Google Cyber Security - Glossary - All Flashcards
1
Q
The full file path, which starts from the root
A
Absolute file path
2
Q
Security controls that manage access, authorization, and accountability of information
A
Access controls
3
Q
A type of attack where data packets are manipulated in transit
A
Active packet sniffing
4
Q
A network protocol used to determine the MAC address of the next router or device on the path
A
Address Resolution Protocol (ARP)
5
Q
An instance when a threat actor maintains unauthorized access to a system for an extended period of time
A
Advanced persistent threat (APT)
6
Q
A technique that manipulates artificial intelligence (AI) and machine learning (ML) technology to conduct attacks more efficiently
A
Adversarial artificial intelligence (AI)
7
Q
A type of legitimate software that is sometimes used to display digital advertisements in applications
A
Adware
8
Q
A set of rules used to solve a problem
A
Algorithm
9
Q
The investigation and validation of alerts
A
Analysis
10
Q
A technique where attackers impersonate customer service representatives on social media
A
Angler phishing
11
Q
A detection method that identifies abnormal behavior
A
Anomaly-based analysis
12
Q
A software program used to prevent, detect, and eliminate malware and viruses
A
Antivirus software
13
Q
A program that performs a specific task
A
Application
14
Q
A small block of encrypted code that contains information about a user
A
Application programming interface (API) token
15
Q
Specific information needed by a command
A
Argument (Linux)
16
Q
The data brought into a function when it is called
A
Argument (Python)
17
Q
A data type that stores data in a comma-separated ordered list
A
Array
18
Q
The fifth step of the NIST RMF that means to determine if established controls are implemented correctly
A
Assess
19
Q
An item perceived as having value to an organization
A
Asset
20
Q
The practice of labeling assets based on sensitivity and importance to an organization
A
Asset classification
21
Q
A catalog of assets that need to be protected
A
Asset inventory
22
Q
The process of tracking assets and the risks that affect them
A
Asset management
23
Q
The use of a public and private key pair for encryption and decryption of data
A
Asymmetric encryption
24
Q
All the potential vulnerabilities that a threat actor could exploit
A
Attack surface
25
A diagram that maps threats to assets
Attack tree
26
The pathways attackers use to penetrate security defenses
Attack vectors
27
The process of verifying who someone is
Authentication
28
The concept of granting access to specific resources in a system
Authorization
29
The sixth step of the NIST RMF that refers to being accountable for the security and privacy risks that might exist in an organization
Authorize
30
The use of technology to reduce human and manual effort to perform common and repetitive tasks
Automation
31
The idea that data is accessible to those who are authorized to access it
Availability
32
A social engineering tactic that tempts people into compromising their security
Baiting
33
The maximum data transmission capacity over a network, measured by bits per second
Bandwidth
34
A documented set of specifications within a system that is used as a basis for future builds, releases, and updates
Baseline configuration (baseline image)
35
The default shell in most Linux distributions
Bash
36
The technology used to establish a user’s request to access a server
Basic auth
37
A microchip that contains loading instructions for the computer and is prevalent in older systems
Basic Input/Output System (BIOS)
38
The unique physical characteristics that can be used to verify a person’s identity
Biometrics
39
The smallest unit of data measurement on a computer
Bit
40
Data that can only be one of two values: either True or False
Boolean data
41
A software program that boots the operating system
Bootloader
42
A collection of computers infected by malware that are under the control of a single threat actor, known as the “bot-herder"
Botnet
43
The indices placed in square brackets
Bracket notation
44
Inconsistencies in the collection and logging of evidence in the chain of custody
Broken chain of custody
45
The trial and error process of discovering private information
Brute force attack
46
Programs that encourage freelance hackers to find and report vulnerabilities
Bug bounty
47
A function that exists within Python and can be called directly
Built-in function
48
An organization's ability to maintain their everyday productivity by establishing risk disaster recovery plans
Business continuity
49
A document that outlines the procedures to sustain business operations during and after a significant disruption
Business continuity plan (BCP)
50
A type of phishing attack where a threat actor impersonates a known source to obtain financial advantage
Business Email Compromise (BEC)
51
The second step of the NIST RMF that is used to develop risk management processes and tasks
Categorize
52
An open-source distribution that is closely related to Red Hat
CentOS
53
A computer’s main processor, which is used to perform general computing tasks on a computer
Central Processing Unit (CPU)
54
The process of documenting evidence possession and control during an incident lifecycle
Chain of custody
55
A cloud-native tool designed to retain, analyze, and search data
Chronicle
56
An algorithm that encrypts information
Cipher
57
Software firewalls that are hosted by the cloud service provider
Cloud-based firewalls:
58
