General Flashcards
(267 cards)
1
Q
Apache log file path
A
/var/log/httpd/access_log
2
Q
/var/log/httpd/access_log
A
This file records all requests processed by the Apache server
3
Q
httpd_log
A
Log file for WebSphere, an old web server application from the early 2000’s for z/OS
4
Q
http_log
A
C header library for http logging, utilized by Apache
5
Q
apache_log
A
Binary/executable file used for parsing Apache logs in a Postgres DB
6
Q
The incident response policy contains procedures and guidelines, divided into these categories
A
- Preparation
- Detection/Analysis
- Containment
- Eradication/Recovery
- Post-incident stages
7
Q
Incident Response Procedures
A
Provide detailed, tactical information to the CSIRT
8
Q
CSIRT
A
Cybersecurity Incident Response Team
9
Q
A Policy is
A
a statement of intent
10
Q
A Guideline is
A
A statement by which to determine a course of action, aiming to streamline a routine process
11
Q
A Framework is
A
A basic structure underlying a system, concept, or text
12
Q
Mimikatz
A
Post-exploitation tool that dumps passwords from memory, as well as hashes, PINs, and Kerberos tickets
13
Q
Tool for performing pass-the-hash, pass-the-ticket, or building Golden Kerberos tickets
A
Mimikatz
14
Q
Extensible Configuration Checklist Description Format (XCCDF)
A
XCCDF is a specification language for writing security checklists, benchmarks, and related kinds of documents in XML.
15
Q
Common Vulnerabilities and Exposures (CVE)
A
Provides a reference-method for publicly known information-security vulnerabilities and exposures
16
Q
Common Configuration Enumeration (CCE)
A
Provides unique identifiers to system configuration issues to facilitate fast and accurate correlation of configuration data across multiple information sources and tools
Used with vulnerability scanners
17
Q
Common Platform Enumeration (CPE)
A
A structured naming scheme for IT systems, software, and packages
18
Q
Used to identify an endpoint’s characteristics when conducting network authentication
A
Network Access Control (NAC)
19
Q
Port Security
A
Enables an administrator to configure individual switch ports to allow only a specified number of source MAC addresses ingressing the port
20
Q
Shellshock/Bash Bug/Bashdoor
A
A critical Bash vulnerability that was discovered in 2014 that enabled RCE by encoding a script in an environment variable via the “function export” feature
21
Q
Logjam
A
A TLS downgrade attack, discovered in 2015
22
Q
Drupalgeddon
A
A highly critical Drupal vulnerability discovered in 2014 that allows RCE
23
Q
Stagefright
A
A critical Android vulnerability that enables RCE by utilizing Multimedia Messages (MMS), discovered in 2015
24
Q
Heartbleed
A
A high severity vulnerability in OpenSSL effecting the TLS protocol via improperly handled Heartbeat Extension packets (bad input validation), causing a “buffer-over-read” condition that allows the retreival of sensitive information in process memory
25
Root Cause Analysis
Helps understand why important alerts were missed and guides improvements in your alert management system to prevent similar oversights
26
Alert Fatigue
A common cause of missed security alerts, due to a security team being inundated with an excessive volume of alerts
27
CVSS Metric - AV
Access Vector
28
CVSS Metric - AC
Access Complexity
29
CVSS Metric - PR
Privilege Required
30
CVSS Metric - UI
User Interaction
31
CVSS Metric - S
Scope
32
CVSS Metric - C
Confidentiality
33
CVSS Metric - I
Integrity
34
CVSS Metric - A
Availability
35
Nmap Filtered Result
A network obstacle is blocking the port so Nmap cannot tell whether it is open or closed
36
Gramm-Leach-Bliley Act (GLBA)
Protects the privacy of an individual's financial information held by financial institutions
37
Sarbanes-Oxley Act (SOX)
Dictates requirements for retaining documents related to an organization's financial and business operations
38
Security framework that assumes a unidirectional workflow
Lockheed Martin Cyber Killchain; Fails to consider attacker retreat
39
Attack framework developed in response to unidirectional workflows
AT&T Alienvault
40
Best security mitigation for ICS/SCADA and IoT networks
User Entity Behavioral Analysis (UEBA) to compare behavior to a known good baseline
41
Sensitive/Commonly Abused Ports
53 (DNS)
42
Advanced Persistent Threat (APT)
A stealthy threat actor, typically a nation-state or state-sponsored, that can remain undetected for an extended period of time
EUBA unlikely to detect this kind of threat actor, should be discovered through endpoint analysis
43
Regex \b
Delimiter for a "whole word"
44
Developed Capabilities (MITRE)
A threat actor's capability to identify and exploit zero-day vulnerabilities
45
Acquired and Augmented (MITRE)
Refers to the utiliation of commodity malware and techniques (aka script kiddies)
46
Advanced Capabilities (MITRE)
A threat actor's capability to introduce vulnerabilities through the supply chain attacks
47
Integrated Capabilities (MITRE)
Refers to non-cyber tools, such as political or military assets
48
Formal Verification Methods
A mathematical model of the inputs and outputs of a system to prove that the system works as specified in all cases
Provides the single greatest mitigation for critical software which cannot have errors (corner cases)
49
User Acceptance Testing (UAT)
A beta phase of software testing by a limited set of users who report their findings
50
eFUSE
Intel-designed mecahnism to allow software instructions to blow a transistor in the hardware chip.
