Brainscape Glossarry Flashcards
(579 cards)
1
Q
PPTP
Point-to-Point Tunneling Protocol
A
Developed by Cisco and Microsoft to support VPNs over PPP and TCP/IP. PPTP is highly vulnerable to password cracking attacks and considered obsolete.
2
Q
ATT&CK
Adversarial Tactics, Techniques, and Common Knowledge
A
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and procedures.
3
Q
XaaS
anything as a service
A
Expressing the concept that most types of IT requirements can be deployed as a cloud service model.
4
Q
ARP
ARP poisoning
A
A network-based attack where an attacker with access to the target local network segment redirects an IP address to the MAC address of a computer that is not the intended recipient. This can be used to perform a variety of attacks, including DoS, spoofing, and Man-in-the-Middle.
5
Q
asymmetric algorithm
A
A cipher that uses public and private keys. The keys are mathematically linked, using either Rivel, Shamir, Adleman (RSA) or elliptic curve cryptography (ECC) algorithms, but the private key is not derivable from the public one. An asymmetric key cannot reverse the operation it performs, so the public key cannot decrypt what it has encrypted, for example. Also known as Elliptic Curve Cryptography or ECC.
6
Q
attack surface
A
The points at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.
7
Q
attack vector
A
A specific path by which a threat actor gains unauthorized access to a system. Also known as vector.
8
Q
authenticator
A
A PNAC switch or router that activates EAPoL and passes a supplicant’s authentication data to an authenticating server, such as a RADIUS server.
9
Q
automation
A
Using scripts and APIs to provision and deprovision systems without manual intervention.
10
Q
Autopsy
A
The Sleuth Kit is an open-source collection of command line and programming libraries for disk imaging and file analysis. Autopsy is a graphical frontend for these tools and also provides a case management/workflow tool. Also known as Sleuth Kit.
11
Q
availability
A
The fundamental security goal of ensuring that computer systems operate continuously and that authorized persons can access data that they need.
12
Q
baseband radio
A
The chip and firmware in a smartphone that acts as a cellular modem.
13
Q
baseline configuration
A
A collection of security and configuration settings that are to be applied to a particular system or network in the organization.
14
Q
behavioral analysis
A
A network monitoring system that detects changes in normal operating data sequences and identifies abnormal sequences. Also known as behavior-based detection.
15
Q
birthday attack
A
A type of password attack that exploits weaknesses in the mathematical algorithms used to encrypt passwords, in order to take advantage of the probability of different password inputs producing the same encrypted output. This means that different passwords may have the same hash; the attacker can use any of these passwords to gain access.
16
Q
block cipher
A
A type of symmetric encryption that encrypts data one block at a time, often in 64-bit blocks. It is usually more secure, but is also slower, than stream ciphers.
17
Q
blockchain
A
A concept in which an expanding list of transactional records listed in a public ledger is secured using cryptography.
18
Q
blue team
A
The defensive team in a penetration test or incident response exercise.
19
Q
bluejacking
A
Sending an unsolicited message or picture message using a Bluetooth connection.
20
Q
bluesnarfing
A
A wireless attack where an attacker gains access to unauthorized information on a device using a Bluetooth connection.
21
Q
boot attestation
A
Report of boot state integrity data that is signed by a tamper-proof TPM key and reported to a network server.
22
Q
botnet
A
A set of hosts that has been infected by a control program called a bot that enables attackers to exploit the hosts to mount attacks. Also known as zombie.
23
Q
BASH
Bourne again shell
A
A command shell and scripting language for Unix-like systems. bastion host A server typically found in a DMZ that is configured to provide a single service to reduce the possibility of compromise.
24
Q
BPDU guard
Bridge Protocol Data Unit guard
A
Switch port security feature that disables the port if it receives BPDU notifications related to spanning tree. This is configured on access ports where any BPDU frames are likely to be malicious.
25
# BYOD
bring your own device
Security framework and tools to facilitate use of personally-owned devices to access corporate networks and data.
26
brute force attack
A type of password attack where an attacker uses an application to exhaustively try every possible alphanumeric combination to crack encrypted passwords.
27
buffer overflow
An attack in which data goes past the boundary of the destination buffer and begins to corrupt adjacent memory. This can allow the attacker to crash the system or execute arbitrary code.
28
bug bounty
Reward scheme operated by software and web services vendors for reporting vulnerabilities.
29
# BAS
building automation system
Components and protocols that facilitate the centralized configuration and monitoring of mechanical and electrical systems within offices and data centers.
30
# BIA
business impact analysis
A systematic activity that identifies organizational risks and determines their effect on ongoing, mission-critical operations.
31
# BPA
business partnership agreement
Agreement by two companies to work together closely, such as the partner agreements that large IT companies set up with resellers and solution providers.
32
cable lock
Devices can be physically secured against theft using cable ties and padlocks. Some systems also feature lockable faceplates, preventing access to the power switch and removable drives.
33
captive portal
A web page or website to which a client is redirected before being granted full network access.
34
capture the flag
Training event where learners must identify a token within a live network environment.
35
card cloning/skimming
Duplicating a smart card by reading (skimming) the confidential data stored on it. Also known as skimming.
36
carving
The process of extracting data from a computer when that data has no associated file system metadata.
37
cat command
Linux command to view and combine (concatenate) files.
38
# CIS
Center for Internet Security
A not-for-profit organization (founded partly by SANS). It publishes the well-known "Top 20 Critical Security Controls" (or system design recommendations).
39
# CA
certificate authority
A server that guarantees subject identities by issuing signed digital certificate wrappers for their public keys.
40
# CRL
certificate revocation list
A list of certificates that were revoked before their expiration date.
41
# CSR
certificate signing request
A Base64 ASCII file that a subject sends to a CA to get a certificate.
42
chain of custody
The record of evidence history from collection, to presentation in court, to disposal.
43
# CHAP
Challenge Handshake Authentication Protocol
Authentication scheme developed for dial-up networks that uses an encrypted three-way handshake to authenticate the client to the server. The challenge-response is repeated throughout the connection (though transparently to the user) to guard against replay attacks.
44
change control
The process by which the need for change is recorded and approved.
45
change management
The process through which changes to the configuration of information systems are implemented, as part of the organization's overall configuration management efforts.
46
checksum
The output of a hash function.
47
chmod
Linux command for managing file permissions.
48
# CYOD
choose your own device
Enterprise mobile device provisioning model where employees are offered a selection of corporate devices for work and, optionally, private use.
49
# CBC
cipher block chaining
An encryption mode of operation where an exclusive or (XOR) is applied to the first plaintext block
50
circuit-level stateful inspection firewall
A Layer 5 firewall technology that tracks the active state of a connection, and can make decisions based on the contents of network traffic as it relates to the state of the connection.
51
clean desk policy
An organizational policy that mandates employee work areas be free from potentially sensitive information; sensitive documents must not be left out where unauthorized personnel might see them.
52
# CASB
cloud access security broker
Enterprise management software designed to mediate access to cloud services by users across all types of devices.
53
cloud deployment model
Classifying the ownership and management of a cloud as public, private, community, or hybrid.
54
Cloud Security Alliance
Industry body providing security guidance to CSPs, including enterprise reference architecture and security controls matrix.
55
cloud service model
Classifying the provision of cloud services and the limit of the cloud service provider's responsibility as software, platform, infrastructure,
56
# CSP
cloud service provider
A vendor offering public cloud service models, such as PaaS, IaaS, or SaaS.
57
code of conduct
Professional behavior depends on basic ethical standards, such as honesty and fairness. Some professions may have developed codes of ethics to cover difficult situations; some businesses may also have a code of ethics to communicate the values it expects its employees to practice. Also known as ethics.
58
code reuse
Potentially unsecure programming practice of using code originally written for a different context.
59
code signing
The method of using a digital signature to ensure the source and integrity of programming code.
60
cold site
A predetermined alternate location where a network can be rebuilt after a disaster.
61
collector
A network appliance that gathers or receives log and/or state data from other network systems.
62
collision
In cryptography, the act of two different plaintext inputs producing the same exact ciphertext output.
63
# C&C
command and control
An infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets. Also known as C2.
64
# CAC
common access card
A smart card that provides certificate-based authentication and supports two-factor authentication. A CAC is produced for Department of Defense employees and contractors in response to a Homeland Security Directive.
65
# CN
common name
An X500 attribute expressing a host or user name, also used as the subject identifier for a digital certificate.
66
Common Vulnerabilities and Exposures
Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.
