynamic host configuration protocol
network management protocol is used to assign multiple local private IP addresses from one public IP address
UDP
366
DHCP port
67/68
UDP
367
Port 69
TFTP
trivial file transfer protocol
UDP
368
TFTP port
69
UDP
369
Port 80
HTTP
hypertext transfer protocol
protocol used for websites and most internet traffic
TCP
370
HTTP port
80
TCP
371
Port 88
Kerberos
network authentication protocol that allows for communication over a non-secure network. primarily uses UDP but can use TCP
TCP/UDP
372
Kerberos port
88
TCP/UDP
373
Port 110
POP
post office protocol
email protocol that allows email clients to communicate with email servers. POP provides only one-way communication.
TCP
374
POP port
110
TCP
375
Port 123
NTP
network time protocol
low latency protocol used to synchronize timekeeping across a network
UDP
376
NTP port
123
UDP
377
Port 139
SMB
server message block
windows proprietary protocol built on NetBIOS. allows users to remotely access servers.
UDP
378
SMB port
139
UDP
379
Port 143/993
IMAP
internet message access protocol
email protocol used by email clients to communicate with email servers. provides two-way communication unlike POP
TCP
380
IMAP port
143/993
TCP
381
Port 161/162
SNMP
simple network management protocol
protocol used to monitor and manage network devices on IP networks
UDP
382
SNMP port
161/162
UDP
383
Port 179
BGP
border gateway protocol
TCP
384
BGP port
179
TCP
385
Port 389
LDAP
lightweight directory access protocol
used to manage and communicate with directories
UDP
386
LDAP port
389
UDP
387
Port 443
HTTPS
hypertext transfer protocol secure
secure version of HTTP that uses TLS for encryption. Most websites use HTTPS instead of HTTP
TCP
388
HTTPS port
443
TCP
389
Port 500
IPSec using ISAKMP (internet security association and key management protocol)
UDP
390
IPSec using ISAKMP port
500
UDP
391
Port 514
syslog
syslog protocol, for collecting and organizing all of the log files sent from the various devices on a network
UDP
392
syslog port
514
UDP
393
Port 587
SMTPS
simple mail transfer protocol secure
secure version of SMTP. uses TLS
TCP
394
SMTPS port
587
395
Port 636
LDAPS
LDAP secure that uses TLS
TCP
396
LDAPS port
636
TCP
397
Port 989/990
FTPS
FTP secure uses TLS. It can run on 20/21 but sometimes allocated to 989/990
TCP
398
FTPS port
989/990
TCP
399
Port 993
IMAPS
IMAP secure that uses TLS
TCP
400
IMAPS port
993
TCP
401
Port 995
POP3S
POP3 secure that uses TLS
TCP
402
POP3S port
995
403
Port 1433
SQL Server
404
SQL Server port
1433
TCP
405
Port 1812/1813
RADIUS
remote authentication dial-in user service
used to provide AAA for network services
UDP
406
RADIUS port
1812/1813
UDP
407
Port 3306
MySQL DB system
TCP
408
MySQL port
3306
TCP
409
Port 3389
RDP
Remote Desktop Protocol
Windows proprietary protocol that enables remote connections to other computers.
TCP
410
RDP port
3389
TCP
411
Port 3868
Diameter
developed as an upgrade to RADIUS
TCP
412
Diameter port
3868
TCP
413
Port 5004
SRTP
secure real time protocol
replaced RTP and is a protocol used to stream audio/video communication using UDP
414
SRTP port
5004
UDP
415
Port 5432
PostgreSQL
416
PostgreSQL port
5432
417
Symmetric Algorithms
AES
DES
3DES
RC4
Blowfish/Twofish
418
Asymmetric Algorithms
RSA
DSA
Diffie-Hellman
ECC
PGP
419
Hashing Algorithms
MD5
SHA
HMAC
RIPEMD
420
Layer 7, or the application layer, deals with end-user services, and appliances at this layer can make filtering decisions based on specifics like URLs, HTTP headers, and specific application functions.
421
Layer 6, the presentation layer, is responsible for translating data between the application and transport layers.