The practice of using remote servers, applications, and network services that are hosted on the internet instead of on local physical devices
Cloud computing
59
A collection of servers or computers that stores resources and data in remote data centers that can be accessed via the internet
Cloud network
60
The process of ensuring that assets stored in the cloud are properly configured and access to those assets is limited to authorized users
Cloud security
61
An instruction telling the computer to do something
Command
62
The techniques used by malicious actors to maintain communications with compromised systems
Command and control (C2)
63
A text-based user interface that uses commands to interact with the computer
Command-line interface (CLI)
64
A note programmers make about the intention behind their code
Comment:
65
A log format that uses key-value pairs to structure data and identify fields and their corresponding values
Common Event Format (CEF)
66
An openly accessible dictionary of known vulnerabilities and exposures
Common Vulnerabilities and Exposures (CVE®) list
67
A measurement system that scores the severity of a vulnerability
Common Vulnerability Scoring System (CVSS)
68
The process of adhering to internal standards and external regulations
Compliance
69
A specialized group of security professionals that are trained in incident management and response
Computer security incident response teams (CSIRT)
70
Malicious code written to interfere with computer operations and cause damage to data and software
Computer virus
71
A statement that evaluates code to determine if it meets a specified set of conditions
Conditional statement
72
The idea that only authorized users can access specific assets or data
Confidentiality
73
Data that often has limits on the number of people who have access to it
Confidential data
74
A model that helps inform how organizations consider risk when setting up systems and security policies
Confidentiality, integrity, availability (CIA) triad
75
A file used to configure the settings of an application
Configuration file
76
The act of limiting and preventing additional damage caused by an incident
Containment
77
A subnet that protects the internal network from the uncontrolled zone
Controlled zone
78
An injection attack that inserts code into a vulnerable website or web application
Cross-site scripting (XSS)
79
The practice of gathering information using public input and collaboration
Crowdsourcing
80
Cryptographic attack: An attack that affects secure forms of communication between a sender and intended recipient
Cryptographic attack
81
A mechanism that decrypts ciphertext
Cryptographic key
82
The process of transforming information into a form that unintended readers can’t understand
Cryptography
83
A form of malware that installs software to illegally mine cryptocurrencies
Cryptojacking
84
An organization that volunteers to analyze and distribute information on eligible CVEs
CVE Numbering Authority (CNA)
85
The practice of ensuring confidentiality, integrity, and availability of information by protecting networks, devices, people, and data from unauthorized access or criminal exploitation
Cybersecurity (or security)
86
Information that is translated, processed, or stored by a computer
Data
87
Data not currently being accessed
Data at rest
88
An organized collection of information or data
Database
89
A person that determines the procedure and purpose for processing data
Data controller
90
Anyone or anything that’s responsible for the safe handling, transport, and storage of information
Data custodian
91
Unauthorized transmission of data from a system
Data exfiltration:
92
Data traveling from one point to another
Data in transit:
93
Data being accessed by one or more users
Data in use
94
The person who decides who can access, edit, use, or destroy their information
Data owner
95
A basic unit of information that travels from one device to another within a network
Data packet
96
A specific piece of information
Data point
97
A person that is responsible for processing data on behalf of the data controller
Data processor
98
An individual that is responsible for monitoring the compliance of an organization's data protection procedures
Data protection officer (DPO)
99
A category for a particular type of data item
Data type
100
Data representing a date and/or time
Date and time data
101
A software tool that helps to locate the source of an error and assess its causes
Debugger
102
The practice of identifying and fixing errors in code
Debugging
103
A layered approach to vulnerability management that reduces risk
Defense in depth
104
An attack that targets a network or server and floods it with network traffic
Denial of service (DoS) attack
105
A NIST core function related to identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections
Detect
106
The prompt discovery of security events
Detection
107
Data that consists of one or more key-value pairs
Dictionary data
108
A file that verifies the identity of a public key holder
Digital certificate
109
The practice of collecting and analyzing data to determine what has happened after an attack
Digital forensics
110
A file that organizes where other files are stored
Directory
111
A plan that allows an organization’s security team to outline the steps needed to minimize the impact of a security incident
Disaster recovery plan
112
A type of denial or service attack that uses multiple devices or servers located in different locations to flood the target network with unwanted traffic
Distributed denial of service (DDoS) attack
