Cybersecurity Flashcards
(432 cards)
1
Q
Absolute file path
A
The full file path, which starts from the root
2
Q
Access controls
A
Security controls that manage access, authorization, and accountability of information
3
Q
Active packet sniffing
A
A type of attack where data packets are manipulated in transit
4
Q
Address Resolution Protocol (ARP)
A
A network protocol used to determine the MAC address of the next router or device on the path
5
Q
Advanced persistent threat (APT)
A
An instance when a threat actor maintains unauthorized access to a system for an extended period of time
6
Q
Adversarial artificial intelligence (AI)
A
A technique that manipulates artificial intelligence (AI) and machine learning (ML) technology to conduct attacks more efficiently
7
Q
Adware
A
A type of legitimate software that is sometimes used to display digital advertisements in applications
8
Q
Algorithm
A
A set of rules used to solve a problem
9
Q
Analysis
A
The investigation and validation of alerts
10
Q
Angler phishing
A
A technique where attackers impersonate customer service representatives on social media
11
Q
Anomaly-based analysis
A
A detection method that identifies abnormal behavior
12
Q
Antivirus software
A
A software program used to prevent, detect, and eliminate malware and viruses
13
Q
Application
A
A program that performs a specific task
14
Q
Application programming interface (API) token
A
A small block of encrypted code that contains information about a user
15
Q
Argument (Linux)
A
Specific information needed by a command
16
Q
Argument (Python)
A
The data brought into a function when it is called
17
Q
Array
A
A data type that stores data in a comma-separated ordered list
18
Q
Assess
A
The fifth step of the NIST RMF that means to determine if established controls are implemented correctly
19
Q
Asset
A
An item perceived as having value to an organization
20
Q
Asset classification
A
The practice of labeling assets based on sensitivity and importance to an organization
21
Q
Asset inventory
A
A catalog of assets that need to be protected
22
Q
Asset management
A
The process of tracking assets and the risks that affect them
23
Q
Asymmetric encryption
A
The use of a public and private key pair for encryption and decryption of data
24
Q
Attack surface
A
All the potential vulnerabilities that a threat actor could exploit
25
Attack tree
A diagram that maps threats to assets
26
Attack vectors
The pathways attackers use to penetrate security defenses
27
Authentication
The process of verifying who someone is
28
Authorization
The concept of granting access to specific resources in a system
29
Authorize
The sixth step of the NIST RMF that refers to being accountable for the security and privacy risks that might exist in an organization
30
Automation
The use of technology to reduce human and manual effort to perform common and repetitive tasks
31
Availability
The idea that data is accessible to those who are authorized to access it
32
Baiting
A social engineering tactic that tempts people into compromising their security
33
Bandwidth
The maximum data transmission capacity over a network, measured by bits per second
34
Baseline configuration (baseline image)
A documented set of specifications within a system that is used as a basis for future builds, releases, and updates
35
Bash
The default shell in most Linux distributions
36
Basic auth
The technology used to establish a user’s request to access a server
37
Basic Input/Output System (BIOS)
A microchip that contains loading instructions for the computer and is prevalent in older systems
38
Biometrics
The unique physical characteristics that can be used to verify a person’s identity
39
Bit
The smallest unit of data measurement on a computer
40
Boolean data
Data that can only be one of two values: either True or False
41
Bootloader
A software program that boots the operating system
42
Botnet
A collection of computers infected by malware that are under the control of a single threat actor, known as the “bot-herder"
43
Bracket notation
The indices placed in square brackets
44
Broken chain of custody
Inconsistencies in the collection and logging of evidence in the chain of custody
45
Brute force attack
The trial and error process of discovering private information
46
Bug bounty
Programs that encourage freelance hackers to find and report vulnerabilities
47
Built-in function
A function that exists within Python and can be called directly
48
Business continuity
An organization's ability to maintain their everyday productivity by establishing risk disaster recovery plans
49
Business continuity plan (BCP)
A document that outlines the procedures to sustain business operations during and after a significant disruption
50
Business Email Compromise (BEC)
A type of phishing attack where a threat actor impersonates a known source to obtain financial advantage
51
Categorize
The second step of the NIST RMF that is used to develop risk management processes and tasks
52
CentOS
An open-source distribution that is closely related to Red Hat
53
Central Processing Unit (CPU)
A computer’s main processor, which is used to perform general computing tasks on a computer
54
Chain of custody
The process of documenting evidence possession and control during an incident lifecycle
55
Chronicle
A cloud-native tool designed to retain, analyze, and search data
56
Cipher
An algorithm that encrypts information
57
Cloud-based firewalls
Software firewalls that are hosted by the cloud service provider
