Primary Definitions 14.0-18.0 Flashcards
(178 cards)
1
Q
Security Architecture
A
Design, structure, and behavior of an organization’s information security environment.
2
Q
Serverless
A
Model where the responsibility of managing servers, databases, and some application logic is shifted away from developers.
3
Q
Responsibility Matrix
A
Outlines the division of responsibilities between the cloud service provider and the customer.
4
Q
Hybrid Solutions
A
Combine on-premise infrastructure, private cloud services, and public cloud services.
5
Q
On-Premise Solutions
A
Computing infrastructure that’s physically located on-site at a business.
6
Q
Scalability
A
System’s ability to handle increased workloads.
7
Q
Virtualization
A
Technology that allows for the emulation of servers.
8
Q
Containerization
A
Lightweight alternative to full machine virtualization that places applications in separate containers with their own dependencies.
9
Q
Virtual Machine Escape
A
Occurs when an attacker is able to break out of one of these normally isolated virtual machines.
10
Q
Privilege Elevation
A
Occurs when a user is able to gain the ability to run functions as a higher level user.
11
Q
Live Migration of Virtual Machines
A
When a virtual machine needs to move from one physical host to another.
12
Q
Resource Reuse
A
Concept in computing where system resource like memory or processing power are reused.
13
Q
Microservices
A
A software architecture where large applications are broken down into smaller and independent services.
14
Q
Physical Separation/Air Gapping
A
Isolation of a network by removing any direct or indirect connections from other networks.
15
Q
Logical Separation
A
Creates boundaries within a network, restricting access to certain areas.
16
Q
Software Defined Network (SDN)
A
Enables efficient network configuration to improve performance and monitoring.
17
Q
Infrastructure as Code
A
A method in which IT infrastructures are defined in code files that can be versioned, tested, and audited.
18
Q
Snowflake System
A
A configuration that lacks consistency that might introduce risks, so it has to be eliminated.
19
Q
Idempotence
A
The ability of an operation to produce the same results as many times as it is executed.
20
Q
Internet of Things (IoT)
A
Refers to the network of physical items with embedded systems that enables connection and data exchange.
21
Q
Hub
A
The central point connecting all IoT devices and sends commands to them.
22
Q
Smart Devices
A
Everyday objects enhanced with computing capabilities and Internet connectivity.
23
Q
Wearables
A
Subset of smart devices designed to be worn on the body.
24
Q
Weak Defaults
A
Utilizing the weak default settings that come with the device upon purchase.
25
Industrial Control Systems (ICS)
Control systems used to monitor and control industrial processes ranging from simple systems to complex systems.
26
Distributed Control Systems (DCS)
Used to control a specific location.
27
Programmable Logic Controllers (PLCs)
Used to control components like assembly lines.
28
Supervisory Control and Data Acquisition (SCADA)
A type of ICS used to monitor and control geographically dispersed industrial processes.
29
Embedded System
Specialized computing component designed to perform dedicated functions within a larger structure.
30
Real-Time Operating System (RTOS)
Ensures data processing in real-time and is crucial for time-sensitive applications.
31
Network Segmentation
Divides a network into multiple segments or subnets, limiting potential damage in case of a breach.
32
Wrappers
Show only the entry and exit points of the data when travelling between networks.
33
Security Infrastructure
Combination of hardware, software, policies, and practices that organizations use to protect information.
34
Network Appliance
Specialized hardware or software device designed to perform specific networking functions or services.
35
Software Defined Networking (SD-WAN)
Technology that utilizes software-defined networking principles to manage and optimize wide area network (WAN) connections.
36
Secure Access Service Edge (SASE)
Network security and connectivity framework that integrates network security and wide area networking into a cloud-based service.
37
Port
Logical communication endpoint that exists on a computer or server.
38
Inbound Port
Logical communication opening on a server that is listening for a connection from a client.