113
The different versions of Linux
Distributions
114
Any form of recorded content that is used for a specific purpose
Documentation
115
An instance when malicious script exists in the webpage a browser loads
DOM-based XSS attack
116
A networking protocol that translates internet domain names into IP addresses
Domain Name System (DNS)
117
Dropper: A program or a file used to install a rootkit on a target computer
Dropper
118
A brief summary of your experience, skills, and background
Elevator pitch
119
A process performed by a VPN service that protects your data by wrapping sensitive data in other data packets
Encapsulation
120
The process of converting data from a readable format to an encoded format
Encryption
121
Any device connected on a network
Endpoint
122
An application that monitors an endpoint for malicious activity
Endpoint detection and response (EDR)
123
The complete removal of the incident elements from all affected systems
Eradication
124
A set of actions that outline who should be notified when an incident alert occurs and how that incident should be handled
Escalation policy
125
An observable occurrence on a network, system, or device
Event
126
An error that involves code that cannot be executed even though it is syntactically correct
Exception
127
An operator that does not include the value of comparison
Exclusive operator
128
A way of taking advantage of a vulnerability
Exploit
129
A mistake that can be exploited by a threat
Exposure
130
Anything outside the organization that has the potential to harm organizational assets
External threat
131
A state where the presence of a threat is not detected
False negative
132
An alert that incorrectly detects the presence of a threat
False positive
133
Malware that does not need to be installed by the user because it uses legitimate programs that are already installed to infect a computer
Fileless malware
134
The location of a file or directory
File path
135
The component of the Linux OS that organizes data
Filesystem Hierarchy Standard (FHS)
136
Selecting data that match a certain condition
Filtering
137
Documentation that provides a comprehensive review of an incident
Final report
138
Firewall: A network security device that monitors traffic to or from a network
Firewall
139
Data consisting of a number with a decimal point
Float data
140
A column in a table that is a primary key in another table
Foreign key
141
A server that regulates and restricts a person’s access to the internet
Forward proxy server
142
A section of code that can be reused in a program
Function
143
A variable that is available through the entire program
Global variable
144
A user interface that uses icons on the screen to manage different tasks on the computer
Graphical user interface (GUI)
145
Any person or group who uses computers to gain unauthorized access to data
Hacker
146
A person who uses hacking to achieve a political goal
Hacktivist
147
A hardware component used for long-term memory
Hard drive
148
The physical components of a computer
Hardware
149
An instance when different inputs produce the same hash value
Hash collision
150
An algorithm that produces a code that can’t be decrypted
Hash function
151
A data structure that's used to store and reference hash values
Hash table
152
A U.S. federal law established to protect patients’ health information
Health Insurance Portability and Accountability Act (HIPAA)
153
A system or resource created as a decoy vulnerable to attacks with the purpose of attracting potential intruders
Honeypot
154
An application that monitors the activity of the host on which it’s installed
Host-based intrusion detection system (HIDS)
155
A network device that broadcasts information to every device on the network
Hub
156
An application layer protocol that provides a method of communication between clients and website servers
Hypertext Transfer Protocol (HTTP)
157
A network protocol that provides a secure method of communication between clients and website servers
Hypertext Transfer Protocol Secure (HTTPS)
158
A NIST core function related to management of cybersecurity risk and its effect on an organization’s people and assets
Identify:
159
A collection of processes and technologies that helps organizations manage digital identities in their environment
Identity and access management (IAM):
159
A set of standards that define communication for wireless LANs
IEEE 802.11 (Wi-Fi):
160
An object that cannot be changed after it is created and assigned a value
Immutable:
161
The fourth step of the NIST RMF that means to implement security and privacy plans for an organization
Implement:
162
An incident type that occurs when an employee of an organization violates the organization’s acceptable use policies
Improper usage:
163
An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies
Incident:
163
Observable evidence that suggests signs of a potential security incident
Indicators of compromise (IoC):
164
The process of identifying a potential security incident, triaging it, and handing it off to a more experienced team member
Incident escalation:
165
A form of documentation used in incident response
Incident handler’s journal:
166
An organization’s quick attempt to identify an attack, contain the damage, and correct the effects of a security breach
Incident response:
167
A document that outlines the procedures to take in each step of incident response
Incident response plan:
168
An operator that includes the value of comparison
Inclusive operator:
169
Space added at the beginning of a line of code