422
Layer 5, the session layer, establishes, maintains, and terminates connections between applications on different devices. It doesn't handle filtering based on IP addresses and port numbers.
423
Layer 4, or the transport layer, deals with protocols like TCP and UDP and is concerned with port numbers and connection-oriented communication. Network appliances operating at this layer filter and manage traffic based on source and destination IP addresses, as well as port numbers.
424
Layer 3, the network layer, is primarily focused on routing data and IP addressing. Devices at this layer, like routers, aren't primarily concerned with port numbers.
425
Layer 2, the data link layer, deals with frames and MAC addresses. Switches typically operate at this layer.
426
COPE
corporate owned personally enabled
deployment model, the company provides devices to employees and allows them to use for corporate and personal uses
427
COBE
corporate owned business only (dont ask me why)
deployment model, the company provides devices to employees and allows them to use for corporate use only
428
BYOD
bring your own device
employee can use their own personal device for work and personal use
429
CYOD
choose your own device
employee choose from a list of approved devices provided by the company
430
HSM
hardware security module
a physical computing device that safeguards and manages digital keys for strong authentication
431
TPM
trusted platform module
hardware-based storage system that contains keys, digital certs, hashed passwords, and many other types of info used for authentication
432
TCO
total cost of ownership
433
CAPEX
capital expenditure
434
ROI
return on investment
435
WCF
web content filtering
436
full-disk encryption
encrypts the entire physical drive
437
database encryption
encrypts entire databases
438
file-level encryption
encrypts specific files or folders
439
volume encryption
encrypts a specific volume or virtual drive
440
journaling
a form of backup that involves recording all transactions in a system
441
full backup
involves making a complete copy of all data in the system
442
incremental backup
saves only the changes made since the last backup, whether that was a full or another incremental backup
443
differential backup
capture all changes made since the last full backup
444
recent NIST guidelines on password policies
allow users to decide when to change their password
block common passwords like dictionary words
disallow the use of the username within the password
445
Alert tuning
helps in reducing false positives, enhancing the accuracy of the alerting systems
446
URL scanning
is a method that assesses URLs in real-time, helping organizations prevent access to malicious or inappropriate websites
447
downtime
is a period when a system is unavailable or its performance is degraded, often due to planned maintenance or unforeseen incidents
448
service restart
the act of stopping and then starting a service, often to apply changes or updates
449
change management
is a formalized procedure to ensure changes are reviewed and approved before implementation. This is a process but does not specifically define the time a system is unavailable
450
maintenance window
is a predefined time frame during which system changes or updates are applied to minimize disruption to business operations. This indicates when changes may occur but does not specifically define the period of system unavailability
451
FIM
file integrity monitoring
452
simulation
simulations, on the other hand, are team-based, with one team acting as intruders and the other responding to the threat. Moderators enforce the rules, and these exercises are more extensive than tabletop exercises.
453
tabletop exercise
tabletop exercises begin with a scenario, where participants discuss how they would respond. These are discussion-based and don’t require technology. In this case, the team is discussing solutions to a scenario, making it a tabletop exercise
454
functional exercise
functional exercise involves real-time simulations where teams actively use tools, processes, and communication, making it more hands-on compared to tabletop exercises.
455
live drill
live drill involves real systems and environments in real-time to simulate events like a cyberattack, requiring immediate, hands-on responses. Since the Data Core team is only discussing the scenario, this is not a live drill, simulation, or functional exercise, but a tabletop exercise
456
tokenization
tokenization is the process of substituting a sensitive data element with a non-sensitive equivalent, referred to as a token. The token and the data it substitutes are stored in a secure database. If the original data is needed, it can be accessed using the token and querying the database. The token will be a different size and have a different structure than the original data so the token can’t be used to decipher the original data
457
steganography
steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video.