39
Outbound Port
Logical communication opening created on a client to call out to a server that is listening for a connection.
40
Well-Known Ports
Ports 0 to 1023 are considered well-known and are assigned by the Internet Assigned Numbers Authority (IANA).
41
Registered Ports
Ports 1024 to 49,151 are considered registered and are usually assigned to proprietary protocols.
42
Dynamic and Private Ports
Port 49,152 to 65,535 can be used by any application without being registered with IANA.
43
Protocol
Rules governing device communication and data exchange.
44
Firewalls
Safeguards networks by monitoring and controlling traffic based on predefined security rules.
45
Screened Subnet (Dual-homed Host)
Acts as a security barrier between external untrusted networks and internal trusted networks, using a protected host with security measures like a packet-filtering firewall.
46
Packet Filtering
Checks packet headers for traffic allowance based on IP addresses and port numbers. Layer 4 firewall.
47
Stateful
Monitors all inbound and outbound network connections and requests. Layer 7 firewall.
48
Proxy
Acts as an intermediary between internal and external connections, making connections on behalf of other endpoints.
49
Kernel Proxy (Fifth Generation Firewall)
Has minimal impact on network performance while thoroughly inspecting packets across all layers.
50
Next-Generation Firewall (NGFW)
Aims to address the limitations of traditional firewalls by being more aware of applications and their behaviors.
51
Unified Threat Management Firewall (UTM)
Provides the ability to conduct multiple security functions in a single appliance.
52
Web Application Firewall (WAF)
Focuses on the inspection of the HTTP traffic.
53
Inline
Device sits between the network firewall and the web servers.
54
Out of band
Device receives a mirrored copy of web server traffic.
55
Intrusion Detection System (IDS)
Logs and alerts.
56
Intrusion Prevention System (IPS)
Logs, alerts, and takes action.
57
Signature-based IDS
Analyzes traffic based on defined signatures and can only recognize attacks based on previously identified attacks in its database.
58
Anomaly-based/Behavioral-based IDS
Analyzes traffic and compares it to a normal baseline of traffic to determine whether a threat is occurring.
59
Jump Servers
Dedicated gateway used by system administrators to securely access devices located in different security zones within the network.
60
Content Addressable Memory (CAM) Table
Used to store information about the MAC addresses that are available on any given port of the switch.
61
Persistent (Sticky) MAC Learning
Feature in network port security where the switch automatically learns and associates MAC addresses with specific interfaces.
62
802.1x Protocol
Standardized framework that is used for port-based authentication for both wired and wireless networks.
63
Site-to-site VPN
Establishes secure tunnels over the public Internet for interconnecting remote sites.
64
Client-to-site VPN
Connects individual devices directly to the organization's headquarters, enabling remote users to access the network.
65
Full Tunnel
Maximizes security by encrypting all traffic to the headquarters while integrating clients with the network.
66
Split Tunnel
Divides traffic and network requests and then routes them to the appropriate network.
67
Clientless VPN
Secures remote access through browser-based VPN tunnels without needing client software or hardware configuration.
68
Transport Layer Security (TLS)
A protocol that provides cryptographic security for secure connections and is used for secure web browsing and data transfer.
69
Transmission Control Protocol (TCP)
Used by TLS to establish secure connections between a client and server, but it may slow down the connection.
70
Datagram Transport Layer Security (DTLS)
A UDP-based version of TLS protocol that offers the same security level as TLS while maintaining faster operations.
71
Internet Protocol Security Suite (IPSec)
A protocol suite for secure communication through authentication and data encryption in IP networks.
72
Authentication Header (AH)
Offers connectionless data integrity and data origin authentication for IP datagrams using cryptographic hash as identification information.
73
Encapsulating Security Payload (ESP)
Employed for providing authentication, integrity, replay protection, and data confidentiality by encrypting the packet's payload.
74
Security Zone
Distinct segment within a network, often created by logically isolating the segment using a firewall or other security device.