Indentation:
170
The practice of keeping data in all states away from unauthorized users
Information security (InfoSec):
170
The series of observed events that indicate a real-time incident
Indicators of attack (IoA):
170
A number assigned to every element in a sequence that indicates its position
Index:
171
The protection of unauthorized access and distribution of data
Information privacy:
172
Malicious code inserted into a vulnerable application
Injection attack:
173
Data consisting of a number that does not include a decimal point
Integer data:
174
Programming that validates inputs from users and other programs
Input validation:
175
The idea that the data is correct, authentic, and reliable
Integrity:
175
A software application for writing code that provides editing assistance and error correction tools
Integrated development environment (IDE):
176
The components required to run the computer
Internal hardware:
177
A current or former employee, external vendor, or trusted partner who poses a security risk
Internal threat:
178
An internet protocol used by devices to tell each other about data transmission errors across the network
Internet Control Message Protocol (ICMP):
179
A unique string of characters that identifies the location of a device on the internet
Internet Protocol (IP) address:
180
A type of DoS attack performed by an attacker repeatedly sending ICMP request packets to a network server
Internet Control Message Protocol flood (ICMP flood):
181
A set of standards used for routing and addressing data packets as they travel between devices on a network
Internet Protocol (IP):
182
A computer program that translates Python code into runnable instructions line by line
Interpreter:
183
An application that monitors system activity and alerts on possible intrusions
Intrusion detection system (IDS):
184
A network attack performed when an attacker changes the source IP of a data packet to impersonate an authorized system and gain access to a network
IP spoofing:
185
An application that monitors system activity for intrusive activity and takes action to stop the activity
Intrusion prevention system (IPS):
186
Code that repeatedly executes a set of instructions
Iterative statement:
187
The component of the Linux OS that manages processes and memory
Kernel:
187
An open-source distribution of Linux that is widely used in the security industry
KALI LINUX ™:
188
A set of data that represents two linked items: a key, and its corresponding value
Key-value pair:
188
A collection of modules that provide code users can access in their programs
Library:
189
An operating system that is outdated but still being used
Legacy operating system:
190
A meeting that includes all involved parties after a major incident
Lessons learned meeting:
191
An open-source operating system
Linux:
192
The concept of combining two lists into one by placing the elements of the second list directly after the elements of the first list
List concatenation:
193
Data structure that consists of a collection of data in sequential form
List data:
194
Malicious code that launches after a user initiates a dropper program
Loader:
195
A network that spans small areas like an office building, a school, or a home
Local Area Network (LAN):
195
A variable assigned within a function
Local variable:
196
The process of examining logs to identify events of interest
Log analysis:
197
A record of events that occur within an organization’s systems
Log:
198
The recording of events occurring on computer systems and networks
Logging:
198
The process of collecting, storing, analyzing, and disposing of log data
Log management:
199
An error that results when the logic used in code produces unintended results
Logic error:
200
The part of a loop that determines when the loop terminates
Loop condition:
201
A variable that is used to control the iterations of a loop
Loop variable:
202
Software designed to harm devices or networks
Malware:
202
Key technical attributes such as response time, availability, and failure rate, which are used to assess the performance of a software application
Metrics:
203
A unique alphanumeric identifier that is assigned to each physical device on a network
Media Access Control (MAC) address:
203
An incident type that occurs when malicious software designed to disrupt a system infiltrates an organization’s computers or network
Malware infection:
203
A function that belongs to a specific data type
Method:
204
A device that connects your router to the internet and brings internet access to the LAN
Modem:
204
A collection of non-profit research and development centers
MITRE:
205
A Python file that contains additional functions, variables, classes, and any kind of runnable code
Module:
205
The seventh step of the NIST RMF that means be aware of how systems are operating
Monitor:
206
A group of connected devices
Network:
206
A security measure that requires a user to verify their identity in two or more ways to access a system or network
Multi-factor authentication (MFA):
207
A command-line file editor that is available by default in many Linux distributions
nano:
208
A voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk
National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF):
208
A framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery, and Post-incident activity
National Institute of Standards and Technology (NIST) Incident Response Lifecycle:
209
A unified framework for protecting the security of information systems within the U.S. federal government
