Primary Definitions 1.0-8.0 Flashcards
Understanding all the core security concepts. (185 cards)
1
Q
CIA Triad
A
Confidentiality, Integrity, Availability.
2
Q
AAA of Security
A
Authentication, Authorization, Accounting.
3
Q
Threat
A
Anything that could cause harm, loss, damage, or compromise to information technology systems.
4
Q
Vulnerability
A
Any weakness in the system design or implementation.
5
Q
Zero Trust
A
Security model that operates on the principle that no one, whether inside or outside the organization, should be trusted by default.
6
Q
Confidentiality
A
Protection of information from unauthorized access or disclosure.
7
Q
Encryption
A
Process of converting data into code to prevent unauthorized access.
8
Q
Access Controls
A
Ensure only authorized personnel can access certain types of data.
9
Q
Data Masking
A
Method that involves obscuring data within a database to make it inaccessible for unauthorized users while retaining the real data’s authenticity and use for authorized users.
10
Q
Integrity
A
Ensuring information and data remain accurate and unchanged from their original state unless intentionally modified by an authorized individual.
11
Q
Hashing
A
Process of converting data into a fixed-size value.
12
Q
Checksums
A
Method to verify the integrity of data during transmission.
13
Q
Availability
A
Ensuring information, systems, and resources are accessible and operational when needed by authorized users.
14
Q
Redundancy
A
Duplication of critical components or functions of a system with the intention of enhancing its reliability.
15
Q
Non-Repudiation
A
Focused on providing undeniable proof in digital transactions.
16
Q
Digital Signature
A
The process of hashing a message/communication and encrypting the hash with a private key so anyone with the public key can trace the ownership.
17
Q
Authentication
A
Security measure that ensures individuals or entities are who they claim to be during a communication or transaction.
18
Q
Multi-factor Authentication (MFA)
A
Using two or more methods of user verification together.
19
Q
Authorization
A
Permission and privileges granted to users or entities after they have been authenticated that determine what they can do within a system.
20
Q
Accounting
A
Security measure that ensures all user activities are properly tracked and recorded.
21
Q
Secured Zones
A
Isolated environments within a network that are designed to house sensitive data.
22
Q
Gap Analysis
A
Process of evaluating the differences between an organization’s current performance and it’s desired performance.
23
Q
Plan of Action and Milestones (POA&M)
A
Outlines the specific measures to address each vulnerability, allocate resources, and set up timelines for each remediation task that is needed.
24
Q
Threat Actor
A
An individual or entity responsible for incidents that impact security and data protection.
25
Data Exfiltration
The unauthorized transfer of data from a computer.
26
Service Disruption
Overwhelming a network, service, or server with excessive traffic so it becomes unavailable to its normal users.
27
Internal Threat Actors
Individuals or entities within an organization who pose a threat to its security.
28
External Threat Actors
Individuals or entities outside an organization who attempt to breach its cybersecurity defenses.
29
Unskilled Attacker (Script Kiddie)
An individual who lacks the technical knowledge to develop their own hacking tools or exploits.
30
Hacktivist
Individuals or groups that use their technical skills to promote a cause or drive social change.
31
Organized Cyber Crime Groups
Sophisticated and well-structured entities that leverage resources and technical skills for illicit gain.
32
Nation-State Actors
Groups that are sponsored by a government to conduct cyber operations against other nations, organizations, or individuals.
33
False Flag Attack
Attack that is orchestrated in such a way that is appears to originate from a different source or group.
34
Advanced Persistent Threat (APT)
Using long-term persistence and stealth to perform more enhanced cyber attacks.
35
Shadow IT
The use of information technology systems, devices, software, applications, and services without explicit organizational approval.
36
Threat Vector
The means or pathway by which an attacker can gain unauthorized access to a computer or network to deliver a malicious payload or carry out an unwanted action.
37
Attack Surface
Encompasses all the various points where an unauthorized user can try to enter data or extract data from an environment.
38
Tactics, Techniques, and Procedures (TTPs)
Specific methods and patterns of activities or behaviors associated with a particular threat actor or group of threat actors.
39
Deception and Disruption Technologies
Designed to mislead, confuse, and divert attackers from critical assets while simultaneously detecting and neutralizing threats.
40
Honeypots
Decoy system or network set up to attract potential hackers.
41
Honeynets
Network of honepots to create a more complex system designed to mimic an entire network.
42
Honeyfiles
Decoy file placed within a system to lure in potential attackers.
43
Honeytokens
Pieces of data or resources that have no legitimate value or use but are monitored for access or use.
44
Bollards
Short, sturdy vertical posts designed to control or prevent access by vehicles to an area or structure.
45
Fences
Barriers made of posts, wire, or boards that are erected to enclose a space or separate areas.
