Sec+

Lakukan tugas rumah & ujian kamu dengan baik sekarang menggunakan Quizwiz!

Log review

is a critical part of security assurance

RSA (Rivest, Shamir, Adelman) 1024-bit

is a secure asymmetric encryption algorithm.

Pretty Good Privacy (PGP)

is a web of trust

BitLocker To Go

A Windows 10 utility that can encrypt data on a USB flash drive and restrict access by requiring a password.

BitLocker

A Windows feature that encrypts an entire drive

DevSecOps

A combination of software development, security operations, and systems operations by integrating each discipline with the others

stateless packet filtering

A firewall technology that looks at the incoming packet and permits or denies it based strictly on the rule base.

Trusted Firmware Updates

A firmware update that is digitally signed by the vendor and trusted by the system before installation

Whaling

A form of spear phishing that directly targets the CEO, CFO, CIO, CSO, or other high-value target in an organization

Nessus

A proprietary vulnerability scanner that can remotely scan a computer or network for vulnerabilities

Downgrade Attack

A protocol is tricked into using a lower quality version of itself instead of a higher quality version

Federated Identity Management (FIdM)

A single identity is created for a user and shared with all of the organizations in a federation

XMAS Attack

A specialized network scan that sets the FIN, PSH, and URG flags set and can cause a device to crash or reboot

Flood Attack

A specialized type of DoS which attempts to send more packets to a single server or host than they can handle

Backdoor

A way of bypassing normal authentication in a system

gpedit

Access the Group Policy Editor by opening the Run prompt and enter __________, and you can view the local policies

SSID

According to Comptia, Disable the ______broadcast in the exam, for network security

IPS

An _____ can prevent a small-scale DDoS

XML External Entity (XXE)

An attack that embeds a request for a local resource

ISO 27701

An international standard that acts as a privacy extension to the ISO 27001 to enhance the existing Information Security Management System (ISMS) with additional requirements in order to establish, implement, maintain, and continually improve a Privacy Information Management System (PIMS)

ISO 27001

An international standard that details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS)

ISO 27002

An international standard that provides best practice recommendations on information security controls for use by those responsible for initiating, implementing, or maintaining information security management systems (ISMS)

Python

An interpreted, high-level and general-purpose programming language

nmap

An open-source network scanner that is used to discover hosts and services on a computer network by sending packets and analyzing their responses

hping

An open-source packet generator and analyzer for the TCP/IP protocol that is used for security auditing and testing of firewalls and networks

Trusted Operating Systems (TOS)

An operating system that meets the requirements set forth by government and has multilevel security

Access Control List

An ordered set of rules that a router uses to decide whether to permit or deny traffic based upon given characteristics; IP Spoofing is used to trick a router's ______

Choose Your Own Device (CYOD)

An organization allows employees to select from specified devices for business usage.

Application Blacklist

Any application placed on the list will be prevented from running while all others will be permitted to run

Threat

Any condition that could cause harm, loss, damage, or compromise to our information technology systems § are external and beyond your control

Internet-facing Host

Any host that accepts inbound connections from the internet

DNS Amplification

Attack which relies on the large amount of DNS information that is sent in response to a spoofed query on behalf of the victimized server

Double Tagging

Attacker adds an additional VLAN tag to create an outer and inner tag; can be prevented by moving all ports out of the default VLAN group

Cryptanalysis Attack

Comparing a precomputed encrypted password to a value in a lookup table

Change Management Policy

Defines the structured way of changing the state of a computer system, network, or IT procedure

Data Masking

Deidentification Method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data

unnecessary and regenerate

Delete _______ keys and ________keys when moving into a production environment

Radio Frequency Identification (RFID)

Devices that use a radio frequency signal to transmit identifying information about the device or token holder § can operate from 10 cm to 200 meters depending on the device

Fieldbus

Digital serial data communications used in operational technology networks to link PLCs

wuauserv

Disable the ___________service to prevent Windows Update from running automatically