58
Cloud computing
The practice of using remote servers, applications, and network services that are hosted on the internet instead of on local physical devices
59
Cloud network
A collection of servers or computers that stores resources and data in remote data centers that can be accessed via the internet
60
Cloud security:
The process of ensuring that assets stored in the cloud are properly configured and access to those assets is limited to authorized users
61
Command
An instruction telling the computer to do something
62
Command and control (C2)
The techniques used by malicious actors to maintain communications with compromised systems
63
Command-line interface (CLI)
A text-based user interface that uses commands to interact with the computer
64
Comment
A note programmers make about the intention behind their code
65
Common Event Format (CEF)
A log format that uses key-value pairs to structure data and identify fields and their corresponding values
66
Common Vulnerabilities and Exposures (CVE®) list
An openly accessible dictionary of known vulnerabilities and exposures
67
Common Vulnerability Scoring System (CVSS)
A measurement system that scores the severity of a vulnerability
68
Compliance
The process of adhering to internal standards and external regulations
69
Computer security incident response teams (CSIRT)
A specialized group of security professionals that are trained in incident management and response
70
Computer virus
Malicious code written to interfere with computer operations and cause damage to data and software
71
Conditional statement
A statement that evaluates code to determine if it meets a specified set of conditions
72
Confidentiality
The idea that only authorized users can access specific assets or data
73
Confidential data:
Data that often has limits on the number of people who have access to it
74
Confidentiality, integrity, availability (CIA) triad
A model that helps inform how organizations consider risk when setting up systems and security policies
75
Configuration file
A file used to configure the settings of an application
76
Containment
The act of limiting and preventing additional damage caused by an incident
77
Controlled zone
A subnet that protects the internal network from the uncontrolled zone
78
Cross-site scripting (XSS)
An injection attack that inserts code into a vulnerable website or web application
79
Crowdsourcing
The practice of gathering information using public input and collaboration
80
Cryptographic attack
An attack that affects secure forms of communication between a sender and intended recipient
81
Cryptographic key
A mechanism that decrypts ciphertext
82
Cryptography
The process of transforming information into a form that unintended readers can’t understand
83
Cryptojacking
A form of malware that installs software to illegally mine cryptocurrencies
84
CVE Numbering Authority (CNA)
An organization that volunteers to analyze and distribute information on eligible CVEs
85
Cybersecurity (or security)
The practice of ensuring confidentiality, integrity, and availability of information by protecting networks, devices, people, and data from unauthorized access or criminal exploitation
86
Data
Information that is translated, processed, or stored by a computer
87
Data at rest
Data not currently being accessed
88
Database
An organized collection of information or data
89
Data controller
A person that determines the procedure and purpose for processing data
90
Data custodian
Anyone or anything that’s responsible for the safe handling, transport, and storage of information
91
Data exfiltration
Unauthorized transmission of data from a system
92
Data in transit
Data traveling from one point to another
93
Data in use
Data being accessed by one or more users
94
Data owner
The person who decides who can access, edit, use, or destroy their information
95
Data packet
A basic unit of information that travels from one device to another within a network
96
Data point
A specific piece of information
97
Data processor
A person that is responsible for processing data on behalf of the data controller
98
Data protection officer (DPO)
An individual that is responsible for monitoring the compliance of an organization's data protection procedures
99
Data type
A category for a particular type of data item
100
Date and time data
Data representing a date and/or time
101
Debugger
A software tool that helps to locate the source of an error and assess its causes
102
Debugging
The practice of identifying and fixing errors in code
103
Defense in depth
A layered approach to vulnerability management that reduces risk
104
Denial of service (DoS) attack
An attack that targets a network or server and floods it with network traffic
105
Detect
A NIST core function related to identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections
106
Detection
The prompt discovery of security events
107
Dictionary data
Data that consists of one or more key-value pairs
108
Digital certificate
A file that verifies the identity of a public key holder
109
Digital forensics
The practice of collecting and analyzing data to determine what has happened after an attack
110
Directory
A file that organizes where other files are stored
111
Disaster recovery plan:
A plan that allows an organization’s security team to outline the steps needed to minimize the impact of a security incident
112
Distributed denial of service (DDoS) attack