458
data masking
data masking is a method to de-identify some or all characters in a sequence, but not changing the total number of characters that a field should contain. The masked version will be structurally the same, but the data will be hidden. Changing the letters or numbers entered into a password field with dots is an example of data masking. Data that is masked will have the same number of characters as the original data, not a smaller set
459
risk acceptance
risk acceptance means that an organization understands the level of risk that in involved in an activity and is willing to accept the outcomes of taking the risk. The risk is either accepted or not, there aren't levels of risk acceptance. In this case they are not making a decision about a level of risk for a specific activity
460
risk appetite
risk appetite refers to an organization's willingness to take on risk in pursuit of its business objectives. It reflects the organization's strategic approach to risk and how much risk it is willing to undertake to achieve specific goals
461
risk tolerance
risk tolerance is the extent to which an organization is comfortable with the level of risk it is willing to take. It represents the organization's ability to withstand potential losses or disruptions
462
risk deterrence
strategies designed to discourage potential attackers from carrying out cyberattacks by making them perceive the risks and costs outweigh the potential benefits
463
physical
Physical security controls are measures that involve protecting an organization’s physical assets. These controls can include security cameras, locks, and security badges
464
operational
Operational security controls are measures that involve the day-to-day operations of an organization’s security. These controls can include backup and recovery procedures, configuration management, media protection, and log monitoring
465
managerial
Managerial security controls are measures that involve directing and overseeing the overall security of an organization. These controls can include risk assessments, security awareness training, incident response planning, and service acquisition
466
technical
Technical security controls are measures that are put in place to protect the confidentiality, integrity, and availability of a system or network. These controls can include firewalls, intrusion detection/prevention systems, encryption, and access controls.
467
secure boot with signature verification
Secure boot with signature verification ensures that a device only runs software or firmware signed by a trusted entity, preventing unauthorized or malicious firmware images from being loaded
468
Cross-site scripting (XSS)
is a security vulnerability typically found in web applications, enabling attackers to inject malicious scripts into websites viewed by other users, potentially leading to a variety of malicious activities
469
Buffer overflow
Buffer overflows occur when a program writes more data to a block of memory, or buffer, than it was allocated for, which can lead to various issues, including the potential execution of arbitrary code
470
side loading
Side loading refers to the practice of installing applications on a device without using the official app store, which can lead to various security concerns, including the installation of malicious software
471
Insecure Interfaces and APIs
are a type of vulnerability that arises when the interaction between users and cloud services through interfaces and APIs is not secure, exposing systems to potential unauthorized access and manipulation of data
472
Key risk indicators
KRIs are metrics that provide early warnings of increasing risk exposures, enabling organizations' leadership to manage these risks proactively
473
risk threshold
is the defined level of risk an organization is willing to accept, not a predictive indicator
474
risk metrics
are quantitative measures of risk but do not specifically refer to the predictive indicators used for monitoring potential risks
475
risk parameters
are specific variables used within risk assessment processes, not predictive indicators
476
SOW
statement of work specifies the detailed scope of work, tasks, deliverables, timelines, and costs for a specific project or engagement with the vendor
477
MOA
Memorandum of agreement (MOA) typically outlines a broader understanding or collaboration between parties, but it may not necessarily include specific services, timelines, and costs as in this context
478
SLA
Service-level agreement (SLA) is a specific type of agreement that defines the level of service expected from the vendor, including performance metrics, response times, and other service-related terms
479
MSA
Master Service Agreement is a comprehensive contract that sets forth the general terms and conditions that will govern multiple future engagements between the parties. It may reference specific work orders or statements of work for individual projects
480
pretexting
involves creating a fabricated scenario, such as the described urgent meeting, to deceive the target into providing desired information or performing an action
481
whaling
is a type of phishing attack that specifically targets high-profile employees, like executives or CEOs, to steal sensitive information
482
brute force attack
involves attempting all possible combinations of passwords or encryption keys until the correct one is found. This scenario doesn't involve this kind of attack method at all
483
cloning
refers to the duplication of items such as badges, access cards, or even digital identities. It's about copying something authentic to gain unauthorized access, rather than fabricating a scenario
484
likelihood
is used in qualitative risk analysis to subjectively describe how probable a risk event is, often expressed in terms such as "low," "medium," or "high."