67
# CVSS
Common Vulnerability Scoring System
A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.
68
community cloud
A cloud that is deployed for shared use by cooperating tenants.
69
compensating control
A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.
70
# CAPTCHA
completely automated public turing test to tell computers and humans apart
An image of text characters or audio of some speech that is difficult for a computer to interpret. CAPTCHAs are used for purposes such as preventing bots from creating accounts or submitting forms.
71
confidentiality
The fundamental security goal of keeping information and communications private and protecting them from unauthorized access.
72
# CIA triad
confidentiality, integrity, and availability
The three principles of security control and management. Also known as the information security triad. or AIC triad.
73
containerization
A type of virtualization applied by a host operating system to provision an isolated execution environment for an application.
74
content filter
A software application or gateway that filters client requests for various types of internet content (web, FTP, IM, and so on).
75
context-aware authentication
An access control scheme that verifies an object's identity based on various environmental factors, like time, location, and behavior.
76
continuous delivery
Software development method in which app and platform requirements are frequently tested and validated for immediate availability.
77
continuous deployment
Software development method in which app and platform updates are committed to production rapidly.
78
continuous integration
Software development method in which code updates are tested and committed to a development or build server/code repository rapidly.
79
continuous monitoring
The technique of constantly evaluating an environment for changes so that new risks may be more quickly detected and business operations improved upon. Also known as continuous security monitoring or CSM.
80
control risk
Risk that arises when a control does not provide the level of mitigation that was expected.
81
# CAN bus
controller area network bus
A serial network designed to allow communications between embedded programmable logic controllers.
82
# COBO
corporate owned, business only
Enterprise mobile device provisioning model where the device is the property of the organization and personal use is prohibited.
83
# COPE
corporate owned, personally enabled
Enterprise mobile device provisioning model where the device remains the property of the organization, but certain personal use, such as private email, social networking, and web browsing, is permitted.
84
corrective control
A type of security control that acts after an incident to eliminate or minimize its impact.
85
correlation
Function of log analysis that links log and state data to identify a pattern that should be logged or alerted as an event.
86
counter mode CTM
An encryption mode of operation where a numerical counter value is used to create a constantly changing IV. Also referred to as CTM (counter mode) and CM (counter mode).
87
# CCMP
counter mode with cipher block chaining message authentication code protocol
An encryption protocol used for wireless LANs that addresses the vulnerabilities of the WEP protocol.
88
credential stuffing
Brute force attack in which stolen user account names and passwords are tested against multiple websites.
89
crossover error rate
Biometric evaluation factor expressing the point at which FAR and FRR meet, with a low value indicating better performance.
90
# XSRF
cross-site request forgery
A malicious script hosted on the attacker's site that can exploit a session started on another site in the same browser. Also known as client-side request forgery or CSRF.
91
# XSS
cross-site scripting
A malicious script hosted on the attacker's site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site, circumventing the browser's security model of trusted zones.
92
# CE
cryptographic erase
A method of sanitizing a self-encrypting drive by erasing the media encryption key.
93
Cuckoo
Implementation of a sandbox for malware analysis.
94
curl command
Utility for command-line manipulation of URL-based protocol requests.
95
# CTI
cyber threat intelligence
The process of investigating, collecting, analyzing, and disseminating information about emerging threats and threat sources. Also known as threat intelligence.
96
data at rest
Information that is primarily stored on specific media, rather than moving from one medium to another.
97
data breach
When confidential or private data is read, copied, or changed without authorization. Data breach events may have notification and reporting requirements.
98
data controller
In privacy regulations, the entity that determines why and how personal data is collected, stored, and used.
99
data custodian
An individual who is responsible for managing the system on which data assets are stored, including being responsible for enforcing access control, encryption, and backup/recovery measures.
100
data exfiltration
The process by which an attacker takes data that is stored inside of a private network and moves it to an external network.
101
data exposure
A software vulnerability where an attacker is able to circumvent access controls and retrieve confidential or sensitive data from the file system or database.
102
data governance
The overall management of the availability, usability, and security of the information used in an organization.
103
data in processing
Information that is present in the volatile memory of a host, such as system memory or cache.
104
data in transit
Information that is being transmitted between two hosts, such as over a private network or the Internet. Also known as data in motion.
105
# DLP
data loss/leak prevention
A software solution that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks.
106
data masking
A deidentification method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data.
107
data minimization
In data protection, the principle that only necessary and sufficient personal information can be collected and processed for the stated purpose.
108
data owner
A senior (executive) role with ultimate responsibility for maintaining the confidentiality, integrity, and availability of an information asset.
109
# DPO
data privacy officer
Institutional data governance role with responsibility
110
data processor
In privacy regulations, an entity trusted with a copy of personal data to perform storage and/or analysis on behalf of the data collector.
111
data remnant
Leftover information on a storage medium even after basic attempts have been made to remove that data. Also known as remnant.
112
data sovereignty
In data protection, the principle that countries and states may impose individual requirements on data collected or stored within their jurisdiction.
113
data steward
An individual who is primarily responsible for data quality, ensuring data is labeled and identified with appropriate metadata and that data is collected and stored in a format and with values that comply with applicable laws and regulations.
114
DCHP snooping
A configuration option that enables a switch to inspect DHCP traffic to prevent MAC spoofing.
115
dd command
Linux command that makes a bit-by-bit copy of an input file, typically used for disk imaging.
116
DDoS attack
An attack that uses multiple compromised hosts (a botnet) to overwhelm a service with request or response traffic.
117
dead code
Code in an application that is redundant because it will never be called within the logic of the program flow.
118
deauthentication/disassociation
Spoofing frames to disconnect a wireless station to try to obtain authentication data to crack.
119
deception and disruption
Cybersecurity resilience tools and techniques to increase the cost of attack planning for the threat actor.
120
default account
Default administrative and guest accounts configured on servers and network devices are possible points of unauthorized access.
121
defense in depth
A security strategy that positions the layers of network security as network traffic roadblocks; each layer is intended to slow an attack's progress, rather than eliminating it outright.
122
degaussing
The process of rendering a storage drive inoperable and its data unrecoverable by eliminating the drive's magnetic charge.
123
deidentification
In data protection, methods and technologies that remove identifying information from data before it is distributed.
124
# DMZ
demilitarized zone
A segment isolated from the rest of a private network by one or more firewalls that accepts connections from the Internet over designated ports.
125
# DoS attack
denial of service attack
Any type of physical, application, or network attack that affects the availability of a managed resource.
126
deprovisioning
The process of removing an application from packages or instances.
127
# DNAT
destination network address translation
NAT service where private internal addresses are mapped to one or more public addresses to facilitate Internet connectivity for hosts on a local network via a router.
128
detective control
A type of security control that acts during an incident to identify or record that it is happening.
129
deterrent control
A type of security
130
Diamond Model
A framework for analyzing cybersecurity incidents.
131
dictionary attack
A type of password attack that compares encrypted passwords against a predetermined list of possible password values.
132
differential backup
A backup type in which all selected files that have changed since the last full backup are backed up.
133
# DH
Diffie-Hellman
A cryptographic technique that provides secure key exchange.
134
digital signature
A message digest encrypted using the sender's private key that is appended to a message to authenticate the sender and prove message integrity.
135
# DSA
Digital Signature Algorithm
public key encryption standard used for digital signatures that provides authentication and integrity verification for messages.
136
directory service
A network service that stores identity information about all the objects in a particular network, including users, groups, servers, client computers, and printers.
137
directory traversal
An application attack that allows access to commands, files, and directories that may or may not be connected to the web document root directory.
138
# DRP
disaster recovery plan
A documented and resourced plan showing actions and responsibilities to be used in response to critical incidents.
139
# DAC
discretionary access control
Access control model where each resource is protected by an Access Control List (ACL) managed by the resource's owner (or owners).
140
# DER
distinguished encoding rules
The binary format used to structure the information in a digital certificate.
141
diversity
Cybersecurity resilience strategy that increases attack costs by provisioning multiple types of controls, technologies, vendors, and crypto implementations.
142
domain hijacking
A type of hijacking attack where the attacker steals a domain name by altering its registration information and then transferring the domain name to another entity. Sometimes referred to as brandjacking.
143
# DNS hijacking
Domain Name System hijacking
An attack in which an attacker modifies a computer's DNS configurations to point to a malicious DNS server.
144
# DNS poisoning
Domain Name System poisoning
A network-based attack where an attacker exploits the traditionally open nature of the DNS system to redirect a domain name to an IP address of the attacker's choosing.