eFUSE prevents firmware downgrades
51
FERPA
Family Education Rights and Privacy Act
Privacy act that relates to Education
52
Dynamic Threat Models
Diamond, MITRE ATT&CK, AT&T Alienvault
53
Open Web Application Security Project (OWASP)
International non-profit organization dedicated to web application security
54
NetBIOS
A legacy transport layer protocol that allows Windows computers to talk to eachother on the same network, and was used as a legacy implementation of SMB on port 139
55
LPR (Protocol)
Line Printer Remote Protocol (TCP 515)
56
AppSocket (RAW)
Non Windows printing protocol
Utilizes smaller packet headers and requires no further processing by the receiving printer
Offers no security and very vulnerable
Port 9100
57
Internet Printing Protocol (IPP) supports
Authentication, access control, and encryption
58
Proprietary ISO Framework
27001
59
Security Intelligence
Collects, analyzes and disseminates information on the status of security systems (internal)
60
Cyber Threat Intelligence
Investigation, collection and dissemination of information about emerging threats and the threat landscape (external)
61
Cisco Talos
A reputational threat research intelligence supplier
62
Information Sharing and Analysis Centers (ISAC)
(USA) Not-for-profit group set up to share sector-specific threat intelligence and security best practices amongst its members. ISACs are available for Critical Infrastructure, Government, Healthcare and other industries.
63
Cyber Security Information Sharing Partnership (CSIP)
The UK's alternative to USA's ISACs
64
Indicator of Attack
Evidence that an intrusion is ongoing
65
Indicator of Compromise
Evidence that an attack has happened
66
Behavioral Threat Research
Refers to the correlation of IoCs into attack patterns (killchain)
67
STIX
Structured Threat Information eXpression
68
Structured Threat Information Expression
Language standard for the dissemination of IOC data via JSON included in the OASIS CTI framework
69
TAXII
Trusted Automation eXchange of Indicator Information
70
Trusted Automation eXchange of Indicator Information (TAXII)
Application protocol for exchanging CTI over HTTPS using a REST API
71
OpenIOC
CTI framework developed by Mandiant of XML formatted data to be used in automated incident detection and threat analysis
72
MISP
Malware Information Sharing Project
73
CTI
Cyber Threat Intelligence
74
Adversary Capability
A formal classification of the resources and expertise available to a particular threat actor (ie. Acquired or Augmented tools)
75
Attack Surface
The point at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor
76
Attack Vector
A specific path by which a threat actor gain unauthorized access to a system
77
Google Hacking
Open-source intelligence technique that use Google search operators to locate vulnerable web servers and applications. The Google Hacking Database contains a reference for optimized GH search strings aka "Dorks".
78
Shodan
A search engine optimized for identifying vulnerable internet-attached devices
79
AbuseIPDB
Community-driven database that keeps track of IP addresses reported for abusive behavior
80
NetFlow
Cisco-developed means of reporting network flow information and metadata to a structured database
81
Zeek (Bro)
Open source IDS/IPS for UNIX/Linux that contains a scripting engine that can be used to act on significant events by generating an alert or executing a process
82
Domain Generation Algorithm (DGA)
Method used by malware to evade block lists by dynamically generating domain names for C2 networks, primarily used in a "Fast Flux Network" and usually generates a high volume of NXDOMAIN errors.