485
probability
is a quantitative measure, usually expressed as a number between 0 and 1, or as a percentage, indicating the statistical likelihood of a risk event
486
severity ranking
exposure factor (EF) is the fraction of the asset value that is at risk in the event of a security incident.
487
exposure factor
may determine how serious an impact might be but does not directly relate to the probability of an event occurring
488
content categorization
systematically classifies websites based on their overall theme, making it easier to block access to unsuitable or irrelevant categories of web content
489
firewalls
primarily focus on blocking or allowing traffic based on IP addresses and ports, not necessarily the thematic content of websites
490
pharming
involves redirecting users from legitimate websites to fraudulent ones designed to steal sensitive information. It's a technique used in cyberattacks that manipulate the DNS system or exploit vulnerabilities in browsers
491
vishing
(voice phishing) is a form of social engineering where the attacker uses telephone services to trick individuals into providing personal information, such as passwords or credit card numbers.
492
smishing
refers to phishing attacks conducted through SMS text messages rather than voice calls. Attackers send deceitful text messages to trick individuals into disclosing personal information
493
phishing
type of online fraud where criminals attempt to trick individuals into revealing sensitive information like passwords, credit card details, or personal information
494
spear phishing
a type of phishing attack that targets a specific individual, group or organization
495
fileless malware
operates in memory, often leveraging legitimate system tools to evade detection. It might adjust registry values for persistence and can run within its own process or use tools like PowerShell to achieve its objectives.
496
worm
A worm self-replicates to spread across networks
497
bloatware
refers to unnecessary or unwanted software that comes pre-installed on a device
498
business continuity planning
developing strategies and procedures to ensure an organization can continue operations, especially after a cyberattack or other disruptive incident
499
classification
Classification ensures that assets are labeled with appropriate access levels, limiting unauthorized access to sensitive information. This process allows organizations to implement access controls, reducing the risk of data breaches and ensuring data security. Although classification documentation can support financial tracking and budget allocation, its main purpose is access control and data protection. Assigning classifications to individuals or departments may enhance accountability, but accountability alone is not the focus of classification
500
risk register
is a comprehensive record that lists all identified risks, their potential impacts, assigned risk owners, and current risk status. It serves as a central repository for tracking and monitoring risks over time.
501
business impact analysis
assesses the potential consequences of specific risks on critical business functions, helping prioritize risk response efforts
502
risk assessment
is the initial step in the risk management process, involving the identification, analysis, and evaluation of potential risks
503
risk reporting
involves the regular communication and documentation of identified risks, their potential impact, and risk management strategies to relevant stakeholdersl
504
risk identification
is the first step in the risk management process. It involves identifying potential threats and vulnerabilities that could pose a risk to an organization's assets or operations
505
log aggregation
Log aggregation collects and normalizes log data from various sources to make it easier to analyze
is essential for collecting, normalizing, and centralizing log data from various sources, such as network devices, servers, and applications. This centralized approach enables comprehensive analysis and detection of security incidents, providing valuable insights into potential security threats and breaches. While log aggregation makes it easier for analysts to view the data, aggregation doesn't involve analysis, only collection and centralization.
506
honeyfile
is a fake file or set of files designed to appear valuable or sensitive in order to attract attackers
507
honeynet
network of honeypots designed to simulate a real network and attract attackers
508
honeytoken
is a fake piece of data, such as a username or password, designed to appear valuable or sensitive in order to attract attackers
509
honeypot
a cybersecurity mechanism that uses a manufactured attack target to lure cybercriminals away from legitimate targets and gather intelligence about their identity, methods, and motivations
510
business partnership agreement
BPA
is a contractual agreement between two business entities that outlines their collaborative efforts, roles, and responsibilities in a specific business venture or partnership
511
NetFlow
NetFlow can identify the source and destination of traffic, making it easier to spot potential threats
NetFlow can help with capacity planning and understanding network performance issues
NetFlow helps provide an understanding of network traffic flow, enhancing security by identifying unusual patterns
NetFlow allows for the visualization of flow patterns. It is up to the security analyst to interpret the data and identify a type of network attack. The ability to identify the source and destination of traffic is a core aspect of NetFlow. This information can be critical in identifying potential threats and sources of security breaches
512
identity proofing
involves confirming the authenticity of an individual's claimed identity through various verification methods
513
AES (Advanced Encryption Standard)
is a symmetric encryption standard used to protect data at rest and in transit, ensuring confidentiality and security
514
HMAC (Hash-Based Message Authentication Code)
is a specific construction for creating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret key, rather than for encryption purposes
515
SHA (Secure Hash Algorithm)
is a set of cryptographic hash functions designed to ensure data integrity, not to encrypt data
516
RSA (Rivest-Shamir-Adleman)
is an asymmetric encryption standard typically used for secure data transmission, not specifically for data at rest
517
rainbow table attack
involves precomputed hash values to decrypt passwords, rather than directly attempting logins across accounts
518
capability (threat actor)
pertains to a threat actor's proficiency in devising new exploit techniques and tools. It can range from using commonly found attack tools to creating zero-day exploits in various systems. Those with the highest capabilities can even deploy non-cyber tools, such as political or military assets.