145
# DNSSEC
Domain Name System Security Extensions
A security protocol that provides authentication of DNS data and upholds DNS data integrity.
146
downgrade attack
A cryptographic attack where the attacker exploits the need for backward compatibility to force a computer system to abandon the use of encrypted messages in favor of plaintext messages.
147
dump file
File containing data captured from system memory.
148
dumpster diving Dumpster
The social engineering technique of discovering things about an organization (or person) based on what it throws away.
149
# DHCP spoofing
Dynamic Host Configuration Protocol spoofing
An attack in which an attacker responds to a client requesting address assignment from a DHCP server.
150
# EAP-FAST
EAP Flexible Authentication via Secure Tunneling
An EAP method that is expected to address the shortcomings of LEAP.
151
# EAP-TLS
EAP Transport Layer Security
An EAP method that requires server-side and client-side certificates for authentication using SSL/ TLS.
152
# EAP-TTLS
EAP Tunneled Transport Layer Security
An EAP method that enables a client and server to establish a secure connection without mandating a client-side certificate.
153
east-west traffic
Design paradigm accounting for the fact that data center traffic between servers is greater than that passing in and out (north-south).
154
edge computing
Provisioning processing resource close to the network edge of IoT devices to reduce latency.
155
e-discovery
Procedures and tools to collect, preserve, and analyze digital evidence.
156
elasticity
The property by which a computing environment can instantly react to both increasing and decreasing demands in workload.
157
# ECC
elliptic curve cryptography
An asymmetric encryption algorithm that leverages the algebraic structures of elliptic curves over finite fields to derive public/private key pairs.
158
# ESP
Encapsulating Security Protocol
IPSec sub-protocol that enables encryption and authentication of the header and payload of a data packet.
159
# EOL
end of life
Product life cycle phase where sales are discontinued and support options reduced over time.
160
# EOSL
end of service life
Product life cycle phase where support is no longer available from the vendor.
161
# EDR
endpoint detection and response
A software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats.
162
# EPP
endpoint protection platform
A software agent and monitoring system that performs multiple security tasks.
163
# ERM
enterprise risk management
The comprehensive process of evaluating, measuring, and mitigating the many risks that pervade an organization.
164
entropy
A measure of disorder. Cryptographic systems should exhibit high entropy to better resist brute force attacks.
165
error handling
Coding methods to anticipate and deal with exceptions thrown during execution of a process.
166
escrow
In key management, the storage of a backup key with a third party.
167
evil twin
A wireless access point that deceives users into believing that it is a legitimate network access point.
168
# XOR
Exclusive OR
An operation that outputs to true only if one input is true and the other input is false.
169
execution control
The process of determining what additional software may be installed on a client or server beyond its baseline to prevent the use of unauthorized software.
170
exploitation framework
Suite of tools designed to automate delivery of exploits against common software and firmware vulnerabilities.
171
# EF
exposure factor
In risk calculation, the percentage of an asset's value that would be lost during a security incident or disaster scenario.
172
# EAP
Extensible Authentication Protocol
Framework for negotiating authentication methods that enables systems to use hardware-based identifiers, such as fingerprint scanners or smart card readers, for authentication.
173
# EAPoL
Extensible Authentication Protocol over LAN
A port-based network access control (PNAC) mechanism that allows the use of EAP authentication when a host connects to an Ethernet switch.
174
extranet
A private network that provides some access to outside parties, particularly vendors, partners, and select customers.
175
failover
A technique that ensures a redundant component, device, or application can quickly and efficiently take over the functionality of an asset that has failed.
176
fake telemetry
Deception strategy that returns spoofed data in response to network probes.
177
# FAR
false acceptance rate
Biometric assessment metric that measures the number of unauthorized users who are mistakenly allowed access.
178
false negative
In security scanning, a case that is not reported when it should be.
179
false positive
In security scanning, a case that is reported when it should not be.
180
# FRR
false rejection rate
Biometric assessment metric that measures the number of valid subjects who are denied access.
181
Faraday cage
A wire mesh container that blocks external electromagnetic fields from entering into the container.
182
federation
A process that provides a shared login capability across multiple systems and enterprises. It essentially connects the identity management services of multiple systems.
183
# FC
Fibre Channel
High speed network communications protocol used to implement SANs.
184
# FPGA
field programmable gate array
A processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture.
185
# FIM
file integrity monitoring
A type of software that reviews system files to ensure that they have not been tampered with.
186
# FTPS
File Transfer Protocol Secure
A type of FTP using TLS for confidentiality.
187
fingerprint scanner
Biometric authentication device that can produce a template signature of a user's fingerprint then subsequently compare the template to the digit submitted for authentication.
188
first responder
The first experienced person or team to arrive at the scene of an incident.
189
fog computing
Provisioning processing resource close to the network edge of IoT devices to reduce latency.
190
# FTK
Forensic Toolkit
A commercial digital forensics investigation management and utilities suite, published by AccessData.
191
full backup
A backup type in which all selected files, regardless of prior state, are backed up. full tunnel VPN configuration where all traffic is routed via the VPN gateway.
192
# FDE
full disk encryption
Encryption of all data on a disk (including system files, temporary files, and the pagefile) can be accomplished via a supported OS, third-party software, or at the controller level by the disk device itself.
193
fuzzing
A dynamic code analysis technique that involves sending a running
application random and unusual input so as to evaluate how the app responds.
194
gait analysis
Biometric mechanism that identifies a subject based on movement pattern.
195
# GCM
Galois/Counter Mode
A mode of block chained encryption that provides message authenticity for each block.
196
# GDPR
General Data Protection Regulation
Provisions and requirements protecting the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single Market are restricted unless protected by like-for-like regulations, such as the US's Privacy Shield requirements.
197
geofencing
The practice of creating a virtual boundary based on real-world geography.
198
geolocation
The identification or estimation of the physical location of an object, such as a radar source, mobile phone, or Internet-connected computing device.
199
grep command
Linux command for searching and filtering input. This can be used as a file search tool when combined with ls.
200
group account
A group account is a collection of user accounts that are useful when establishing file permissions and user rights because when many individuals need the same level of access, a group could be established containing all the relevant users.
201
# GPO
Group Policy Object
On a Windows domain, a way to deploy per-user and per-computer settings such as password policy, account restrictions, firewall status, and so on.
202
hardening
The process of making a host or app configuration secure by reducing its attack surface, through running only necessary services, installing monitoring software to protect against malware and intrusions, and establishing a maintenance schedule to ensure the system is patched to be secure against software exploits.
203
# HSM
hardware security module
An appliance for generating and storing cryptographic keys. This sort of solution may be less susceptible to tampering and insider threats than software-based storage.
204
# HMAC
hash-based message authentication code
A method used to verify both the integrity and authenticity of a message by combining a cryptographic hash of the message with a secret key.
205
hashcat
Command-line tool used to perform brute force and dictionary attacks against password hashes.
206
hashing
A function that converts an arbitrary length string input to a fixed length string output. A cryptographic hash function does this in a way that reduces the chance of collisions, where two different inputs produce the same output. Also known as message digest.
207
head command
Linux utility for showing the first lines in a file.
208
heat map
In a Wi-Fi site survey, a diagram showing signal strength at different locations.
209
heuristic analysis heuristic
A method that uses feature comparisons and likenesses rather than specific signature matching to identify whether the target of observation is malicious.
210
# HA
high availability
The property that defines how closely systems approach the goal of providing data availability 100 percent of the time while maintaining a high level of system performance.
211
# HOTP
HMAC-based One-time Password
An algorithm that generates a one-time password using a hash-based authentication code to verify the authenticity of the message.
212
homomorphic encryption
Method that allows computation of certain fields in a dataset without decrypting it.
213
honeypot honeynet
A host, network, or file set up with the purpose of luring attackers away from assets of actual value and/or discovering attack strategies and weaknesses in the security configuration. Also known as honeyfile.
214
horizontal privilege escalation
When a user accesses or modifies specific resources that they are not entitled to.
215
host-based firewall
A software application running on a single host and designed to protect only that host. Also known as personal firewall.
216
hot site
A fully configured alternate network that can be online quickly after a disaster.
217
hot/cold aisle
Arrangement of server racks to maximize the efficiency of cooling systems. Also known as cold/hot aisle.
218
HTML5 VPN
Using features of HTML5 to implement remote desktop/VPN connections via browser software (clientless).