A type of denial of service attack that uses multiple devices or servers located in different locations to flood the target network with unwanted traffic
113
Distributions
The different versions of Linux
114
Documentation
Any form of recorded content that is used for a specific purpose
115
DOM-based XSS attack
An instance when malicious script exists in the webpage a browser loads
116
Domain Name System (DNS)
A networking protocol that translates internet domain names into IP addresses
117
Dropper
A type of malware that comes packed with malicious code which is delivered and installed onto a target system
118
Elevator pitch
A brief summary of your experience, skills, and background
119
Encapsulation
A process performed by a VPN service that protects your data by wrapping sensitive data in other data packets
120
Encryption
The process of converting data from a readable format to an encoded format
121
Endpoint
Any device connected on a network
122
Endpoint detection and response (EDR)
An application that monitors an endpoint for malicious activity
123
Eradication
The complete removal of the incident elements from all affected systems
124
Escalation policy
A set of actions that outline who should be notified when an incident alert occurs and how that incident should be handled
125
Event
An observable occurrence on a network, system, or device
126
Exception
An error that involves code that cannot be executed even though it is syntactically correct
127
Exclusive operator
An operator that does not include the value of comparison
128
Exploit
A way of taking advantage of a vulnerability
129
Exposure
A mistake that can be exploited by a threat
130
External threat
Anything outside the organization that has the potential to harm organizational assets
131
False negative
A state where the presence of a threat is not detected
132
False positive
An alert that incorrectly detects the presence of a threat
133
Fileless malware
Malware that does not need to be installed by the user because it uses legitimate programs that are already installed to infect a computer
134
File path
The location of a file or directory
135
Filesystem Hierarchy Standard (FHS)
The component of the Linux OS that organizes data
136
Filtering
Selecting data that match a certain condition
137
Final report
Documentation that provides a comprehensive review of an incident
138
Firewall
A network security device that monitors traffic to or from a network
139
Float data
Data consisting of a number with a decimal point
140
Foreign key
A column in a table that is a primary key in another table
141
Forward proxy server
A server that regulates and restricts a person’s access to the internet
142
Function
A section of code that can be reused in a program
143
Global variable
A variable that is available through the entire program
144
Graphical user interface (GUI)
A user interface that uses icons on the screen to manage different tasks on the computer
145
Hacker
Any person who uses computers to gain access to computer systems, networks, or data
146
Hacktivist
A person who uses hacking to achieve a political goal
147
Hard drive
A hardware component used for long-term memory
148
Hardware
The physical components of a computer
149
Hash collision
An instance when different inputs produce the same hash value
150
Hash function
An algorithm that produces a code that can’t be decrypted
151
Hash table
A data structure that's used to store and reference hash values
152
Health Insurance Portability and Accountability Act (HIPAA)
A U.S. federal law established to protect patients’ health information
153
Honeypot
A system or resource created as a decoy vulnerable to attacks with the purpose of attracting potential intruders
154
Host-based intrusion detection system (HIDS)
An application that monitors the activity of the host on which it’s installed
155
Hub
A network device that broadcasts information to every device on the network
156
Hypertext Transfer Protocol (HTTP)
An application layer protocol that provides a method of communication between clients and website servers
157
Hypertext Transfer Protocol Secure (HTTPS):
A network protocol that provides a secure method of communication between clients and website servers
158
Identify
A NIST core function related to management of cybersecurity risk and its effect on an organization’s people and assets
159
Identity and access management (IAM)
A collection of processes and technologies that helps organizations manage digital identities in their environment
160
IEEE 802.11 (Wi-Fi)
A set of standards that define communication for wireless LANs
161
Immutable
An object that cannot be changed after it is created and assigned a value
162
Implement
The fourth step of the NIST RMF that means to implement security and privacy plans for an organization
163
Improper usage
An incident type that occurs when an employee of an organization violates the organization’s acceptable use policies
164
Incident
An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies
165
Incident escalation
The process of identifying a potential security incident, triaging it, and handing it off to a more experienced team member
166
Incident handler’s journal
A form of documentation used in incident response
167
Incident response:
An organization’s quick attempt to identify an attack, contain the damage, and correct the effects of a security breach
168
Incident response plan
A document that outlines the procedures to take in each step of incident response