46
Surveillance System
Organized strategy or setup designed to observe and report activities in a given area.
47
Access Control Vestibule
Double-door electronically controlled system that ensures only one door is open at any given moment.
48
Piggybacking
Person with legitimate access intentionally allows another person without authorization to enter a secure area with them.
49
Tailgating
Unauthorized person follows someone with legitimate access into the secure space without their knowledge or consent.
50
Brute Force
Attack where access to a system is gained by trying all of the possibilities until breaking through.
51
False Acceptance Rate (FAR)
The rate that a system authenticates a user as valid, even though that person does not have legitimate access.
52
False Rejection Rate (FRR)
The rate that a system denies authentic users access who should have been allowed access to a system.
53
Equal Error Rate (EER)
The measure of effectiveness of a given biometrics system to achieve balance.
54
Access Badge Cloning
Refers to copying the data from an RFID or NFC card or badge onto another card or device.
55
Social Engineering
Manipulative strategy that exploits human psychology to gain unauthorized access to systems, data, or physical spaces.
56
The 6 Motivational Triggers of Social Engineering
Authority, Urgency, Social Proof, Scarcity, Likability, and Fear.
57
Impersonation
An attack where an adversary assumes the identity of another person to gain unauthorized access to resources or steal sensitive data.
58
Brand Impersonation
Attacker pretends to represent a legitimate company.
59
Typosquatting
Attacker registers a domain name that is similar to a popular website but contains some kind of common typographical errors.
60
Watering Hole Attack
Attacker compromises a specific website or service their target is known to frequently use.
61
Pretexting
Attacker asks leading questions to gain valuable information without any prior knowledge of the organization's systems.
62
Phishing
Using deceptive emails from trusted sources to trick individuals into disclosing personal information like passwords or credit card numbers.
63
Vishing
Using phone calls to deceive victims into divulging personal or financial information.
64
Smishing
Using text messages to deceive individuals into sharing personal information.
65
Whaling
Form or spear phishing that targets high-profile targets.
66
Spear Phishing
Using methodically planned deception and social engineering techniques on a specific group or singular individual.
67
Business Email Compromise
Advanced phishing attack that leverages internal email accounts to manipulate employees into carrying out malicious actions for the attacker.
68
Anti-phishing Campaign
Vital way to educate individuals about social engineering risks and how to recognize potential phishing attempts.
69
Fraud
The wrongful or criminal deception intended to result in financial or personal gain.
70
Identity Fraud (Theft)
Using another person's personal information without authorization to commit a crime or deceive/defraud them or a third person.
71
Misinformation
Inaccurate information shared unintentionally.
72
Disinformation
Intentional spread of false information to deceive or mislead.
73
Shoulder Surfing
Looking over someone's shoulder to gather personal information.
74
Hoaxes
Malicious deception often spread through social media, email, or other communication channels.
75
Dumpster Diving
Searching through trash to find valuable information.
76
Eavesdropping
Secretly listening to private conversations.
77
Baiting
Planting a malware-infected device for a victim to find and unintentionally introduce malware to their organization's system.
78
Malware
Any software designed to infiltrate a computer system without the user's knowledge.
79
Attack Vector
The means by which an attacker gains access to a computer to infect the system with malware.
80
Computer Virus
Malicious code that's run on a machine without the user's knowledge and infects any computer it is run on.
81
Boot Sector Virus
Stored in the first sector of a hard drive and is then loaded into memory whenever the computer is booted up.
82
Macro Virus
A form of code that allows a virus to be embedded inside another document so that when that document is opened by the user the virus is executed.
83
Program Virus
Tries to find executables or applications files to infect with malicious code.
84
Multipartite Virus
A combination of a boot sector virus and program virus.
85
Encrypted Virus
Virus that hides itself from detection through encryption to avoid detection by antivirus software.
86
Polymorphic Virus
Advanced version of encrypted virus that changes the virus's code each time is executed.
87
Metamorphic Virus
Virus that is able to rewrite itself entirely before it attempts to infect files.
88
Stealth Virus
Technique used to avoid antivirus protection.
89
Armored Virus
A layer of protection that confuses the program or person trying to analyze the virus.
90
Hoax Virus
A form of technical social engineering that attempts to scare end users into taking undesirable action on their system.
91
Worm
Piece of malicious software, much like a virus, but it can replicate itself without any user interaction.
92
Trojan
A piece of malicious software that is disguised as a piece of harmless or desirable software.
93
Remote Access Trojan (RAT)
A kind of Trojan that provides remote access to the infected device.
94
Ransomware
Type of malicious software that is designed to block access to the computer system or data until a ransom is paid to the attacker.
95
Botnet
Network of compromised computers or devices controlled remotely by malicious actors.