219
hybrid cloud
A cloud deployment that uses both private and public elements.
220
# IAM
identity and access management
A security process that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets like networks, operating systems, and applications.
221
identity fraud
The invention of fake personal information or the theft and misuse of an individual's personal information.
222
identity provider
In a federated network, the service that holds the user account and performs authentication.
223
IEEE 802.1X
A standard for encapsulating EAP communications over a LAN (EAPoL) to implement port-based authentication.
224
implicit deny
A basic principle of security stating that unless something has explicitly been granted access, it should be denied access.
225
# IRP
incident response plan
Specific procedures that must be performed if a certain type of event is detected or reported.
226
incremental backup
A backup type in which all selected files that have changed since the last full or incremental backup (whichever was most recent) are backed up.
227
# IoC
indicator of compromise
A sign that an asset or network has been attacked or is currently under attack.
228
industrial camouflage
Methods of disguising the nature and purpose of buildings or parts of buildings.
229
# ICS
industrial control system
A network managing embedded devices (computer systems that are designed to perform a specific, dedicated function).
230
# ISAC
Information Sharing and Analysis Center
Not-for-profit group set up to share sector-specific threat intelligence and security best practices amongst its members.
231
# IaaS
Infrastructure as a Service
A computing method that uses the cloud to provide any or all infrastructure needs.
232
# IaC
infrastructure as code
A provisioning architecture in which deployment of resources is performed by scripted automation and orchestration.
233
inherent risk
Risk that an event will pose if no controls are put in place to mitigate it.
234
# IV attack
Initialization Vector Attack
A wireless attack where the attacker is able to predict or control the IV of an encryption process, thus giving the attacker access to view the encrypted data that is supposed to be hidden from everyone else except the user or network.
235
# OATH
Initiative for Open Authentication
An industry body comprising the main PKI providers, such as Verisign and Entrust, that was established with the aim of developing an open, strong authentication framework.
236
input validation
Any technique used to ensure that the data entered into a field or variable in an application is handled appropriately by that application.
237
insecure object reference
Coding vulnerability where unvalidated input is used to select a resource object, such as a file or database. 1
238
insider threat
A type of threat actor who is assigned privileges on the system that cause an intentional or unintentional incident.
239
integer overflow
An attack in which a computed result is too large to fit in its assigned storage space, which may lead to crashing or data corruption, and may trigger a buffer overflow.
240
integrity
The fundamental security goal of keeping organizational information accurate, free of errors, and without unauthorized modifications.
241
intelligence fusion
In threat hunting, using sources of threat intelligence data to automate detection of adversary IoCs and TTPs.
242
# ISA
interconnection security agreement
Any federal agency interconnecting its IT system to a third-party must create an ISA to govern the relationship. An ISA sets out a security risk awareness process and commit the agency and supplier to implementing security controls.
243
# ISO/IEC 27K
International Organization for Standardization 27000 Series
A comprehensive set of standards for information security, including best practices for security and risk management, compliance, and technical implementation.
244
# ISO/IEC 31K
International Organization for Standardization 31000 Series
A comprehensive set of standards for enterprise risk management.
245
# IKE
Internet Key Exchange
Framework for creating a Security Association (SA) used with IPSec. An SA establishes that two hosts trust one another (authenticate) and agree secure protocols and cipher suites to use to exchange data.
246
# IPsec
Internet Protocol Security
A set of open, non-proprietary standards that are used to secure data through authentication and encryption as the data travels across the network or the Internet.
247
intranet
A private network that is only accessible by the organization's own personnel.
248
# IDS
intrusion detection system
A software and/or hardware system that scans, audits, and monitors the security infrastructure for signs of attacks in progress.
249
# IPS
intrusion prevention system
An IDS that can actively block attacks.
250
# IPAM
IP address management
Software consolidating management of multiple DHCP and DNS services to provide oversight into IP address allocation across an enterprise network.
251
# IPFIX
IP Flow Information Export
Standards-based version of the Netflow framework.
252
jamming
An attack in which radio waves disrupt 802.11 wireless signals.
253
job rotation
The policy of preventing any one individual performing the same role or tasks for too long. This deters fraud and provides better oversight of the person's duties.
254
jump server
A hardened server that provides access to other hosts. Also known as jumpbox.
255
Kerberos
A single sign-on authentication and authorization service that is based on a time-sensitive ticket-granting system.
256
keylogger
Malicious software or hardware that can record user keystrokes.
257
kill chain
A model developed by Lockheed Martin that describes the stages by which a threat actor progresses a network intrusion.
258
lateral movement
The process by which an attacker is able to move from one part of a computing environment to another.
259
# L2TP
Layer 2 Tunneling Protocol
VPN protocol for tunneling PPP sessions across a variety of network protocols such as IP, Frame Relay, or ATM.
260
LDAP injection
An application attack that targets web-based applications by fabricating LDAP statements that are typically created by user input.
261
least privilege
A basic principle of security stating that something should be allocated the minimum necessary rights, privileges, or information to perform its role.
262
# LLR
lessons learned report
An analysis of events that can provide insight into how to improve response processes in the future. Also known as after action report or AAR.
263
lightweight cryptography
Cryptographic algorithms with reduced compute requirements that are suitable for use in resource-constrained environments, such as battery-powered devices.
264
# LDAP
Lightweight Directory Access Protocol
A network protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information.
265
# LDAPS
Lightweight Directory Access Protocol Secure
A method of implementing LDAP using SSL/TLS encryption.
266
# LEAP
Lightweight Extensible Authentication Protocol
Cisco Systems' proprietary EAP implementation.
267
load balancer
A type of switch or router that distributes client requests between different resources, such as communications links or similarly-configured servers. This provides fault tolerance and improves throughput.
268
logger command
Linux utility that writes data to the system log.
269
logic bomb
A malicious program or script that is set to run under particular circumstances or in response to a defined event.
270
loop protection
If broadcast traffic is allowed to continually loop around a network, the number of broadcast packets increases exponentially, crashing the network. Loop protection in switches (such as Spanning Tree Protocol), and in routers (Time To Live for instance) is designed to prevent this.
271
MAC Authentication
Proving the integrity and authenticity of a message by combining its hash with a shared secret.
272
MAC flooding
A variation of an ARP poisoning attack where a switch's cache table is inundated with frames from random source MAC addresses.
273
# MSSP
managed security service provider
Third-party provision of security configuration and monitoring as an outsourced service.
274
managerial control
A category of security control that gives oversight of the information system.
275
# MAC
Mandatory Access Control
Access control model where resources are protected by inflexible, system defined rules. Resources (objects) and users (subjects) are allocated a clearance level (or label).
276
mandatory vacations
The principle that states when and how long an employee must take time off from work so that their activities may be subjected to a security review.
277
maneuver
In threat hunting, the concept that threat actor and defender may use deception or counterattacking strategies to gain positional advantage.
278
# MitB attack
MitB attack
Man-in-the-Browser attack
An attack when the web browser is compromised by installing malicious plug-ins or scripts, or intercepting API calls between the browser process and DLLs.
279
# MitM attack
Man-in-the-Middle attack
A form of eavesdropping where the attacker makes an independent connection between two victims and steals information to use fraudulently.
280
# MTD
mantrap access control vestibule
A secure entry system with two gateways, only one of which is open at any one time.
281
maximum tolerable downtime
The longest period of time a business can be inoperable without causing irrevocable business failure.
282
# MTBF
mean time between failures
The rating on a device or component that predicts the expected time between failures.
283
# MTTF
mean time to failure
The average time a device or component is expected to be in operation.
284
# MTTR
mean time to repair/replace/recover
The average time taken for a device or component to be repaired, replaced, or otherwise recover from a failure.
285
measured boot
A UEFI feature that gathers secure metrics to validate the boot process in an attestation report.
286
# MSA
measurement systems analysis
Evaluates the data collection and statistical methods used by a quality management process to ensure they are robust.
287
# MAC Cloning
Media Access Control cloning
An attack in which an attacker falsifies the factory-assigned MAC address of a device's network interface. Also known as MAC spoofing.
288
# MAC filtering
Media Access Control filtering
Applying an access control list to a switch or access point so that only clients with approved MAC addresses can connect to it.
289
memdump command
Linux utility developed as part of the Coroner's Toolkit to dump system memory data to a file.
290
# MoU
memorandum of understanding
Usually a preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve the exchange of money.
291
memory leak
A software vulnerability that can occur when software does not release allocated memory when it is done using it, potentially leading to system instability.