169
Inclusive operator
An operator that includes the value of comparison
170
Indentation
Space added at the beginning of a line of code
171
Index
A number assigned to every element in a sequence that indicates its position
172
Indicators of attack (IoA)
The series of observed events that indicate a real-time incident
173
Indicators of compromise (IoC)
Observable evidence that suggests signs of a potential security incident
174
Information privacy
The protection of unauthorized access and distribution of data
175
Information security (InfoSec)
The practice of keeping data in all states away from unauthorized users
176
Injection attack
Malicious code inserted into a vulnerable application
177
Input validation
Programming that validates inputs from users and other programs
178
Integer data
Data consisting of a number that does not include a decimal point
179
Integrated development environment (IDE)
A software application for writing code that provides editing assistance and error correction tools
180
Integrity
The idea that the data is correct, authentic, and reliable
181
Internal hardware
The components required to run the computer
182
Internal threat
A current or former employee, external vendor, or trusted partner who poses a security risk
183
Internet Control Message Protocol (ICMP)
An internet protocol used by devices to tell each other about data transmission errors across the network
184
Internet Control Message Protocol flood (ICMP flood)
A type of DoS attack performed by an attacker repeatedly sending ICMP request packets to a network server
185
Internet Protocol (IP)
A set of standards used for routing and addressing data packets as they travel between devices on a network
186
Internet Protocol (IP) address
A unique string of characters that identifies the location of a device on the internet
187
Interpreter
A computer program that translates Python code into runnable instructions line by line
188
Intrusion detection system (IDS)
An application that monitors system activity and alerts on possible intrusions
189
Intrusion prevention system (IPS)
An application that monitors system activity for intrusive activity and takes action to stop the activity
190
IP spoofing
A network attack performed when an attacker changes the source IP of a data packet to impersonate an authorized system and gain access to a network
191
Iterative statement
Code that repeatedly executes a set of instructions
192
KALI LINUX ™
An open-source distribution of Linux that is widely used in the security industry
193
Kernel
The component of the Linux OS that manages processes and memory
194
Key-value pair
A set of data that represents two linked items: a key, and its corresponding value
195
Legacy operating system
An operating system that is outdated but still being used
196
Lessons learned meeting
A meeting that includes all involved parties after a major incident
197
Library
A collection of modules that provide code users can access in their programs
198
Linux
An open-source operating system
199
List concatenation
The concept of combining two lists into one by placing the elements of the second list directly after the elements of the first list
200
List data
Data structure that consists of a collection of data in sequential form
201
Loader
A type of malware that downloads strains of malicious code from an external source and installs them onto a target system
202
Local Area Network (LAN)
A network that spans small areas like an office building, a school, or a home
203
Local variable
A variable assigned within a function
204
Log
A record of events that occur within an organization’s systems
205
Log analysis
The process of examining logs to identify events of interest
206
Logging
The recording of events occurring on computer systems and networks
207
Logic error
An error that results when the logic used in code produces unintended results
208
Log management
The process of collecting, storing, analyzing, and disposing of log data
209
Loop condition
The part of a loop that determines when the loop terminates
210
Loop variable
A variable that is used to control the iterations of a loop
211
Malware
Software designed to harm devices or networks
212
Malware infection
An incident type that occurs when malicious software designed to disrupt a system infiltrates an organization’s computers or network
213
Media Access Control (MAC) address
A unique alphanumeric identifier that is assigned to each physical device on a network
214
Method
A function that belongs to a specific data type
215
Metrics
Key technical attributes such as response time, availability, and failure rate, which are used to assess the performance of a software application
216
MITRE
A collection of non-profit research and development centers
217
Modem
A device that connects your router to the internet and brings internet access to the LAN
218
Module
A Python file that contains additional functions, variables, classes, and any kind of runnable code
219
Monitor
The seventh step of the NIST RMF that means be aware of how systems are operating
220
Multi-factor authentication (MFA)
A security measure that requires a user to verify their identity in two or more ways to access a system or network
221
nano
A command-line file editor that is available by default in many Linux distributions
222
National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)
A voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk
223