75
Fail-open
Allows all traffic in the event of a failure.
76
Fail-closed
Blocks all traffic in the event of a failure.
77
Principle of Least Privilege
Users or systems are granted only the necessary access rights to perform their duties, reducing the attack surface.
78
Defense in Depth
Emphasizes the use of multiple layers of security to mitigate threats even if one control fails.
79
Risk-based Approach
Prioritizing controls based on potential risks and vulnerabilities specific to the infrastructure to make efficient use of resources.
80
Lifecycle Management
Regularly reviewing, updating, and retiring controls to adapt to evolving threat landscapes.
81
Open Design Principle
Ensuring transparency and accountability through rigorous testing and scrutiny of infrastructure and controls.
82
Identity and Access Management (IAM)
Systems and processes used to manage access to information in an organization to ensure that the right individuals have access to the right resources at the right times for the right reasons.
83
Provisioning
Process of creating new user accounts, assigning them appropriate permissions, and providing users with access to systems.
84
Deprovisioning
Process of removing an individual's access rights when the rights are no longer required.
85
Identity Proofing
Process of verifying the identity of a user before the account is created.
86
Interoperability
The ability of different systems, devices, and applications to work together and share information.
87
Multi-Factor Authentication (MFA)
Security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity.
88
Passkeys
Users can create and access online accounts without needing to input a password.
89
Password Managers
Store, generate, and autofill passwords to enhance security.
90
Passwordless Authentication
Provides improved security and a more user-friendly experience.
91
Dictionary Attack
Using a list (or 'dictionary') of commonly used passwords and trying them all.
92
Spraying Attack
A form of brute force attack that involves trying a small number of commonly used passwords against a large number of usernames or accounts.
93
Hybrid Attack
Blends brute force and dictionary techniques by using common passwords with variations, such as adding numbers or special characters.
94
Single Sign-On (SSO)
Authentication process that allows a user to access multiple applications or websites by logging in only once with a single set of credentials.
95
Identity Provider (IdP)
System that creates, maintains, and manages identity information for principals while providing authentication services to applications within a federation or distributed network.
96
Lightweight Directory Access Protocol (LDAP)
Used to access and maintain distributed directory information services over an Internet protocol network.
97
Open Authorization (OAuth)
Open standard for token-based authentication and authorization that allows an individual's account information to be used by third-party services without exposing the user's password.
98
Security Assertion Markup Language (SAML)
A standard for logging users into applications based on their sessions in another context.
99
Federation
Process that allows for the linking of electronic identities and attributes to store information across multiple distinct identity management systems.
100
Privileged Access Management (PAM)
Solution that helps organizations restrict and monitor privileged access within an IT environment.
101
Just-in-Time Permissions
Security model where administrative access is granted only when needed for a specific period.
102
Password Vaulting
Technique used to store and manage passwords in a secure environment, such as in a digital vault.
103
Temporal Accounts
Used to provide time-limited access to resources, and they are automatically disabled or deleted after a certain period of time.
104
Rule-based access control
Enables administrators to apply security policies to all users.
105
User Account Control (UAC)
A mechanism designed to ensure that actions requiring administrative rights are explicitly authorized by the user.
106
Vulnerabilities
Weaknesses or flaws in hardware, software, configurations, or processes within a computer system, network, or application.
107
Attacks
Deliberate actions or activities carried out by threat actors with the intent to exploit vulnerabilities.
108
Zero-Day Vulnerability
Type of software or hardware vulnerability that is discovered and exploited by malicious actors before a patch is released.
109
Firmware
Specialized form of software stored on hardware device, like a router or a smart thermostat, that provides low-level control for the device's specific hardware.
110
End-of-life Systems
Refer to hardware or software products that have reached the end of their life cycle.
111
Legacy Systems
Outdated computing software, hardware, or technologies that have been largely superseded by newer and more efficient alternatives.