292
# MD5
Message Digest Algorithm v5
A cryptographic hash function producing a 128-bit output.
293
metadata
Information stored or recorded as a property of an object, state of a system, or transaction.
294
microservices
A software architecture where components of the solution are conceived as highly decoupled services not dependent on a single platform type or technology.
295
mirroring
A type of RAID that using two hard disks, providing the simplest way of protecting a single disk against failure. Data is written to both disks and can be read from either disk.
296
# MEF
mission essential function
A business or organizational activity that is too critical to be deferred for anything more than a few hours, if at all.
297
# MAM
mobile application management
Enterprise management function that enables control over apps and storage for mobile devices and other endpoints.
298
# MDM
mobile device management
The process and supporting technologies for tracking, controlling, and securing the organization's mobile infrastructure.
299
mode of operation
Implementation of a block symmetric cipher, with some modes allowing secure encryption of a stream of data, with or without authentication for each block.
300
# MaaS
monitoring as a service
Cloud service providing ongoing security and availability monitoring of on-premises and/or cloud-based hosts and services.
301
multi-cloud
A cloud deployment model where the cloud consumer uses multiple public cloud services.
302
# MFA
multifactor authentication
An authentication scheme that requires the user to present at least two different factors as credentials, from something you know, something you have, something you are, something you do, and somewhere you are. Specifying two factors is known as 2FA.
303
# MMS
multimedia messaging service
Extension to SMS allowing digital data (picture, video, or audio) to be sent over a cellular data connection.
304
multipath
Overprovisioning controllers and cabling so that a host has failover connections to storage media.
305
# MPLS
Multiprotocol Label Switching
Developed by Cisco from ATM as a means of providing traffic engineering (congestion control), Class of Service,
306
# MPLS
Multiprotocol Label Switching
Developed by Cisco from ATM as a means of providing traffic engineering (congestion control), Class of Service, and Quality of Service within a packet switched, rather than circuit switched, network.
307
narrow-band
Low-power cellular networks designed to provide data connectivity to IoT devices.
308
ncat
Utility for reading and writing raw data over a network connection. Also known as netcat.
309
# NFC
Near Field Communication
A standard for peer-to-peer (2-way) radio communications over very short (around 4") distances, facilitating contactless payment and similar technologies. NFC is based on RFID.
310
Nessus
One of the best-known commercial vulnerability scanners, produced by Tenable Network Security. Also known as Tenable.
311
Netflow
A Cisco-developed means of reporting network flow information to a structured database. NetFlow allows better understanding of IP traffic flows as used by different network applications and hosts.
312
# NAC
network access control
A general term for the collected protocols, policies, and hardware that authenticate and authorize access to a network at the device level.
313
# NAT
network address translation
A routing mechanism that conceals internal addressing schemes from the public Internet by translating between a single public address on the external side of a router and private, non-routable addresses internally.
314
# NFV
network functions virtualization
Provisioning virtual network appliances, such as switches, routers, and firewalls, via VMs and containers.
315
# NGFW
next generation firewall
Advances in firewall technology, from app awareness, user-based filtering, and intrusion prevention to cloud inspection. Also known as layer 7 firewall.
316
Nmap
Versatile port scanner used for topology, host, service, and OS discovery and enumeration.
317
nonce
An arbitrary number used only once in a cryptographic communication, often to prevent replay attacks.
318
# NDA
non-disclosure agreement
An agreement that stipulates that entities will not share confidential information, knowledge, or materials with unauthorized third parties.
319
non-repudiation
The security goal of ensuring that the party that sent a transmission or created data remains associated with that data and cannot deny sending or creating that data.
320
normalization
A routine that applies a common consistent format to incoming data so that it can be processed safely. Normalization is referred to in the context of log collection and software coding.
321
# NTLM
NT LAN Manager authentication
A challenge-response authentication protocol created by Microsoft for use in its products.
322
nxlog
Software optimized for multiplatform log collection and aggregation.
323
obfuscation
A technique that essentially "hides" or "camouflages" code or other information so that it is harder to read by unauthorized users.
324
# OID
Object Identifier
Numeric schema used for attributes of digital certificates.
325
offboarding
The process of ensuring that all HR and other requirements are covered when an employee leaves an organization. Also known as exit interview.
326
# offline CA
offline certificate authority
In PKI, a CA (typically the root CA) that has been disconnected from the network to protect it from compromise.
327
onboarding
The process of bringing in a new employee, contractor, or supplier.
328
# OCSP
Online Certificate Status Protocol
Allows clients to request the status of a digital certificate, to check whether it is revoked.
329
Opal
Standards for implementing device encryption on storage devices.
330
# OAuth
Open Authorization
Standard for federated identity management, allowing resource servers or consumer sites to work with user accounts created and managed on a separate identity provider.
331
# OWASP
Open Web Application Security Project
A charity and community publishing a number of secure application development resources.
332
# OICD
OpenID Connect
An authentication layer that sits on top of the OAuth 2.0 authorization protocol.
333
# OSINT
Open-Source Intelligence
Publicly available information plus the tools used to aggregate and search it.
334
operational control
A category of security control that is implemented by people.
335
# OT
Operational Technology
A communications network designed to implement an industrial control system rather than data networking.
336
orchestration
The automation of multiple steps in a deployment process.
337
order of volatility
The order in which volatile data should be recovered from various storage locations and devices after a security incident occurs.
338
# OOB
out-of-band management
Accessing the administrative interface of a network appliance using a separate network from the usual data network. This could use a separate VLAN or a different kind of link, such as a dial-up modem.
339
# OTA
Over The Air
A firmware update delivered on a cellular data connection.
340
# PtH attack
pass the hash attack
A network-based attack where the attacker steals hashed user credentials and uses them as-is to try to authenticate to the same network the hashed credentials originated on.
341
penetration testing
A test that uses active tools and security utilities to evaluate security by simulating an attack on a system. A pen test will verify that a threat exists, then will actively test and bypass security controls, and will finally exploit vulnerabilities on the system. Also known as pentest.
342
percent encoding
Mechanism for encoding characters as hexadecimal values delimited by the percent sign.
343
# PFS
Perfect Forward Secrecy
A characteristic of transport encryption that ensures if a key is compromised the compromise will only affect a single session and not facilitate recovery of plaintext data from other sessions.
344
persistence cybersecurity
The ability of a threat actor to maintain covert access to a target host or network.
345
persistence load balancing
In load balancing, the configuration option that enables a client to maintain a connection with a load-balanced server over the duration of the session. Also referred to as sticky sessions.
346
# PIV card
personal identity verification card
A smart card that meets the standards for FIPS 201, in that it is resistant to tampering and provides quick electronic authentication of the card's owner.
347
# PFX
Personal Information Exchange
Windows file format for storing a private key and certificate data. The file can be password-protected.
348
# PII
Personally Identifiable Information
Data that can be used to identify or contact an individual (or in the case of identity theft, to impersonate them).
349
pharming
An impersonation attack in which a request for a website, typically an e-commerce site, is redirected to a similar-looking, but fake, website.
350
phishing
A type of email-based social engineering attack, in which the attacker sends email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim.
351
physical control
A type of security control that acts against in-person intrusion attempts.
352
pinning
A deprecated method of trusting digital certificates that bypasses the CA hierarchy and chain of trust to minimize man-in-the-middle attacks.
353
# PaaS
Platform as a Service
A computing method that uses the cloud to provide any platform-type services.
354
playbook
A checklist of actions to perform to detect and respond to a specific type of incident
355
# PPP
Point to Point Protocol
Dial-up protocol working at layer 2 (Data Link) used to connect devices remotely to networks.
356
pointer dereferencing
A software vulnerability that can occur when code attempts to read a memory location specified by a pointer, but the memory location is null. Also known as dereferencing.
357
Point-to-Point/Point-to-Multipoint Topology
A point-to-point topology is one where two nodes have a dedicated connection to one another. In a point-to-multipoint topology, a central node mediates links between remote nodes. Also known as Point-to-point.
358
port forwarding
A process in which a router takes requests from the Internet for a particular application (such as HTTP) and sends them to a designated host on the LAN. Also known as destination network address translation or DNAT.
359
port mirroring
Copying ingress and/or egress communications from one or more switch ports to another port. This is used to monitor communications passing over the switch. Also known as switched port analyzer or SPAN.
360
port security
Preventing a device attached to a switch port from communicating on the network unless it matches a given MAC address or other protection profile.
361
# PNAC
port-based network access control
A switch (or router) that performs some sort of authentication of the attached device before activating the port.