83
Mitigating DGA
Use Secure Recursive DNS Resolvers
84
Fast Flux Network
Method used by malware to hide the presence of C2 networks by continually changing the host IP addresses in domain records using domain generation algorithms
85
Blinding Attack
Condition that occurs when a firewall is under-resourced and cannot log data fast enough, therefore some data is missed
86
Firewalking
A firewall enumeration technique that sends packets with a TTL of 1 to a variety of ports in an attempt to identify hosts behind an open port
87
Black Hole
Means of mitigating DoS or intrusion attacks by routing traffic to a null interface, effectively dropping the traffic
88
Sinkhole
DoS attack mitigation strategy that directs the traffic that is flooding a target IP address to a different network for analysis
89
Dark Nets
Unused physical network ports or unused IP address space within a local network often used by attackers
90
Forward Proxy
A server that receives traffic and sends (forwards) it to another network. Can filter or modify data in the process of forwarding.
91
Reverse Proxy
A type of proxy server that protects servers from direct contact with client requests
92
Non-Transparent Proxy
A type of proxy that requires explicit clientside configuration that a user is generally aware of
93
Transparent Proxy (Forced or Intercepting Proxy)
A proxy server that redirects requests and responses without the client being explicitly configured to use it
94
Web Application Firewall (WAF)
A firewall designed specifically to protect software running on webservers and their backend databases from code injection and DoS attacks
95
Snort
IDS or IPS/SIEM
96
Security Onion
Open source Linux-based platform for security monitoring, incident response, and threat hunting that bundles Snort, Suricata, Zeek, Wireshark and NetworkMiner, and other log and incident management tools
97
Port Security
Security measures applied to physical or logical ports on a networked device
98
Endpoint Security Hybrid Products
Advanced Threat Protection (ATP), Advanced Endpoint Protection (AEP), NextGen AV (NGAV)
99
FLARE VM
A malware analysis sandbox for Windows binaries
100
Cuckoo
Malware analysis VM for Linux, Windows and Mac binaries
101
Joe Sandbox
Malware sandbox tool that performs some automated malware classification and accepts Windows, Linux, Mac and Android binaries
102
File Signature (Magic Number)
The first two bytes of a binary header that indicates its file type. FileSignatures.net serves as a resource for information on Magic Numbers.
103
MZ
The first two bytes of an executable binary, AKA MZ in ASCII.
104
Packed Program/Program Packer
An executable self-extracting archive
105
Masquerading
Replaces a genuine executable with a malicious one
106
DLL Sideloading
Exploits a programs manifest to load a malicious DLL at runtime
107
Process Hollowing
Dropper starts a process in a suspended state and rewrites the memory locations for the program with malware code
108
Shellcode
Any lightweight code designed to run an exploit on a target
109
Yara
Program for identifying, classifying and describing malware samples. Commonly used for analyzing pcaps against Yara rules.
110
MAEC Scheme (Malware Attribute Enumeration and Characterization Scheme)
A standardized language for sharing structured information about malware that is copmlementary to STIX and TAXII to improve the automated sharing of threat intelligence
111
MUA (Software)
Mail User Agent
112
MDA
Mail Delivery Agent
113
MTA (Email)
Message Transfer Agent
114
MIME
Multipurpose Internet Mail Extensions
115
Multipurpose Internet Mail Extensions (MIME)
Allows a body of an email to support different formats, such as HTML, RTF, encoded binary and attachments
116
MIME Exploit
Message data that contains scripts or objects that target some vulnerability in the message client
117
Secure MIME (S/MIME)
Email encryption standard that adds digital signatures and public key cryptography to traditional MIME communications
118
SPF
Sender Policy Framework
119
Sender Policy Framework (SPF)
Single DNS record identifying hosts authorized to send mail for the domain that can include other SPF records (Ex: TXT @ v=spf1 mx include:_spf.google.com include:email.domain.com -all)
120
DKIM
DomainKeys Identified Mail
121
DomainKeys Identified Mail (DKIM)
Provides a cryptgoraphic authentication mechanism for mail utilizing a public key published as DNS record, performed serverside (Ex: v=DKIM1;k=rsa;p=PublicKeyGoesHere)
122
DMARC
Domain-Based Message Authentication, Reporting and Conformance
123
Domain-Based Message Authentication, Reporting and Conformance (DMARC)
