Sec+ Book Flashcards
1
Q
Cross Site Scripting (XXS)
A
Attackers embed malicious html or java code into website to capture cookies or hased passwords
2
Q
Cross Site Request Forgery
A
attacker tricks user into preforming an action on a website that creates a html link
3
Q
Code Signing
A
provides digital signature for code +certification includes hash for code
4
Q
Static Code Analysis
A
examines code without running it
5
Q
Dynamic Code Analysis
A
examines code while running
6
Q
Sanboxing
A
isolated area used for testing
7
Q
Domain Hijacking
A
attacker changes registration of domain name without permissions from the owner, usually social engineering
8
Q
Shimming
A
produces solution that makes it appear that older drivers are compatible
9
Q
Refractoring
A
Rewriting code without changing behavior
10
Q
Memory Leak
A
a bug in the app that consumes more memory as it runs
11
Q
Integer overflow attack
A
attempts to create numeric value that is too big for an application to handle
12
Q
Buffer Overflow
A
when an app recieves more input or different input then expected
13
Q
Diffie Hellman
A
algorithm used to private share key between two paroes
14
Q
MD5
A
Message Digest - Produces 128 bit hash shown in hexadecimal
15
Q
SHA
A
Secure Hash Algorithm - Verifies integrity
16
Q
Diffusion
A
Small changes in plain text result in large changes in cipher
17
Q
Block Cipher
A
encrypts data in specific sized blocks of 8
Twofish
Blowfish
RC5
CFB
18
Q
Stream Cipher
A
encyrpts data as a stream of bits rather than blocks and is more efficent
RC4
TLS
AES
19
Q
Online Certificate Status Protocol (OCSP)
A
allows the client to query the ca with serial number of the certificate
20
Q
Transport Layer Security (TLS)
A
encrypts https traffic, replacement for SSL,port 443 (TLS)
21
Q
Secure Sockets Layer (SSL)
A
certificate based authentication + encrypts data with a combinations of both symmetric and asymmetric
22
Q
Pretty good Privacy (PGP)
A
Encrypts email traffic with RSA
23
Q
CA
A
Certificate Authority
24
Q
CRL
A
certificate revocation list, CA Revoked
25
XSRF
cross site request forgery
web application tricks user into performing acts on a site ex. purchasing
26
DAC
Discretionary access control
all objects have owners they modify permissions. DAC allows coworkers to share information within a corporate file system
27
AES
Advanced Encryption. BLOCK CIPHER encrypts in 128 bit blocks. Can use key sizes 128.192. 256
28
DES
data encryption standard. Used to provide confidentiality, replaced by AES and 3DES
29
DLP
Group of technologies that prevent data loss ex. block usb
30
DSA
Digital Signature Algorithm
encrypts hash of a message
31
LDAP
Lightweight directory access protocol
used to communicate with directories, indentifies objects and query strings using codes
32
IPSEC
Internet protocol security
a suite of protocols used to encrypt data in transit
33
IMAP
Internet Message Access Protocol. Store and manage emails on server
34
HMAC
Hashed based one message authentication code. A hashing algorithm to verify message of shared key
35
HOTP
HMAC Based one time password. one time password combines with a secrete key
36
FDE
Full disk encryption
37
RADIUS
Remote Authentication Dial In User Service
Process central authentication for remote access client
38
PKI
Public Key Infrastructure
Group tech used to request, create, manage, store, distribute or revoke digital certificates. Allows two entities privately share symmetric keys without any prior communication
39
PAP
Password Authentication Protcol. Old protocol that used cleartext
40
OSCP
Online Certificate Status Protocol
Alternative to CRL. Allows entities to query into the CA with the serial number of a certification
41
NTLM
New Technology LAN Manager. Protocols that provide CIA in windows systems,128 bits
42
NAC
Network Access Control - System inspects client to observe health
43
MSCHAPv2
Microsoft Challenge Handshake Authentication Protocol, provides mutual authentication
44
Mandatory Access Control (MAC)
restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (i.e., clearance) of users to access information of such sensitivity. method of limiting access to resources based on the sensitivity of the information that the resource contains and the authorization of the user to access information with that level of sensitivity. You define the sensitivity of the resource by means of a security label
45
RAT
Remote Access Trojan
46
RSA
Rivest, SHamir, Adleman - AYSEMMETRIC algorithm used to encrypt data and digitally sign transmissions
47
SAML
Security Assertion Markup Language
an XML based standard used to exchange authentication
IdP gigitally signs request confirming users identity, then this isent to the SP Service Provider to grant access
48
SCADA
Security Control and Data Acquisition - system used to control an Industry Control System
49
SOAR
(security orchestration, automation and response) is a stack of compatible software programs that enables an organization to collect data about cybersecurity threats and respond to security events with little or no human assistance.