Network Mapping

Discovery and documentation of physical and logical connectivity that exists in the network

Baseline Reporting

Documenting and reporting on the changes in a baseline

10 Tape Rotation

Each tape is used once per day for two weeks and then the entire set is reused

key

Encryption strength comes from the ____, not the algorithm

-Establish administrative control over Operational technology networks by recruiting staff with relevant expertise § Implement the minimum network links by disabling unnecessary links, services § Develop and test a patch management program for Operational Technology Network § Perform regular audits of logical and physical access to systems to detect possible vulnerabilities and intrusion

Four key controls for mitigating vulnerabilities in specialized system

Rootkit

Gains administrative control of your system by targeting boot loader or kernel

Sensitive but Unclassified

Government Classifications- Items that wouldn't hurt national security if released but could impact those whose data is contained in it

Unclassified data

Government Classifications- can be released to the public

Regulatory bodies

Governmental organizations that oversee the compliance with specific regulations and law

6

Group can RW in Linux

sequentially; locking mechanism

How can you prevent race conditions and TOCTTOU? • Develop applications to not process things __________ if possible • Implement a _____ _________to provide app with exclusive access

o Analyze network traffic o Analyze the executable process list o Analyze other infected host o Identify how the malicious process was executed

How to perform Threat hunting using tools for monitoring and incident response (4)

40%

Humidity should be kept around _____

alert and log

IDS can only ____ and _____ suspicious activity

143 TCP

IMAP

external USB drive

If your motherboard doesn't have TPM, you can use an _____ ____ _______ as a key

Data at Rest

Inactive data that is archived, such as data resident on a hard disk drive

Key stretching and salting

Increasing Hash Security

Confidentiality

Information has not been disclosed to unauthorized people

Integrity

Information has not been modified or altered without proper authorization

Availability

Information is able to be stored, accessed, or protected at all times

WEP

Initialization Vector

88 TCP/UDP

Kerberos

Rule-based Access Control

Label-based access control that defines whether access should be granted or denied to objects by comparing the object label and the subject label

centrally

Large organizations _________ manage updates through an update server

False positive

Legitimate activity is identified as an attack

iptables

Linux firewall, can be accessed from the command line

Processor Security Extensions

Low-level CPU changes and instructions that enable secure processing

Rule-based and the Latticebased

MAC is implemented through the ______ and ______ access control methods

security labels

MAC relies on ____ ____ being assigned to every user

OS X

Mac operating system; built in firewall on mac computer

FireVault

Mac whole disk encryption

security

Management should be conducted on an out-of-band network to increase _____

Social Engineering

Manipulates a user into revealing confidential information that are detrimental to that user or the security of our systems; Anytime you are trying to deceive, lie, or trick the user into doing something

PAC - Proxy Auto Configuration

Method used to automatically configure systems to use a proxy server. It is recommended to disabled this since it can be used by an attacker to manipulate the configuration; it suggested to manually configure your proxy server

dictionary attack

Method where a program attempts to guess the password by using a list of possible passwords

Brute-Force Attack

Method where a program attempts to try every possible combination until it cracks the password Increasing complexity exponentially increases the time required to brute-force a password

Due Care

Mitigation actions that an organization takes to defend against the risks that have been uncovered during due diligence

3 and 4

Most FW operate at Layer __ (blocking IP addresses) and Layer___(blocking ports)

1433 TCP

Ms-sql-s

Signature-based

Network traffic is analyzed for predetermined attack patterns

Open wireless connection

No security or no protection provided

White Hats, penetration tester or ethical hacker

Non-malicious hackers who attempt to break into a company's systems at their request

Man-in-the-Browser (MITB)

Occurs when a Trojan infects a vulnerable web browser and modifies the web pages or transactions being done within the browser

Active Interception

Occurs when a computer is placed between the sender and receiver and is able to capture or modify the traffic between them

Black-box Testing

Occurs when a tester is not provided with any information about the system or program prior to conducting the test

White-box Testing

Occurs when a tester is provided full details of a system including the source code, diagrams, and user credentials in order to conduct the test

Privilege Creep

Occurs when a user gets additional permission over time as they rotate through different positions or roles; violates the principles of least privilege

Password Guessing

Occurs when a weak password is simply figured out by a person

physical or virtual servers.