519
sophistication (threat actor)
relates to the level of intricacy and advancement of a threat actor's methods and tools, but does not directly address their skill in crafting novel exploits. While resources can aid in bolstering a threat actor's capabilities, this term primarily refers to the tools and personnel that a threat actor can access or utilize.
520
ISO/IEC 27001
It specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).[
521
ISO/IEC 27002
provides best practice recommendations on information security controls for use by those responsible for initiating, implementing or maintaining information security management systems (ISMS).
522
ISO/IEC 27017
is a security standard developed for cloud service providers and users to make a safer cloud-based environment and reduce the risk of security problems
523
NIST Special Publication 800-63
Digital Identity Guidelines
524
pentesting red team
emulates realworld adversarial techniques/entities
525
pentesting blue team
acts as real world defense against adversarial techniques/entities
526
black hat hacker
Black hat hackers are criminals who break into computer networks with malicious intent. They may also release malware that destroys files, holds computers hostage, or steals passwords, credit card numbers, and other personal information.
Black hats are motivated by self-serving reasons, such as financial gain, revenge, or simply to spread havoc. Sometimes their motivation might be ideological, by targeting people they strongly disagree with.
527
white hat hacker
White hat hackers use their capabilities to uncover security failings to help safeguard organizations from dangerous hackers. They can sometimes be paid employees or contractors working for companies as security specialists who attempt to find gaps in security.
White hat hackers are one reason large organizations typically have less downtime and experience fewer issues with their websites. Most hackers know it will be harder to get into systems managed by large companies than those operated by small businesses that probably don't have the resources to examine every possible security leak.
A subset of ethical hackers includes penetration testers or "pentesters,” who focus specifically on finding vulnerabilities and assessing risk within systems.
528
gray hat hacker
Gray hat hackers may sometimes violate laws or usual ethical standards, but they do not have the malicious intent typical of a black hat hacker.
When a white hat hacker discovers a vulnerability, they will exploit it only with permission and not tell others about it until it has been fixed. In contrast, the black hat will illegally exploit it or tell others how to do so. The gray hat will neither illegally exploit it nor tell others how to do so.
529
SOX
The Sarbanes-Oxley Act is a US legislation that mandates various practices to protect investors by improving the accuracy and reliability of corporate financial statements and disclosures
530
GDPR
GDPR (General Data Protection Regulation) is a European Union regulation that pertains to the protection of personal data and its processing, ensuring that entities collect and use such data fairly and transparently
531
FISMA
FISMA (Federal Information Security Management Act) aims to govern the security of data processed by federal government agencies, but it doesn't specifically focus on financial transparency and accountability
532
domain hijacking
also known as domain theft, refers to the act of changing the registration of a domain name without the permission of its original registrant. It results in the domain pointing to a different location, often with malicious intent
533
ARP spoofing
ARP spoofing is a type of attack where an attacker sends fake Address Resolution Protocol (ARP) messages onto a local network. This is unrelated to domain registration or DNS
534
DNS poisoning
DNS poisoning involves altering or adding records to a DNS server, redirecting domain's traffic to a different IP address. While it can result in redirection, it doesn't involve changing the domain's registration details
535
Which network device would be the most suitable for the organization to enhance network security by segmenting and isolating network traffic between devices in different departments?