112
Unsupported Systems
Hardware or software products that no longer receive official technical support, security updates, or patches from their respective vendors or developers.
113
Unpatched Systems
Device, application, or piece of software that has not been updated with the latest security patches so that it remains vulnerable to known exploits and attacks.
114
Hardware Misconfiguration
Occurs when a device's settings, parameters, or options are not optimally set up, and this can cause vulnerabilities to exist, a decrease in performance, or unintended behavior of devices or systems.
115
Bluetooth
Wireless technology standard used for exchanging data between fixed and mobile devices over short distances without the need for an Internet connection.
116
Insecure Pairing
Occurs when Bluetooth devices establish a connection without proper authentication.
117
Device Spoofing
Occurs when an attacker impersonates a device to trick a user into connecting.
118
Bluejacking
Sending unsolicited messages to the device over Bluetooth to test the security of the device or as a prank.
119
Bluesnarfing
Getting unauthorized access to a Bluetooth device through the connection to steal information like contacts, call logs, and text messages.
120
Bluebugging
Takes bluesnarfing further by using the target device to make calls, send text messages, or access the internet.
121
Bluesmack
Using DoS attack techniques to crash the Bluetooth device.
122
Blueborne
Sends out a signal to infect local Bluetooth devices, infecting multiple devices within seconds.
123
Sideloading
The practice of installing applications on a device from unofficial sources which actually bypasses the device's default app store.
124
Jailbreaking and Rooting
Process that gives users escalated privileges on the devices and allows users to circumvent the built-in security measures provided by the devices.
125
Data Exfiltration
Unauthorized data transfers from within an organization to an external location.
126
Malicious Updates
Occurs when an attacker has been able to craft a malicious updated to a well-known and trusted program in order to compromise the systems of the program's end users.
127
Code Injection
The insertion of additional information or code through a data input form from a client to an application
128
Extensible Markup Language (XML)
Used by web applications for authentication, authorization, and other types of data exchange.
129
XML Bomb (Billion Laughs Attack)
XML encodes entities that expand to exponential sizes, consuming memory on the host and potentially crashing it.
130
Cross-Site Scripting (XSS)
Injects a malicious script into a trusted site to compromise the site's visitors.
131
Document Object Model (DOM) XSS
Exploits the client's web browser using client-side scripts to modify the content and layout of the web page.
132
Cookie
Text file used to store information about a user when they visit a website.
133
Session Hijacking
Type of spoofing attack where the attacker disconnects a host and then replaces it with his or her own machine by spoofing the original host IP.
134
Session Prediction
Type of spoofing attack where the attacker attempts to predict the session token in order to hijack the session.
135
Cross-Site Request Forgery (XSRF)
Malicious script is used to exploit a session started on another site within the same web browser.
136
Buffer Overflow
Occurs when data exceeds allocated memory, potentially enabling unauthorized access or code execution.
137
Buffer
A temporary storage area where a program stores its data.
138
Stack
A memory region where a program stores the return addresses from function calls.
139
"Smashing the Stack"
Occurs when an attacker can execute their malicious code by overwriting the return address.
140
Address Space Layout Randomization (ASLR)
A security measure that randomizes memory addresses, making buffer overflow attacks harder for attackers.
141
Race Condition
Software vulnerability where the outcome depends on the timing of events not matching the developer's intended order.
142
Dereferencing
A fundamental operation in programming, and the vulnerabilities arise from unsafe or concurrent usage, particularly in scenarios involving race conditions.
143
Time-of-Check (TOC)
Type of race condition where an attacker can alter a system resource after an application checks its state but before the operation is performed.
144
Time-of-Use (TOU)
Type of race condition that occurs when an attacker can change the state of a system resource between the time it is checked and the time it is used.
145
Time-of-Evaluation (TOE)
Type of race condition that involves the manipulation of data or resources during the time window when a system is making a decision or evaluation.