One of the great things about doing serverless is that it eliminates the need to manage ______ or ________

curl, C-U-R-L.

One of the ways you can test APIs is by using a tool known as This is a tool to transfer data from one server to another, and you can do this using any supportive protocol, including HTTP, HTTPS, FTP, FTPS, SCP, SFTP, TFTP, DICT, TELNET, LDAP, or FILE.

Port Mirroring

One or more switch ports are configured to forward all of their packets to another port on the switch

Incremental Backup

Only conducts a backup of the contents of a drive that have changed since the last full or incremental backup

official App Store or Play Store

Only install apps from the ________

v2

Only use ____ SIM cards with your devices

Circuit-Level gateway

Operates at the session layer and only inspects the traffic during the establishment of the initial session over TCP or UDP

inherited by default

Permissions are _____ ____ _____ from the parent when a new folder is created, meaning Any permissions added/removed from the parent folder will pass to the child by default too!

port 1645

Proprietary variation authentication port

Authentication Header (AH)

Protocol used in IPSec that provides integrity and authentication

Organizational Policies

Provide general direction and goals, a framework to meet the business goals, and define the roles, responsibilities, and terms

1812/1813 UDP

RADIUS

1645/1646 UDP

RADIUS (alternative)

3389 TCP/UDP

RDP

vulnerability, encrypts

Ransomware uses a __________ in your software to gain access and then ________ your files

Key Management

Refers to how an organization will generate, exchange, store, and use encryption keys

Policy-based

Relies on specific declaration of the security policy (i.e., 'No Telnet Authorized')

Biometrics

Relies on the physical characteristics of a person to identify them; considered "something you are"

supply chain

Secure working in an unsecure environment involves mitigating the risks of the ____ _____

Vulnerability Assessment

Seeks to identify any issues in a network, application, database, or other systems prior to it being used that might compromise the system; Defines, identifies, and classifies vulnerabilities within a system

Bluejacking

Sending of unsolicited messages to Bluetooth-enabled devices

orchestration

Serverless depends on ______

§ No patching § No administration § No file system monitoring

Serverless eliminates the need to manage physical or virtual servers ie. 3

personal firewalls

Software application that protects a single computer from unwanted Internet traffic

Critical Update

Software code for a specific problem addressing a critical, non-security bug in the software

802.1x

Standardized framework used for port-based authentication on wired and wireless networks; can prevent rogue devices

self-encrypting drive (SED)

Storage device that performs whole disk encryption by using embedded hardware; seldom used since its very expensive

Twofish

Symmetric block cipher that replaced blowfish and uses 128-bit blocks and a 128-bit, 192-bit, or 256-bit encryption key to encrypt plaintext into ciphertext

Blowfish

Symmetric block cipher that uses 64-bit blocks and a variable length encryption key to encrypt plaintext into ciphertext

Rivest Cipher (RC6)

Symmetric block cipher that was introduced as a replacement for DES but AES was chosen instead

69 UDP

TFTP

WPA

TKIP and RC4

Birthday Attack

Technique used by an attacker to find two different messages that have the same identical hash digest

Port 23 (TCP/UDP)

Telnet

Denial of Service (DoS)

Term used to describe many different types of attacks which attempt to make a computer or server's resources unavailable

PKI

The federation trust between parties is established using ____certificates.

Red Team

The hostile or attacking team in a penetration test or incident response exercise

Risk

The probability that a threat will be realized

Fraud

The wrongful or criminal deception intended to result in financial or personal gain

electronic access systems

These can use an RFID reader to scan an employee's badge and grant them access based on those credentials.