Switches enhance network security by creating separate collision domains for devices on different switch ports, isolating network traffic and preventing unauthorized access to data. By forwarding data based on MAC addresses, switches ensure efficient, secure transmission within each department's network segment
536
UEFI
Unified Extensible Firmware Interface
UEFI provides the code that allows a host system to boot an OS and can enforce various boot integrity checksUEFI provides the code that allows a host system to boot an OS and can enforce various boot integrity checks
537
RoT
Hardware Root of Trust
RoT can provide attestation and verify the signatures of boot metrics and OS files, it doesn't provide the code to boot the OS
538
"Attribute-Based Access Control" (ABAC)
where permissions are dynamically evaluated based on attributes like job role, department, location, and time, enabling fine-grained, context-aware access
539
"Role-Based Access Control" (RBAC)
relies solely on predefined roles
540
"Rule-Based Access Control"
is broader, encompassing various mechanisms but lacking the dynamic attribute combination of ABAC
541
A RAT
is a type of malware that allows a cybercriminal to remotely control and monitor an infected computer or device
542
Spyware
Spyware can perform various covert activities like tracking, taking screenshots, activating recording devices, and even redirecting DNS to farming sites. The employees' experiences align with the characteristics of spyware
543
Committee based governance
A committee governance structure involves forming a group with representatives from different departments or units within the organization. This approach allows for a collective decision-making process, leveraging expertise and perspectives from various parts of the company. By pooling insights from diverse sectors, the committee can ensure that decisions are holistic, considerate of multiple facets of the business, and are thus more likely to contribute to effective and efficient operations. It promotes collaboration, shared responsibility, and balanced power distribution in organizational governance.
544
Hierarchical based governance
relies on a strict top-down approach, where decisions are made at the higher levels and passed down to the lower levels for execution. This can sometimes lead to a disconnect between the decision-makers and those affected by the decisions on the ground
545
Board based governance
Board governance is typically associated with the oversight and decision-making of an organization's board of directors, which is responsible for high-level strategic decisions and governance oversight but may not involve decision-making power distribution across different departments or units
546
Centralized based governance
concentrates decision-making power in a single authority or department, where all major decisions are made by a central entity, often top-level management
547
Systems monitoring
Systems monitoring evaluates the hardware, operating systems, and essential services that applications run on but not the broader foundational structures of IT.
548
Infrastructure monitoring
Infrastructure monitoring is focused on ensuring the foundational IT components, like servers, data centers, and networking equipment, are both functional and secure
549
Applications monitoring
Application monitoring pertains to overseeing individual software solutions and ensuring their security and performance
550
Which of the following network technologies separates the control plane from the data plane, allowing for more flexibility and automation in network management?
SDN
Software-defined networking (SDN) is a network technology that separates the control plane from the data plane, allowing for more flexibility and automation in network management. The control plane provides the intelligence and logic for the network, while the data plane handles the actual traffic forwarding
551
Which of the following pieces of information is LEAST likely to be found in the OS-specific security logs?
The antivirus signature database version
552
(Pentesting) known environment
means that a significant amount of information has been given to the tester. This can include passwords, usernames, and other information
553
(Pentesting) partially known environment
occurs in an environment where some information about the target systems is available to the tester, but not all details are known. It is likely that a tester in this environment would still need to complete the reconnaissance phase.
554
(Pentesting) unknown environment
means that the tester is not given any information, so they must begin with reconnaissance. Reconnaissance is the initial phase of a penetration test, where information gathering and data collection occur without directly engaging the target. It is not a type of penetration testing, but rather a preparatory phase
555
secure enclave
is a chip that is used only to secure encryption keys, hashes, and other important data. It is embedded in Apple and Android devices
556
KMS
Key Management System is a process used to ensure that keys are kept secure by establishing standards of security. It is a set of policy decisions, not a chip or device such as TPM, HSM, and Secure Enclave.