50
SIEM
Security Information and Event Management - Security system that attempts to look at security events throughout organization
51
SNMPv3
Simple network management Protocol - monitor and manage network devices
52
SSH
Secure shell - used to encrypt network traffic
53
SSO
Single Sign on - Authentication method where users can access multiple resources on a network using a single sign on
54
STP
Spinning Tree Protocol - protects switches from looping
55
TACACS+
Terminal Access Controller Access Control System+
provides central authentication for remote access clients
56
TOTP
time based one time password
uses a timestamp that expires after a set time
57
TPM
Trusted Platform Module- chip on a motherboard that produces full disk encryption, remote attestation, and a secure boot process
58
UTM
Unified Threat Manager - group of security controls combined in a single solution
59
Technical Control
one that uses tech to reduce vulnerabilities. encryption, antivirus, IDS, firewalls, least priveldge
60
least privilege (PoLP)
user or entity should only have access to the specific data, resources and applications needed to complete a required task.
61
Administrative Controls
risk vulnerability assessments, day to day ops, security and awareness training
62
Preventive Controls
Prevent security incidents including hardening, user training, guards, account management
63
Corrective Controls
attempts to reverse the impact of an incident or problem after its occured, IPS< backups, recover plans
64
Compensating Control
when you cant use the primary control
65
Netstat
view stats for TCP/IP Protocols
65
Virtualization
allows multiple servers to operate on a single physical host
65
VM Sprawl
when the number of virtual machines (VMs) on a network reaches a point where administrators can no longer manage them effectively
65
ARP Command
view and manipluate the ARP cache
66
VM Escape
the attacker runs code on a VM that allows an operating system running within it to break out and interact directly with the hypervisor
67
RoleBAC
Role Based Access Control - used roles to manage rights and perms for users.
68
RuleBAS
uses rules like a firewall
69
ABAC
Attribute based access control uses policies to evaluate attributes and grant access when the system detects a match in the policy. You can also use an ABAC policy to enforce more complex behavior, such as 'users from the Sales department can only edit CRM records during work hours.
70
Crossover Error Rate
quality of the biometric system
71
False Rejection Rate
percentage of time false rejections occur
72
Smart Cards
credit card sized cards that authenticate using PKI. Certificate based
73
Kerberos
Authentication protocol using tickets
74
Airgap
A metaphor for physicals isolation, indicating that a system or network is completelty isolated from another system/network
75
DMZ
Demilitriziaed Zone - provides a layer of security for servers that are accessible from the internet
76
WAF
Protects a web server against web application attacks, usually placed in the DMZ
77
802.1x server
provides strong port secuirty using port based authentication. Prevents rogue devices form connection to a network by ensuring that only authorized clients can
78
SSID
Server Set Identifier is the name of the wireless network. Disabling ssid broadcast hides a wireless network from casual users
79
Bluejacking
sends information to a device
sending unsolicited messages thru the phone.
80
Bluesnarfing
g takes information from a device
unauthorized access from a bluetooth device
81
IaaS
Infastrucutre as a service provides hardware resources via cloud. Limit the size of an org's hardware footprint
82
PaaS
Platform As A service - provides an easy to configure OS and on demand computing for customers
83
chmod
changes commands on a linux system
84
Watering Hole Attack
attackers modify a sites that a targeted groups visits and infects them with malware
85
APR Poisoning
misleads the computer about the actual mac. used for man in the middle attacks
86
Hash Collision
occurs when the hashing algorithm creates the same hash for different passwords
87
Birthday Attack
Attacker is able to create a passwords that uses the same has as the actual users password
88
What attacks does input validation prevent?
buffer overflow, SQL Injection, command injection, cross site scripting, XSRF
89
race condition
where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events, leading to unexpected or inconsistent results
90
Black Box Testing
pen testing with zero prior knowledge
91
White Box Testing
pen testing with full knowledge of the enviroment
92
TCPdump
a command line protocol analyzer.
93
Nmap
network scanner run form the command line
94
Netcat
used to remotley administer servers. can be used for banner grabbing
95
syslogs
identify when service starts and stops
96
SIEM
Security Information and Event Management
aggregate and correlate logs from multiple sources in a single location. continous monitoring and automated alerting and triggering
97
Physical Controls
Tech controls you can touch
98
Cable Locks
Secure mobile computers and laptops
98
Airgap
physical sec control that ensures a computer or network is physically isolated from another computer or network
99
RPO
Recovery Point Object
Refers to the amount of data you can afford to lose
100
RTO
Recover Time Object
maximum amount of time it should take to restore a system after an outage
101
MTBF
Mean Time Before Repair
average time between failures
101
MTTR
Mean Time To Repair
average time it takes to restore a failed system
102
Table Top Exercises
Discussion based only
102
Symmetric Ecnyrption
Uses the same key to encrypt and decrypt data
103
Asymmetric Encyrption
used a public and private key to create a matched pair
104
Non-Repudiation
prevents a party from denying an action
105
RC4
Commonly used stream cipher, symmetric
106
These methods secure email with encryption and digital signatures
S/MIME and PGP, both use RSA and certificates
107
Key Escrow
stores cop of private keys used in PKI
108
Wildcard Certificates
use a * for child domains to reduce the admin burden of managing certificates
109
Purging
all sensitive data has been removed from the device
110
Wiping
completely removing all remnants of data on a disk by using 1s and 0s to overwrite bits
111
Degaussing
a very powerful electronic magnet that renders data on a tape and data disk drives unreadable
112
AUP
Acceptable Use Policy
proper system usage for users and spells out rules of behavior when accessing systems and networks
113
NDA
Non disclosure Agreement
ensure that proprietary data is not shared
114
Data Owner
Overall responsible for the data
114
Privacy Officer
Ensure the company complies with relevant laws to protect private data, PII, PHI
114
SLA
Service Level Agreement
agreement between a company and a vendor that stipulated performance expectations such as min uptime and max downtime
115
Privacy Custodian/Steward
handles routine tasks to protect data
116
Order of Votality from Most to Least volatile
cache memory, RAM, paging file, hard drive data, logs stored remote, achrived media
117
DNS Blackholing
uses a list of known domains/IP addresses belonging to malicious hosts and uses an internal DNS server to create a fake reply.
118
Proximity Cards
commonly used with physical access control systems and relies upon RFID devices embedded into a token
119
Physical Controls
Any security measures that are designed to deter or prevent
unauthorized access to sensitive information or the systems that
contain it
Alarm systems, locks, surveillance cameras, identification cards, and
security guards
120
Technical Controls
Safeguards and countermeasures used to avoid, detect,
counteract, or minimize security risks to our systems and
information
Smart cards, encryption, access control lists (ACLs), intrusion detection
systems, and network authentication
121
Administrative Controls
Focused on changing the behavior of people instead of removing
the actual risk involved
Policies, procedures, security awareness training, contingency planning,
and disaster recovery plans. User training is the most cost-effective security control to use
122
White Hats Hacker
Non-malicious hackers who attempt to break into a company’s
systems at their request
123
Open-Source Intelligence (OSINT)
Methods of obtaining information about a person or organization through public records, websites, and social media
124
Kill Chain
A model developed by Lockheed Martin that describes the stages by which a threat actor progresses a network intrusion
125
Polymorphic
Advanced version of an encrypted virus that changes itself
every time it is executed by altering the decryption module
to avoid detection
126
Watering Holes
Malware is placed on a website that you know your potential victims will
access
ex. diontrainings.com rather than diontraining.com
127
Privilege Escalation
Occurs when you are able to exploit a design flaw or bug in a system to
gain access to resources that a normal user isn’t able to access
128
Logic Bomb
Malicious code that has been inserted inside a program and will execute
only when certain conditions have been met
129
Signature-based Detection
A specific string of bytes triggers an alert
130
True positive
Malicious activity is identified as an attack
131
False positive
Legitimate activity is identified as an attack
132
True negative
Legitimate activity is identified as legitimate traffic
133
False negative
Malicious activity is identified as legitimate traffic
134
Basic Input Output System (Bios)
Firmware that provides the computer instructions for how to accept input
and send output
▪ Unified Extensible Firmware Interface (UEFI)
▪ BIOS and UEFI are used interchangeable in this lesson
135
SCCM
Microsoft’s System Center Configuration Management
135
Network Attached Storage (NAS)
Storage devices that connect directly to your organization’s network. NAS systems often implement RAID arrays to ensure high availability
136
Unified Extensible Firmware Interface (UEFI)
A type of system firmware providing support for 64-bit CPU
operation at boot, full GUI and mouse operation at boot, and
better boot security
137
Secure Boot
A UEFI feature that prevents unwanted processes from executing
during the boot operation
138
Hypervisor
Manages the distribution of the physical resources of a host machine
(server) to the virtual machines being run (guests)
139
Defense in Depth
Layering of security controls is more effective and secure than relying on
a single control
140
Directory Traversal
Method of accessing unauthorized directories by moving through the
directory structure on a remote server
141
Race Conditions
A software vulnerability when the resulting outcome from execution processes is
directly dependent on the order and timing of certain events, and those events
fail to execute in the order and timing intended by the developer
142
MAC Flooding
Attempt to overwhelm the limited switch memory set aside to store the
MAC addresses for each port
Switches can fail-open when flooded and begin to act like a hub
143
Access Control List
▪ An ordered set of rules that a router uses to decide whether to permit or
deny traffic based upon given characteristics
▪ IP Spoofing is used to trick a router’s ACL
144
Bastion Hosts
▪ Hosts or servers in the DMZ which are not configured with any services
that run on the local network
▪ To configure devices in the DMZ, a jumpbox is utilized
145
Network Address Translation (NAT)
Process of changing an IP address while it transits across a router
▪ sing NAT can help us hide our network IPs
146
NAT Filtering
Filters traffic based upon the ports being utilized and type of connection
(TCP or UDP)
147
Web Application Firewall
Firewall installed to protect your server by inspecting traffic being sent to
a web application
▪ A WAF can prevent a XSS or SQL injection
148
Proxy Server
A device that acts as a middle man between a device and a remote server
149
Unified Threat Management
Combination of network security devices and technologies to provide
more defense in depth within a single device. UTM may include a firewall, NIDS/NIPS, content filter, anti-malware, DLP,
and VPN. UTM is also known as a Next Generation Firewall (NGFW)
150
Virtual Desktop Infrastructure (VDI)
VDI allows a cloud provider to offer a full desktop operating system to an
end user from a centralized server
151
Software as a Service (SaaS)
Provides all the hardware, operating system, software, and applications
needed for a complete service to be delivered
152
Infrastructure as a Service (IaaS)
Provides all the hardware, operating system, and backend software
needed in order to develop your own software or service
153
Platform as a Service (PaaS)
Provides your organization with the hardware and software needed for a
specific service to operate
154
Domain Controller
A server that acts as a central repository of all the user accounts and their
associated passwords for the network
155
FTP Server
A specialized type of file server that is used to host files for distribution
across the web
156
Continuous Integration
▪ A software development method where code updates are tested and
committed to a development or build server/code repository rapidly
▪ Continuous integration can test and commit updates multiple times per
day
▪ Continuous integration detects and resolves development conflicts early
and often
157
Continuous Deployment
Continuous deployment focuses on automated testing and release of
code in order to get it into the production environment more quickly. A software development method where application and platform updates
are committed to production rapidly
158
Continuous Delivery
A software development method where application and platform
requirements are frequently tested and validated for immediate
availability. Continuous delivery focuses on automated testing of code in order to get it ready for release
159
Ping Flood
An attacker attempts to flood the server by sending too many ICMP echo
request packets (which are known as pings)
160
Smurf Attack
Attacker sends a ping to subnet broadcast address and devices reply to
spoofed IP (victim server), using up bandwidth and processing
161
SYN Flood
Variant on a Denial of Service (DOS) attack where attacker initiates
multiple TCP sessions but never completes the 3-way handshake
162
Man-in-the-Middle (MITM)
Attack that causes data to flow through the attacker’s computer where
they can intercept or manipulate the data
163
Watering Hole
Occurs when malware is placed on a website that the attacker knows his
potential victims will access
164
Replay Attack
Network-based attack where a valid data transmission is fraudulently or
malicious rebroadcast, repeated, or delayed
165
Service Set Identifier (SSID)
▪ Uniquely identifies the network and is the name of the WAP used by the
clients
▪ Disable the SSID broadcast in the exam
165
Evil Twin
A rogue, counterfeit, and unauthorized WAP with the same SSID as your
valid one
166
Simultaneous Authentication of Equals (SAE)
▪ A secure password-based authentication and password-authenticated key
agreement method
166
WiFi Protected Access version 2 (WPA2)
802.11i standard to provide better wireless security featuring AES with a
128-bit key, CCMP, and integrity checking
▪ WPA2 is considered the best wireless encryption available
167
!! if you are asked about.....
Open == No security or protection provided
WEP + IV
WPA == TKIP and RC4
WPA2 = CCMP AND AES
168
HVAC
HVAC systems may be connected to ICS and SCADA networks
169
OpenID
An open standard and decentralized protocol that is used to
authenticate users in a federated identity management system
● User logs into an Identity Provider (IP) and uses their account at
Relying Parties (RP)
● OpenID is easier to implement than SAML
● SAML is more efficient than OpenID
170
Security Assertion Markup Language (SAML)
Attestation model built upon XML used to share federated identity
management information between systems
171
802.1x
IEEE standard that defines Port-based Network Access Control (PNAC) and
is a data link layer authentication technology used to connected devices
to a wired or wireless LAN
▪ RADIUS
▪ TACACS+
▪ 802.1x can prevent rogue devices
172
Extensible Authentication Protocol (EAP
A framework of protocols that allows for numerous methods of
authentication including passwords, digital certificates, and public key
infrastructure
173
Lightweight Directory Access Protocol (LDAP
A database used to centralize information about clients and objects on
the network
Unencrypted Port 389
Encrypted Port 636
Active Directory is Microsoft’s version
174
Challenge Handshake Authentication Protocol (CHAP)
Used to provide authentication by using the user’s password to encrypt a
challenge string of random numbers
175
Virtual Private Network (VPN)
Allows end users to create a tunnel over an untrusted network and
connect remotely and securely back into the enterprise network. Client-to-Site VPN or Remote Access VPN
176
Remote Authentication Dial-In User Service (RADIUS)
Provides centralized administration of dial-up, VPN, and wireless
authentication services for 802.1x and the Extensible Authentication
Protocol (EAP)
177
Discretionary Access Control (DAC)
The access control policy is determined by the owner
1. Every object in a system must have an owner
2. Each owner determines access rights and permissions for each
object
178
Mandatory Access Control (MAC)
An access control policy where the computer system determines
the access control for an object. The owner chooses the permissions in DAC but in MAC, the computer does. MAC relies on security labels being assigned to every user (called a subject) and every file/folder/device or network connection (called an object). Data labels create trust levels for all subjects and objects
179
Implicit Deny
All access to a resource should be denied by default and only be allowed
when explicitly stated
180
Separation of Duties
Requires more than one person to conduct a sensitive task or operation
180
Job Rotation
Occurs when users are cycled through various jobs to learn the overall
operations better, reduce their boredom, enhance their skill level, and
most importantly, increase our security
181
chmod
Program in Linux that is used to change the permissions or rights of a file
or folder using a shorthand number system
182
Risk Avoidance
A strategy that requires stopping the activity that has risk or
choosing a less risky alternative
183
Quantitative analysis
s uses numerical and monetary values to calculate risk
184
Dictionary Attack
Method where a program attempts to guess the
password by using a list of possible passwords
185
Rainbow Table
List of precomputed valued used to more quickly break a password since values don’t have to be calculated for each password being guessed. crack the password hashes in a database
186
Simple Network Management Protocol (SNMP)
A TCP/IP protocol that aids in monitoring network-attached devices and
computers. SNMP is incorporated into a network management and monitoring system
187
Runbook
An automated version of a playbook that leaves clearly defined
interaction points for human analysis
188
dd
A command line utility used to copy disk images using a bit by bit copying
process
189
FTK Imager
A data preview and imaging tool that lets you quickly assess electronic
evidence to determine if further analysis with a forensic tool is needed
190
Memdump
A command line utility used to dump system memory to the standard
output stream by skipping over holes in memory maps
191
SSH
Utility that supports encrypted data transfer between two computers for
secure logins, file transfers, or general purpose connections
192
netstat
Utility that displays network connections for Transmission Control
Protocol, routing tables, and a number of network interface and network
protocol statistics
193
Risk Appetite vs Risk Acceptance
Risk acceptance: choosing (or not choosing) to take an action that affects risk to the organization
Risk appetite: how much risk you can accept.