National Institute of Standards and Technology (NIST) Special Publication (S.P.) 800-53:
210
The data that’s transmitted between devices on a network
Network data:
210
An application that collects and monitors network traffic and network data
Network-based intrusion detection system (NIDS):
211
A tool designed to capture and analyze data traffic within a network
Network protocol analyzer (packet sniffer):
211
The process of examining network logs to identify events of interest
Network log analysis:
211
Hardware that connects computers to a network
Network Interface Card (NIC):
212
The practice of keeping an organization's network infrastructure secure from unauthorized access
Network security:
212
A set of rules used by two or more devices on a network to describe the order of delivery and the structure of data
Network protocols:
212
A security technique that divides the network into segments
Network segmentation:
213
The amount of data that moves across a network
Network traffic:
214
The concept that the authenticity of information can’t be denied
Non-repudiation:
215
An online interface for writing, storing, and running code
Notebook:
216
Data consisting of numbers
Numeric data:
217
A data type that stores data in a comma-separated list of key-value pairs
Object:
217
An open-standard authorization protocol that shares designated access between applications
OAuth:
218
An attack where a malicious actor places themselves in the middle of an authorized connection and intercepts or alters the data in transit
On-path attack:
219
The collection and analysis of information from publicly available sources to generate usable intelligence
Open-source intelligence (OSINT):
220
A standardized concept that describes the seven layers computers use to communicate and send data over the network
Open systems interconnection (OSI) model:
221
The interface between computer hardware and the user
Operating system (OS):
221
A non-profit organization focused on improving software security
Open Web Application Security Project (OWASP):
222
A symbol or keyword that represents an operation
Operator:
223
Input that modifies the behavior of a command
Options:
224
The practice of capturing and inspecting data packets across a network
Packet sniffing:
224
A sequence outlining the order of data that must be preserved from first to last
Order of volatility:
225
A globally recognized standard awareness document that lists the top 10 most critical security risks to web applications
OWASP Top 10:
226
A piece of software that can be combined with other packages to form an application
Package:
227
A tool that helps users install, manage, and remove packages or applications
Package manager:
228
A file containing data packets intercepted from an interface or network
Packet capture (P-cap):
229
An object that is included in a function definition for use in that function
Parameter (Python):
230
An open-source distribution that is commonly used for security
Parrot:
231
The process of converting data into a more readable format
Parsing:
232
A type of attack where a malicious actor connects to a network hub and looks at all traffic on the network
Passive packet sniffing:
233
An attempt to access password secured devices, systems, networks, or data
Password attack:
234
A software and operating system update that addresses security vulnerabilities within a program or product
Patch update:
235
Any cardholder data that an organization accepts, transmits, or stores
Payment Card Industry Data Security Standards (PCI DSS):
236
A simulated attack that helps identify vulnerabilities in systems, networks, websites, applications, and processes
Penetration test (pen test):
237
A resource that provides stylistic guidelines for programmers working in Python
PEP 8 style guide:
238
Hardware components that are attached and controlled by the computer system
Peripheral devices:
239
The type of access granted for a file or directory
Permissions:
240
The use of digital communications to trick people into revealing sensitive data or deploying malicious software
Phishing:
240
Any information used to infer an individual's identity
Personally identifiable information (PII):
241
A collection of software tools needed to launch a phishing campaign
Phishing kit:
242
A security incident that affects not only digital but also physical environments where the incident is deployed
Physical attack:
243
An attack in which a threat actor impersonates an employee, customer, or vendor to obtain unauthorized access to a physical location
Physical social engineering:
244
A type of DoS attack caused when a hacker pings a system by sending it an oversized ICMP packet that is bigger than 64KB
Ping of death:
245
A manual that provides details about any operational action
Playbook:
246
A set of rules that reduce risk and protect information
Policy:
247
A software-based location that organizes the sending and receiving of data between devices on a network
Port:
248
A firewall function that blocks or allows certain port numbers to limit unwanted communication
Port filtering:
249
The process of reviewing an incident to identify areas for improvement during incident handling
Post-incident activity:
250
A type of unwanted software that is bundled in with legitimate programs which might display ads, cause device slowdown, or install other software
Potentially unwanted application (PUA):
251
Information that should be kept from the public
Private data:
252
The first step of the NIST RMF related to activities that are necessary to manage security and privacy risks before a breach occurs