557
TPM
Trusted Platform Module is a hardware-based storage system that contains keys, digital certificates, hashed passwords, and many other types of information used for authentication. It is embedded on device motherboards that use Windows operating systems
558
HSM
Hardware Security Module is a physical computing device that safeguards and manages digital keys for strong authentication. It can be a external device or on an expansion card, but it is not embedded on the motherboard.
559
injection
An injection attack is a type of application attack that involves inserting malicious code or commands into an application or database to execute unauthorized actions or access sensitive data
560
privilege escalation
A privilege escalation attack is a type of application attack that involves exploiting a vulnerability or misconfiguration to gain higher privileges or access than intended on a system or application
561
replay attack
A replay attack is a type of application attack that involves capturing and retransmitting data, such as authentication tokens or credentials, to impersonate a legitimate user or session.
562
buffer overflow attack
A buffer overflow attack is a type of application attack that involves sending more data than expected to a function, causing it to overwrite adjacent memory locations and execute arbitrary code
563
CVSS vulnerability classifications
Low <4
Medium 4<=x<7
High 7<=x<9
Critical 9<=x
564
impact
refers to the consequences a risk event has on an organization, affecting various areas such as operations, finance, and reputation
565
EF
exposure factor (EF) is the fraction of the asset value that is at risk in the event of a security incident
566
Which of the following pieces of information is NOT typically available in the firewall log data?
Open ports on the destination device
567
"due diligence/care"
Due diligence/care refers to the diligent and proactive efforts made by an organization to meet and maintain compliance requirements. This includes implementing necessary policies, procedures, and controls to align with regulatory mandates
568
US regulations, "horizontal" personal data regulation similar to EU's GDPR?
CCPA
(California Consumer Privacy Act) is a state legislation that provides comprehensive data protection rights to consumers, much like the GDPR. It's considered "horizontal" as it applies across sectors.
569
GLBA
(Gramm–Leach–Bliley Act) is more of a "vertical" regulation as it targets a specific sector, the financial services industry, rather than applying broadly across various industries.
570
CCPA
(California Consumer Privacy Act) is a state legislation that provides comprehensive data protection rights to consumers, much like the GDPR. It's considered "horizontal" as it applies across sectors.
571
E-discovery
E-discovery involves examining drives to find data that is electronically stored to use them for evidence
572
SELinux
Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control policies, ensuring processes have only the permissions they require and no more.
573
chroot environment
restricts a process's view of the file system but doesn't offer the same comprehensive policy-based control as SELinux
574
SSH key authentication
enhances secure remote access, it doesn't provide granular control over processes and their behaviors
575
Enumeration
Enumeration aids inventory by tracking equipment and access controls to hardware, software, and data assets
576
Which of the following components of the data plane is responsible for the user or device being verified before it interacts with the network?
Policy Enforcement Point
577
Policy Enforcement Point
is responsible for ensuring that security policies are enforced when a user or device tries to access resources on the network. It acts as a gatekeeper, verifying the identity and context of the access request against the policies set by the organization before allowing or denying access
578
Policy Engine
responsible for making decisions based on the security policies defined. It evaluates the information it receives from the Policy Enforcement Point but does not directly interact with users or devices attempting to access the network.
579
Policy Adminstrator
involves managing and updating the security policies, it does not perform real-time verification of users or devices attempting to access the network
580
Which of the following best explains the importance of Insurance in vulnerability management?
Insurance can provide financial support in mitigating the aftermath of a security breach
581
Time-of-check (TOC)
is a type of race condition that occurs when a process checks the state or value of a resource before using it, but another process changes it in between. It can lead to incorrect or unauthorized actions based on outdated information
582
Time-of-use (TOU)
type of race condition that occurs when a process uses a resource based on the assumption that it has not changed since the last check, but another process has changed it in between. It can lead to incorrect or unauthorized actions based on invalid assumptions
583
Journaling
keeps track of all transactions and changes that occur within a system. In the event of a crash or failure, this record allows for precise recovery to the moment before the disruption
584
Snapshots
provide a way to capture the system's state at a specific moment in time. They can be used for quick recoveries but don't track continuous transactional changes like journaling
585
She is currently in the 'establish' phase of creating secure baselines. What will she do FIRST in this phase?