Installation

This mechanism enables the weaponized code to run a remote access tool and achieve persistence on the target system

BC extinguisher

This most often uses CO2 to put out a fire. This is useful for both gas fires, Class B, and electrical fires, Class C, and it's also safe to use on computers.

Grandfather-Father-Son

Three sets of backup tapes are defined as the son (daily), the father (weekly), and the grandfather (monthly)

syslog / rsyslog / syslog-ng

Three variations of syslog which all permit the logging of data from different types of systems in a central repository

SYSLOG

To consolidate all the logs into a single repository, you can use this. A standardized format used for computer message logging that allows for the separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them; uses port 514 over UDP

encryption

Turn on _______for voice and data

Cluster

Two or more servers working together to perform a particular job function

Port 389

Unencrypted

Service Set Identifier (SSID)

Uniquely identifies the network and is the name of the WAP used by the clients

separated

VMs are ________ from other VMs by default

plan

Verify it is compatible with your systems and ______for how you will test and deploy it

Security Assessments

Verify that the organization's security posture is designed and configured properly to help thwart different types of attacks; might be required by contracts, regulations, or laws

Kali Linux

Version of Linus that is use by penetration tested or simulated attacker

SNMP v3

Version of SNMP that provides integrity, authentication, and encryption of the messages being sent over the network

Macro

Virus embedded into a document and is executed when the document is opened by the user

Metamorphic

Virus that is able to rewrite itself entirely before it attempts to infect a file (advanced version of polymorphic virus)

user action

Viruses require a _______ in order to reproduce and spread

Advanced Encryption Standard (AES)

WPA relies for its algorithm

Baiting

When a malicious individual leaves malware-infected removable media such as a USB drive or optical disc lying around in plain view

Overwrite Events

When a maximum log size is reached, the system can begin overwriting the oldest events in the log files to make room

Dumpster Diving

When a person scavenges for private information in garbage containers

Eavesdropping

When a person uses direct observation to "listen" in to a conversation

Shoulder Surfing

When a person uses direct observation to obtain authentication information

Authentication

When a person's identity is established with proof and confirmed by a system

risk

When security is sacrificed in favor of more efficient operations, additional _____ exists

Power Users

___ ____ is a role-based permission

Adobe Flash

being phased out in favor of html 5

ultrasonic camera

camera sound-based detection.

runtime error

error occurs while the program is running

Online password attacks

involve entering guessing directly to a service

ArcSight

A SIEM log management and analytics software that can be used for compliance reporting for legislation and regulations like HIPPA, SOX, and PCI DSS

QRadar

A SIEM log management, analytics, and compliance reporting platform created by IBM § Alien Vault and OSSIM (Open-Source Security Information Management) § A SIEM solution originally developed by Alien Vault, now owned by AT&T, and rebranded as AT&T Cybersecurity § OSSIM can integrate other open-source tools, such as the Snort IDS and OpenVAS vulnerability scanner, and provide an integrated web administrative tool to manage the whole security environmen

Simple Network Management Protocol (SNMP)

A TCP/IP protocol that aids in monitoring network-attached devices and computers is incorporated into a network management and monitoring system

Measured Boot

A UEFI feature that gathers secure metrics to validate the boot process in an attestation report

Secure Boot

A UEFI feature that prevents unwanted processes from executing during the boot operation

virtual machine

A ____ ______ is a container for an emulated computer that runs an entire operating system

laptop

A _____ would be better classified as a computer or host than as part of the Internet of Things.

Race Condition

A ______ ________ vulnerability is found where multiple threads are attempting to write a variable or object at the same memory location; difficult to detect and mitigate; can also be used against databases and file systems

Hypothesis

A _______ is derived from the threat modeling and is based on potential events with higher likelihood and higher impact.

