Security+ Terminology Ch 3
passive response
A nonactive response, such as logging. Is the most common type of response to many intrusions. Easiest to develop and implement
implicit deny
A condition that states that unless otherwise given, the permission will be denied.
Secure Sockets Layer (SSL)
A protocol that secures messages by operating between the Application layer (HTTP) and the Transport layer.
proxy firewall
A proxy server that also acts as a firewall, blocking network access from external networks.
Internet Protocol Security (IPSec)
A set of protocols that enable encryption, authentication, and integrity over IP. Is commonly used with virtual private networks (VPNs) and operates at Layer 3.
HSM (Hardware Security Module)
A software or appliance stand-alone used to enhance security and commonly used with PKI systems.
Access Control List (ACL)
A table or data file that specifies whether a user or group has access to a specific resource on a computer or network.
proxy server
A type of server that makes a single Internet connection and services requests on behalf of many users.
Network Intrusion Prevention System (NIPS)
An intrusion prevention system that is network based.
Data Loss Prevention (DLP)
Any systems that identify, monitor, and protect data to prevent it from unauthorized use, modification, destruction, egress, or exfiltration from a location.
load balancing
Dividing a load for greater efficiency of management among multiple devices.
stateful inspection
Inspections that occur at all levels of the network and provide additional security using a state table that tracks every communications channel.
Network Access Control (NAC)
The set of standards defined by the network for clients attempting to access it. Usually requires that clients be virus free and adhere to specified policies before allowing them on the network.
Authentication Header (AH)
This provides connectionless integrity and data origin authentication for IP datagrams and to provide protection against replays
Intrusion Detection System (IDS)
Tools that identify attacks using defined rules or logic and are considered passive. Can be network based or host based.
Intrusion Prevention System (IPS)
Tools that respond to attacks using defined rules or logic and are considered active. Can be network based or host based.
compensating controls
gap controls that fill in the coverage between other types of vulnerability mitigation techniques
Anomaly Detection IDS
learns what the normal operation is and then spots deviations from it
anomalies
variations from normal operations
Encapsulating Security Payload (ESP)
An IPSec header used to provide a mix of security services in IPv4 and IPv6. Can be used alone or in combination with the IP Authentication Header (AH).
SSID broadcast
An access point's broadcasting of the network name
Network-based IDS (NIDS)
An approach to an intrusion detection system (IDS); it attaches the system to a point in the network where it can monitor and report on all network traffic.
analyzer
The component or process that analyzes the data collected by the sensor.
firewall
a combination of hardware and software filters placed between trusted and untrusted networks intended to protect a network from attack by hackers who could gain access through public networks, including the internet
application-level proxy
a device or software that recognizes application-specific commands and offers granular control over them
false positive
a flagged event that isn't really an event and has been falsely triggered
appliance
a freestanding device that operates in a largely self-contained manner
clustering
a method of balancing loads and providing fault tolerance
switch
a network device that can replace a router or hub in a local network and get data from a source to a destination. Also allows for higher speeds.
alarm
a notification that an unusual condition exists an should be investigated
active response
a response generated in real time
signature-based system
a system that acts based on the digital signature it sees and offers no repudiation to increase the integrity of a message
proxy
a type of system that prevents direct communication between a client and a host by acting as an intermediary
all-in-one appliance
an appliance that performs multiple functions
false negative
an event that should be flagged but isn't
alert
an indication that an unusual condition could exist and should be investigated
host-based IDS
an intrusion detection system that is host-based, An alternative is in intrusion detection system that is network based
Security Information and Event Management (SIEM)
software that combines security information management (SIM) and security event management (SEM) functions to provide real-time analysis of security alerts
key management
the management of all aspects of cryptographic keys in a cryptosystem, including key generation, exchange, storage, use, destruction, and replacement
access point (AP)
the point at which access to a network is accomplished. This term is often used in relation to a wireless access point
Encapsulation
the process of enclosing data in a packet