National Institute of Standards and Technology (NIST) Incident Response Lifecycle
A framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery, and Post-incident activity
224
National Institute of Standards and Technology (NIST) Special Publication (S.P.) 800-53
A unified framework for protecting the security of information systems within the U.S. federal government
225
Network
A group of connected devices
226
Network-based intrusion detection system (NIDS)
An application that collects and monitors network traffic and network data
227
Network data
The data that’s transmitted between devices on a network
228
Network Interface Card (NIC)
Hardware that connects computers to a network
229
Network log analysis
The process of examining network logs to identify events of interest
230
Network protocol analyzer (packet sniffer)
A tool designed to capture and analyze data traffic within a network
231
Network protocols
A set of rules used by two or more devices on a network to describe the order of delivery and the structure of data
232
Network security
The practice of keeping an organization's network infrastructure secure from unauthorized access
233
Network segmentation
A security technique that divides the network into segments
234
Network traffic
The amount of data that moves across a network
235
Non-repudiation
The concept that the authenticity of information can’t be denied
236
Notebook
An online interface for writing, storing, and running code
237
Numeric data
Data consisting of numbers
238
OAuth
An open-standard authorization protocol that shares designated access between applications
239
Object
A data type that stores data in a comma-separated list of key-value pairs
240
On-path attack
An attack where a malicious actor places themselves in the middle of an authorized connection and intercepts or alters the data in transit
241
Open-source intelligence (OSINT)
The collection and analysis of information from publicly available sources to generate usable intelligence
242
Open systems interconnection (OSI) model
A standardized concept that describes the seven layers computers use to communicate and send data over the network
243
Open Web Application Security Project/Open Worldwide Application Security Project (OWASP)
A non-profit organization focused on improving software security
244
Operating system (OS)
The interface between computer hardware and the user
245
Operator
A symbol or keyword that represents an operation
246
Options
Input that modifies the behavior of a command
247
Order of volatility
A sequence outlining the order of data that must be preserved from first to last
248
OWASP Top 10
A globally recognized standard awareness document that lists the top 10 most critical security risks to web applications
249
Package
A piece of software that can be combined with other packages to form an application
250
Package manager
A tool that helps users install, manage, and remove packages or applications
251
Packet capture (P-cap)
A file containing data packets intercepted from an interface or network
252
Packet sniffing
The practice of capturing and inspecting data packets across a network
253
Parameter (Python)
An object that is included in a function definition for use in that function
254
Parrot
An open-source distribution that is commonly used for security
255
Parsing
The process of converting data into a more readable format
256
Passive packet sniffing
A type of attack where a malicious actor connects to a network hub and looks at all traffic on the network
257
Password attack
An attempt to access password secured devices, systems, networks, or data
258
Patch update
A software and operating system update that addresses security vulnerabilities within a program or product
259
Payment Card Industry Data Security Standards (PCI DSS)
A set of security standards formed by major organizations in the financial industry
260
Penetration test (pen test)
A simulated attack that helps identify vulnerabilities in systems, networks, websites, applications, and processes
261
PEP 8 style guide
A resource that provides stylistic guidelines for programmers working in Python
262
Peripheral devices
Hardware components that are attached and controlled by the computer system
263
Permissions
The type of access granted for a file or directory
264
Personally identifiable information (PII)
Any information used to infer an individual's identity
265
Phishing
The use of digital communications to trick people into revealing sensitive data or deploying malicious software
266
Phishing kit
A collection of software tools needed to launch a phishing campaign
267
Physical attack
A security incident that affects not only digital but also physical environments where the incident is deployed
268
Physical social engineering
An attack in which a threat actor impersonates an employee, customer, or vendor to obtain unauthorized access to a physical location
269
Ping of death
A type of DoS attack caused when a hacker pings a system by sending it an oversized ICMP packet that is bigger than 64KB
270
Playbook
A manual that provides details about any operational action
271
Policy
A set of rules that reduce risk and protect information
272
Port
A software-based location that organizes the sending and receiving of data between devices on a network
273
Port filtering
A firewall function that blocks or allows certain port numbers to limit unwanted communication
274
Post-incident activity