Rainbow Table Attack

A ________ is a password attack that allows an attacker to use a set of plaintext passwords and their hashes to crack passwords.

normal

A baseline establishes what is _____ so you can find deviations

Anomaly-based

A baseline is established and any network traffic that is outside of the baseline is evaluated

Playbook

A checklist of actions to perform to detect and respond to a specific type of incident

Attestation

A claim that the data presented in the report is valid by digitally signing it using the TPM's private key

Security Orchestration, Automation, and Response (SOAR)

A class of security tools that facilitates incident response, threat hunting, and security configuration by orchestrating automated runbooks and delivering data enrichment - is primarily used for incident response

Function as a Service (FAAS)

A cloud service model that supports serverless software architecture by provisioning runtime containers in which code is executed in a particular programming language

Botnet

A collection of compromised computers under the control of a master node

Security Information and Event Monitoring (SIEM)

A combination of different data sources into one tool that provides realtime analysis of security alerts generated by applications and network hardware • Sensor • Sensitivity • Trends • Alerts • Correlation

network firewall

A combination of hardware and software that filters traffic between private networks or between a private network and a public network, such as the Internet.

curl

A command line tool to transfer data to or from a server, using any of the supported protocols (HTTP, FTP, IMAP, POP3, SCP, SFTP, SMTP, TFTP, TELNET, LDAP or FILE)

tcpdump

A command line utility that allows you to capture and analyze network traffic going through your system

Memdump

A command line utility used to dump system memory to the standard output stream by skipping over holes in memory maps

cat (concatenate)

A command-line utility for outputting the contents of a file to the screen

head

A command-line utility for outputting the first ten lines of a file provided to it

tail

A command-line utility for outputting the last ten lines of a file provided to it

grep

A command-line utility for searching plain-text data sets for lines that match a regular expression or pattern

chmod

A command-line utility used to change the access permissions of file system objects

WinHex

A commercial disk editor and universal hexadecimal editor used for data recovery and digital forensics

Operational Technology (OT)

A communications network designed to implement an industrial control system rather than data networking § Industrial systems prioritize availability and integrity over confidentiality

Quantum Communication

A communications network that relies on qubits made of photons (light) to send multiple combinations of 1s and 0s simultaneously which results in tamper resistant and extremely fast communications

Modbus

A communications protocol used in operational technology networks § gives control servers and SCADA hosts the ability to query and change the configuration of each PLC

Private cloud

A company creates its own cloud environment that only it can utilize as an internal enterprise resource should be chosen when security is more important than cost

Machine Learning (ML)

A component of AI that enables a machine to develop strategies for solving a task given a labeled dataset where features have been manually identified but without further explicit instructions o

Metasploit (MSF)

A computer security tool that offers information about software vulnerabilities, IDS signature development, and improves penetration testing

Embedded Systems

A computer system that is designed to perform a specific, dedicated function; are considered static environments where frequent changes are not made or allowed; have very little support for identifying and correcting security issues

zombie

A computer that is controlled by a Command and Control (hacker) who uses it to launch attacks on other computer systems.

Layer 2 Tunneling Protocol (L2TP) - Port 1701

A connection between two or more computers or device that are not on the same private network; is usually paired with IPSec to provide security

Message Digest Algorithm (MD5)

A cryptographic hashing algorithm created in 1990; uses a 128-bit hash digest, but is susceptible to collisions should only be used as a second-factor of integrity checking

Secure Hash Algorithm (SHA)

A cryptographic hashing algorithm created to address possible weaknesses in the older MD5 hashing algorithm

Ephemeral

A cryptographic key that is generated for each execution of a key establishment process § _______ keys are short-lived and used in the key exchange for WPA3 to create perfect forward secrecy

Hardware Root of Trust (ROT)

A cryptographic module embedded within a computer system that can endorse trusted execution and attest to boot settings and metrics;is used to scan the boot metrics and OS files to verify their signatures, which we can then use to sign a digital report