362
post-quantum
Anticipating challenges to current cryptographic implementations and general security issues in a world where threat actors have access to significant quantum processing capability.
363
# PUP
potentially unwanted program
Software that cannot definitively be classed as malicious, but may not have been chosen by or wanted by the user.
364
# PDU
Power Distribution Unit
Advanced strip socket that provides filtered output voltage. A managed unit supports remote administration.
365
PowerShell
A command shell and scripting language built on the .NET Framework.
366
# PSK
pre-shared key
Passphrase-based mechanism to allow group authentication to a wireless network. The passphrase is used to derive an encryption key.
367
# PEM
Privacy-Enhanced Mail
Base64 encoding scheme used to store certificate and key data as ASCII text.
368
private cloud
A cloud that is deployed for use by a single entity.
369
private key
In asymmetric encryption, the private key is known only to the holder and is linked to, but not derivable from, a public key distributed to those with which the holder wants to communicate securely. A private key can be used to encrypt data that can be decrypted by the linked public key or vice versa.
370
privilege access management
The use of authentication and authorization mechanisms to provide an administrator with centralized or decentralized control of user and group role-based privilege management.
371
privilege escalation
The practice of exploiting flaws in an operating system or other application to gain a greater level of access than was intended for the user or application.
372
# PLC
programmable logic controller
A type of computer designed for deployment in an industrial or outdoor setting that can automate and monitor mechanical systems.
373
# PEAP
Protected Extensible Authentication Protocol
EAP implementation that uses a server-side certificate to create a secure tunnel for user authentication, referred to as the inner method.
374
# PHI
Protected Health Information
Information that identifies someone as the subject of medical and insurance records, plus associated hospital and laboratory test results.
375
provenance
In digital forensics, being able to trace the source of evidence to a crime scene and show that it has not been tampered with.
376
proxy server
A server that mediates the communications between a client and another server. It can filter and often modify communications, as well as provide caching services to improve performance. Also known as forward proxy.
377
pseudo-anonymization
Removing personal information from a data set to make identification of individuals difficult, even if the data set is combined with other sources.
378
public cloud
A cloud that is deployed for shared use by multiple independent tenants.
379
public key
During asymmetric encryption, this key is freely distributed and can be used to perform the reverse encryption or decryption operation of the linked private key in the pair.
380
# P12
Public Key Cryptography Standard #12
Format that allows a private key to be exported along with its digital certificate.
381
# PKCS
public key cryptography standards
Series of standards defining the use of certificate authorities and digital certificates.
382
# PKI
public key infrastructure
Framework of certificate authorities, digital certificates, software, services, and other cryptographic components deployed for the purpose of validating subject identities.
383
purple team
A mode of penetration testing where red and blue teams share information and collaborate throughout the engagement.
384
purpose limitation
In data protection, the principle that personal information can be collected and processed only for a stated purpose to which the subject has consented.
385
Python
High-level programming language that is widely used for automation.
386
# QA
Quality Assurance
Policies, procedures, and tools designed to ensure defect-free development and delivery.
387
qualitative analysis
A risk analysis method that uses opinions and reasoning to measure the likelihood and impact of risk.
388
# QoS
quality of service
Systems that differentiate data passing over the network that can reserve bandwidth for particular applications. A system that cannot guarantee a level of available bandwidth is often described as Class of Service (CoS). Also known as CoS.
389
quantitative analysis
A risk analysis method that is based on assigning concrete values to factors.
390
quantum cryptography
Using quantum computing for cryptographic tasks, such as distributing keys or cracking (traditional) cryptographic systems. Quantum computing works on the principle that its units (qubits) have more properties than the bits used in "classical" computers, notably (and very crudely) that a qubit can have a probability of being 1 or 0 and that inspecting the value of one qubit can instantly determine that of others (entanglement).
391
race condition
A software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events, and those events fail to execute in the order and timing intended by the developer.
392
rainbow table
Tool for speeding up attacks against Windows passwords by precomputing possible hashes.
393
ransomware
A type of password attack where an attacker uses a set of related plaintext passwords and their hashes to crack passwords.
394
Raspberry Pi
Open-source platform producing programmable circuit boards for education and industrial prototyping.
395
# RTOS
real-time operating system
A type of OS that prioritizes deterministic execution of operations to ensure consistent response for time-critical tasks.
396
# RTP
Real-time Transport Protocol
Opens a data stream for video and voice applications over UDP. The data is packetized and tagged with control information (sequence numbering and time-stamping).
397
# RA
Recovery agent
In PKI, an account or combination of accounts that can copy a cryptographic key from backup or escrow and restore it to a subject host or user.
398
# RPO
recovery point objective
The longest period of time that an organization can tolerate lost data being unrecoverable.
399
# RTO
recovery time objective
The length of time it takes after an event to resume normal business operations and activities.
400
red team
The "hostile" or attacking team in a penetration test or incident response exercise.
401
# RAID
redundant array of independent/inexpensive disks
Specifications that support redundancy and fault tolerance for different configurations of multiple-device storage systems.
402
regex regular expression
A group of characters that describe how to execute a specific search pattern on a given text.
403
# RA
registration authority
In PKI, an authority that accepts requests for digital certificates and authenticates the entities making those requests.
404
# RAT
remote access Trojan
Malware that creates a backdoor remote administration channel to allow a threat actor to access and control the infected host.
405
# RADIUS
Remote Authentication Dial-In User Service
A standard protocol used to manage remote and wireless authentication infrastructures.
406
# RTBH
remote triggered black hole
Using a trigger device to send a BGP route update that instructs routers to drop traffic that is suspected of attempting DDoS.
407
replay attack
An attack where the attacker intercepts some authentication data and reuses it to try to re-establish a session.
408
replication
Automatically copying data between two processing systems either simultaneously on both systems (synchronous) or from a primary to a secondary location (asynchronous).
409
residual risk
Risk that remains even after controls are put into place.
410
retention policy
Dictates for how long information needs to be kept available on backup and archive systems. This may be subject to legislative requirements.
411
reverse proxy
A type of proxy server that protects servers from direct contact with client requests.
412
reverse shell
A maliciously spawned remote command shell where the victim host opens the connection to the attacking host.
413
# RCS
rich communication services
Platform-independent advanced messaging functionality designed to replace SMS and MMS.
414
risk acceptance
The response of determining that a risk is within the organization's appetite and no countermeasures other than ongoing monitoring is needed.
415
risk avoidance
In risk mitigation, the practice of ceasing activity that presents risk.
416
risk deterrence
In risk mitigation, the response of deploying security controls to reduce the likelihood and/or impact of a threat scenario. Also known as risk reduction.
417
risk matrix/heat map
A graphical table indicating the likelihood and impact of risk factors identified for a workflow, project, or department 1 for reference by stakeholders. 2
418
risk mitigation
The response of reducing risk to fit within an organization's risk appetite.
419
risk register
A document highlighting the results of risk assessments in an easily comprehensible format (such as a "traffic light" grid). Its purpose is for department managers and technicians to understand risks associated with the workflows that they manage.
420
risk transference
In risk mitigation, the response of moving or sharing the responsibility of risk to another entity, such as by purchasing cybersecurity insurance.
421
risk-based framework
In ESA, a framework that uses risk assessment to prioritize security control selection and investment.
422
# RSA
Rivest Shamir Adelman
Named for its designers, Ronald Rivest, Adi Shamir, and Len Adelman, the first successful algorithm for public key encryption with a variable key length and block size.
423
robot sentry
A remote-controlled or autonomous robot capable of patrolling site premises or monitoring gateways.
424
# RBAC
role-based access control
An access control model where resources are protected by ACLs that are managed by administrators and that provide user permissions based on job functions.
425
# root CA
root certificate authority
In PKI, a CA that issues certificates to intermediate CAs in a hierarchical structure.
426
rootkit
A class of malware that modifies system files, often at the kernel level, to conceal its presence.
427
router firewall
A hardware device that has the primary function of a router, but also has firewall functionality embedded into the router firmware.
428
routing protocols
Rules that govern how routers communicate and forward traffic between networks.
429
rule-based access control
A nondiscretionary access control technique that is based on a set of operational rules or restrictions to enforce a least privileges permissions policy.
430
runbook
An automated version of a playbook that leaves clearly defined interaction points for human analysis.
431
salt
A security countermeasure that mitigates the impact of a rainbow table attack by adding a random value to ("salting") each plaintext input.