The process of reviewing an incident to identify areas for improvement during incident handling
275
Potentially unwanted application (PUA)
A type of unwanted software that is bundled in with legitimate programs which might display ads, cause device slowdown, or install other software
276
Private data
Information that should be kept from the public
277
Prepare
The first step of the NIST RMF related to activities that are necessary to manage security and privacy risks before a breach occurs
278
Prepared statement:
A coding technique that executes SQL statements before passing them on to a database
279
Primary key
A column where every row has a unique entry
280
Principle of least privilege
The concept of granting only the minimal access and authorization required to complete a task or function
281
Privacy protection
The act of safeguarding personal information from unauthorized use
282
Procedures
Step-by-step instructions to perform a specific security task
283
Process of Attack Simulation and Threat Analysis (PASTA):
A popular threat modeling framework that’s used across many industries
284
Programming
A process that can be used to create a specific set of instructions for a computer to execute tasks
285
Protect
A NIST core function used to protect an organization through the implementation of policies, procedures, training, and tools that help mitigate cybersecurity threats
286
Protected health information (PHI)
Information that relates to the past, present, or future physical or mental health or condition of an individual
287
Protecting and preserving evidence
The process of properly working with fragile and volatile digital evidence
288
Proxy server
A server that fulfills the requests of its clients by forwarding them to other servers
289
Public data
Data that is already accessible to the public and poses a minimal risk to the organization if viewed or shared by others
290
Public key infrastructure (PKI)
An encryption framework that secures the exchange of online information
291
Python Standard Library
An extensive collection of Python code that often comes packaged with Python
292
Query
A request for data from a database table or a combination of tables
293
Quid pro quo
A type of baiting used to trick someone into believing that they’ll be rewarded in return for sharing access, information, or money
294
Rainbow table
A file of pre-generated hash values and their associated plaintext
295
Random Access Memory (RAM)
A hardware component used for short-term memory
296
Ransomware
A malicious attack where threat actors encrypt an organization’s data and demand payment to restore access
297
Rapport
A friendly relationship in which the people involved understand each other’s ideas and communicate well with each other
298
Recover
A NIST core function related to returning affected systems back to normal operation
299
Recovery
The process of returning affected systems back to normal operations
300
Red Hat® Enterprise Linux®
A subscription-based distribution of Linux built for enterprise use
301
Reflected XSS attack
An instance when malicious script is sent to a server and activated during the server’s response
302
Regular expression (regex)
A sequence of characters that forms a pattern
303
Regulations
Rules set by a government or other authority to control the way something is done
304
Relational database
A structured database containing tables that are related to each other
305
Relative file path
A file path that starts from the user's current directory
306
Replay attack
A network attack performed when a malicious actor intercepts a data packet in transit and delays it or repeats it at another time
307
Resiliency
The ability to prepare for, respond to, and recover from disruptions
308
Respond
A NIST core function related to making sure that the proper procedures are used to contain, neutralize, and analyze security incidents, and implement improvements to the security process
309
Return statement
A Python statement that executes inside a function and sends information back to the function call
310
Reverse proxy server
A server that regulates and restricts the internet's access to an internal server
311
Risk
Anything that can impact the confidentiality, integrity, or availability of an asset
312
Risk mitigation
The process of having the right procedures and rules in place to quickly reduce the impact of a risk like a breach
313
Root directory
The highest-level directory in Linux
314
Rootkit
Malware that provides remote, administrative access to a computer
315
Root user (or superuser)
A user with elevated privileges to modify the system
316
Router
A network device that connects multiple networks together
317
Salting
An additional safeguard that’s used to strengthen hash functions
318
Scareware
Malware that employs tactics to frighten users into infecting their device
319
Search Processing Language (SPL)
Splunk’s query language
320
Secure File Transfer Protocol (SFTP)
A secure protocol used to transfer files from one device to another over a network
321
Secure shell (SSH)
A security protocol used to create a shell with a remote system
322
Security architecture
A type of security design composed of multiple components, such as tools and processes, that are used to protect an organization from risks and external threats
323
Security audit
A review of an organization's security controls, policies, and procedures against a set of expectations
324
Security controls
Safeguards designed to reduce specific security risks