Prepare:
253
A column where every row has a unique entry
Primary key:
254
A coding technique that executes SQL statements before passing them on to a database
Prepared statement:
255
The concept of granting only the minimal access and authorization required to complete a task or function
Principle of least privilege:
256
The act of safeguarding personal information from unauthorized use
Privacy protection:
257
Step-by-step instructions to perform a specific security task
Procedures:
258
A popular threat modeling framework that’s used across many industries
Process of Attack Simulation and Threat Analysis (PASTA):
259
A process that can be used to create a specific set of instructions for a computer to execute tasks
Programming:
260
A NIST core function used to protect an organization through the implementation of policies, procedures, training, and tools that help mitigate cybersecurity threats
Protect:
261
Information that relates to the past, present, or future physical or mental health or condition of an individual
Protected health information (PHI):
262
The process of properly working with fragile and volatile digital evidence
Protecting and preserving evidence:
263
A server that fulfills the requests of its clients by forwarding them to other servers
Proxy server:
264
Data that is already accessible to the public and poses a minimal risk to the organization if viewed or shared by others
Public data:
265
An encryption framework that secures the exchange of online information
Public key infrastructure (PKI):
266
An extensive collection of Python code that often comes packaged with Python
Python Standard Library:
267
A request for data from a database table or a combination of tables
Query:
267
A file of pre-generated hash values and their associated plaintext
Rainbow table:
268
A type of baiting used to trick someone into believing that they’ll be rewarded in return for sharing access, information, or money
Quid pro quo:
269
A hardware component used for short-term memory
Random Access Memory (RAM):
270
The process of returning affected systems back to normal operations
Recovery:
271
A friendly relationship in which the people involved understand each other’s ideas and communicate well with each other
Rapport:
271
Ransomware: A malicious attack where threat actors encrypt an organization’s data and demand payment to restore access
Ransomware:
272
A NIST core function related to returning affected systems back to normal operation
Recover:
273
An instance when malicious script is sent to a server and activated during the server’s response
Reflected XSS attack:
274
A subscription-based distribution of Linux built for enterprise use
Red Hat® Enterprise Linux® (also referred to simply as Red Hat in this course):
275
A sequence of characters that forms a pattern
Regular expression (regex):
276
Rules set by a government or other authority to control the way something is done
Regulations:
277
Relational database: A structured database containing tables that are related to each other
Relational database:
278
A file path that starts from the user's current directory
Relative file path:
279
Replay attack: A network attack performed when a malicious actor intercepts a data packet in transit and delays it or repeats it at another time
Replay attack:
280
The ability to prepare for, respond to, and recover from disruptions
Resiliency:
281
Respond: A NIST core function related to making sure that the proper procedures are used to contain, neutralize, and analyze security incidents, and implement improvements to the security process
Respond:
282
A Python statement that executes inside a function and sends information back to the function call
Return statement:
283
A server that regulates and restricts the internet's access to an internal server
Reverse proxy server:
284
Anything that can impact the confidentiality, integrity, or availability of an asset
Risk:
285
The process of having the right procedures and rules in place to quickly reduce the impact of a risk like a breach
Risk mitigation:
286
The highest-level directory in Linux
Root directory:
287
A user with elevated privileges to modify the system
Root user (or superuser):
288
Rootkit: Malware that provides remote, administrative access to a computer
Rootkit:
289
A network device that connects multiple networks together
Router:
290
An additional safeguard that’s used to strengthen hash functions
Salting:
291
Malware that employs tactics to frighten users into infecting their device
Scareware:
292
Splunk’s query language
Search Processing Language (SPL):
293
Secure File Transfer Protocol (SFTP): A secure protocol used to transfer files from one device to another over a network
Secure File Transfer Protocol (SFTP):
294
A security protocol used to create a shell with a remote system
Secure shell (SSH):
295
A type of security design composed of multiple components, such as tools and processes, that are used to protect an organization from risks and external threats
Security architecture:
296
A review of an organization's security controls, policies, and procedures against a set of expectations
Security audit:
297
Security controls: Safeguards designed to reduce specific security risks
Security controls:
298
Guidelines for making appropriate decisions as a security professional
Security ethics:
299
Guidelines used for building plans to help mitigate risk and threats to data and privacy
Security frameworks:
300
Practices that help support, define, and direct security efforts of an organization