432
sandbox
A computing environment that is isolated from a host system to guarantee that the environment runs in a controlled, secure fashion. Communication links between the sandbox and the host are usually completely prohibited.
433
sanitization
The process of thorough and completely removing data from a storage medium so that file remnants cannot be recovered.
434
scalability
The property by which a computing environment is able to gracefully fulfill its ever-increasing resource needs.
435
scanless
Utility that runs port scans through third-party websites to evade detection.
436
screened host
A dual-homed proxy/gateway server used to provide Internet access to other network nodes, while protecting them from external attack.
437
script kiddie
An inexperienced, unskilled attacker that typically uses tools or scripts created by others.
438
secure boot
A UEFI feature that prevents unwanted processes from executing during the boot operation.
439
# SE
secure erase
A method of sanitizing a drive using the ATA command set.
440
# SFTP
Secure File Transfer Protocol
A secure version of the File Transfer Protocol that uses a Secure Shell (SSH) tunnel as an encryption method to transfer, access, and manage files.
441
# SHA
Secure Hash Algorithm
A cryptographic hashing algorithm created to address possible weaknesses in MDA. The current version is SHA-2.
442
# SSH
Secure Shell
A remote administration and file-copy program that supports VPNs by using port forwarding, and that runs on TCP port 22.
443
# SSTP
Secure Socket Tunneling Protocol
A protocol that uses the HTTP over SSL protocol and encapsulates an IP packet with a PPP header and then with an SSTP header.
444
# SWG
secure web gateway
An appliance or proxy server that mediates client connections with the Internet by filtering spam and malware and enforcing access restrictions on types of sites visited, time spent, and bandwidth consumed.
445
# S/MIME
Secure/Multipurpose Internet Mail Extensions
An email encryption standard that adds digital signatures and public key cryptography to traditional MIME communications.
446
# SECaaS
Security as a Service
A computing method that enables clients to take advantage of information, software, infrastructure, and processes provided by a cloud vendor in the specific area of computer security.
447
# SAML
Security Assertion Markup Language
An XML-based data format used to exchange authentication information between a client and a service.
448
# SCAP
Security Content Automation Protocol
A NIST framework that outlines various accepted practices for automating vulnerability scanning.
449
security control
A technology or procedure put in place to mitigate vulnerabilities and risk and to ensure the confidentiality, integrity, and availability (CIA) of information.
450
# SID
security identifier
The value assigned to an account by Windows and that is used by the operating system to identify that account.
451
# SIEM
security information and event management
A solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications.
452
# SOAR
security orchestration, automation, and response
A class of security tools that facilitates incident response, threat hunting, and security configuration by orchestrating automated runbooks and delivering data enrichment.
453
# SEAndroid
Security-Enhanced Android
Since version 4.3, Android has been based on Security-Enhanced Linux, enabling granular permissions for apps, container isolation, and storage segmentation.
454
segment
A portion of a network where all attached hosts can communicate freely with one another.
455
# SED
self-encrypting drive
A disk drive where the controller can automatically encrypt data that is written to it.
456
self-signed certificate
A digital certificate that has been signed by the entity that issued it, rather than by a CA.
457
sentiment analysis
Devising an AI/ML algorithm that can describe or classify the intention expressed in natural language statements.
458
separation of duties
A concept that states that duties and responsibilities should be divided among individuals to prevent ethical conflicts or abuse of powers.
459
# SAS
Serial Attached Small Computer Systems Interface
Developed from parallel SCSI, SAS represents the highest performing hard disk interface available.
460
server certificate
A digital certificate that guarantees the identity of e-commerce sites and other websites that gather and store confidential information.
461
serverless
A software architecture that runs functions within virtualized runtime containers in a cloud rather than on dedicated server instances.
462
server-side
In a web application, input data that is executed or validated as part of a script or process running on the server.
463
service account
A host or network account that is designed to run a background service, rather than to log on interactively.
464
# SLA
service level agreement
Operating procedures and standards for a service contract.
465
# SSID
service set identifier
A character string that identifies a particular wireless LAN (WLAN).
466
# SOA
service-oriented architecture
A software architecture where components of the solution are conceived as loosely coupled services not dependent on a single platform type or technology.
467
session affinity
A scheduling approach used by load balancers to route traffic to devices that have already established connections with the client in question. Also known as source IP affinity.
468
session hijacking
A type of spoofing attack where the attacker disconnects a host then replaces it with his or her own machine, spoofing the original host's IP address.
469
# SIP
Session Initiation Protocol
Used to establish, disestablish, and manage VoIP and conferencing communications sessions. It handles user discovery (locating a user on the network), availability advertising (whether a user is prepared to receive calls), negotiating session parameters (such as use of audio/video), and session management and termination.
470
sflow
Web standard for using sampling to record network traffic statistics.
471
shadow IT
Computer hardware, software, or services used on a private network without authorization from the system owner.
472
shared account
An account with no credential (guest) or one where the credential is known to multiple persons.
473
shellcode
Lightweight block of malicious code that exploits a software vulnerability to gain initial access to a victim system.
474
shimming
The process of developing and implementing additional code between an application and the operating system to enable functionality that would otherwise be unavailable.
475
shoulder surfing
A social engineering tactic to obtain someone's password or PIN by observing him or her as he or she types it in.
476
signature-based detection
A network monitoring system that uses a predefined set of rules provided by a software vendor or security personnel to identify events that are unacceptable.
477
# SNMP
Simple Network Management Protocol
Protocol for monitoring and managing network devices. SNMP works over UDP ports 161 and 162 by default.
478
# SOAP
Simple Object Access Protocol
An XML-based web services protocol that is used to exchange messages.
479
# SAE
Simultaneous Authentication of Equals
Personal authentication mechanism for Wi-Fi networks introduced with WPA3 to address vulnerabilities in the WPA-PSK method.
480
# SLE
single loss expectancy
The amount that would be lost in a single occurrence of a particular risk factor.
481
# SPoF
single point of failure
A component or system that would cause a complete interruption of a service if it failed.
482
# SSO
single sign-on
An authentication
483
sinkhole
A DoS attack mitigation strategy that directs the traffic that is flooding a target IP address to a different network for analysis.
484
smart card
A device similar to a credit card that can store authentication information, such as a user's private key, on an embedded microchip.
485
smart meter
A utility meter that can submit readings to the supplier without user intervention.
486
SMiShing
A form of phishing that uses SMS text messages to trick a victim into revealing information.
487
sn1per
Software utility designed for penetration testing reporting and evidence gathering that can also run automated test suites.
488
# SaaS
Software as a Service
A computing method that uses the cloud to provide application services to users.
489
# SDN
software defined networking
APIs and compatible hardware/virtual appliances allowing for programmable network appliances and systems.
490
# SDV
software defined visibility
APIs for reporting configuration and state data for automated monitoring and alerting.
491
# SDK
software development kit
Coding resources provided by a vendor to assist with development projects that use their platform or API.
492
# SPIM
spam over internet messaging
A spam attack that is propagated through instant messaging rather than email.
493
# STP
Spanning Tree Protocol
A switching protocol that prevents network loops by dynamically disabling links as needed.
494
spear phishing
An email-based or web-based form of phishing which targets specific individuals.
495
split tunnel VPN configuration
VPN configuration where only traffic for the private network is routed via the VPN gateway.
496
standard naming convention
Applying consistent names and labels to assets and digital resources/identities within a configuration management system.
497
stapling
Mechanism used to mitigate performance and privacy issues when requesting certificate status from an OCSP responder.
498
state actor
A type of threat actor that is supported by the resources of its host country's military and security services. Also known as nation state actor.
499
Subject Alternative Name
Field in a digital certificate allowing a host to be identified by multiple host names/subdomains.
500
Subscriber Identity Module
A small chip card that identifies the user and phone number of a mobile device, via an International Mobile Subscriber Identity (ISMI).
501
# SSAE SOC
Supervisory Control and Data Acquisition
A type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographically large areas.
502
supplicant
In EAP architecture, the device requesting access to the network.
503
symmetric encryption
A two-way encryption scheme in which encryption and decryption are both performed by the same key. Also known as shared-key encryption.
504
syslog
A protocol enabling different appliances and software applications to transmit logs or event records to a central server.
505
system-on-chip
A processor that integrates the platform functionality of multiple logical controllers onto a single chip.
506
# SEH
tactics, techniques, and procedures
Analysis of historical cyberattacks and adversary actions.
507
# SEH
tail command
Linux utility for showing the last lines in a file.