325
Security ethics
Guidelines for making appropriate decisions as a security professional
326
Security frameworks
Guidelines used for building plans to help mitigate risk and threats to data and privacy
327
Security governance
Practices that help support, define, and direct security efforts of an organization
328
Security hardening
The process of strengthening a system to reduce its vulnerabilities and attack surface
329
Security information and event management (SIEM)
An application that collects and analyzes log data to monitor critical activities in an organization
330
Security mindset
The ability to evaluate risk and constantly seek out and identify the potential or actual breach of a system, application, or data
331
Security operations center (SOC)
An organizational unit dedicated to monitoring networks, systems, and devices for security threats or attacks
332
Security orchestration, automation, and response (SOAR)
A collection of applications, tools, and workflows that use automation to respond to security events
333
Security posture
An organization’s ability to manage its defense of critical assets and data and react to change
334
Security zone
A segment of a company’s network that protects the internal network from the internet
335
Select
The third step of the NIST RMF that means to choose, customize, and capture documentation of the controls that protect an organization
336
Sensitive data
A type of data that includes personally identifiable information (PII), sensitive personally identifiable information (SPII), or protected health information (PHI)
337
Sensitive personally identifiable information (SPII)
A specific type of PII that falls under stricter handling guidelines
338
Separation of duties
The principle that users should not be given levels of authorization that would allow them to misuse a system
339
Session
a sequence of network HTTP requests and responses associated with the same user
340
Session cookie
A token that websites use to validate a session and determine how long that session should last
341
Session hijacking
An event when attackers obtain a legitimate user’s session ID
342
Session ID
A unique token that identifies a user and their device while accessing a system
343
Set data
Data that consists of an unordered collection of unique values
344
Shared responsibility
The idea that all individuals within an organization take an active role in lowering risk and maintaining both physical and virtual security
345
Shell
The command-line interpreter
346
Signature
A pattern that is associated with malicious activity
347
Signature analysis
A detection method used to find events of interest
348
Simple Network Management Protocol (SNMP)
A network protocol used for monitoring and managing devices on a network
349
Single sign-on (SSO)
A technology that combines several different logins into one
350
Smishing
The use of text messages to trick users to obtain sensitive information or to impersonate a known source
351
Smurf attack
A network attack performed when an attacker sniffs an authorized user’s IP address and floods it with ICMP packets
352
Social engineering
A manipulation technique that exploits human error to gain private information, access, or valuables
353
Social media phishing
A type of attack where a threat actor collects detailed information about their target on social media sites before initiating the attack
354
Spear phishing
A malicious email attack targeting a specific user or group of users, appearing to originate from a trusted source
355
Speed
The rate at which a device sends and receives data, measured by bits per second
356
Splunk Cloud
A cloud-hosted tool used to collect, search, and monitor log data
357
Splunk Enterprise
A self-hosted tool used to retain, analyze, and search an organization's log data to provide security information and alerts in real-time
358
Spyware
Malware that’s used to gather and sell information without consent
359
SQL (Structured Query Language)
A programming language used to create, interact with, and request information from a database
360
SQL injection
An attack that executes unexpected queries on a database
361
Stakeholder
An individual or group that has an interest in any decision or activity of an organization
362
Standard error
An error message returned by the OS through the shell
363
Standard input
Information received by the OS via the command line
364
Standard output
Information returned by the OS through the shell
365
Standards
References that inform how to set policies
366
STAR method
An interview technique used to answer behavioral and situational questions
367
Stateful
A class of firewall that keeps track of information passing through it and proactively filters out threats
368
Stateless
A class of firewall that operates based on predefined rules and that does not keep track of information from data packets
369
Stored XSS attack
An instance when malicious script is injected directly on the server
370
String concatenation
The process of joining two strings together
371
String data
Data consisting of an ordered sequence of characters
372
Style guide
A manual that informs the writing, formatting, and design of documents
373
Subnetting
The subdivision of a network into logical groups called subnets
374
Substring
A continuous sequence of characters within a string
375
Sudo
A command that temporarily grants elevated permissions to specific users
376
Supply-chain attack