Security governance:
301
The process of strengthening a system to reduce its vulnerabilities and attack surface
Security hardening:
302
An application that collects and analyzes log data to monitor critical activities in an organization
Security information and event management (SIEM):
303
The ability to evaluate risk and constantly seek out and identify the potential or actual breach of a system, application, or data
Security mindset:
304
An organizational unit dedicated to monitoring networks, systems, and devices for security threats or attacks
Security operations center (SOC):
305
Security zone: A segment of a company’s network that protects the internal network from the internet
Security zone:
305
An organization’s ability to manage its defense of critical assets and data and react to change
Security posture:
305
A collection of applications, tools, and workflows that use automation to respond to security events
Security orchestration, automation, and response (SOAR):
306
The third step of the NIST RMF that means to choose, customize, and capture documentation of the controls that protect an organization
Select:
307
A type of data that includes personally identifiable information (PII), sensitive personally identifiable information (SPII), or protected health information (PHI)
Sensitive data:
308
The principle that users should not be given levels of authorization that would allow them to misuse a system
Separation of duties:
309
A specific type of PII that falls under stricter handling guidelines
Sensitive personally identifiable information (SPII):
310
a sequence of network HTTP requests and responses associated with the same user
Session:
311
A token that websites use to validate a session and determine how long that session should last
Session cookie:
312
An event when attackers obtain a legitimate user’s session ID
Session hijacking:
313
Data that consists of an unordered collection of unique values
Set data:
313
Session ID: A unique token that identifies a user and their device while accessing a system
Session ID: A unique token that identifies a user and their device while accessing a system
314
The command-line interpreter
Shell:
314
The idea that all individuals within an organization take an active role in lowering risk and maintaining both physical and virtual security
Shared responsibility:
315
A pattern that is associated with malicious activity
Signature:
316
A network protocol used for monitoring and managing devices on a network
Simple Network Management Protocol (SNMP):
316
A detection method used to find events of interest
Signature analysis:
317
A technology that combines several different logins into one
Single sign-on (SSO):
318
The use of text messages to trick users to obtain sensitive information or to impersonate a known source
Smishing:
319
A network attack performed when an attacker sniffs an authorized user’s IP address and floods it with ICMP packets
Smurf attack:
320
A manipulation technique that exploits human error to gain private information, access, or valuables
Social engineering:
321
A type of attack where a threat actor collects detailed information about their target on social media sites before initiating the attack
Social media phishing:
322
A malicious email attack targeting a specific user or group of users, appearing to originate from a trusted source
Spear phishing:
323
The rate at which a device sends and receives data, measured by bits per second
Speed:
324
A cloud-hosted tool used to collect, search, and monitor log data
Splunk Cloud:
325
A self-hosted tool used to retain, analyze, and search an organization's log data to provide security information and alerts in real-time
Splunk Enterprise:
326
Spyware: Malware that’s used to gather and sell information without consent
Spyware:
326
A programming language used to create, interact with, and request information from a database
SQL (Structured Query Language):
327
An attack that executes unexpected queries on a database
SQL injection:
328
Stakeholder: An individual or group that has an interest in any decision or activity of an organization
Stakeholder:
329
An error message returned by the OS through the shell
Standard error:
330
Information received by the OS via the command line
Standard input:
331
Information returned by the OS through the shell
Standard output:
332
STAR method: An interview technique used to answer behavioral and situational questions
STAR method:
333
Standards: References that inform how to set policies
Standards:
334
A class of firewall that keeps track of information passing through it and proactively filters out threats
Stateful:
335
A class of firewall that operates based on predefined rules and that does not keep track of information from data packets
Stateless:
336
An instance when malicious script is injected directly on the server
Stored XSS attack:
337
Data consisting of an ordered sequence of characters
String data:
337
The process of joining two strings together
String concatenation:
338
A manual that informs the writing, formatting, and design of documents
Style guide:
339
A continuous sequence of characters within a string
Substring:
339
The subdivision of a network into logical groups called subnets
Subnetting:
340
A command that temporarily grants elevated permissions to specific users
Sudo:
341
An attack that targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed
Supply-chain attack:
342
Suricata: An open-source intrusion detection system, intrusion prevention system, and network analysis tool