Framework for ensuring proper application of SPF and DKIM utilizing a policy published as a DNS record (Ex: v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:user@ex.domain.tld; ruf=mailto:user@ruf.domain.tld; fo=1)
124
Security Information and Event Management Systems (SIEM)
A solution that provides real time or near real time analysis of security alerts generated by network hardware and appliances
125
Normalization
Process where data is reformatted or restructured to facilitate the scanning and analysis process
126
find/findstr
Windows alternative to grep
127
Windows Management Instrumentation Command-Line (WMIC)
CLI for the administration of Windows systems using WMI, often used for reviewing log files on a remote machine
128
EnCase
Digital forensics case management suite that provides workflows to assist in investigations
129
Forensic Toolkit (FTK)
Digital forensics investigation suite for Windows which can utilize server clustering for faster processing speeds
130
Sleuth Kit
Commandline utilities for imaging and file analysis that interfaces with Autopsy
131
File Carving
The process of extracting data from a computer when that data has no associated file system metadata
132
Master File Table
A table that contains metadata with the location of each file in terms of blocks/clusters for disks formatted as NTFS (FAT uses a File Allocation Table instead)
133
Scalpel
Open source CLI tool included in Sleuth Kit/Autopsy that is used to conduct file carving on Linux and Windows
134
Covert Channel
An IOC where data is transmitted with a hidden element, such as non standard data inside of a ping packet
135
DRDoS
Distributed Reflection DoS
136
Beaconing
Means for a network node to advertise its presence and establish a link with other nodes, often seen in specified intervals
137
Slashdot Effect
When a website experiences DoS conditions due to sudden popularity
138
ARP Spoofing/Poisoning
Occurs when an attacker redirects an IP to a MAC that was not its intended destination, best remediated by an IDS
139
Footprinting
Phase of an attack or penetration test in which the attacker or tester gathers information about the target before attacking it
140
IANA Dynamic Ports
49,152 - 65,535
141
Overt Channel Exfiltration
The usage of commonly used programs to exfiltrate data, such as IM, SMS, Email, FTP or P2P programs
142
Covert Channel Exfiltration
The exfiltration of data using covert techniques such as data segmentation, obfuscation and encoding, with the aim of evading detection
143
pstree
Linux command that provides the parent/child relationship of all the processes on a system
144
ps
Linux command that lists the attributes of all the current processes
145
systemd
A Linux Init daemon
146
SO (Shared Library)
Linux equivalent of a DLL
147
Memory Overflow
A means of exploiting a vulnerability in an application to execute arbitrary code or to crash the process with a memory leak
148
Prefetch File
A file that records the names of applications that have been run, as well as the date and time, file path, run count and DLLs used by the executable
149
Shimcache
An application usage cache that is stored in the Registry as the key. (Ex. HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache) Often used for applications that require specialized compatibility settings.
150
Amcache
An application usage cache that is stored as a hive file (Ex. C:\Windows\appcompat\Programs\Amcache.hve)
151
Persistence
The ability of a threat actor to maintain covert access to a target host or network
152
crontab
Tool that manages cron jobs, the Linux equivalent of scheduled tasks. "crontab -l" lists the currently scheduled cron jobs
153
Cellebrite
Software for evidence extraction from smartphones and other mobile devices, cloud data and metadata using a universal forensic extraction device (UFED)
154
Mobile Phone Examiner Plus (MPE+)
Mobile device forensics tools created by AccessData, the developers of FTK
155
EnCase Portable
Mobile device forensics tool created by Guidance Software, the developers of EnCase
156
Pivoting
Using an infected host to attack another host (Using SSH with the -D flag, you can set up a local proxy and port forwarding on a target)
157
Pass the Hash
Network based attack where the attacker steals hashed user credentials and uses them as is to try to authenticate to the same network the hashed credentials originated on. Only use Domain Admin accounts for logging into Domain Controllers to prevent pass the hash exploits
158
Golden Ticket
A Kerberos ticket that can grant other tickets in an Active Directory environment (AKA TGT). Admins should regularly change the krbtgt account password.
159
krbtgt hash
The trust anchor of the AD domain which functions like a private key of a RCA (root cert authority) and generates ticket-granting tickets (TGT) that are used by users to access services within Kerberos
160
Business Continuity Plan (BCP)
The plans and processes used during the response to a disruptive event
161
Disaster Recovery Plan (DRP)
The plans used during the event of a disaster
162
Tabletop Exercise
An exercise that tests a framework of controls using an incident scenario conducted by a "red team"
163
OODA Loop
A military decision making model created to help responders think clearly in the "fog of war", consisting of Observe, Orient, Decide and Act
164
Isolation Mitigation
Removes an affected component from a larger environment
165
Segmentation Mitigation
Achieves the isolation of a host or group of hosts using network technologies and architecture
166
Sanitization
Group of procedures that an organization uses to govern the disposal of obsolete information and equipment
167
Enterprise Risk Management (ERM)
The comprehensive process of evaluating, measuring, and mitigating the many risks that pervade an organization, usually as defined by business stakeholders rather than engineers
168
Single Loss Expectancy (SLE)
Metric to determine the expected financial loss from a single event. SLE = AV * EF, (Asset Value * Exposure Factor)
169
AV (Risk Analysis)
Asset Value, Monetary value of the asset
170
EF (Risk Analysis)
Exposure Factor, The percentage of loss that would result
171
Annual Rate of Occurence (ARO)
Number of times per year that a specific threat is expected to occur
172
Annual Loss Expectancy (ALE)
Expected financial loss for multiple events during a year
173
Business Impact Analysis (BIA)
A systemic activity that identifies organizational risks and determines their effect on ongoing mission critical operations
174
Maximum Tolerable Downtime (MTD)
The longest period of time a business can be inoperable without causing irrevocable business failure
175
Recovery Time Objective (RTO)
Length of time it takes after an event to resume normal business operations and activities
176
Work Recovery Time (WRT)
The length of time in addition to the RTO of individual systems to perform reintegration and testing of a restored or upgraded system
177
Recovery Point Objective (RPO)
The longest period of time that an organization can tolerate lost data being unrecoverable
178
Risk transference
Response that involves moving or sharing the responsibility of a risk to another entity, usually involving insurance
179
Risk mitigation
Response that reduces a risk to fit within an organization's risk appetite
180
Risk avoidance
Ceasing an activity that presents risk
181
Risk Register
Document highlighting the results of risk assessments in an easily comprehensible format that is disseminated to stakeholders
182
CVSS Base Score 9+
Critical
183
CVSS Base Score 7-8.x
High
184
CVSS Base Score 4-6.x
Medium
185
CVSS Base Score 0.x-3.x
Low
186
CVSS Base Score 0
None
187
tcpdump -e
Includes the ethernet header during packet capture.
188
tcpdump -n
Displays the IP addresses in numeric form
189
tcpdump -l
Line buffered mode
190
tcpdump -C
Packet buffered mode
191
tcpdump port
Listen only on a specified port
192
tcpdump -A
Print each packet in ASCII
193
tcpdump -s
Set snap length (0 for unlimited, all traffic)
194
tcpdump -B
Set buffer size
195
tcpdump -c
Limit captured packets to provided value (e.g. 20 packets)
196
tcpdump Logical Operators
"AND", &&, "OR", ||, "NOT", !
197
Continuous Integration
Automated building and testing of an application after it's source code has been updated
198
Continuous Delivery
Delivers the newest version of an application to a production or testing environment, which can then be approved for release by a human
199
Continuous Deployment
All changes to code that pass CI/CD checks are automatically released without the need for human intervention
200
Continuous Monitoring
Constant evaluation of an environment for changes to quickly detect new risks and improve business operations
201
Data Sampling
Captures specified data that is determined to be useful, rather than collecting all data
202
SSL vs TLS
TLS was developed in 1999 as SSLv3.1 before being renamed to TLS and the two terms are often used interchangably although SSL is not considered to be secure
203
Nikto
Web application scanner
204
OpenVAS
Infrastructure vulnerability scanner
205
Nessus
Infrastructure vulnerability scanner
206
Qualys
Infrastructure vulnerability scanner
207
Output Encoding
Translates special characters into an encoded form that isn't dangerous to the target system (Ex: < to < in HTML)
208
Input Validation
Ensures data entering a system is formatted as expected
209
Defense In Depth
Layering various technical controls to further secure infrastructure
210
Base64 Encoding
Commonly used to bypass detection mechanisms in a network, and will commonly end with two equal signs (Ex. aGVsbG8gd29ybGQNCg==)
211
Windows Autostart Registry Location
Run Subkey (HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\CurrentVersion\Run)
212
nmap -sT
TCP connect scan
213
nmap -sV
Service discovery scan
214
nmap -Pn
Scan ports, no ping
215
nmap -p
Scan port or port range
216
nmap -p-
Scan all ports on system
217
nmap -F
Fast port scan
218
nmap -sS
Syn Port Scan, Only performs a partial connection and thus does not reveal you to your target
219
nmap -sT
TCP Connect Scan, Detects open TCP ports
220
nmap -sU
UDP Port Scan, Detects open UDP ports
221
nmap -sA
Ack Port Scan, Detects if a port is stateful and/or filtered
222
nmap -sn
Performs host discovery but does not scan any ports (use for quick scans)
223
nmap -PR
Performs ARP discovery on a local network
224
nmap -n
Does not resolve DNS, speeds up some scans
225
nmap -A
Aggression Detection Mode, which is a combination of OS and service discovery
226
nmap -O
OS Detection
227
nmap -oN
Output Normal
228
nmap -oX
Output XML
229
nmap -oG
Output Greppable
230
nmap -oA
Output All (types)
231
Password Spraying
When an attacker uses a common password(s) to attempt to access multiple accounts
232
Credential Stuffing
The automated injection of stolen username and password pairs (credentials) to an authentication system
233
Ring 0
Kernel
234
Ring 1
Device Drivers (Most privileged)
235
Ring 2
Device Drivers (Less privileged)
236
Ring 3
Applications
237
Secure Disposal
A method of sanitizing by physical destruction of the media via shredding, incineration or degaussing
238
Clearing involves
Overwriting data once with repetitive data, or resetting a device to factory settings
239
Purging involves
Eliminating information from being feasibly recovered even in a laboratory environment
240
DeepScan
Static code analyzer
241
Tripwire
File integrity monitoring program
242
OAuth2 is designed to
Authenticate claims, not to authenticate users. It's a standard designed to allow a website or application to access resources hosted by other web apps on behalf of a user.
243
OpenID Connect (OIDC)
OIDC is an identity authentication protocol that is an extension of open authorization (OAuth) 2.0 to standardize the process for authenticating and authorizing users when they sign in to access digital services.
244
DGA
Domain Generation Algorithm
245
SCAP
Security Content Automation Protocol
246
Security Content Automation Protocol (SCAP)
A method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation of systems deployed in an organization
247
TOGAF
The Open Group Architecture Framework
248
The Open Group Architecture Framework (TOGAF)
A prescriptive framework that divides the enterprise architecture into four domains: Technical, Business, Applications and Data
249
Regression Testing
Re-running functional and non-functional tests to ensure that previously developed and tested software still performs after a change
250
Linux command to find bash version
which bash
251
NIST recommendations on SMS multi-factor
NIST’s SP 800-63-3 recommends SMS be depreciated for MFA, as it may be accessible to attackers
252
MacOS Application Config File Format
Property Lists (plists)
253
net config
Used to manage network resources
254
net group
Used to manage domain groups
255
net computer
Adds or removes a computer from a domain (ran on primary DC)
256
ZAP
OWASP Zed Attack Proxy
257
OWASP Zed Attack Proxy (ZAP)
The worlds most popular FOSS web application scanner
258
sc
Windows Scheduler command
259
/etc/xinetd.conf
Older location for Linux startup services configuration. Potential location for evidence of a backdoor.
260
Why are FPGAs often considered as "Anti-Tamper"
FPGAs are often used to provide "Physically Unclonable Functions" (PUFs) that generate a digital fingerprint based on unique features of a device
261
XXE
XML External Entity
262
XML External Entity (XXE)
Type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
263
UEFI Boot Phase Order
1. Security
2. Pre-EFI initialization
3. Driver Execution Environment
4. Boot Device Select
5. Transient System Load
6. Runtime
264
Identity Provider (IdP)
Validates a user's identity when using SAML for authentication
265
Relying Party (RP)
Provide services to members of a federation (SAML)
266
FISMA
Federal Information Security Management Act
267
Federal Information Security Management Act (FISMA)
United States federal law that defines a comprehensive framework to protect government information, operations, and assets (Compliance)