508
tailgating
Social engineering technique to gain access to a building by following someone who is unaware of their presence.
509
tape
Tape media provides robust, high-speed, high-capacity backup storage. Tape drives and autoloader libraries can be connected to the SATA and SAS buses or accessed via a SAN.
510
tcpdump
A command-line packet sniffing utility.
511
tcpreplay
A command-line utility that replays packets saved to a file back through a network adapter.
512
technical control
A category of security control that is implemented as a system (hardware, software, or firmware). Technical controls may also be described as logical controls.
513
# TKIP
Temporal Key Integrity Protocol
A mechanism used in the first version of WPA to improve the security of wireless encryption mechanisms, compared to the flawed WEP standard.
514
# TACACS+
Terminal Access Controller Access Control System Plus
An AAA protocol developed by Cisco that is often used to authenticate to administrator accounts for network appliance management.
515
# TAP
test access port
A hardware device inserted into a cable to copy frames for analysis.
516
tethering
Using the cellular data plan of a mobile device to provide Internet access to a laptop or PC. The PC can be tethered to the mobile by USB, Bluetooth, or Wi-Fi (a mobile hotspot). Also known as hotspot.
517
# DSCP/Diifserv
The Differentiated Services Code Point
a field is used to indicate a priority value for a layer 3 (IP) packet to facilitate Quality of Service (QoS) or Class of Service (CoS) scheduling.
518
theHarvester
Utility for gathering results from open source intelligence queries.
519
thin AP
An access point that requires a wireless controller in order to function.
520
third-party risks
Vulnerabilities that arise from dependencies in business relationships with suppliers and customers.
521
threat actor
The person or entity responsible for an event that has been identified as a security incident or as a risk.
522
threat hunting
Cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring.
523
threat map
Animated map showing threat sources in near real-time.
524
# TOCTTOU
time of check to time of use
The potential vulnerability that occurs when there is a change between when an app checked a resource and when the app used the resource.
525
time of day restrictions
The potential vulnerability that occurs when there is a change between when an app checked a resource and when the app used the resource.
526
time offset
In forensics, identifying whether a time zone offset has been applied to a file's time stamp.
527
# TOTP
Time-based One-time Password
An improvement on HOTP that forces one-time passwords to expire after a short period of time.
528
# TLS
timeline
In digital forensics, a tool that shows the sequence of file system events within a source image in a graphical format.
529
token
A physical or virtual item that contains authentication and/or authorization data, commonly used in multifactor authentication.
530
tokenization
A deidentification method where a unique token is substituted for real data.
531
transit gateway
In cloud computing, a virtual router deployed to facilitate connections between VPC subnets and VPN gateways.
532
Transport Layer Security
A security protocol that uses certificates for authentication and encryption to protect web communication.
533
trend analysis
The process of detecting patterns within a dataset over time, and using those patterns to make predictions about future events or better understand past events.
534
Trojan
A malicious software program hidden within an innocuous-seeming piece of software. Usually, the Trojan is used to try to compromise the security of the target computer. Also known as Trojan.
535
# TPM
Trusted Automated eXchange of Indicator Information
A protocol for exchanging cyber threat intelligence between organizations.
536
Trusted Automated eXchange of Indicator Information
A protocol for exchanging cyber threat intelligence between organizations.
537
# TPM
Trusted Platform Module
A specification for hardware-based storage of digital certificates, keys, hashed passwords, and other user and platform identification information.
538
typosquatting
An attack—also called typosquatting—in which an attacker registers a domain name with a common misspelling of an existing domain, so that a user who misspells a URL they enter into a browser is taken to the attacker's website. Also known as URL hijacking.
539
# UEM
unified endpoint management
Enterprise software for controlling device settings, apps, and corporate data storage on all types of fixed, mobile, and IoT computing devices.
540
# UTM
unified threat management
All-in-one security appliances and agents that combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, data loss prevention, content filtering, and so on.
541
# USB data blocker
Universal Serial Bus data blocker
Hardware plug to prevent malicious data transfer when a device is plugged into a USB charging point.
542
# UEBA
user and entity behavior analytics
A system that can provide automated identification of suspicious activity by user accounts and computer hosts.
543
# VDE
vendor management
Policies and procedures to identify vulnerabilities and ensure security of the supply chain.
544
# VDE
virtual desktop environment
The user desktop and software applications provisioned as an instance under VDI.
545
# VDI
virtual desktop infrastructure
A virtualization implementation that separates the personal computing environment from a user's physical computer.
546
# VLAN
virtual local area network
A logically separate network, created by using switching technology. Even though hosts on two VLANs may be physically connected to the same cabling, local traffic is isolated to each VLAN so they must use a router to communicate.
547
# VM escaping
virtual machine escaping
An attack where malware running in a VM is able to interact directly with the hypervisor or host kernel.
548
# VM sprawl
virtual machine sprawl
Configuration vulnerability where provisioning and deprovisioning of virtual assets is not properly authorized and monitored.
549
# VPC
virtual private cloud
A private network segment made available to a single cloud consumer on a public cloud.
550
# VPN
virtual private network
A secure tunnel created between two endpoints connected via an unsecure network (typically the Internet).
551
virus
Code designed to infect computer files (or disks) when it is activated.
552
vishing
A human-based attack where the attacker extracts information while speaking over the phone or leveraging IPbased voice messaging services (VoIP).
553
# VBA
Visual Basic for Applications
Programming languages used to implement macros and scripting in Office document automation.
554
vulnerability
A weakness that could be triggered accidentally or exploited intentionally to cause a security breach.
555
vulnerability assessment
An evaluation of a system's security and ability to meet compliance requirements based on the configuration state of the system, as represented by information collected from the system.
556
war driving
The practice of using a Wi-Fi sniffer to detect WLANs and then either making use of them (if they are open/unsecured) or trying to break into them (using WEP and WPA cracking tools).
557
warm site
A location that is dormant or performs noncritical functions under normal conditions, but which can be rapidly converted to a key operations site if needed.
558
watering hole attack
An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.
559
# WAF
web application firewall
"A firewall designed specifically to protect software running on web servers and their backend databases from code injection and DoS
attacks"
560
whaling
An email-based or web-based form of phishing which targets senior executives or wealthy individuals.
561
white team
Staff administering, evaluating, and supervising a penetration test or incident response exercise.
562
# WPA
Wi-Fi Protected Access
Standards for authenticating and encrypting access to Wi-Fi networks. Also known as WPA2, WPA3.
563
# WPS
Wi-Fi Protected Setup
A feature of WPA and WPA2 that allows enrollment in a wireless network based on an 8-digit PIN.
564
WinHex
Forensics tool for Windows that allows collection and inspection of binary code in disk and memory images.
565
# WEP
Wired Equivalent Privacy
A legacy mechanism for encrypting data sent over a wireless connection.
566
zero-day
A vulnerability in software that is unpatched by the developer or an attack that exploits such a vulnerability.
567
zero-fill
A method of sanitizing a drive by setting all bits to zero.
568
ZigBee
Low-power wireless communications open source protocol used primarily for home automation. ZigBee uses radio frequencies in the 2.4 GHz band and a mesh topology.
569
Z-Wave
Low-power wireless communications protocol used primarily for home automation. Z-Wave uses radio frequencies in the high 800 to low 900 MHz and a mesh topology
570
state table
Information about sessions between hosts that is gathered by a stateful firewall.
571
stateful inspection
A technique used in firewalls to analyze packets down to the application layer rather than filtering packets only by header information, enabling the firewall to enforce tighter and more security.
572
Statements on Standards for Attestation Engagements Service Organization Control
Audit specifications designed to ensure that cloud/hosting providers meet professional standards. A SOC2 Type II report is created for a restricted audience, while SOC3 reports are provided for general consumption.
573
steganography
A technique for obscuring the presence of a message, often by embedding information within a file or other entity.
574
stored procedure
One of a set of precompiled database statements that can be used to validate input to a database.
575
stream cipher
A type of symmetric encryption that combines a stream of plaintext bits or bytes with a pseudorandom stream initialized by a secret key.
576
stress test
A software testing method that evaluates how software performs under extreme load.
577
structured exception handler
A mechanism to account for unexpected error conditions that might arise during code execution. Effective error handling reduces the chances that a program could be exploited. 1
578
Structured Query Language injection
An attack that injects a database query into the input data directed at a server by accessing the client side of the application.
579
Structured Threat Information eXpression
A framework for analyzing cybersecurity incidents.