Suricata:
343
A device that makes connections between specific devices on a network by sending and receiving data between them
Switch:
344
Symmetric encryption: The use of a single secret key to exchange information
Symmetric encryption:
345
A type of DoS attack that simulates a TCP/IP connection and floods a server with SYN packets
Synchronize (SYN) flood attack:
346
The rules that determine what is correctly structured in a computing language
Syntax:
347
An error that involves invalid usage of a programming language
Syntax error:
348
Any person or group who presents a security risk
Threat actor:
348
A social engineering tactic in which unauthorized people follow an authorized person into a restricted area
Tailgating:
348
A framework used to visualize how data is organized and transmitted across a network
TCP/IP model:
348
The proactive search for threats on a network
Threat hunting:
348
tcpdump: A command-line network protocol analyzer
tcpdump:
349
Skills that require knowledge of specific tools, procedures, and policies
Technical skills:
349
Threat: Any circumstance or event that can negatively impact assets
Threat:
350
The collection and transmission of data for analysis
Telemetry:
351
Evidence-based threat information that provides context about existing or emerging threats
Threat intelligence:
352
The process of identifying assets, their vulnerabilities, and how each is exposed to threats
Threat modeling:
353
Skills from other areas that can apply to different careers
Transferable skills:
354
An internet communication protocol that allows two devices to form a connection and stream data
Transmission Control Protocol (TCP):
355
The prioritizing of incidents according to their level of importance or urgency
Triage:
356
Malware that looks like a legitimate file or program
Trojan horse:
357
A state where there is no detection of malicious activity
True negative:
358
True positive An alert that correctly detects the presence of an attack
True positive
359
Data that consists of a collection of data that cannot be changed
Tuple data:
360
An error that results from using the wrong data type
Type error:
361
Ubuntu: An open-source, user-friendly distribution that is widely used in security and other industries
Ubuntu:
362
Unauthorized access: An incident type that occurs when an individual gains digital or physical access to a system or application without permission
Unauthorized access: An incident type that occurs when an individual gains digital or physical access to a system or application without permission
363
A microchip that contains loading instructions for the computer and replaces BIOS on more modern systems
Unified Extensible Firmware Interface (UEFI):
363
Any network outside your organization's control
Uncontrolled zone:
364
An attack in which a threat actor strategically leaves a malware USB stick for an employee to find and install to unknowingly infect a network
USB baiting:
365
The person interacting with a computer
User:
366
A function that programmers design for their specific needs
User-defined function:
367
A connectionless protocol that does not establish a connection between devices before transmissions
User Datagram Protocol (UDP):
368
A program that allows the user to control the functions of the operating system
User interface:
369
The process of creating and maintaining a user's digital identity
User provisioning:
370
A container that stores data
Variable:
371
A network security service that changes your public IP address and hides your virtual location so that you can keep your data private when you are using a public network like the internet
Virtual Private Network (VPN):
372
The exploitation of electronic voice communication to obtain sensitive information or to impersonate a known source
Vishing:
372
A weakness that can be exploited by a threat
Vulnerability:
372
Malicious code written to interfere with computer operations and cause damage to data and software
Virus:
372
A service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content
VirusTotal:
372
A way of displaying various types of data quickly in one place
Visual dashboard:
372
Vulnerability scanner: Software that automatically compares existing common vulnerabilities and exposures against the technologies on the network
Vulnerability scanner:
372
The process of finding and patching vulnerabilities
Vulnerability management:
373
Vulnerability assessment: The internal review process of an organization's security systems
Vulnerability assessment:
373
A type of attack when a threat actor compromises a website frequently visited by a specific group of users
Watering hole attack:
373
Malicious code or behavior that’s used to take advantage of coding flaws in a web application
Web-based exploits:
374
A category of spear phishing attempts that are aimed at high-ranking executives in an organization
Whaling:
374
A network that spans a large geographic area like a city, state, or country
Wide Area Network (WAN):
375
A wireless security protocol for devices to connect to the internet
Wi-Fi Protected Access (WPA):
376
A special character that can be substituted with any other character
Wildcard:
377
An open-source network protocol analyzer
Wireshark:
378
An exploit that was previously unknown
Zero-day:
378
A computer language used to create rules for searching through ingested log data
YARA-L:
378
Malware that can duplicate and spread itself across systems on its own
Worm:
378
A file that can be altered by anyone in the world
World-writable file:
