Security+ 501 1.0 - 6.0
components
CA, Intermediate CA, CRL, OCSP, CSR, Certificate, Public key, Private key, Object identifiers (OID)
backup concepts
Differential, Incremental, Snapshots, Full
storage segmentation
when the device is used on the enterprise network, a corporate workspace with a defined selection of apps and a separate storage container is created
insiders
when the perpetrator of an attack is a member of, ex-member of, or somehow affiliated with the organization's own staff, partners, or contractors
vulnerabilities due to end-of-life systems
when the system has reached a point where it can no longer function as intended. This status can be reached for many reasons, such as lack of vendor support, a failure to instantiate on newer hardware, or incompatibility with other aspects of a system; valuable data that is still on the system before it is disposed
forward proxy
when we have a proxy on the inside of our network that we're using to help our users protect themselves from the internet
antispoofing
when you implement an access control list (ACL) with deny statements for private network addresses spaces
diffie-hellman
a key exchange method over an insecure communications channel; a key agreement protocol, published in 1976 by Whitfield Diffie and Martin Hellman
session affinity/source IP
a layer 4 approach to handling user sessions. It means that when a client establishes a session, it becomes stuck to the node that first accepted the request
certificate revocation list (CRL)
a list of certificates that were revoked before their expiration date
access control list (ACL)
a list of subjects and the rights or permissions they have been granted on the object; network traffic that can be filtered; allow or disallow traffic based on tuples
warm site
a location that is dormant or performs noncritical functions under normal conditions, but which can be rapidly converted to a key operations site if needed
biometric lock
a lock may be integrated with a biometric scanner
role-based awareness training
a system for identifying staff performing security-sensitive roles and grading the level of training and education required
short message service (SMS)
a system for sending text messages between cell phones
steganography
a technique for obscuring the presence of a message, often by embedding information within a file or other entity.
failover
a technique that ensures a redundant component, device, application, or site can quickly and efficiently take over the functionality of an asset that has failed
obfuscation
a technique that essentially "hides" or "camouflages" code or other information so that it is harder to read by unauthorized users.
obfuscation/camouflage
a technique that essentially "hides" or "camouflages" code or other information so that it is harder to read by unauthorized users.
heuristic
a technique that leverages past behavior to predict future behavior.
key stretching
a technique that strengthens potentially weak cryptographic keys, such as passwords or passphrases created by people, against brute force attacks
external actor
a threat actor that comes from outside the organization
internal actor
a threat actor that comes from within an organization
oauth (open authorization)
a token-based authorization protocol that is often used in conjunction with OpenID.
Network Scanners
a tool for probing a network for ports. The tool will report back to the user which ports are open ("listening"), which are closed and which are filtered. An example of a network scanner is Nmap.
skimming attack
a type of RFID attack in which an attacker uses a fraudulent RFID reader to read the signals from a contactless bank card
ransomware
a type of Trojan malware that tries to extort money from the victim
birthday attack
a type of brute force attack aimed at exploiting collisions in hash functions
self-signed certificate
a type of digital certificate that is owned by the entity that signs it
Supervisory Control and Data Acquisition (SCADA)
a type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographically large areas
air gap
a type of network isolation that physically separates a network from all other networks.
air gaps
a type of network isolation that physically separates a network from all other networks.
Secure/Multipurpose Internet Mail Extensions (S/MIME)
an email encryption standard that adds digital signatures and public key cryptography to traditional MIME communications.
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCP)
an encryption protocol used for wireless LANs that addresses the vulnerabilities of the WEP protocol
multimedia message service (MMS)
an extension of short message service (SMS) that enables messages that include text, sound, images, and video clips to be sent from a cell phone or PDA to other phones or e-mail addresses
media access control filtering (MAC filtering)
applying an access control list to a switch or access point so that only clients with approved MAC addresses can connect to it.
firewalls
are the devices principally used to implement security zones, such as intranet, demilitarized zone (DMZ), and the Internet
spam filter
are the first line of defense that protects organizations from phishing attacks
diffusion
change one character of the input, and many characters change of the output; makes ciphertext change drastically upon even the slightest changes in the plaintext input
identification of critical systems
compiling an inventory of its business processes and its tangible and intangible assets and resources
agile
focuses on iterative and incremental development to account for evolving requirements and expectations.
carrier unlocking
for either iOS or Android, this means removing the restrictions that lock a device to a single carrier
custom firmware
for some devices, it is necessary to exploit a vulnerability
distinguished encoding rules (DER)
format designed to transfer syntax for data structures
privilege escalation attack
gain higher-level access to a system to exploit a vulnerability
non-intrusive scan
gather information, don't try to exploit a vulnerability; vulnerability scanners; a test that does not disrupt the operations of a system;
bcrypt
generates hashes from passwords; a key-derivation function based on the Blowfish cipher algorithm
sideloading
giving users and businesses the flexibility to directly install apps without going through the storefront interface
dumpster diving
going through an organization's (or individual's) garbage to try to find useful documents (or even files stored on discarded removable media)
Platform-Specific guides
guides mean't for platforms
Vendor-Specific guides
guides mean't for vendors
active reconnaissance
has more risk of detection; the use of tools, such as network scanners & vulnerability scanners, to analyze a system, network or organization
unauthorized software
has the potential to bring malware into a network
logic bomb
having infected a system, a disgruntled person waits for a preconfigured system or user event to be triggered
stapling
having the SSL/TLS web server periodically obtain a time-stamped OCSP response from the CA
public cloud/multi-tenant
hosted by a third party and shared with other subscribers. This is what many people understand by "cloud computing." As a shared resource, there are risks regarding performance and security
license compliance violation
how software can only be used when properly licensed and under what circumstances you would find software being used outside of the license scope, which would therefore be problematic
finance
how the score is kept
passive
may sit on the inner network side of a firewall, on the DMZ, or on the WAN side. Placement on either the DMZ or inner network is preferable in that it will make less noise.
application server guide
secure configuration guides useful for configuring applications servers
network infrastructure devices
secure configuration guides useful for configuring network infrastructure devices
operating system guide
secure configuration guides useful for configuring operating systems
web server guide
secure configuration guides useful for configuring web servers
Secure IMAP
secured by establishing an SSL/TLS tunnel. The default port for IMAPS is TCP port 993
general purpose guides
security configuration guides that are generic in scope.
vendor diversity
security controls are sourced from multiple suppliers
file system security
security functions provided by access control lists (ACLs) for protecting files managed by the operating system.
interconnection security agreement (ISA)
security guide for Interconnecting Information Technology Systems. Any federal agency interconnecting its IT system to a third party must create an ISA to govern the relationship. An ISA sets out a security risk awareness process and commits the agency and supplier to implementing security controls
location-based policies
policies that prevent users from logging on from certain locations, or require that they log on only from specific locations.
password reuse
policy defines whether or not a user can ever use the same password again. Can be used in conjunction with password history.
personnel issues
policy violation, insider threat, social engineering, social media, and personal email
IEEE 802.1x
port-based network access control (NAC) with no access until authentication
something you have
possession (smart card, USB token, or key fob that contains a chip with authentication data, such as a digital certificate)
bluejacking
sending of unsolicited messages to another device via Bluetooth
ping
sends an echo request to a machine to determine if communication is possible.
filters
separates traffic from router
array index overflow
possible to exploit unsecure code to load the array with more values than it expects, creating an exception that could be exploited
satellite communications (SATCOM) connection
services such as voice and video calling, Internet access, faxing, and television and radio broadcasting.
legal implications
refer to the positive or negative legal consequences or commitments as a result of an action or choice made by an individual or group
aggregation
referring to the gathering of log and event data from the different network security devices used on the network.
inline
refers to being in between the firewall and the rest of the network environment.
banner grabbing
refers to probing a server to try to elicit any sort of response that will identify the server application and version number or any other interesting detail about the way the server is configured. This information allows an attacker to identify whether the server is fully patched and to look up any known software vulnerabilities that might be exposed.
supporting confidentiality
secrecy and privacy. Encryption (file-level, drive-level, email)
data encryption standard (DES)
symmetric encryption protocol. DES and its replacement 3DES are considered weak in comparison with modern standards, such as AES
split tunnel
the client accesses the Internet directly using its "native" IP configuration and DNS servers.
scheduling algorithm
the code and metrics that determine which node is selected for processing each incoming request
public key
the component of asymmetric encryption that can be accessed by anyone.
voice recognition
the computer's capability of distinguishing spoken words
security automation
the concept of scripted or programmed infrastructure can also be applied to security infrastructure (firewalls, IDS, SIEM, and privilege management)
safety
the condition of being protected from risk
collectors
to store and interpret (or parse) the logs from different types of systems (host, firewall, IDS sensor, and so on), and to account for differences between vendor implementations
host health checks
to verify the status of any system attempting to connect to the network
advanced malware tools
tools that can block malware from running by blocking file signature, heuristics/Anomalous behavior, sandboxing, virtualizing. Need to be routinely updated with the latest definitions.
patch management tools
tools used to manage security patches
transitive trust
the trust extends to other trusted domains. For example, if Domain A trusts Domain B, and Domain B trusts Domain C, then Domain A also trusts Domain C
remote access
the user's device does not make a direct cabled or wireless connection to the network. The connection occurs over or through an intermediate network, usually a public Wide Area Network
phishing
to email users with the purpose of tricking them to reveal personal information or click on a link
signs
to enforce the idea that security is tightly controlled. Beyond basic no trespassing signs, some homes and offices also display signs from the security companies whose services they are currently using. These may convince intruders to stay away
session hijacking attack
to impersonate a user on a website, using the session ID that is stored in their cookies
cameras
to perform facial recognition
impersonation
to pretend to be someone else in order to obtain personal or sensitive information
URL hijacking attack
to purchase a domain name that is similar to a legitimate domain name
protected cabling
to reduce the likelihood of emission spillage
accounting
tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted
hashing
transforming plaintext of any length into a short code called a hash
stream vs block
transmit byte by byte, vs in groups
jamming attack/interference attack
transmits noise or radio signals on the same frequency that is used by a wireless network, which prevents users from connecting to the network
security through obscurity
trying to keep the design of a security system secret as its only method of security; keeping something a secret by hiding it
disabling unnecessary ports and services
turning off any service that is not being used
identify common misconfigurations
typical results from a vulnerability assessment; use databases and dictionaries that consists of misconfigurations, such as open ports, weak passwords, default accounts and passwords, sensitive data and security & configuration errors
guest
unauthenticated users
Unencrypted credentials/clear text
unencrypted, readable data that is not meant to be encrypted
firewall
universal security control
firmware over-the-air (OTA) updates
updates can be delivered wirelessly, either through a Wi-Fi network or the data connection
vehicle
use a substantial amount of electronics, all of which can potentially have vulnerabilities that could be exploitable. As well as computer systems to control the vehicle's engine, steering, and brakes, there may be embedded systems for in-vehicle entertainment and for navigation (sat-nav), using Global Positioning Systems (GPS)
multipartite viruses
use both boot sector and executable file infection methods of propagation
hosted
used by a third party for the exclusive use of the organization. This is more secure and can guarantee a better level of performance but is correspondingly more expensive.
netcat or nc
used for reading from or writing to network connections using TCP or UDP.
track person hours
used to determine whether the cost of the incident was justified
third-party app stores
used to distribute unauthorized, non-approved applications. Can be downloaded by jailbroken/rooted devices.
downgrade attack
used to facilitate a Man-in-the-Middle attack by requesting that the server use a lower specification protocol with weaker ciphers and key lengths
zones/topologies
DMZ, Extranet, Intranet, Wireless, Guest, Honeynets, NAT, Ad hoc
Protocols
DNSSEC, SSH, S/MIME, SRTP, LDAPS, FTPS, SFTP, SNMPv3, SSL/TLS, HTTPS, Secure POP/IMAP
Connection methods
Cellular, WiFi, SATCOM, Bluetooth, NFC, ANT, Infrared, USB
Industry-standard frameworks and reference architectures
Regulatory, Non-regulatory, National vs. international- Industry-specific frameworks
time synchronization
SIEM logs may be collected from appliances in different geographic locations and, consequently, may be configured with different time zones. This can cause problems when correlating events and analyzing logs.
risk assessment
SLE, ALE, ARO, Asset value, Risk register, Likelihood of occurrence, Supply chain assessment, Impact, Quantitative, Qualitative,Testing, Penetration testing authorization, Vulnerability testing authorization, risk response techniques, accept, transfer, avoid, mitigate
Cloud deployment models
SaaS, PaaS, IaaS, Private, Public, Hybrid, Community
environment
Development, Test, Staging, Production
threat assessment
Environmental, Artificial/manufactured, Internal vs. external
continuity of operations planning (COOP)
Exercises/tabletop, After-action reports, Failover, Alternate processing sites, Alternate business practice
deprovisioning
The process of removing an application from packages or instances.
hybrid cloud
a combination of public and private clouds
tcpdump
a command-line packet sniffing utility.
DDoS mitigator
a hardware device that identifies and blocks real-time distributed denial of service (DDoS) attacks.
SSL/TLS accelerators
a hardware interface that helps offload the resource-intensive encryption calculations in SSL/TLS to reduce overhead for a server.
Password-Based Key Derivation Function 2 (PBKDF2)
a key derivation function used in key stretching to make potentially weak cryptographic keys such as passwords less susceptible to brute force attacks
root certificate
a self-signed public key certificate that identifies the root CA
certificate authority (CA)
a server that can issue digital certificates and the associated public/private key pairs
kerberos
an authentication service that is based on a time-sensitive ticket-granting system.
alarms
an electrical, electronic, or mechanical device that serves to warn of danger by means of a sound or signal.
smart cards
credit card sized card containing a microchip for data storage and processing.
types/category
crucial to enabling swift identification and remediation of the incident
detective
may not prevent or deter access, but it will identify and record any attempted or successful intrusion
network intrusion detection system (NIDS)
(network intrusion detection system) A system that uses passive hardware sensors to monitor traffic on a specific segment of the network.
intimidation (principle)
"there will be bad things if you don't help" and "if you don't help me, the payroll checks won't be processed"
Network Intrusion Prevention System (NIPS)
(Network-Based Intrusion Prevention System) An inline security device that monitors suspicious network and/or system traffic and reacts in real time to block it.
domain information groper (dig)
(domain information groper) Utility to query a DNS and return information about a particular domain name.
router
A network device that links dissimilar networks and can support multiple alternate paths between location-based parameters such as speed, traffic loads, and cost.
symmetric algorithms
AES, DES, 3DES, RC4, Blowfish/Twofish
mobile device management concepts
Application management, Content management, Remote wipe, Geofencing, Geolocation, Screen locks, Push notification services, Passwords and pins, Biometrics, Context-aware authentication, Containerization, Storage segmentation, and Full device encryption
geographic considerations
Off-site backups, Distance, Location selection, Legal implications, Data sovereignty
automation/scripting
Automated courses of action, Continuous monitoring, Configuration validation
key stretching algorithms
BCRYPT, PBKDF2
agreement types
BPA, SLA, ISA, MOU/MOA
deployment models
BYOD, COPE, CYOD, Corporate-owned, VDI
routing and switching use case
Basic layer 2 switches provide ports and Virtual LANs (logical groupings of clients) for wired and (via an access point) wireless devices. Traffic between logical networks is controlled by layer 3 switches with LAN routing functionality. WAN/edge routers provide services such as web, email, and communications access for corporate clients and VPN access to the corporate network for remote clients
data destruction and media sanitization
Burning, Shredding, Pulping, Pulverizing, Degaussing, Purging, Wiping
cipher modes
CBC, GCM, ECB, CTR, Stream vs. block
camera use
CCTV cameras
data acquisition
Capture system image, Network traffic and logs, Capture video, Record time offset, Take hashes, Screenshots, Witness interviews
nslookup
Command-line program in Windows used to determine exactly what information the DNS server is providing about a specific host name.
data sensitivity labeling and handling
Confidential, Private, Public, Proprietary, PII, PHI
account policy enforcement
Credential management, Group policy, Password complexity, Expiration, Recovery, Disablement, Lockout- Password history, Password reuse, Password length
Implementation vs. algorithm selection
Crypto service provider, Crypto modules
network address allocation use case
DHCP provides an automatic method
certificate formats
DER, PEM, PFX, CER, P12, P7B
incident response plan
Documented incident, types/category definitions, Roles and responsibilities, Reporting requirements/escalation, Cyber-incident response teams, Exercise
authentication protocols
EAP, PEAP, EAP-FAST, EAP-TLS, EAP-TTLS, IEEE 802.1x, RADIUS Federation
file transfer use case
Email and Instant Messaging (IM)
hardware/firmware security
FDE/SED, TPM, HSM, UEFI/BIOS, Secure boot and attestation, Supply chain, Hardware root of trust, EMI/EM
biometric factors
Fingerprint scanner, Retinal scanner, Iris scanner, Voice recognition, Facial recognition, False acceptance rate, False rejection rate, Crossover error rate
cross-site scripting (XSS) attack
HTML or JavaScript code entered into a web page form to retrieve sensitive information from the website; one of the most powerful input validation exploits
environmental controls
HVAC, Hot and cold aisles, Fire suppression
tokens
Hardware, Software, HOTP/TOTP
recovery sites
Hot site, Warm site, Cold site
pass-the-hash (PtH) attack
If an attacker can obtain the hash of a user password, it is possible to present the hash (without cracking it) to authenticate to network protocols; an attack that discovers the hash of a user's password and uses it to log on to the system as the user
behavioral-based detection
In IDSs and IPSs, an operation mode where the analysis engine recognizes baseline normal traffic and events, and generates an incident when an anomaly is detected.
full tunnel
Internet access is mediated by the corporate network, which will alter the client's IP address and DNS servers and may use a proxy.
access control lists (ACLs)
It is also possible to apply permissions to ensure only authorized users can read or modify the data
general concepts
Least privilege, Onboarding/offboarding, Permission auditing and review, Usage auditing and review, Time-of-day restrictions, Recertification, Standard naming convention, Account maintenance, Group-based access control, Location-based policies
impact
Life, Property, Safety, Finance, Reputation
common use cases
Low power devices, Low latency, High resiliency, Supporting confidentiality, Supporting integrity, Supporting obfuscation, Supporting authentication, Supporting non-repudiation, Resource vs. security constraints
access control models
MAC, DAC, ABAC, Role-based access control, Rule-based access control
hashing alorithms
MD5, SHA, HMAC, RIPEMD
recording microphone
MDM software may also be able to lock down use of features
personnel management
Mandatory vacations, Job rotation, Separation of duties, Clean desk, Background checks, Exit interviews, Role-based awareness training, Data owner, Systems administrator, System owner, User, Privileged user, Executive user, NDA, Onboarding, Continuing education, Acceptable use policy/rules of behavior, Adverse actions
special purpose
Medical devices, Vehicles, Aircraft/UAV
Time synchronization use case
Network Time Protocol (NTP)
logs
OS and applications software can be configured to record data about activity on a computer. Logs can record information about events automatically.
concepts
Online vs. offline CA, Stapling, Pinning, Trust model, Key escrow, Certificate chaining
data roles
Owner, Steward/custodian, Privacy officer
certificate-based authentication
PIV/CAC/smart card, IEEE 802.1x
methods
PSK vs Enterprise vs Open, WPS, Captive portals
segregation/segmentation/isolation
Physical, Logical (VLAN), Virtualization, Air gaps
Benchmarks/secure configuration guides
Platform/vendor-specific guides, Web server, Operating system, Application server, Network infrastructure devices, General purpose guides
incident response process
Preparation, Identification, Containment, Eradication, Recovery, Lessons learned
secure coding techniques
Proper error handling, Proper input validation, Normalization, Stored procedures, Code signing, Encryption, Obfuscation/camouflage, Code reuse/dead code, Server-side vs. client-side, execution and validation, Memory management, Use of third-party libraries and SDKs, Data exposure
physical access control
Proximity cards, Smart cards
asymmetric algorithms
RSA, DSA, Diffie-Hellman, Groups, DHE, ECDHE, Elliptic curve, PGP/GPG
Secure DevOps
Security automation, Continuous integration, Baselining, Immutable systems, Infrastructure as code
security device/technology placement
Sensors, Collectors, Correlation engines, Filters, Proxies, Firewalls, VPN concentrators, SSL accelerators, Load balancers, DDoS mitigator, Aggregation switches, Taps and port mirror
tunneling/VPN
Site-to-site, Remote access
non-persistence
Snapshots, Revert to known state, Rollback to known configuration, Live boot media
code quality and testing
Static code analyzers, Dynamic analysis (e.g., fuzzing), Stress testing, Sandboxing, Model verification
in-band
The management channel could use the same network as the link being monitored (in-band)
enforcement and monitoring
Third-party app stores, Rooting/jailbreaking, Sideloading, Custom firmware, Carrier unlocking, Firmware OTA updates, Camera use, SMS/MMS, External media, USB OTG, Recording microphone, GPS tagging, WiFi direct/ad hoc, Tethering, Payment method
hypervisor
Type I, Type II, Application cells/container
operating systems
Types, Network, Server, Workstation, Appliance, Kiosk- Mobile OS, Patch management, Disabling unnecessary ports and services, Least functionality, Secure configurations, Trusted operating system, Application whitelisting/blacklisting, Disable default accounts/passwords
account types
User account, Shared and generic accounts/credentials, Guest accounts, Service accounts, Privileged accounts
defense-in-depth/layered security
Vendor diversity, Control diversity, Administrative, Technical, User training
Use cases
Voice and video, Time synchronization, Email and web, File transfer, Directory services, Remote access, Domain name resolution, Routing and switching, Network address allocation, Subscription services
Voice and video use case
Voice over IP (VoIP), web conferencing, and Video Teleconferencing (VTC)
write once, run everywhere
WORM
Cryptographic protocols
WPA, WPA2, CCMP, TKIP
types of certificate
Wildcard, SAN, Code signing, Self-signed, Machine/computer, Email, User, Root, Domain validation, Extended validation
peripherals
Wireless keyboards, Wireless mice, Displays, WiFi-enabled MicroSD cards, Printers/MFDs, External storage devices, Digital cameras
obfuscation
XOR, ROT13, Substitution ciphers
use of third-party libraries and SDKs
a common solution to rewriting code but may introduce vulnerabilities into an application if they are not securely coded or are improperly used.
single point of failure
a component or system that would cause a complete interruption of a service if it failed
honeypot
a "fake" server designed to appear like the real thing. It's meant to be a trap for attackers. Because it's bait, any traffic to it can be assumed to be malicious.
staging environment
a "production like" environment to test installation, configuration and migration scripts. Performance testing, load testing, processes required by other teams, boundary partners, etc.
privacy-enhanced electronic mail (PEM)
a DER-encoded binary file can be represented as ASCII characters (letters and numbers, easy to email, readable)
permanent agent
a NAC agent that is installed on a client. It checks the client for health.
dissolvable agent
a NAC agent that runs on a client, but deletes itself later. It checks the client for health. Compare with permanent agent.
secure boot
a UEFI feature that prevents unwanted processes from executing during the boot operation.
ifconfig
a UNIX/Linux-based utility used to gather information about the IP configuration of the network adapter or to configure the network adapter. It has been replaced with the ip command in most Linux distributions.
virtual desktop environment (VDE)
a VM that runs a desktop operating system
ipconfig
a Windows-based utility used to gather information about the IP configuration of a workstation.
full
a backup type in which all selected files, regardless of prior state, are backed up.
yagi
a bar with fins
least privilege
a basic principle of security stating that something should be allocated the minimum necessary rights, privileges, or information to perform its role.
Public Key Cryptography Standards #12 (PKCS#12/.P12)
a binary format used to store a server certificate, intermediate certificate, and a private key in one file that can be encrypted and having a PFX format with file extension
fingerprint scanner
a biometric technology that can detect the unique patterns and swirls of an individual's finger.
Wi-Fi Protected Setup (WPS) attack
a brute force attack that attempts to discover the PIN of a wireless device that uses Wi-Fi Protected Setup (WPS)
group policy
a centralized configuration management feature available for Active Directory on Windows Server systems
NT LAN manager authentication (NTLM)
a challenge-response authentication protocol created by Microsoft for use in its products
service set identifier (SSID)
a character string that identifies a particular wireless LAN (WLAN).
certificate issues
a client rejecting a server certificate (or slightly less commonly, an authentication server rejecting a client's certificate)
botnets
a collection of compromised computers under the control of a master node; can be utilized in other processor intensive functions and activities; robot networks
Security as a Service (SECaaS)
a computing method that enables clients to take advantage of information, software, infrastructure, and processes provided by a cloud vendor in the specific area of computer security
Infrastructure as a Service (IaaS)
a computing method that uses the cloud to provide any or all infrastructure needs.
Platform as a Service (PaaS)
a computing method that uses the cloud to provide any platform-type services.
Software as a Service (SaaS)
a computing method that uses the cloud to provide application services to users.
order of restoration
a concept that dictates what types of systems to prioritize in disaster recovery efforts
separation of duties
a concept that states that duties and responsibilities should be divided among individuals to prevent ethical conflicts or abuse of powers.
service level agreement (SLA)
a contractual agreement setting out the detailed terms under which a service is provided
asset value
a corporate share's portion of the corporation's net worth, represented by its assets minus its liabilities
secure hash algorithm (SHA)
a cryptographic hashing algorithm created to address possible weaknesses in MDA. The current version is SHA-2
ephemeral key
a cryptographic key that is generated for each execution of a key-establishment process and that meets other requirements of the key type (e.g., unique to each message or session)
Public Key Cryptography Standards #7 (PKCS#7 P7B)
a cryptographic message-syntax standard associated with the .p7b file
email blocking
a data loss prevention (DLP) technique for blocking the copying of files at the email
USB Blocking
a data loss prevention (DLP) technique for blocking the copying of files to a USB flash drive
cloud based blocking
a data loss prevention (DLP) technique for blocking the copying of files to the cloud
insider threat
a deliberate effort on the part of an employee to cause damage to the network, reveal company secrets, or adversely effect the operation of the enterprise
privacy impact assessment (PIA)
a detailed study to assess the risks associated with storing, processing, and disclosing PII. The study should identify vulnerabilities that may lead to data breach and evaluate controls mitigating those risks
hardware token
a device held by a user that displays a number or a password that changes frequently, such as every 60 seconds. The number is synchronized with a server and used as a onetime password.
bridge
a device similar to a switch that has one port for incoming traffic and one port for outgoing traffic.
proxy
a device that acts on behalf of one end of a network connection when communicating with the other end of the connection.
correlation engine
a device that aggregates and correlates content from different sources to uncover an attack
hardware security module (HSM)
a device that generates, manages and securely stores encryption keys
access point (ap)
a device that provides a connection between wireless devices and can connect to wired networks
risk register
a document highlighting the results of risk assessments in an easily comprehensible format (such as a "traffic light" grid). Its purpose is for department managers and technicians to understand risks associated with the workflows that they manage
RACE Integrity Primitives Evaluation Message Digest (RIPEMD)
a family of message digest algorithms; a message digest algorithm designed as an alternative to MD5 and SHA
data exposure
a fault that allows privileged information (such as a token, password, or PII) to be read without being subject to the appropriate access controls; refers to ensuring that data is only available to those with a "need to know"
code signing
a form of digital signature that guarantees that source code and application binaries are authentic and have not been tampered with.
code signing
a form of digital signature that guarantees that source code and application binaries are authentic and have not been tampered with; refers to the generation of a digital signature for a piece of code so that users can verify that it originates from a legitimate party and has not been modified in transit
proprietary
a form of the confidential classification. Disclosure of proprietary data could have a significant negative effect on an organization
memorandum of agreement (MOA)
a formal agreement (or contract) that contains specific obligations rather than a broad understanding. If one party fails to fulfill its obligations, the other party will be able to seek redress under the terms of the agreement through the courts
blowfish
a freely available 64-bit block cipher algorithm that uses a variable key length.
hot site
a fully configured alternate network that can be online quickly after a disaster.
burning
a good method for destroying data on paper. However, disposing of data on USB drives, DVDs, CDs, or other storage media via burning can give off toxic fumes, making it an environmental issue. This method should be used mainly for data on paper
virtual local area network (logical)
a logically separate network, created by using switching technology. Even though hosts on two VLANs may be physically connected to the same cabling, local traffic is isolated to each VLAN so they must use a router to communicate.
keylogger
a malicious program that records keystrokes that actively attempts to steal confidential information
internal threat
a malicious threat to an organization that comes from people within the organization, such as employees, former employees, contractors or business associates, who have inside information concerning the organization's security practices, data and computer systems
network access control (NAC)
a means of ensuring endpoint security—ensuring that all devices connecting to the network conform to a "health" policy (patch level, anti-virus/firewall configuration, and so on)
false acceptance rate (FAR)
a measurement of the percentage of invalid users that will be falsely accepted by the system. This is called a Type II error. Type II errors are more dangerous than Type I errors.
false rejection rate (FRR)
a measurement of valid users that will be falsely rejected by the system. This is called a Type I error.
hoax
a message that tells of impending doom from a security threat that doesn't exist
loop prevention
a method of preventing switching loop or bridge loop problems. Both 51? and RSTP prevent switching loops.
pretty good privacy (PGP)
a method of securing emails created to prevent attackers from intercepting and manipulating email and attachments by encrypting and digitally signing the contents of the email using public key cryptography
certificate chaining
a method of validating a certificate by tracing each CA that signs the certificate, up through the hierarchy to the root CA. Also referred to as chain of trust.
authentication
a method of validating a particular entity's or individual's unique credentials.
pulping
a method that turns paper into a liquid slurry. This is only for data on paper and the disadvantages outweigh advantages, including having to haul the paper to a pulping facility and ensuring that the paper will be secure until pulping occurs
motion detection
a motion-based alarm is linked to a detector triggered by any movement within an area (defined by the sensitivity and range of the detector), such as a room
Industrial Control System (ICS)
a network managing embedded devices (computer systems that are designed to perform a specific, dedicated function)
anomaly-based detection
a network monitoring system that uses a baseline of acceptable outcomes or event patterns to identify events that fall outside the acceptable range.
lightweight directory access protocol (LDAP)
a network protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information
directory services use case
a network service that stores identity information about all the objects in a particular network, including users, groups, servers, client computers, and printers
switch
a networking device that receives incoming data, reviews the destination MAC address against an internal address table, and sends the data out through the port that contains the destination MAC address.
crypto-malware
a new generation of ransomware as your data is unavailable until you provide cash
salt
a nonce most commonly associated with password randomization that makes the password hash unpredictable; a security countermeasure that mitigates the impact of a rainbow table attack by adding a random value to ("salting") each plaintext input.
development environment
a package for programming, usually including an editor with syntax highlighting and other features and an interactive command line
stored procedures
a part of a database that executes a custom query. The procedure is supplied an input by the calling program and returns a pre-defined output for matched records. This can provide a more secure means of querying the database. Any stored procedures that are part of the database but not required by the application should be disabled; group of SQL statements stored in a Relational Database Management System that make functionality available to users of the database. Users should only have access to the minimum set of stored procedures necessary to do their job.
cloud storage
a particular type of Software as a Service where the vendor provides reliable data storage and backup
pre-shared key (PSK)
a passphrase to generate the key that is used to encrypt communications
hacktivist (hacking activist)
a person or group who launches cyber attack(s) as part of an activist movement to promote a political agenda
pivot
a system and/or set of privileges that allow the tester to compromise other network systems (lateral spread); to use various tools to gain additional information
witness interviews
a person who sees an event when it takes place. It is imperative to call the witness to assist the investigation process. The witness can testify about how the event occurred, where and when it occurred, and other information related to the event in question
VM sprawl avoidance
a phenomenon that occurs when the number of virtual machines (VMs) on a network reaches a point where the administrator can no longer manage them effectively. A policy for developing and deploying VMs must be established and enforced.
vishing (voice phishing)
a phishing attack conducted through a voice channel (telephone or VoIP, for instance)
rollback to known configuration
a physical instance might not support snapshots but has an "internal" mechanism for restoring the baseline system configuration, such as Windows System Restore
snapshots
a point-in-time copy of data maintained by the file system
cipher block chaining (CBC)
a popular mode of operation relatively easy to implement; an encryption mode of operation where an exclusive or (XOR) is applied to the first plaintext block
gnu privacy guard (GPG)
a popular open-source implementation of PGP
rivest cipher 4 (RC4)
a popular streaming symmetric-key algorithm
cold site
a predetermined alternate location where a network can be rebuilt after a disaster.
memorandum of understanding (MOU)
a preliminary or exploratory agreement to express an intent to work together. MOUs are usually intended to be relatively informal and not to act as binding contracts. MOUs almost always have clauses stating that the parties shall respect confidentiality, however
intranet
a private network that is only accessible by the organization's own personnel.
extranet
a private network that provides some access to outside parties, particularly vendors, partners, and select customers.
legal hold
a process designed to preserve all relevant information when litigation is reasonably expected to occur.
reporting requirements/escalation
a process for indicating to whom information should be distributed and at what point the security event has escalated to the degree that specific actions should be implemented.
memory leak
a process that takes memory without subsequently freeing it up could be a legitimate but faulty application or could be a worm or other type of malware. To detect a memory leak, look for decreasing Available Bytes and increasing Committed Bytes
after-action reports
a process to determine how effective COOP and DR planning and resources were
microsoft challenge handshake authentication protocol (MS-CHAP)
a protocol that strengthens the password authentication provided by Protected Extensible Authentication Protocol (PEAP)
digital signature algorithm (DSA)
a public key encryption standard used for digital signatures that provides authentication and integrity verification for messages
rivest shamir adleman (RSA)
a public-key cryptosystem that is widely used for secure data transmission. It is also one of the oldest
stream cipher
a relatively fast type of encryption that encrypts data one bit at a time.
secure shell (SSH)
a remote administration and file-copy program that supports VPNs by using port forwarding, and that runs on TCP port 22
mandatory vacations
a requirement that employees are forced to take their vacation time, during which someone else fulfills their duties.
data owner
a role with overall responsibility for data guardianship
man trap
a secure entry system with two gateways, only one of which is open at any one time.
flood guard
a security control in network switches that protects hosts on the switch against SYN flood and ping flood DoS attacks.
recertification
a security control where user access privileges are audited to ensure they are accurate and adhere to relevant standards and regulations.
screen locks
a security feature that requires the user to enter a PIN or a password after a short period of inactivity before they can access the system again. This feature ensures that if your device is left unattended or is lost or stolen, it will be difficult for anyone else to access your data or applications
pinning
a security feature where a certain web server is linked with a public key to minimizing the risk of forged certificates
Domain Name System Security Extensions (DNSSEC)
a security protocol that provides authentication of DNS data and upholds DNS data integrity.
Transport Layer Security (TLS)
a security protocol that uses certificates and public key cryptography for mutual authentication and data encryption over a TCP/IP connection.
weak implementations
a security system that has known vulnerabilities
Internet Protocol Security (IPSec)
a set of open-non-proprietary standards that are used to secure data through authentication and encryption as the data travels across the network or the Internet
redundant array of independent/ inexpensive disks (RAID)
a set of vendor-independent specifications that support redundancy and fault tolerance for configurations on multiple-device storage systems
bluetooth connection
a short-range wireless radio network transmission medium normally used to connect two personal devices, such as a mobile phone and a wireless headset.
network address translation (NAT)
a simple form of Internet security that conceals internal addressing schemes from the public Internet by translating between a single public address on the external side of a router and private, non-routable addresses internally.
ROT13
a simple letter substitution cipher that replaces a letter with the 13th letter after it, in the alphabet
session keys
a single-use symmetric key used for encrypting all messages in one communication session
demilitarized zone (DMZ)
a small section of a private network that is located behind one firewall or between two firewalls and made available for public access.
tokens/cards
a smart lock may be opened using a magnetic swipe card or feature a proximity reader to detect the presence of a wireless key fob or one-time password generator (physical tokens) or smart card
software defined networking (SDN)
a software application for defining policy decision on the control plane
host-based firewall/personal firewall
a software application running on a single host and designed to protect only that host
crypto service provider (CSP)
a software library that implements the Microsoft CryptoAPI
hijacking attack
a software or system takeover
data loss/leak prevention (DLP)
a software solution that detects and prevents sensitive information in a system or network from being stolen or otherwise falling into the wrong hands
data loss prevention (DLP)
a software solution that detects and prevents sensitive information in a system or network from being stolen or otherwise falling into the wrong hands.
stress testing
a software testing method that evaluates how software performs under extreme load
testing risk assessment
a software testing type which is based on the probability of risk
security information and event management (SIEM)
a solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications.
whaling
a spear phishing attack directed specifically against upper levels of management in the organization (CEOs and other "big beasts")
multipurpose proxy
a special proxy that "knows" the application protocols that it supports. For example, an FTP proxy server implements the protocol FTP.
guest account
a special type of shared account with no password. It allows anonymous and unauthenticated access to a resource
trusted platform module (TPM)
a specification for hardware-based storage of digital certificates, keys, hashed passwords, and other user and platform identification information.
near filed communication (NFC) connection
a standard for peer-to-peer (2-way) radio communications over very short (around 4") distances, facilitating contactless payment and similar technologies. NFC is based on RFID.
remote authentication dial-in user service
a standard protocol used to manage remote and wireless authentication infrastructures
IEEE 802.1X
a standard that authenticates users on a per-switch port basis by permitting access to valid users but effectively disabling the port if authentication fails.
object identifiers (OID)
a string of decimal numbers used to uniquely identify the objects (e.g., syntaxes, data elements, and other parts of distributed applications). OIDs are usually found in SNMP, X.500 directories, and OSI applications where uniqueness is crucial.
normalization
a string that is stripped of illegal characters or substrings and converted to the accepted character set. This ensures that the string is in a format that can be processed correctly by the input validation routines; refers to transforming user input into the expected format before processing it.
database security
a subset of information security that focuses on the assessment and protection of information stored in data repositories like database management systems and storage media.
advanced encryption standard (AES)
a symmetric 128-, 192-, or 256-bit block cipher based on the Rijndael algorithm developed by Belgian cryptographers Joan Daemen and Vincent Rijmen and adopted by the U.S. government as its encryption standard to replace DES
twofish
a symmetric key block cipher, similar to Blowfish, consisting of a block size of 128 bits and key sizes up to 256 bits.
initialization vector (IV)
a type of nonce used for randomizing an encryption scheme; a technique used in cryptography to generate random numbers to be used along with a secret key to provide data encryption.
server operating system (SOS)
a type of operating system that is designed to be installed and used on a server computer
SSL decryptors
a type of proxy used to examine encrypted traffic before it enters or leaves the network
load balancer
a type of switch or router that distributes client requests between different resources, such as communications links or similarly configured servers. This provides fault tolerance and improves throughput.
block cipher
a type of symmetric encryption that encrypts data one block at a time, often in 64-bit blocks. It is usually more secure, but is also slower, than stream ciphers
Unified Extensible Firmware Interface (UEFI)/ Basic Input Output System (BIOS)
a type of system firmware providing support for 64-bit CPU operation at boot, full GUI and mouse operation at boot, and better boot security. A firmware interface that initializes hardware for an operating system boot.
WiFi Direct/ad hoc
a type of wireless network where connected devices communicate directly with each other instead of over an established medium.
ad hoc
a type of wireless network where connected devices communicate directly with each other instead of over an established medium.
password complexity
a typical strong network password should be 12-16 characters. a longer password or passphrase might be used for mission critical systems or devices where logon is infrequent. no single words—better to use word and number/punctuation combinations. mix upper and lowercase (assuming the software uses case-sensitive passwords)
recovery
a user configured to restore encrypted data in the event that the original key is lost
capture system image
a very effective way of preserving evidence, data, and verify its integrity
virtual desktop infrastructure (VDI)
a virtualization implementation that separates the personal computing environment from a user's physical computer
application cells/containers
a virtualized environment that holds only the necessary operating system components (such as binary files and libraries) that are needed for a specific application to run. Also called an container. This not only reduces the necessary hard drive storage space and Random Access Memory (RAM) needed but also allows for containers to start more quickly because the entire operating system does not have to be started.
backdoor
a way of bypassing normal authentication in a system
full device encryption
a way to assure data at-rest is secure even in the event of loss or theft is to usE.
likelihood of occurrence
a weighted factor based on a subjective analysis of the probability that a given threat is capable of exploiting a given vulnerability.
faraday cage
a wire mesh container that blocks external electromagnetic fields from entering into the container
ANT connection
a wireless sensor protocol that uses a part of the 2.4 GHz range that is reserved for industrial, scientific, and medical or ISM
privileged account
able to install and remove programs and drivers, change system-level settings, and access any object in the file system
rule-based access control
access is determined through system-enforced rules as the system checks the ACLs for that object
validation
act of confirming or verifying
injection attack
adding your own information into a data stream
role based access control (RBAC)
administrators provide access based on the role of the user and rights are gained implicitly instead of explicitly
recovery
after the incident has been contained, it's important to restore all your affected systems and services as soon as possible
quantitative risk assessment
aims to assign concrete values to each risk factor
crypto module
algorithms underpinning cryptography that are interpreted and packaged as a computer program or programming library.
Configuration compliance scanner
all of this is a lot of work and automation goes a long way. SCAP is the security content automation protocol. It's a protocol for managing information related to security configurations, and validating them in an automated way. There are tools to help with this, some that are SCAP compliant.
on-premise
all of your applications and all of the servers are going to be running in a data center. It's inside of a building and have complete control over everything that happens with those systems.
differential
all selected files that have changed since the last full backup are backed up.
incremental
all selected files that have changed since the last full or incremental backup (whichever was most recent) are backed up.
unified threat management (UTM)
all-in-one security appliances and technologies that combine the functions of a firewall, malware scanner, intrusion detection, vulnerability scanner, Data Loss Prevention, content filtering, and so on
alternate business practices
allow the information flow to resume to at least some extent
Enterpise
allows WLAN authentication to be integrated with the wired LAN authentication scheme
USB On The Go (OTG)
allows a port to function either as a host or as a device
encryption
allows a program to require a secret key for access to certain data
standard naming convention
allows better administrative control over network resources. The naming strategy should allow administrators to identify the type and function of any particular resource or location at any point in the directory information tree
remote access trojan (RAT)
allows the attacker to remotely access the PC, upload files, and install software on it
group-based access control
allows you to set permissions (or rights) for several users at the same time
system sprawl/undocumented assets
also be the root of security issues; an overabundance of systems that are not being uses; assets that are not being tracked, indicating poor loss prevention and poor inventory control
standalone AP
also referred to as thick access points, do not require a controller and are generally used in smaller environments.
site-to-site
always on, or almost always; a VPN that can be accessed automatically by users
access points
among the most common points of attack; measures should be taken to prevent unauthorized access, such as outdated firmware, default username and passwords, unlocked management interfaces, and more
certificate
an X.509 digital certificate is issued by a certificate authority (CA) as a guarantee that a public key it has issued to an organization to encrypt messages sent to it genuinely belongs to that organization
security assertion markup language (SAML)
an XML-based data format used to exchange authentication information between a client and a service
fat AP
an access point whose firmware contains enough processing logic to be able to function autonomously and handle clients without the use of a wireless controller
social engineering
an activity where the goal is to use deception and trickery to convince unsuspecting users to provide sensitive data or to violate security guidelines.
domain hijacking
an adversary gains control over the registration of a domain name, allowing the host records to be configured to IP addresses of the attacker's choosing
random/pseudo-random number generation
an algorithm for generating a sequence of numbers whose properties approximate the properties of sequences of random numbers
HMAC-based One-time Password (HOTP)
an algorithm that generates a one-time password using a hash-based authentication code to verify the authenticity of the message
terminal access controller access control system plus
an alternative to RADIUS developed by Cisco. The version in current use is TACACS+; TACACS and XTACACS are legacy protocols
software token
an app, or other software that generates a token for authentication.
hardware security module (HSM)
an appliance for generating and storing cryptographic keys. This sort of solution may be less susceptible to tampering and insider threats than software-based storage.
nonce
an arbitrary number used only once in a cryptographic communication, often to prevent replay attacks.
denial-of-service (DOS) attack
an attack from one attacker against one target
distributed denial-of-service (DDoS) attack
an attack from two or more attackers against one target
dictionary attack
an attack that attempts to discover a password from words in the dictionary
man-in-the-middle (MITM) attack
an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other by redirecting network traffic and inserting malware
extensible authentication protocol (EAP)
an authentication framework; a wireless authentication protocol that enables systems to use hardware-based identifiers, such as fingerprint scanners or smart card readers, for authentication
openID connect (OIDC)
an authentication layer that sits on top of the OAuth 2.0 authorization protocol.
context-aware authentication
an authentication method using multiple elements to authenticate a user and a mobile device. It can include identity, geolocation, the device type, and more.
shibboleth
an identity federation method that provides single sign-on capabilities and enables websites to make informed authorization decisions for access to protected online resources.
memory management
an important aspect of secure coding. Mistakes like freeing the memory associated with a pointer twice can open an application up to attack.
proper error handling
an important component of secure coding. Program crashes are an indicator of potentially exploitable code, so appropriate error handling helps protect applications both by ensuring correct functionality and revealing indicators of potential coding flaws.
Wi-Fi Protected Access (WPA)
an improved encryption scheme for protecting Wi-Fi communications, designed to replace WEP.
Wi-Fi Protected Access 2 (WPA2)
an improved version of WPA that does not support older network cards and offers both secure authentication and data encryption. It uses EAP for a variety of authentication methods—most often EAP-PSK. (16)
Time-based One-time Password (TOTP)
an improvement on HOTP that forces one-time passwords to expire after a short period of time
steward/custodian
an individual who has been assigned or is responsible for the day-to-day proper storage, maintenance and protection of information
privacy officer
an individual who is responsible for overseeing the proper handling of PII
universal serial bus (USB) connection
an industry standard that establishes specifications for cables and connectors and protocols for connection, communication and power supply (interfacing) between computers, peripherals and other computers
standard operating procedure (SOPs)
an inflexible, step-by-step listing of the actions that must be completed for any given task. Most critical tasks should be governed by SOPs.
privacy threshold assessment (PTA)
an initial audit to determine whether a computer system or workflow collects, stores, or processes PII to a degree where a PIA must be performed. PTAs must be repeated every three years
Wi-Fi Protected Setup (WPS)
an insecure feature of WPA and WPA2 that allows enrollment in a wireless network based on an 8-digit PIN
protected distribution
an intruder could attach eavesdropping equipment to the cable; an intruder could cut the cable
substitution ciphers
an obfuscation technique where each unit of plaintext is kept in the same sequence when converted to ciphertext, but the actual value of the unit changes.
mobile operating system (MOS)
an operating system for mobile phones, tablets, smartwatches, 2-in-1 PCs (that can be convert to a laptop mode or detach and work as a tablet mode), smart speaker, or other mobile devices
Industry-Specific Framework
an organization can structure their IT departments to best serve the overall need of the organization
clean desk
an organizational policy that mandates employee work areas be free from potentially sensitive information; sensitive documents must not be left out where unauthorized personnel might see them.
documented incident
an outline that defines in detail what is and is not an incident that requires a response.
resource exhaustion
an overload of requests sent from an attacker to a resource, which can cause the system to slow down and prevent legitimate users from accessing it
rogue access point (AP)
an unauthorized wireless access point (WAP) installed in a computer network to capture traffic
lessons learned
analyzing the incident and responses to identify whether procedures or systems could be improved. It is imperative to document the incident
alternate processing sites/recovery sites
another location that can provide the same (or similar) level of service
live boot media
another option is to use an instance that boots from read-only storage to memory rather than being installed on a local read/write hard disk
policy violation
any act that bypasses or goes against an organizational security policy; be familiar with outcomes, such as retraining, reassignment, and termination. The severity of the outcome will be determined by the seriousness of the breach.
key exchange
any method by which cryptographic keys are transferred among users, thus enabling the use of a cryptographic algorithm.
adware
any type of software or browser plug-in that displays commercial ads, offers, and deals
application blacklisting
anything not on the prohibited blacklist can run
security guards
armed or unarmed, can be placed in front of and around a location to protect it. They can monitor critical checkpoints and verify identification, allow or disallow access, and log physical entry events. They also provide a visual deterrent and can apply their own knowledge and intuition to potential security breaches. The visible presence of guards is a very effective intrusion detection and deterrence mechanism, but is correspondingly expensive
discretionary access control (DAC)
as the owner, they have control who has access and can modify access at any time
exercise
aspects of incident response plan should regularly be tested in a simulated real-world environment
transfer/sharing
assigning risk to a third party (such as an insurance company or a contract with a supplier that defines liabilities)
user certificate
associate a certificate with a user with a powerful electronic "id card"
boot sector viruses
attack the disk boot sector information, the partition table, and sometimes the file system
secret algorithm
attempting to hide details of the cipher amounts to "security by obscurity"
brute force attack
attempts every possible combination in the key space in order to derive a plaintext password from a hash
rainbow table attack
attempts to discover the password of a hash using a table of pre-computed hashes; redefine the dictionary approach
permission issues
audits should be done to verify that personnel have correct access. Shouldn't have too much, but just the appropriate amount
secure token
authentication mechanism that can identify and authenticate. Tell servers (resources) what access rights a user possesses. Can allow or deny access.
challenge handshake authentication protocol (CHAP)
authentication scheme developed for dial-up networks that uses an encrypted three-way handshake to authenticate the client to the server. The challenge-response is repeated throughout the connection (though transparently to the user) to guard against replay attacks
biometric
authentication schemes based on individuals' physical characteristics.
principles of social engineering
authority, intimidation, consensus, scarcity, familiarity, trust & urgency
qualitative risk assessment
avoids the complexity of the quantitative approach and is focused on identifying significant risk factors.
Logs and events anomalies
be sure to check for any suspicious activity that appear in logs. Verify that logging is enabled to capture these
agent
best for frequently disconnected machines or machines in the DMZ, based on pull technology
implicit deny
block any traffic that has not matched a rule. Typically the final default rule
counter mode (CTR)
block cipher mode that acts like a stream cipher and encrypts successful values of a "counter"
intent/motivation (attribute of actors)
boredom, raised awareness about a cause, greed, revenge, money
heating, ventilation, and air conditioning (HVAC)
building control systems maintain an optimum heating, cooling, and humidity level working environment for different parts of the building.
band selection/width
can affect availability and performance.
displays
can be manipulated by sending it instructions coded into pixel values in a specially crafted web page
media gateway
can be provisioned as a dedicated appliance or as software running on a server
VM escape protection
can be reduced by using effective service design and network placement when deploying VMs
Wireless scanners/cracker
can be used to detect the presence of such networks and report the network name (SSID), the MAC address of the access point (BSSID), the frequency band (2.4 or 5 GHZ) and radio channel used by the network, and the security mode
vulnerabilities due to lack of vendor support
can become an issue at several different levels. The most obvious scenario is when the original manufacturer of the item, be it hardware or software, no longer offers support.
misconfiguration/weak configuration
can cause a system to be taken down; a disabled network, stopped email communications or stopped network traffic
WiFi-enabled MicroSD cards
can connect to a host Wi-Fi network to transfer images stored on the card. Unfortunately, it is straightforward to replace the kernel on this type of device and install whatever software the hacker chooses
Protocol Analyzer
can decode a captured frame to reveal its contents in a readable format. You can choose to view a summary of the frame or choose a more detailed view that provides information on the OSI layer, protocol, function, and data.
safe
can feature key-operated or combination locks but are more likely to come with electronic locking mechanisms. Safes can be rated to a particular cash value for the contents against various international grading schemes
improperly configured accounts
can have two different types of impact. On the one hand, setting privileges that are too restrictive creates a large volume of support calls and reduces productivity. On the other hand, granting too many privileges to users weakens the security of the system and increases the risk of things like malware infection and data breach
network operating system (NOS)
can host shared folders and files, enabling them to be copied or accessed over the local network or via remote access (over a VPN, for instance)
organized crime
can operate across the Internet from different jurisdictions than its victim, increasing the complexity of prosecution; a group of people who launch a cyber attack(s), except they function like a legitimate business
heap overflow
can overwrite stored variables of some sort in an area of memory allocated by the application during execution, with unexpected effects. An example is a known vulnerability in Microsoft's GDI+ processing of JPEG images
push notification services
can push a notification to all managed devices. Can be used for a large scale update of software.
systems administrator
can share resources (folders, printers, and other resources) to make them available for network users
automated alerting and triggers
can take an amount of data comparable to a fire hose and shrink it down to the mere trickle that you are looking for. This data can then be run through rules that the system administrator creates which then fires off notification alerts to the system administrator's email informing of said events
level of sophistication (attributes of actors)
can vary depending on the number and skill level of individuals working together as an organized crime
resources/funding (attribute of actors)
can vary depending on the number and skill level of individuals working together as an organized crime
automated courses of action
can work to maintain or to restore services with minimal human intervention or even no intervention at all. For example, you might configure services that are primarily hosted on physical infrastructure to failover to cloud-based instances, or conversely, have a cloud-based system failover to a backup site with physical servers. You could also use automation to isolate a network segment if a computer worm outbreak is detected.
near field communications (NFC) attack
captures data from mobile devices that use near field communication (NFC)
integer overflow
causes the target software to calculate a value that exceeds these bounds. This may cause a positive number to become negative (changing a bank debit to a credit, for instance). It could also be used where the software is calculating a buffer size; if the attacker is able to make the buffer smaller than it should be, he or she may then be able to launch a buffer overflow attack
wildcard
certificates based on the name of the server
command line tools
ping, netstat, tracert, nslookup and dig, ipconfig/ifconfig, tcpdump, nmap, netcat or nc
perfect forward secrecy (PFS)
change the method of key exchange; a characteristic of session encryption that ensures if a key used during a certain session is compromised, it should not affect data previously encrypted by that key
access violations
changed system files, missing system files, and other evidence of unusual file states and possible access violations on the system
media access control (MAC) spoofing attack
changes the Media Access Control (MAC) address configured on an adapter interface or asserts the use of an arbitrary MAC address
static code analyzers
check the logic of applications without actually running the code. This is a more difficult but less risky of determining the functionality of code.
location selection
choosing the location for a processing facility or data center requires considering multiple factors
EAP Flexible Authentication via Secure Tunneling (EAP-FAST)
cisco's proposal to address the shortcomings of LEAP
wireless mice
clickjacking issues
private cloud
cloud infrastructure that is completely private to and owned by the organization. In this case, there is likely to be one business unit dedicated to managing the cloud while other business units make use of it. With private cloud computing, organizations can exercise greater control over the privacy and security of their services. This type of delivery method is geared more toward banking and governmental services that require strict access control in their operations
compiled code
code that is converted from high-level programming language source code into lower-level code that can then be directly executed by the system.
capture video
collect and preserve digital video evidence for legal proceedings
hash-based message authentication code (HMAC)
combine a hash with a secret key; a method (described in RFC-2104) used to verify both the integrity and authenticity of a message by combining cryptographic hash functions, such as MD5 or SHA-1, with a secret key
Temporal Key Integrity Protocol (TKIP)
combines the secret root key with the IV and adds a sequence counter to prevent replay attacks; a mechanism used in the first version of WPA to improve the security of wireless encryption mechanisms, compared to the flawed WEP standard
macro viruses
common in microsoft office
wireless
computer network that uses wireless data connections between network nodes
appliance operating system (AOS)
computer with software or firmware that is specifically designed to provide a specific computing resource. Such devices became known as appliances because of the similarity in role or management to a home appliance, which are generally closed and sealed, and are not serviceable by the user or owner
infrared (IR) connection
computers equipped with an IR sensor could transfer files and other digital data over short-range wireless signals
wearable technology
computing devices that are worn on various parts of the body.
active-active
configurations consist of n nodes, all of which are processing concurrently
active-passive
configurations use a redundant node to failover
usage auditing and review
configuring the security log to record key indicators and then reviewing the logs for suspicious activity. Behavior recorded by event logs that differs from expected behavior may indicate everything from a minor security infraction to a major incident
WiFi connection
connection via a universal wireless network standard that uses radio waves
cellular connection
connection via cell phone towers that provides high speed transmission
site-to-site
connects two or more local networks, each of which runs a VPN gateway (or router/VPN concentrator)
replay attack (cryptography attacks)
consists of intercepting a key or password hash then reusing it to gain access to a resource, such as the pass-the-hash attack. This type of attack is prevented by using once-only session tokens or timestamping sessions
controller-based AP
controller-based Access points are also known as thin clients and require a controller for centralized management (updates, configuration, etc.) and do not need to be manually configured
technical
controls implemented in operating systems, software, and security appliances. Examples include Access Control Lists (ACL) and Intrusion Detection Systems
physical
controls such as alarms, gateways, and locks that deter access to premises and hardware are often classed separately
administrative/management
controls that determine the way people act, including policies, procedures, and guidance. For example, annual or regularly scheduled security scans and audits can check for compliance with security policies
physical
controls that restrict, detect, and monitor access to specific physical areas or assets through measures such as physical barriers, physical tokens, or biometric access controls.
lock types
conventional, deadbolt, electronic
consensus/social proof (principle)
convince based on what's normally expected; "your co-worker Jill did this for me last week"
administrative control/user training
could ensure that the media is not left unattended on a desk and is not inserted into a computer system without scanning it first
vulnerable business processes
could result in disclosure, modification, loss, destruction, or interruption of critical data or it could lead to loss of service to customers; aspects of a business that are vulnerable to security risks, such as the shopping cart of a company's website, a web server or a back-end database server
technical control/endpoint security
could scan the media for malware or block access automatically
nmap
created by Gordon Lyon in 1999 for network scanning and mapping. Check out their website, which is also clearly from the late 90s.
identification
creating an account or ID that identifies the user, device, or process on the network; the process by which a user account (and its credentials) is issued to the correct person. Sometimes referred to as enrollment.
account maintenance
creating an account, modifying account properties, disabling an account, changing an account's password, and so on
authentication issues
credential violations, what to do in the event of credential leaks, system breaches that result in the invalidation of all passwords, and steps to follow after an account impersonation incident
offline brute force attack
cryptographic attack where the attacker steals the password and then tries to decode it by systematically guessing possible keystroke combinations that match the encrypted password
online brute force attack
cryptographic attack where the attacker tries to enter a succession of passwords using the same interface as the target user application
layer 2
data link
private
data of a personal nature and intended only for internal use. Significant negative impact to the organization if disclosed
data sovereignty
data stored in a country is subject to the laws of that country
personally identifiable information (PII)
data that can be used to identify or contact an individual (or in the case of identity theft, to impersonate them)
weak cipher suites and implementations
data that it is storing and processing may not be secure. It may also allow a malicious attacker to masquerade as it, causing huge reputational damage; weak encryption technologies
attestation
declare something to be true
proxies
deconstructs each packet, performs analysis, then rebuilds the packet and forwards it on (providing it conforms to the rules)
default configuration
default installation is (theoretically) secure but minimal. Any options or services must explicitly be enabled by the installer; a default username/password that is susceptible to being exploited by an attacker
agentless
designed for centralized, based on push technology
web application firewall
designed specifically to protect software running on web servers and their backend databases from code injection and DoS attacks
infrared detection
detects moving heat sources
identification
determining whether an incident has taken place and assessing how severe it might be, followed by notification of the incident to stakeholders
SSL accelerators
device that speeds up the process of SSL handshake encryption. The SSL handshake requires some cryptographic overhead. Requires a lot of CPY Cycles. Offload the SSL process to a hardware accelerator. Often integrated into a load balancer.
distance
dictate the need to ensure the recovery site is located far enough from the main data center so as not to be affected by a single incident
risk response techniques
different options available when dealing with risks.
parabolic
dish or grid
load balancer
distributes client requests across available server nodes in a farm or pool
stateless
does not keep track of traffic flows
compensating
does not prevent the attack but restores the function of the system through some other means, such as using data backup or an alternative site
secure baseline
each development environment should be built to the same specification, possibly using automated provisioning
baselining
each development environment should be built to the same specification, possibly using automated provisioning.
sandboxing
each development environment should be segmented from the others. No processes should be able to connect to anything outside the sandbox. Only the minimum tools and services necessary to perform code development and testing should be allowed in each sandbox
virtual IPs
each server node or instance needs its own IP address, but externally a load-balanced service is advertised using a Virtual IP (VIP) address (or addresses)
privileged user
employees with access to privileged data should be given extra training on data management and PII plus any relevant regulatory or compliance frameworks
correlation
enables SIEM to look for similarities, repeating occurrences, and patterns of the event data
protected extensible authentication protocol (PEAP)
encapsulates EAP in a TLS tunnel, one certificate on the server; similar to EAP-TLS, PEAP is an open standard developed by a coalition made up of Cisco Systems, Microsoft, and RSA Security
confusion
encrypted data is drastically different from the plaintext; makes the relationship between an encryption key and its ciphertext as complex and opaque as possible
weak/deprecated algorithms
encryption algorithms that have been cracked and are not considered secure. Avoid proprietary encryption algorithms and "security by obscurity". Avoid MD5, SHA-0, SHA-1 and DES. WEP and WPA are considered weak ciphers.
full disk encryption (FDE/SED)
encryption of all data on a disk (including system files, temporary files, and the pagefile) can be accomplished via a supported OS, third-party software, or at the controller level by the disk device itself.
symmetric algorithm
encryption schemes that use a shared cryptographic key for both encryption and decryption of data
galois/counter mode (GCM)
encryption with authentication; an encryption mode of operation that adds authentication to the standard encryption services of a cipher mode
virtual private network (VPN) concentrator
encryption/decryption access device for private data traversing a public network; sometimes called a VPN-enabled router
lighting
enormously important in contributing to the perception that a building is safe and secure at night. Well-designed lighting helps to make people feel safe, especially in public areas or enclosed spaces, such as parking garages. Security lighting also acts as a deterrent by making intrusion more difficult and surveillance (whether by camera or guard) easier
continuing education
ensure that the participants do not treat a single training course or certificate as a sort of final accomplishment. Skills and knowledge must be continually updated to cope with changes to technology and regulatory practices
tailgating
entering a secure area without authorization by following close behind the person that has been allowed to open the door or checkpoint
cloud access security broker (CASB)
enterprise management software designed to mediate access to cloud services by users across all types of devices
improper error handling
errors that give users information that is too detailed and is not logged
penetration testing/ethical hacking
essentially involves thinking like an attacker and trying to penetrate the target's security systems; exploits vulnerabilities
subject alternative name (SAN)
extension to an X.509 certificate; the subdomains are listed as extensions. If a new subdomain is added, a new certificate must be issued
social media
familiar with company acceptable usage policies, how to prevent access to such social media sites via firewalls and filters on the network, as well as group policy implementations to restrict such access
shimming
filling in the space between two objects
network-based
filters traffic by port number; can encrypt traffic into/out of the network; can proxy traffic; most firewalls can be layer 3 devices (routers) firewalls that are better suited for placement at network or segment borders
misconfigured devices
firewalls, content filter, and access points
jailbreaking
iOS is more restrictive than Android so the term "jailbreaking" became popular for exploits that enabled the user to obtain root privileges, sideload apps, change or add carriers, and customize the interface
patch management
identifying, testing, and deploying OS and application updates. Patches are often classified as critical, security-critical, recommended, and optional.
reputation
if a business damages their reputation, this might hurt them in the future
lockout
if an incorrect passcode is entered, the device locks for a set period. This could be configured to escalate (so the first incorrect attempt locks the device for 30 seconds while the third locks it for 10 minutes, for instance). This deters attempts to guess the passcode
low latency
if cryptography is deployed with a real time-sensitive channel, such as voice or video, the processing overhead on both the transmitter and receiver must be low enough not to impact the quality of the signal
hot and cold aisles
if multiple racks are used, install equipment so that servers are placed back-to-back not front-to-back, so that the warm exhaust from one bank of servers is not forming the air intake for another bank
Data sanitization tools
if you need to get rid of data, there are special data sanitization tools to help. These allow you to "destroy, purge or otherwise identify for destruction" data on systems. Probably pretty use for government and other highly regulated industries.
offline certificate authority
in PKI, a CA (typically the root CA) that has been disconnected from the network to protect it from compromise.
online certificate authority
in PKI, a CA that is available to accept and process certificate signing requests, publish certificate revocation lists, and perform other certificate management tasks
trust model
in PKI, a description of how users and different CAs exchange information and certificates.
key management
in cryptography, the process of administering cryptographic keys, often performed by a CA, and including the management of usage, storage, expiration, renewal, revocation, recovery, and escrow. In physical security, a scheme for identifying who has copies of a physical key or key card.
adverse actions
in disciplining or firing an employee, the employer is discriminating against them in some way
weak security configurations
include replacing old hardware with compliant versions that have better security features, firmware updates, and configuration updates and updating network configurations to prevent unauthorized access
something you do
indicating action, such as gestures on a touch screen.
strategic intelligence/counterintelligence gathering
information about the changing nature of certain problems and threats for the purpose of developing response strategies and reallocating resources
protected health information (PHI)
information that identifies someone as the subject of medical and insurance records, plus associated hospital and laboratory test results
open-source intelligence
information that is available via websites and social media
data-in-use
information that is currently being created, deleted, read from, or written to
data-at-rest
information that is primarily stored on specific media, rather than moving from one medium to another
data-in-transit
information that primarily moves from medium to medium, such as over a private network or the Internet.
improper input handling
input that allows attacks, such as buffer overflow and injection attacks
type 1 hypervisor/bare metal
installed directly onto the computer and manages access to the host hardware without going through a host OS
active tools
interact in a way that can be detected. One passive example is using Wireshark to examine traffic after the fact. An active example is port scanning using Nmap.
proper input validation
involves confirming that user input is of a type and in a format expected by the program and, if not, handling the error appropriately.
model verification
involves testing or proving that an application actually functions in the way that the model says that it should
Electromagnetic Pulse (EMP)
is a very powerful but short duration wave with the potential to destroy any type of electronic equipment
honeynets
is an entire decoy network
dead code
is executed but has no effect on the program flow. For example, there may be code to perform a calculation, but the result is never stored as a variable or used to evaluate a condition
type II hypervisor/guest OS (host-based)
is itself installed onto a host operating system
System on Chip (SoC)
is one where most of the activities for that particular system take place within an embedded system
shared/generic account
is one where passwords (or other authentication credentials) are known to more than one person
workstation operating system (WOS)
is primarily designed to run applications. Those applications can be text processor, a spreadsheet application, presentation software, video or audio editors, games, etc
Electromagnetic Interference (EMI)
is the effect unwanted electromagnetic energy has on electronic equipment
kiosk operating system (KOS)
is the system and user interface software designed for an interactive kiosk or Internet kiosk enclosing the system in a way that prevents user interaction and activities on the device outside the scope of execution of the software.
hardware root of trust/trust anchor
is used to scan the boot metrics and OS files to verify their signatures, then it signs the report and allows the NAC server to trust it
server-side
it can be time-consuming, as it may involve multiple transactions between the server and client
program viruses
it's part of the application
personal email
items such as malware and email viruses; blocking access is one such common solution, and could come up in the exam as a way to troubleshoot and prevent such access from occurring.
round-robin
just means picking the next node
wireless keyboards
keylogging issues
private key
known only to the holder and is linked to, but not derivable from, a public key distributed to those with which the holder wants to communicate securely.
key strength
larger keys tend to be more secure and can prevent brute-force attacks; the resiliency of a key to resist attacks
Regulatory Framework
laws and regulations which set out the legal requirements of indiv. businesses/organisations in terms of limits to their pollution and activities and consequences imposed if exceeded government establishes agencies responsible for monitoring and enforcing these regulations (Context of Use: DPI, EPA, usually when problem has already risen)
non-disclosure agreement (NDA)
legal basis for protecting information assets; used between companies and employees, between companies and contractors, and between two companies. If the employee or contractor breaks this agreement and does share such information, they may face legal consequences
time-of-day restrictions
limit when users can access specific systems based on the time of day or week. It can limit access to sensitive environments to normal business hours whenoversight and monitoring can be performed to prevent fraud, abuse, or intrusion
containment, eradication, and recovery
limiting the scope and impact of the incident. The typical response is to "pull the plug" on the affected system, but this is not always appropriate. Once the incident is contained, the cause can then be removed and the system brought back to a secure state
out-of-band
link that offers better security
facial recognition
looks for unique measurements in an individual's face
life
loss of life or injury to others
stateful
maintaining information about the session established between two hosts (including malicious attempts to start a bogus session); remember the "state" of the session; everything within a valid flow is allowed
preservation
maintenance of a resource in its present condition, with as little human impact as possible.
supporting non-repudiation
make sure the signature isn't fake. confirm the authenticity of data. Digital signature provides both integrity and non-repudiation.
preparation
making the system resilient to attack in the first place. This includes hardening systems, writing policies and procedures, and establishing confidential lines of communication. It also implies creating a formal incident response plan
viruses
malware that can reproduce itself as it does not need to click on anything, and it needs you to execute a program
worm
malware that self-replicates and doesn't need user input
spyware
malware that spies on you through advertising, identity theft, and affiliate fraud
improper certificate and key management
manage your keys and certificates; this needs to be well planned; Important decisions, can't do this on the fly • What will be the organization's certificate authority? • How will the CA content be protected? • How will intermediate CAs be created and managed? • Who will validate and sign the organization's certificates? • What is the validation process? • And many more
memory/buffer vulnerability
manipulating memory can be advantageous and relatively difficult to accomplish
digital cameras
may be equipped with Wi-Fi and cellular data adapters to allow connection to the Internet and posting of images directly to social media sites
National Framework
may be used to demonstrate compliance with a country's legal regulatory compliance requirements or with industry-specific regulations
deterrent
may not physically or logically prevent access, but psychologically discourages an attacker from attempting an intrusion, example are cameras
radio frequency identification (RFID) attack
means of encoding information into passive tags, which can be easily attached to devices, structures, clothing, or almost anything else; a sniffing, replay or DoS attack on a radio-frequency identification system (RFID) system
social engineering (hacking the human)
means of getting users to reveal confidential information
virtual desktop infrastructure (VDI)
means provisioning a workstation OS instance to interchangeable hardware
baseline deviation
means testing the actual configuration of clients and servers to ensure that they are patched and that their configuration settings match the baseline template
application whitelisting
means that nothing can run if it is not on the approved whitelist
disablement
means that the account will no longer be an active account and that the user keys for that account are retained which would not be the case if the account was deleted from the system
always-on VPN
means that the computer establishes the VPN whenever an Internet connection over a trusted network is detected, using the user's cached credentials to authenticate. Microsoft has an Always On VPN solution for Windows Server 2016 and Windows 10 clients (https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy-deployment) and an OpenVPN client can be configured to autoconnect (https://openvpn.net/vpn-server-resources/setting-your-client-to-automatically-connect-to-your-vpn-when-your-computer-starts).
remote access
means that the user's device does not make a direct cabled or wireless connection to the network
remote access use case
means that the user's device does not make a direct cabled or wireless connection to the network
Email and web use case
media gateway servers must connect to untrusted networks
personal identity verification card (PIV)
meets the standards for FIPS 201, in that it is resistant to tampering and provides quick electronic authentication of the card's owner.
refactoring
metamorphic malware and is a different program each time it is downloaded
competitors
might be facilitated by employees who have recently changed companies and bring an element of insider knowledge with them
standard users
might require training on product- or sector-specific issues
continuous monitoring
might use a locally installed agent or heartbeat protocol or may involve checking availability remotely
typo squatting attack
misspelled domains can be profitable depending on the frequency that users enter the misspelled name (for example, visiting amazoon.com or amazun.com)
Bring Your Own Device (BYOD)
mobile deployment model that describes how employees can use their own personal mobile devices to get work done, if they so choose
supporting obfuscation
modern malware tries to hide itself. Encrypted data hides the active malware code. Decryption occurs during execution.
rootkit
modifies core system files as part of the kernel; represents a class of backdoor malware that is harder to detect and remove
host-based intrusion detection system (HIDS)
monitors a computer system for unexpected behavior or drastic changes to the system's state
choose your own device (CYOD)
much the same as COPE but the employee is given a choice of device from a list
machine/computer certificate
necessary to issue certificates to servers, PCs, smartphones, and tablets, regardless of function
elliptic curve
needs large integers composed of two or more large prime factors and is an asymmetric encryption; an asymmetric encryption technique that leverages the algebraic structures of elliptic curves over finite fields
permission auditing and review
needs to be put in place so that privileges are reviewed regularly
password authentication protocol (PAP)
obsolete authentication mechanism used with PPP. PAP transfers the password in plaintext and so is vulnerable to eavesdropping
fencing/gate/cage
needs to be transparent (so that guards can see any attempt to penetrate it), robust (so that it is difficult to cut), and secure against climbing (which is generally achieved by making it tall and possibly by using razor wire). Fencing is generally effective, but the drawback is that it gives a building an intimidating appearance
cyber-incident response teams
needs to have a very specific set of skills to combat each incident deftly
layer 3
network layer
Open
no authentication password is required; the client is not required to authenticate. This mode would be used on a public AP (or "hotspot")
accept/retention
no countermeasures are put in place either because the level of risk does not justify the cost or because there will be unavoidable delay before the countermeasures are deployed
dynamic link library (DLL) injection
not a vulnerability of an application but of the way the operating system allows one process to attach to another; To perform DLL injection, the malware must already be operating with sufficient privileges (typically, local administrator or system privileges). It must also evade detection by anti-virus software. One means of doing this is code refactoring.
disassociation attack
not completely disconnected, but neither can it communicate on the network until it reassociates; an attack that removes a wireless client from a wireless network by using a spoofed MAC address of the client and sending a disassociation frame to the network
passive reconnaissance
not likely to alert the target of the investigation as it means querying publicly available information; the use of open-source intelligence and vulnerability scanning to analyze a system, network or organization
application whitelisting
nothing can run if it is not on the approved whitelist
replay attack (application/service attacks)
occur when an attacker captures some communication between two parties, and then re-transmits it later. This might get them authenticated, or repeat a transaction
race conditions
occur when the outcome from execution processes is directly dependent on the order and timing of certain events, and those events fail to execute in the order and timing intended by the developer; the condition in which two or more applications attempt to access a resource at the same time
external threat
occurs when an individual or a group seeks to gain protected information by infiltrating and taking over profile of a trusted user from outside the organization
DNS poisoning attack/pollution attack
occurs when modifying the DNS server
service account
often used by scheduled processes, such as maintenance tasks, or may be used by application software, such as databases, for account or system access
Realtime Operating System (RTOS)
often used for time-sensitive embedded controllers, of the sort required for the modulation and frequency shifts that underpin radio-based connectivity
resource vs security constraints
on-going battle. Browser support vs. supported encryption. Make sure browser supports encryption type. VPN software support vs. supported algorithms. Make sure VPN concentrator can support the clients being installed on workstations.
watering hole attack
once a visitor visits an unsecured website infected with malware, the visitor's computer is infected with malware
reverse proxy
one that is sitting on the outside of the internet, and anyone who needs to gain access to an internal service such as a web server will first connect to a proxy
cross-site request forgery (XSRF) attack
one-click attack, session riding
script viruses
operating system and browser-based
asymmetric algorithm
operations are performed by two different but related public and private keys in a key pair
Steganography Tools
or "stego" for short, is frequently found in CTFs. Stego is the science of hiding messages in other content. The book has nothing else to say about that so just... be aware, I guess?
Rogue System Detection
organizations will also use topology discovery as an auditing technique to build an asset database and identify non-authorized hosts or network configuration errors
international Framework
others simply mandate "best practice"
exclusive OR (XOR)
outputs true when inputs differ; an operation that outputs to true only if one input is true and the other input is false
buffer overflow attack (compare and contrast types of attacks)
overwriting a buffer of memory that spills over into other memory areas
domain validation
owner of the certificate has some control over a DNS domain
camera systems (CCTV)
part of a physical security system
passive tools
passive tools do not interact with the system in a way that allows detection
penetration testing vs. vulnerability scanning
penetration testing exploits vulnerabilities, while vulnerability scanning just scans for vulnerabilities
take hashes
performed before and after the creation of a forensic image
authentication header (AH)
performs a cryptographic hash on the packet plus a shared secret key (known only to the communicating hosts), and adds this HMAC in its header as an Integrity Check Value (ICV). The recipient performs the same function on the packet and key and should derive the same value to confirm that the packet has not been modified. The payload is not encrypted so this protocol does not provide confidentiality and is consequently not often used.
Network Mapping
performs host discovery and identifies how the hosts are connected together on the network
penetration testing authorization
permission to perform a penetration test
vulnerability testing authorization
permission to perform a vulnerability test.
spear phishing
phishing with inside information by making the attack more believable (by attacking high profile targets like a CEO)
something you are
physical characteristic (fingerprint, face, eye, palm)
preventive
physically or logically restricts unauthorized access
something you know
piece of knowledge (password, PIN)
Backup Utilities
pretty self-explanatory, but at scale, backups become an issue. If you have an entire enterprise to worry about, there are hundreds or thousands of servers and workstations. Each of those need to be backed up on an automated schedule. And, the data needs to be segregated, managed, etc. at scale.
data execution prevention (DEP)
prevent areas in memory marked for data storage from executing code (running a new program)
host-based Intrusion Prevention System (HIPS)
prevent system files from being modified or deleted, prevent services from being stopped, log off unauthorized users, and filter network traffic
content filters
prevent viruses or Trojans infecting computers from the Internet, block spam, and restrict web use to authorized sites; understand basic payload structures and basic encoding formats, such as ASCII, Hex and Unicode, as well as processed results when dealing with content filters
port security
preventing a device attached to a switch port from communicating on the network unless it matches a given MAC address or other protection profile.
screen filters
prevents anyone but the user from reading the screen (shoulder surfing)
conventional lock
prevents the door handle from being operated without the use of a key. More expensive types offer greater resistance against lock picking
canonical encoding rules (CER)
primarily a Windows X.509 file extension
Passwords and PINs
private phrases or words that give a particular user a unique access to a particular program or network
active logging
proactively logging in activity
encryption
process of converting readable data into unreadable characters to prevent unauthorized access.
rules
processes traffic according to access control list rules; traffic that does not conform to a rule that allows it access is blocked.
pointer dereference
programming technique that references a portion of memory; Application crash, debug information displayed, Denial of Service, etc; a failed dereference operation that can corrupt memory and sometimes cause an application to crash
redundancy/fault tolerance
protection against system failure by providing extra capacity
supporting integrity
prove the message was not changed. prevent modification of data. Validate the contents with hashes. File download, password storage, etc.
supporting authentication
prove the source of the message. password hashing. Protect the original password. Add salts to randomize the stored password hash.
network traffic and logs
provide empirical evidence if the forensic analysts properly collect and preserve them
captive portals
provides a way to authenticate to a network or at least have you agree to certain terms and conditions
common access card (CAC)
provides certificate-based authentication and supports two-factor authentication
HyperText Transfer Protocol Secure (HTTPS)
provides for encrypted transfers, using SSL/TLS and port 443
diffie-hellman ephemeral mode (DHE)
provides for secure key exchange by using ephemeral keys
elliptic curve diffie-hellman ephemeral
provides for secure key exchange by using ephemeral keys and elliptic curve cryptography
address resolution protocol (arp)
query or manipulate a device's ARP table.
electronic lock
rather than a key, the lock is operated by entering a PIN on an electronic keypad. This type of lock is also referred to as cipher, combination, or keyless
shredding
reducing the size of objects to render them useless. These objects can be sheets of paper, CDs and DVDs. Cross-cut and micro-shredders are preferable to strip shredding, as they make the shredded pieces smaller and therefore even harder to use
distributive allocation
refers to the ability to switch between available processing and data resources to meet service requests. This is typically achieved using load balancing services during normal operations or automated failover during a disaster.
modes of operation
refers to the way a cryptographic product processes multiple blocks
bluesnarfing
refers to using an exploit in Bluetooth to steal information from someone else's phone
password history
remembers past passwords and prevents users from reusing passwords
wiping
removing data from a data storage device. Wiping is a synonym for sanitization or purging. The techniques discussed above all lead to a form of data wiping, depending on the thoroughness/quality of the wiping
printers/multifunction devices (MFD)
represent a powerful pivot point on an enterprise network
untrained users
represent a serious vulnerability because they are susceptible to social engineering and malware attacks and may be careless when handling sensitive or confidential data
medical devices
represent an array of systems potentially vulnerable to a wide range of attacks. It is important to recognize that use of these devices is not confined to hospitals and clinics but includes portable devices such as cardiac monitors/ defibrillators and insulin pumps
executive user
require training on compliance and regulatory issues and may need a good understanding of technical controls, secure system architecture and design, and secure supply chain management depending on the business function they represent
disable default accounts/passwords
required to harden the OS of a workstation PC
corrective
responds to and fixes an incident and may also prevent its reoccurrence
roles and responsibilities
right people and that they know exactly what their role and responsibility are within the incident response plan
evil twin attack
rogue access point disguising as a legitimate one
antenna types and placement
rubber ducky antenna, yagi, parabolic,
application-based
run as software on any type of computing host
identify lack of security controls
scan for lack of up-to-date patches or lack of a running antivirus software
identify vulnerability
scan for vulnerabilities without interrupting normal operations; scan vulnerabilities to determine which ones to mitigate; The scanner looks for everything; Well, not _everything; The signatures are the key; The vulnerabilities can be cross-referenced online; Almost all scanners give you a place to go; National Vulnerability Database: http://nvd.nist.gov/; Microsoft Security Bulletins; Some vulnerabilities cannot be definitively identified; You'll have to check manually to see if a system is vulnerable; But the scanner gives you a heads-up
retinal scanner
scan patterns of blood vessels in the back of the retina
acceptable use policy (AUP)/fair use policy/rules of behavior
sets out what someone is allowed to use a particular service or resource for
driver manipulation
shimming and refactoring
credential management
should instruct users on how to keep their authentication method secure (whether this be a password, smart card, or biometric ID). The credential management policy also needs to alert users to different types of social engineering attacks
personal email
should never be used to conduct official company business. Should only be access at work if the company permits. Acceptable use policies should explicitly state what is permissible.
screenshots
shouldn't trust the software tools on the perpetrator's machine. Therefore, it's unwise to use native screen-capture tool for taking screenshots
netstat
shows network connections to/from a system.
template
similar to a master image, this is the build instructions for an instance. Rather than storing a master image, the software may build and provision an instance according to the template instructions
intermediate certificate authority (CA)/hierarchical
single CA issues certs to intermediate CAs; issue certificates to subjects (leaf or end entities)
scarcity (principle)
situation will not be this way for long; must make the change before time expires
proximity cards
small credit card-sized cards that activate when they are in close proximity to a card reader. They are often used by authorized personnel to open doors.
passively test security controls
sniffing network traffic to identify assets communicating on the network, service ports used, and potentially some types vulnerabilities; identify vulnerabilities without exploiting them
general security policies
social media networks/applications, personal email
antivirus
software capable of detecting and removing virus infections and (in most cases) other types of malware, such as worms, Trojans, rootkits, adware, spyware, password crackers, network mappers, DoS tools, and so on.
Vulnerability scanner
software configured with a list of known weaknesses and exploits and can scan for their presence in a host OS or particular application.
web application firewall (WAF)
software designed to run on a server to protect a particular application only (a web server firewall, for instance, or a firewall designed to protect an SQL Server® database). This is a type of host-based firewall and would typically be deployed in addition to a network firewall
remote wipe
software that allows deletion of data and settings on a mobile device to be initiated from a remote server.
trojan
software that pretends to be something else, so it can conquer your computer
Password cracker
software used to determine a password, often through brute force or dictionary searches.
network operating system (NOS) firewall
software-based firewall running under a network server OS, such as Windows® or Linux®. The server would function as a gateway or proxy for a network segment
external media
some Android and Windows devices support removable storage; such as a plug-in Micro SecureDigital (SD) card slot; some may support the connection of USB-based storage devices
event deduplication
some errors may cause hundreds or thousands of identical error messages to spawn, temporarily blinding the reporting mechanisms of the SIEM system. This type of event storm is identified as a single event.
low power devices
some technologies require more processing cycles and memory space. This makes them slower and means they consume more power. Consequently, some algorithms and key strengths are unsuitable for handheld devices and embedded systems, especially those that work on battery power. Another example is a contactless smart card, where the card only receives power from the reader and has fairly limited storage capacity, which might affect the maximum key size supported
key escrow
someone else holds your decryption keys; in key management, the storage of a backup key with a third party.
script kiddies
someone that uses hacker tools without necessarily understanding how they work or having the ability to craft new attacks
trust (principle)
someone who is safe; "I'm from IT, and I'm here to help"
familiarity/liking (principle)
someone you know; "we have common friends"
false positive
something that is identified by a scanner or other assessment tool as being a vulnerability, when in fact it is not.
false negative
something that is identified by a scanner or other assessment tool as not being a vulnerability, when in fact it is.
barricades/bollards
something that prevents access. As with any security system, no barricade is completely effective; a wall may be climbed or a lock may be picked, for instance. The purpose of barricades is to channel people through defined entry and exit points
multifactor authentication (MFA)
something you are, something you have, something you know, somewhere you are, something you do
runtime code
source code that is interpreted by an intermediary runtime environment that runs the code, rather than the system executing the code directly.
password length
specifies the minimum number of characters in the password
tabletop exercises
staff "ghost" the same procedures as they would in a disaster, without actually creating disaster conditions or applying or changing anything
shoulder surfing
stealing a password or PIN (or other secure information) by watching the user type it. Despite the name, the attacker may not have to be in close proximity to the target—they could use high-powered binoculars or CCTV to directly observe the target remotely
avoid
stop doing the activity that is risk-bearing
off-site backups
stored in a location separate from the computer or mobile device site
EAP Transport Layer Security (EAP-TLS)
strong security, wide adoption; requires a client-side certificate for authentication using SSL/ TLS
social media networks
such as Twitter, LinkedIn®, and Facebook
external storage devices
such as USB flash drives (and potentially any other type of firmware), presents adversaries with an incredible toolkit
removable media control
such as flash memory cards, USB-attached flash and hard disk storage, and optical discs
payment methods
such as wire transfer, bitcoin, or premium rate phone lines
EAP Tunneled Transport Layer Security (EAP-TTLS)
supports other authentication protocols in a TLS tunnel; enables a client and server to establish a secure connection without mandating a client-side certificate
vulnerabilities due to embedded systems
systems that are included within other systems. This term can apply to a stand-alone, single-purpose system designed to provide specific functionality to an overall system; out-of-date security patches; deployments with default configurations
immutable systems
systems that are replaced rather than changed. For example, rather than updating a server, the entire server would be replaced.
heating, ventilation, and air conditioning (HVAC)
systems that provide and regulate heating and cooling
fire suppression
systems work on the basis of the Fire Triangle. The Fire Triangle works on the principle that a fire requires heat, oxygen, and fuel to ignite and burn
content management
tags corporate or confidential data and prevents it from being shared or copied to unauthorized media or channels, such as non-corporate email systems or cloud storage services
asset management
takes inventory of and tracks all the organization's critical systems, components, devices, and other objects of value
home automation
technology makes heating, lighting, alarms, and appliances all controllable through a computer and network interface
host-based firewall/personal firewall
tend to be program-or process-based; implemented as a software application running on a single host designed to protect that host only
least functionality
that a system should run only the protocols and services required by legitimate users and no more
dynamic analysis
that the application is tested under "real world" conditions using a staging environment
application proxy
that the proxy itself understands the way applications operate so that it's able to take a request for an application and proxy that request on the user's behalf
transport mode
the IP header for each packet is not encrypted, just the data (or payload). This mode would be used to secure communications on a private network (an end-to-end implementation).
message digest 5 (MD5)
the Message Digest Algorithm was designed in 1990 by Ronald Rivest, one of the "fathers" of modern cryptography. The most widely used version is MD5, released in 1991, which uses a 128-bit hash value. It is used in IPSec policies for data authentication
file integrity check
the OS package manager checks the signature or fingerprint of each executable file and notifies the user if there is a problem
high resiliency
the ability to quickly recover from resource vs. security constraints
collision
the act of two different plaintext inputs producing the same exact ciphertext output.
amplification attack/ Distributed Reflection DoS (DRDoS) attack
the adversary spoofs the victim's IP address and attempts to open connections with multiple servers; Those servers direct their SYN/ACK responses to the victim server. This rapidly consumes the victim's available bandwidth; a more powerful TCP SYN flood attack
signal strength
the amount of power used by the radio in an access point or station.
single loss expectancy (SLE)
the amount that would be lost in a single occurrence of the risk factor. This is determined by multiplying the value of the asset by an Exposure Factor (EF). EF is the percentage of the asset value that would be lost
annual loss expectancy (ALE)
the amount that would be lost over the course of a year. This is determined by multiplying the SLE by the Annual Rate of Occurrence (ARO)
known cipher text attack
the analyst has obtained the ciphertext but has no additional information about it. The attacker may use statistical methods such as frequency analysis to try to break the encryption
IP Spoofing attack
the attacker changes the source and/or destination address recorded in the IP packet
known plain text attack
the attacker knows or can guess some plaintext presented in a ciphertext, but not its exact location or context. This can greatly assist with analysis
buffer overflow (impact associated with types of vulnerabilities)
the attacker passes data that deliberately overfills the buffer (an area of memory) that the application reserves to store the expected data
mean time to repair/replace/recover
the average time taken for a device or component to be repaired, replaced, or otherwise recover from a failure
architecture/design weaknesses
the best security system fails if you don't have locks on the doors; the network doors aren't always visible; examine every part of the network: • Ingress • VPN • Third-party access • Internal controls • Account access • Front door access • Conference room access
execution
the carrying out or completion of some task
white box (full disclosure) test
the consultant is given complete access to information about the network. This type of test is sometimes conducted as a follow-up to a black box test to fully evaluate flaws discovered during the black box test. The tester skips the reconnaissance phase in this type of test. Useful for simulating the behavior of a privileged insider threat
black box (blind) test
the consultant is given no privileged information about the network and its security systems. This type of test would require the tester to perform the reconnaissance phase. Useful for simulating the behavior of an external threat
collision attack
the creation of a hash from different passwords by a hashing algorithm; different messages are unlikely to produce the same digest
Corporate Owned, Personally-Enabled (COPE)
the device is chosen and supplied by the company and remains its property. The employee may use it to access personal email and social media accounts and for personal web browsing (subject to whatever acceptable use policies are in force)
corporate owned, business only (COBO)
the device is the property of the company and may only be used for company business
firewalls
the devices principally used to implement security zones, such as intranet, demilitarized zone (DMZ), and the Internet
transparent proxy
the end users have no idea there's a proxy in the middle, and no additional configuration needs to occur on the operating system to be able to take advantage of the proxy
supply chain
the end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer.
production environment
the environment for the actual system operation. It includes hardware and software configurations, system utilities, and communications resources. Also called the operational environment.
artifical/manufactured
the evaluation and assessment of the intentions of people who could pose a threat to an organization, how they might cause harm, and their ability and motivation to carry out the task
supply chain assessment
the evaluation of tradeoffs in your supply chain, including delivery times, inventory availability, transportation costs, facility costs, inventory investment and which suppliers to purchase from, to find the highest service and lowest cost supply chain design
testing environment
the hardware and software that are used to test (usually integration testing and system testing) a software product
control diversity
the idea is that to fully compromise a system, the attacker must get past multiple security controls
geolocation
the identification or estimation of the physical location of an object, such as a radar source, mobile phone, or Internet-connected computing device.
escalation of privilege
the initial exploit might give them local administrator privileges. They might be able to use these to obtain system privileges on another machine and then domain administrator privileges from another pivot point.
recovery time objective (RTO)
the length of time it takes after an event to resume normal business operations and activities
user account
the logon ID required for any user who wants to access a Windows computer
recovery point objective (RPO)
the longest period of time that an organization can tolerate lost data being unrecoverable
public
the lowest data classification level. Public data disclosure will not have a significant negative impact on an organization
confidential
the most sensitive classification level. Generally, this data is for internal use only. If disclosed, it will have a significant negative impact for the organization
federation
the notion that a network needs to be accessible to more than just a well-defined group, such as employees
annual rate of occurrence (ARO)
the number of times an incident is expected to occur in a year
nation states/advanced persistent threat (APT)
the ongoing ability of an adversary to compromise network security (to obtain and maintain access) using a variety of tools and techniques
trusted operating system (TOS)
the operating system component of the TCB that protects the resources from applications
mandatory access control (MAC)
the operating system limits the operation on an object based on security clearance levels
order of volatility (OOV)
the order in which volatile data should be recovered from various storage locations and devices after a security incident occurs
mitigate/remediate
the overall process of reducing exposure to or the effects of risk factors
owner
the person who has final organizational responsibility for classifying, labeling, protecting and storing the information
triple DES (3DES)
the plaintext is encrypted three times using different subkeys
rubber ducky antennas
the plastic-coated variants often used on access points
crossover error rate (CER)
the point at which FRR and FAR meet. The lower the CER, the more efficient and reliable the technology
job rotation
the policy of preventing any one individual performing the same role or tasks for too long. Personnel should rotate between job roles to prevent abuses of power, reduce boredom, and improve professional skills
geofencing
the practice of creating a virtual boundary based on real-world geography.
version control
the practice of ensuring that the assets that make up a project are closely managed when it comes time to make changes.; an ID system for each iteration of a software product
cloud
the practice of using a network of remote servers hosted on the Internet to store, manage, and process data, rather than a local server or a personal computer
continuous integration
the principle that developers should commit updates often (every day or sometimes even more frequently). This is designed to reduce the chances of two developers spending time on code changes that are later found to conflict with one another
legal and compliance
the process by which a business ensures that it observes and complies with the external statutory laws and regulations
data exfiltration
the process by which an attacker takes data that is stored inside of a private network and moves it to an external network.
GPS tagging
the process of adding geographical identification metadata, such as the latitude and longitude where the device was located at the time, to media such as photographs, SMS messages, video, and so on
data retention
the process of an organization maintaining the existence of and control over certain data in order to comply with business policies and/or applicable laws and regulations
change management
the process of approving and executing change in order to assure maximum security, stability, and availability of IT services.
impact
the process of assessing the probabilities and consequences of risk events if they are realized
vulnerability scanning
the process of auditing a network (or application) for known vulnerabilities; scans for vulnerabilities
onboarding
the process of bringing in a new employee, contractor, or supplier.
domain name resolution use case
the process of converting a domain name into a public IP address.
virtualization
the process of creating a simulation of a computing environment, where the virtualized system can simulate the hardware, operating system, and applications of a typical computer without being a separate physical computer.
provisioning
the process of deploying an application to the target environment, such as enterprise desktops, mobile devices, or cloud infrastructure.
authorization
the process of determining what rights and privileges a particular entity has.
offboarding
the process of ensuring that all HR and other requirements are covered when an employee leaves an organization.
exit interview
the process of ensuring that an employee leaves a company gracefully
analytics
the process of reviewing the events and incidents that trigger IDS/IPS.
onboarding
the process of welcoming a new employee to the organization
elasticity
the property by which a computing environment can instantly react to both increasing and decreasing demands in workload.
scalability
the property by which a computing environment is able to gracefully fulfill its ever-increasing resource needs.
high availability
the property that defines how closely systems approach the goal of providing data availability 100 percent of the time while maintaining a high level of system performance.
mean time between failures (MTBF)
the rating on a device or component that predicts the expected time between failures
chain of custody
the record of evidence history from collection, to presentation in court, to disposal.
non-credenialed scan
the scanner cannot login to the remote device; one that proceeds without being able to log on to a host. Consequently, the only view obtained is the one that the host exposes to the network. The test routines may be able to include things such as using default passwords for service accounts and device management interfaces but they are not given any sort of privileged access
Secure POP
the secured version of the protocol, operating over TCP port 995 by default
record time offset
the server and workstation times often slightly differ (or out of sync to some degree) from actual time
electronic code book (ECB)
the simplest encryption mode and too simple for most use cases; an encryption mode of operation where each plaintext block is encrypted with the same key
authority (principle)
the social engineer is in charge; "calling from the help desk/office of the CEO/police"
expiration
the specified amount of time when an account expires to eliminate the possibility that it will be forgotten about and act as possible system backdoors
persistence
the tester's ability to reconnect to the compromised host and use it as a Remote Access Tool (RAT) or backdoor
tunnel mode
the whole IP packet (header and payload) is encrypted and a new IP header added. This mode is used for communications across an unsecure network (creating a VPN). This is also referred to as a router implementation.
tethering
there are also various means for a mobile device to share its cellular data or Wi-Fi connection with other devices
aggregation switches
these are functionally similar to layer 3 switches, but the term is often used for high-performing switches deployed to aggregate links in a large enterprise or service provider's routing infrastructure.
Exploitation frameworks
these are toolsets designed to help attackers exploit systems. Some of these tools include automation. Groupings of these tools represent (sorta) standardized ways of attacking, and a framework for moving through an attack. The most famous example is Metasploit.
secure cabinets/enclosures
these can be supplied with key-operated or electronic locks
Non-Regulatory Framework
they do not attempt to address the specific regulations of a specific industry but represent "best practice" in IT security governance generally
application management
they focus on managing a part of the device, not all of it, When the device is joined to the corporate network through enrollment with the EMM software, it can be configured into a corporate "workspace" mode in which only a certain number of whitelisted applications can run
containerization
this allows the employer to manage and maintain the portion of the device that interfaces with the corporate network
property
this includes damage to business property, property of others, or environmental damage
deadbolt lock
this is a bolt on the frame of the door, separate to the handle mechanism
passive test access point (TAP)
this is a box with ports for incoming and outgoing network cabling and an inductor or optical splitter that physically copies the signal from the cabling to a monitor port
snapshot/revert to known state
this is a saved system state that can be reapplied to the instance
master image
this is the "gold" copy of a server instance, with the OS, applications, and patches all installed and configured. This is faster than using a template, but keeping the image up to date can involve more work than updating a template.
infrastructure as code
this is the principle that when deploying an application, the server instance supporting the application can be defined and provisioned through the software code. Imagine a setup program that not only installs the application but also creates a VM and OS on which to run the application.
community cloud
this is where several organizations share the costs of either a hosted private or fully private cloud. This is usually done in order to pool resources for a common concern, like standardization and security policies
switched port analyzer/mirror port
this means that the sensor is attached to a specially configured port on the switch that receives copies of frames addressed to nominated access ports (or all the other ports)
integrity measurement
this process determines whether the development environment varies from the secure baseline
background checks
this process essentially determines that a person is who they say they are and are not concealing criminal activity, bankruptcy, or connections that would make them unsuitable or risky
encapsulating security payload (ESP)
this provides confidentiality and authentication by encrypting the packet rather than simply calculating an HMAC. ESP attaches three fields to the packet (a header, a trailer [providing padding for the cryptographic function], and an Integrity Check Value).
system owner
this role is responsible for designing and planning computer, network, and database systems. The role requires expert knowledge of IT security and network design
aircraft/unmanned aerial vehicle
this sector ranges from full-size fixed wing aircraft to much smaller multi-rotor hover drones
rooting
this term is associated with Android devices. Some vendors provide authorized mechanisms for users to access the root account on their device
environmental
those caused by some sort of failure in the surrounding environment. These could include power or telecoms failure, pollution, or accidental damage (including fire)
subscription services use case
those services that offer membership for a fee, usually on a monthly or annual basis
mission-essential functions
those that MUST occur. If they don't occur, or are performed improperly, the mission of the business is directly impacted
sensors
to aggregate data outputs from multiple sources
secure configurations
to allow the OS and applications software to execute that role
initial exploitation/weaponization
used to gain some sort of access to the target's network. This initial exploitation might be accomplished using a phishing email and payload or by obtaining credentials via social engineering
replay attack (wireless attacks)
used to make the access point generate lots of packets, usually by replaying ARP packets at it, and cycle through IV values quickly
digital signatures
used to prove the identity of the sender of a message and to show that a message has not been tampered with since the sender posted it. This provides authentication, integrity, and non-repudiation. To create a digital signature using RSA encryption, the private key is used to encrypt the signature; the public key is distributed to allow others to read it
cable locks
used to secure portable computers, external hard drives, and other portable pieces of hardware to a table or other object
email certificate
used to sign and encrypt email messages, typically using S/MIME or PGP
horizontal privilege escalation
user A can access user B resources
single sign-on (SSO)
user only has to authenticate to a system once to gain access to all the resources to which the user's account has been granted rights
attribute-based access control (ABAC)
users can have complex relationships to applications and data, and access may be based on many different criteria
RADIUS Federation
uses 802.1X as the authentication method and RADIUS on the backend, EAP to authenticate
initialization vector (IV) attack
uses a number, the IV, to find a wireless protocol's pre-shared key and use packet injection techniques on the network
Transport Layer Security (TLS)
uses certificates and public key cryptography for mutual authentication and data encryption over a TCP/IP connection.
Secure Sockets Layer (SSL)
uses certificates for authentication and encryption to protect web communication.
iris scanner
uses pattern-recognition techniques based on images of the irises of an individual's eyes.
code reuse
using a block of code from elsewhere in the same application or from another application to perform a different function (or perform the same function in a different context). The risk here is that the copy and paste approach causes the developer to overlook potential vulnerabilities (perhaps the function's input parameters are no longer validated in the new context)
client-side
usually restricted to informing the user that there is some sort of problem with the input before submitting it to the server. Even after passing client-side validation, the input will still undergo server-side validation before it can be posted (accepted). Relying on client-side validation only is poor programming practice.
zero day attack
vulnerability that is exploited before the developer knows about it or can release a patch
development life-cycle models
waterfall, agile
smart devices/IoT
wearable/technology, home automation
new threats/zero day
what you don't know can really hurt you; And you won't even see it coming Vulnerabilities are sitting in your system,waiting for someone to find them; Some problems are hidden for years As soon as the problem is discovered (day zero), patch it; There isn't always time to properly test; Balance severity with stability WannaCry ransomware hit on May 12, 2017; However, the patch had been available since March 14
vertical privilege escalation/elevation
where a user or application can access functionality or data that should not be available to them. For instance, a user might have been originally assigned read-only access (or even no access) to certain files, but after vertical escalation, the user can edit or even delete the files in question
mail gateaway
where all the information coming in and out is filtered through that gateway before ever coming into an internal email server
stack overflow
where an attacker could use a buffer overflow to change the return address, allowing the attacker to run arbitrary code on the system. Two examples of this are the Code Red worm, which targeted Microsoft's IIS web server (version 5) and the SQLSlammer worm, which targeted Microsoft SQL Server® 2000
false positive
where legitimate behavior is identified as an incident; a reported vulnerability that does not exist
VPN concentrators
where the functionality is part of a router or dedicated security appliance
waterfall
where the phases of the SDLC cascade so that each phase will start only when all tasks identified in the previous phase are complete.
somewhere you are
where the user is located
man-in-the-browser (MITB) attack
where the web browser is compromised by installing malicious plug-ins or scripts or intercepting API calls between the browser process and DLLs
thin AP
while one that requires a wireless controller in order to function is known as a thin AP
business partners agreement (BPA)
while there are many ways of establishing business partnerships, the most common model in IT is the partner agreements that large IT companies (such as Microsoft and Cisco) set up with resellers and solution providers
tracert or traceroute
windows command for tracing the route a packet takes over the network.
urgency (principle)
works alongside scarcity; "act quickly, don't think"
ARP poisoning attack
works by broadcasting unsolicited ARP reply packets; Because ARP is an antiquated protocol with no security, the receiving devices trust this communication and update their MAC:IP address cache table with the spoofed address
credentialed scan
you are a normal user, emulates an insider attack; given a user account with logon rights to various hosts plus whatever other permissions are appropriate for the testing routines. This sort of test allows much more in-depth analysis, especially in detecting when applications or security settings may be misconfigured. It also demonstrates what an insider attack or one where the attacker has compromised a user account may be able to achieve
clickjacking attack
you are clicking on a button, but you are actually clicking on something else
intrusive scan
you will try out the vulnerability to see if it works; an exploitation framework; a test that disrupts the operations of a system; also known as a penetration test; attempts to exploit vulnerabilities