96
Zombie
Name of a compromised computer or device that is part of a botnet.
97
Command and Control Node (C2 Node)
Responsible for managing and coordinating the activities of a botnet.
98
Rootkit
Type of software that is designed to gain administrative-level control over a given computer system without being detected.
99
DLL Injection
Technique used to run arbitrary code within the address space of another process by forcing it to load a dynamic-link library.
100
Shim
Software code that is placed between two components.
101
Backdoor
Used to bypass the normal security and authentication functions.
102
Easter Egg
Coding practice that inserts a joke or gag gift for users.
103
Logic Bomb
Malicious code inserted into a program that only executes when certain conditions have been met.
104
Keylogger
Piece of software or hardware that records every single keystroke on the infected device.
105
Spyware
Malicious software designed to gather and send information to malicious actors.
106
Bloatware
Software that is pre-installed on new devices.
107
Dropper
Initiates or runs other malware forms within a payload on an infected host.
108
Downloader
Retrieves additional tools post the initial infection facilitated by a dropper.
109
Shellcode
Encompasses lightweight code meant to execute an exploit on a given target.
110
Code Injection
Disguising malicious code by running it with a legitimate process.
111
Sensitive Data
Any information that can result in a loss of security or loss of advantage to a company if accessed by an unauthorized person.
112
Regulated Data
Information controlled by laws, regulations, or industry standards.
113
Data Owner
Senior executive role that has the responsibility for maintaining the confidentiality, integrity, availability, and privacy of information assets.
114
Data Controller
Entity that holds responsibility for deciding the purposes and methods of data storage, collection, and usage, and guaranteeing the legality of the processes.
115
Data Processor
Group or individual hired by the data controller to help with tasks like collecting, storing, or analyzing the data.
116
Data Steward
Focused on the quality of the data and associated metadata.
117
Data Custodian
Responsible for handling the management of the system on which the data assets are stored.
118
Privacy Officer
Responsible for oversight of PII, SPI, PHI and other confidential data.
119
Secure Sockets Layer (SSL) Transport Layer Security (TLS)
Cryptographic protocols designed to provide secure communication over a computer network.
120
Internet Protocol Security (IPSec)
Protocol suite used to secure IP communications by authenticating and encrypting each IP packet in a data stream.
121
Virtual Private Network (VPN)
Technology that creates a secure connection over a less secure network.
122
Personal Identification Information (PII)
Any information that can be used to identify an individual.
123
Protected Health Information (PHI)
Any information about health status, provision of healthcare, or payment for healthcare that can be linked to a specific individual.
124
Trade Secrets
Type of confidential business information that provides a company with a competitive edge.
125
Intellectual Property (IP)
Creations of the mind, such as inventions, literary and artistic works, designs, and symbols.
126
Data Sovereignty
Refers to the concept that digital information is subject to the laws of the country in which it is located.
127
Geographic Restrictions (Geofencing)
Involves setting up virtual boundaries to restrict data access based on geographic location.
128
Tokenization
Replaces sensitive data with non-sensitive substitutes.
129
Obfuscation
Making data unclear, or unintelligible.
130
Segmentation
Dividing an network into separate segments, each with its own security controls.
131
Permission Restrictions
Defining who has access to specific data and what they can do with it.
132
Data Loss Prevention (DLP)
Set up to monitor the data of a system while it's in use, in transit, or at rest to detect any attempts to steal the data.
133
Cryptography
Practice and study of writing and solving codes to hide the true meaning of information.
134
Key
Essential piece of information that determines the output of a cipher.
135
Symmetric Algorithm (Private Key)
Encryption algorithm in which both the sender and the receiver must know the same shared secret using a privately held key.
136
Asymmetric Algorithm (Public Key)
Encryption algorithm where different keys are used to encrypt and decrypt the data.
137
Stream Cipher
Utilizes a keystream generator to encrypt data bit by bit using a mathematical XOR (Exclusive or) function to create the ciphertext.
138
Block Cipher
Breaks the input into fixed-length blocks of data and performs the encryption on each block.
139
Advanced Encryption Standard (AES)
Symmetric block cipher that uses 128-bit, 192-bit, or 256-bit blocks and a matching encryption key size to encrypt plaintext into ciphertext.
140
Rivest Cipher (RC6)
Symmetric block cipher that was introduced as a replacement for DES but AES was chosen instead.
141
Diffie-Hellman (DH)
Used to conduct key exchanges and secure key distribution over an unsecure network.
142
Rivest, Shamir, and Adleman (RSA)
Asymmetric algorithm that relies on the mathematical difficulty of factoring large prime numbers. RSA can support key sizes between 1024-bits and 4096-bits.
143
Elliptic Curve Cryptography (ECC)
Heavily used in mobile devices and it's based on the algebraic structure of elliptical curves over finite fields to define its keys.