146
Mutex
Mutually exclusive flag that acts as a gatekeeper to a section of code so that only one thread can be processed at a time.
147
Deadlock
Occurs when two or more processes are unable to proceed because each is waiting for the other to release a resource.
148
Denial of Service (DoS)
Used to describe an attack that attempts to make a computer or server's resources unavailable.
149
Flood Attack
Specialized type of DoS which attempts to send more packets to a single server or host than it can handle.
150
Ping Flood
A variety of Flood Attack in which a server is sent with too many pings (ICMP echo).
151
SYN Flood
An attacker will initiate multiple TCP sessions but never complete the three-way handshake. This is typically done by setting up fake sessions using fake IP addresses.
152
Permanent Denial of Service (PDoS)
An attack which exploits a security flaw by reflashing a firmware, permanently breaking the networking device. The idea is you send a firmware that overwrites the existing firmware and bricks the device.
153
Fork Bomb
A large number of processes is created to use up a computer's available processing power. The program self replicates to duplicate more and more processes until the server shuts down.
154
Distributed Denial of Service (DDoS)
More machines are used to launch an attack simultaneously against a single server to create denial of service condition.
155
DNS Amplification Attack
Specialized DDoS that allows an attacker to initiate DNS requests from a spoof IP address to flood a website.
156
Blackhole/Sinkhole
Routes all the fake IP traffic to a non-operating network server with null interface. The attackers can shift IP so this is only a temporary solution.
157
Domain Name System (DNS)
Responsible for translating human-friendly domain names into IP addresses that computers can understand.
158
DNS Cache Poisoning (DNS Spoofing)
Involves corrupting the DNS cache data of a DNS resolver with false information. This often redirects the traffic that cannot go into the cache to a fake website the attacker has set up to steal login credentials.
159
DNS Amplification
The attacker overloads a target system with DNS response traffic by exploiting the DNS resolution process.
160
DNS Tunneling
Uses DNS protocol over port 53 to encase non-DNS traffic, trying to evade firewall rules for command control or data exfiltration.
161
Domain Hijacking (Domain Theft)
Altering a domain name's registration without the original registrant's consent. This leads to loss of control over the website, and redirection of website traffic wherever the attacker wants.
162
DNS Zone Transfer Attack
The attacker mimics and authorized system to request and obtain the entire DNS zone data for a domain.
163
Directory Traversal
A type of injection attack that allows access to commands, files, and directories, either connected to the web document root directory or not.
164
Remote File Inclusion
Occurs when an attacker tries to execute a script to inject a remote file.
165
Local File Inclusion
Occurs when an attacker tries to add a file that already exists.
166
Arbitrary Code Execution
A vulnerability that allows an attacker to run a code or module that exploits a vulnerability.
167
Remote Code Execution
A type of arbitrary code execution that allows an attacker to transmit code from a remote host.
168
Vertical Privilege Escalation
From normal level user to higher level.
169
Horizontal Privilege Escalation
From one user to another of generally the same level.
170
Replay Attack
Type of network-based attack that involves maliciously repeating or delaying valid data transmissions.
171
Session Tokens
Unique data pieces that prevent session replay by attackers.
172
Cookie Poisoning
Modifying the contents of a cookie to be sent to a client's browser and exploit the vulnerabilities in an application.
173
Relay Attack
Occurs when attackers insert themselves in between two hosts and become part of the conversation.
174
SSL Stripping
Tricking the encryption application with an HTTP connection instead of an HTTPS connection to avoid SSL/TLS.
175
LDAP Injection
An attack in which LDAP statements, typically created by user input, are fabricated.
176
Command Injection
A threat actor is able to execute arbitrary shell commands via a vulnerable web application.
177
Process Injection
A method of executing arbitrary code in the address space of a separate live process.
178
Indicators of Compromise (IoC)
Data pieces that detect potential malicious activity on a network or system.