During the establish phase of secure baselines, a set of initial configurations which include security controls such as encryption, firewalls, and access controls are designed and implemented. This baseline scenario ensures a specific standard of security is adhered to when the system is set up
586
Secure web gateways
SWGs
are tailored to handle user traffic and can filter URLs based on content blacklists. They also provide threat analysis and integrate features like DLP and CASB to guard against various unauthorized egress threats.
587
Physical security controls
Physical security controls are measures that involve protecting an organization’s physical assets. These controls can include security cameras, locks, and security badges
588
Operational security controls
Operational security controls are measures that involve the day-to-day operations of an organization’s security. These controls can include backup and recovery procedures, configuration management, media protection, and log monitoring
589
Managerial security controls
Managerial security controls are measures that involve directing and overseeing the overall security of an organization. These controls can include risk assessments, security awareness training, incident response planning, and service acquisition
590
Technical security controls
Technical security controls are measures that are put in place to protect the confidentiality, integrity, and availability of a system or network. These controls can include firewalls, intrusion detection/prevention systems, encryption, and access controls
591
Attestation
Attestation is a process where data owners periodically review, validate and confirm the access rights of all users
592
Jump server
intermediary server through which administrators can connect to other servers
593
proxy server
intermediary for requests from clients seeking resources from other servers
594
SCAP
Security Content Automation Protocol) is a cybersecurity framework that combines various security standards, enabling automated vulnerability assessment, and compliance checking. It provides a structured approach for evaluating and managing security vulnerabilities and configurations.
While intrusion detection systems are valuable for monitoring network traffic for security breaches, SCAP is not an intrusion detection system itself but rather a cybersecurity framework focused on security automation.
SCAP is not a network protocol for data transmission; rather, it serves a different purpose related to security automation.
While firewalls are essential for network security, SCAP is not a firewall technology but a cybersecurity framework.
595
DLP
involves a set of techniques and tools designed to detect and prevent the unauthorized transmission of sensitive data outside an organization's network, helping to protect valuable data from being leaked or exposed to unauthorized entities
596
Which of the following aspects is NOT typically addressed in a Business Partnership Agreement (BPA) between two collaborating entities?
or Joint Venture Agreement (JV) primarily focuses on essential aspects of the business relationship between two entities, including profit-sharing arrangements, ownership of intellectual property, and strategies for ending the partnership if necessary.
Responsibilities for software updates
597
After a security audit, Yoshi Innovations LLC decided to dispose of several old hard drives containing sensitive data. They wish to employ a method that ensures the data on these drives is completely unrecoverable. Sasha suggests hitting the drives with a hammer. Given that this is not the most effective solution, which of the following would be the BEST method to use?
- Burning in municipal incinerators
- Shredding to Level 1
- Degaussing
- Pulverizing with industrial machinery
Pulverizing with industrial machinery
Industrial machinery is designed to destroy drives thoroughly, leaving no data intact. Degaussing methods expose hard disks to powerful electromagnetics, disrupting data storage patterns. However, not all types of drives, like SSDs and optical media, can be degaussed, limiting its applicability. While shredding can be an effective method, reducing drives or paper to 12mm strips (Level 1) might still leave data recoverable. More thorough shredding or additional measures would be required for complete data destruction. Incineration can be effective, but using municipal incinerators might leave some remnants of the drives, making this method less secure
598
primary objective of external compliance reporting?
To report compliance status to the public and stakeholders.
599
Risk identification
is the proactive process of recognizing and recording potential threats that could adversely affect an organization.
600
Threat intelligence
involves the collection and analysis of information about current and potential attacks that threaten the security of an organization but does not directly refer to the broader process of risk identification
601
Vulnerability assessment
is a specific method used within risk identification to determine the weaknesses within an organization's IT infrastructure
602
policy review
is an activity that may be part of risk identification but does not encompass the entire scope of identifying a range of potential risks
603
What is a common consequence of a Cross-site scripting (XSS) attack?
theft of user session data
604