144
MD5
Creates a 128-bit hash value that is unique to the input file. Susceptible to hash collision.
145
SHA-3
Newer family of hash functions, and its hash digest can go between 224-bits and 512-bits. Uses 120 rounds of mathematical computations.
146
RIPEMD (RACE Integrity Primitive Evaluation Message Digest)
Hash algorithm that comes in 160-bit, 256-bit, and 320-bit versions.
147
HMAC (Hash-based Message Authentication Code)
Used to check the integrity of a message and provides some level of assurance that its authenticity is real.
148
Digital Security Standard (DSS)
Relies upon a 160-bit message digest created by the Digital Security Algorithm. This is the one the federal government uses.
149
Pass the Hash Attack
Hacking technique that allows the attacker to authenticate to a remote server or service by using the underlying hash of a user's password instead of requiring the associated plaintext password.
150
Birthday Attack
Occurs when an attacker can send two different messages through a hash algorithm and it results in the same identical hash digest, referred to as a collision.
151
Key Stretching
Technique that is used to mitigate a weaker key by increasing the time needed to crack it.
152
Salting
Adding random data into a one-way cryptographic hash to help protect against password cracking techniques.
153
Dictionary Attack
When an attacker tries every work from a predefined list.
154
Brute-force Attack (Cryptography)
When an attacker tries every possible password combination.
155
Rainbow Tables
Precomputed tables for reversing cryptographic hash functions.
156
Nonce
Stands for "number used once", is a unique, often random number that is added to password-based authentication process.
157
Public Key Infrastructure (PKI)
An entire system of hardware, software, policies, procedures, and people that is based on asymmetric encryption.
158
Certificated Authority
Issues digital certificates and keeps the level of trust between all the certificate authorities around the world.
159
Key Escrow
Process where cryptographic keys are stored in a secure, third-party location.
160
Wildcard Certificate
Allows all of the subdomains to use the same public key certificate and have it displayed as valid.
161
Digital Certificate
Digitally signed electronic document that binds a public key with a user's identity.
162
Subject Alternate Name (SAN) Field
Certificate that specifies what additional domains and IP addresses are going to be supported.
163
Single-Sided Certificate
Certificate that only requires the server to be validated.
164
Dual-Sided Certificate
Certificate that requires both the server and the user to be validated. Has more security but requires twice the processing power on the server. Only used is highly secure environments.
165
Self-Signed Certificate
Digital certificate that is signed by the same entity whose identity it certifies. This is commonly used in testing environments because there is no trust in the security from a third party.
166
Third-Party Certificate
Digital certificate issued and signed by a trusted certificate authority (CA).
167
Root of Trust
Each certificate is validated using the concept of a root of trust or the chain of trust.
168
Registration Authority
Request identifying information from the user and forwards that certificate request up to the certificate authority to create the digital certificate.
169
Certificate Signing Request
A block of encoded text that contains information about the entity requesting the certificate.
170
Certificate Revocation List (CRL)
Serves as an online list of digital certificates that the certificate authority has already revoked.
171
Online Certificate Status Protocol (OCSP)
Allows to determine the revocation status of any digital certificate using its serial number.
172
OCSP Stapling
Allows the certificate holder to get the OCSP record from the server at regular intervals.
173
Public Key Pinning
Allows an HTTPS website to resist impersonation attacks from users who are trying to present fraudulent certificates.
174
Blockchain
A shared immutable ledger for recording transactions, tracking assets, and building trust.
175
Public Ledger
A record-keeping system that maintains participant's identities in a secure and anonymous format.
176
Smart Contracts
Self-executing contracts where the terms of agreement or conditions are written directly on the lines of code.
177
Permissioned Blockchain
Used for business transactions and it promotes new levels of trust and transparency using immutable public ledgers.
178
Trusted Platform Module (TPM)
Dedicated microcontroller designed to secure hardware through integrated cryptographic keys.
179
Hardware Security Module (HSM)
Physical device that safeguards and manages digital keys, primarily used for mission-critical situations like financial transactions.
180
Key Management System
Integrate approach for generating, distributing, and managing cryptographic keys for devices and applications.
181
Secure Enclave
Co-processor integrated into the main processor of some devices, designed with the sole purpose of ensuring data protection.
182
Steganography
Derives from Greek words meaning "covered writing," and it is all about concealing a message within another so that the very existence of the message is hidden.
183
Downgrade Attack
Aims to force a system into using a weaker or older cryptographic standard or protocol than what it's currently utilizing.
184
Collision Attack
Aims to find two different inputs that produce the same hash output.
185
Post-quantum Cryptography
A new kind of cryptographic algorithm that can be implemented using today's classical computers but is also impervious to attacks from future quantum computers.