An attack that targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed
377
Suricata
An open-source intrusion detection system, intrusion prevention system, and network analysis tool
378
Switch
A device that makes connections between specific devices on a network by sending and receiving data between them
379
Symmetric encryption
The use of a single secret key to exchange information
380
Synchronize (SYN) flood attack
A type of DoS attack that simulates a TCP/IP connection and floods a server with SYN packets
381
Syntax
The rules that determine what is correctly structured in a computing language
382
Syntax error:
An error that involves invalid usage of a programming language
383
Tailgating
A social engineering tactic in which unauthorized people follow an authorized person into a restricted area
384
TCP/IP model
A framework used to visualize how data is organized and transmitted across a network
385
tcpdump
A command-line network protocol analyzer
386
Technical skills
Skills that require knowledge of specific tools, procedures, and policies
387
Telemetry
The collection and transmission of data for analysis
388
Threat
Any circumstance or event that can negatively impact assets
389
Threat actor:
Any person or group who presents a security risk
390
Threat hunting
The proactive search for threats on a network
391
Threat intelligence
Evidence-based threat information that provides context about existing or emerging threats
392
Threat modeling
The process of identifying assets, their vulnerabilities, and how each is exposed to threats
393
Transferable skills
Skills from other areas that can apply to different careers
394
Transmission Control Protocol (TCP)
An internet communication protocol that allows two devices to form a connection and stream data
395
Triage
The prioritizing of incidents according to their level of importance or urgency
396
Trojan horse
Malware that looks like a legitimate file or program
397
True negative
A state where there is no detection of malicious activity
398
True positive
An alert that correctly detects the presence of an attack
399
Tuple data
Data structure that consists of a collection of data that cannot be changed
400
Type error
An error that results from using the wrong data type
401
Ubuntu
An open-source, user-friendly distribution that is widely used in security and other industries
402
Unauthorized access
An incident type that occurs when an individual gains digital or physical access to a system or application without permission
403
Uncontrolled zone
Any network outside your organization's control
404
Unified Extensible Firmware Interface (UEFI)
A microchip that contains loading instructions for the computer and replaces BIOS on more modern systems
405
USB baiting
An attack in which a threat actor strategically leaves a malware USB stick for an employee to find and install to unknowingly infect a network
406
User
The person interacting with a computer
407
User Datagram Protocol (UDP)
A connectionless protocol that does not establish a connection between devices before transmissions
408
User-defined function
A function that programmers design for their specific needs
409
User interface
A program that allows the user to control the functions of the operating system
410
User provisioning
The process of creating and maintaining a user's digital identity
411
Variable
A container that stores data
412
Virtual machine (VM)
A virtual version of a physical computer
413
Virtual Private Network (VPN)
A network security service that changes your public IP address and hides your virtual location so that you can keep your data private when you are using a public network like the internet
414
Virus
Malicious code written to interfere with computer operations and cause damage to data and software
415
VirusTotal
A service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content
416
Vishing
The exploitation of electronic voice communication to obtain sensitive information or to impersonate a known source
417
Visual dashboard
A way of displaying various types of data quickly in one place
418
Vulnerability
A weakness that can be exploited by a threat
419
Vulnerability assessment
The internal review process of an organization's security systems
420
Vulnerability management
The process of finding and patching vulnerabilities
421
Vulnerability scanner
Software that automatically compares existing common vulnerabilities and exposures against the technologies on the network
422
Watering hole attack
A type of attack when a threat actor compromises a website frequently visited by a specific group of users
423
Web-based exploits
Malicious code or behavior that’s used to take advantage of coding flaws in a web application
424
Whaling
A category of spear phishing attempts that are aimed at high-ranking executives in an organization
425
Wide Area Network (WAN)
A network that spans a large geographic area like a city, state, or country
426
Wi-Fi Protected Access (WPA)
A wireless security protocol for devices to connect to the internet
427
Wildcard
A special character that can be substituted with any other character
428
Wireshark
An open-source network protocol analyzer
429
World-writable file
A file that can be altered by anyone in the world
430
Worm
Malware that can duplicate and spread itself across systems on its own
431
YARA-L
A computer language used to create rules for searching through ingested log data
432
Zero-day
An exploit that was previously unknown