Transport Layer Security (TLS)

A data encryption technology used for securing data transmitted over the Internet. Https: is secure browsing and uses this data encryption

FTK Imager

A data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool is needed

Lightweight Directory Access Protocol (LDAP)

A database used to centralize information about clients and objects on the network; Active Directory is Microsoft's version

Web of Trust

A decentralized trust model that addresses issues associated with the public authentication of public keys within a CA-based PKI system

Single Sign-On (SSO)

A default user profile for each user is created and linked with all of the resources needed § Compromised SSO credentials cause a big breach in security

Tokenization

A deidentification method where a unique token is substituted for real data

Aggregation/Banding

A deidentification technique where data is generalized to protect the individuals involved

Proxy Server

A device that acts as a middle man between a device and a remote server

Modem

A device that could modulate digital information into an analog signal for transmission over a standard dial-up phone line

Autopsy

A digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools

Controller Area Network (CAN)

A digital serial data communications network used within vehicles

Self-Encrypting Drives

A disk drive where the controller can automatically encrypt data that is written to it

Radio Frequency Interference (RFI)

A disturbance that can affect electrical circuits, devices, and cables due to AM/FM transmissions or cell towers

Perfect Forward Secrecy or Forward Secrecy

A feature of key agreement protocols (like SAE) that provides assurance that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised

Log Files

A file that records either events that occur in an operating system or other software runs, or messages between different users of a communication software • Network • System • Application • Security • Web • DNS • Authentication • Dump Files • VoIP • Call Managers

session cookie

A file used by online shopping sites to keep track of items in a user's shopping cart. To track user and the server NOT user and the browser

EFS (Encrypting File System)

A file-encryption tool available on Windows systems that have partitions formatted with NTFS.

Web Security Gateway

A go-between device that scans for viruses, filters unwanted content, and performs data loss prevention functions

Distributed Denial of Service (DDoS)

A group of compromised systems attack simultaneously a single target to create a Denial of Service (DOS)

Honeynet

A group of computers, servers, or networks used to attract an attacker

Internet of Things (IoT)

A group of objects (electronic or not) that are connected to the wider Internet by using embedded electronic components § Most smart devices use an embedded version of Linux or Android as their OS § Devices must be secured and updated when new vulnerabilities are found

Security Template

A group of policies that can be loaded through one procedure

Digital Signature

A hash digest of a message encrypted with the sender's private key to let the recipient know the document was created and sent by the person claiming to have sent it

MITRE ATT&CK Framework

A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and common knowledge or procedures

Due Diligence

A legal principle identifying a subject has used best practice or reasonable care when setting up, configuring, and maintaining a system

Due Process

A legal term that refers to how an organization must respect and safeguard personnel's rights; protects citizens from their government and companies from lawsuits

Inbound Port

A logical communication opening on a server that is listening for a connection from a client

Splunk

A market-leading big data information gathering and analysis tool that can import machine-generated data via a connector or visibility add-on; installed locally or as a cloud-based solution

eFUSE

A means for software or firmware to permanently alter the state of a transistor on a computer chip

Secure Processing

A mechanism for ensuring the confidentiality, integrity, and availability of software code and data as it is executed in volatile memory

Application Programming Interface (API)

A method that uses the brokers connections between the cloud service and the cloud consumer • WARNING: Dependent on the _____ supporting the functions that your policies demand

MAC filtering

A method used to filter out which computers can access the wireless network; the WAP does this by consulting a list of MAC addresses that have been previously entered.

Cloud Security Alliance's Reference Architecture

A methodology and a set of tools that enable security architects, enterprise architects, and risk management professionals to leverage a common set of solutions that fulfill their common needs to be able to assess where their internal IT and their cloud providers are in terms of security capabilities and to plan a roadmap to meet the security needs of their business

Trusted Foundry

A microprocessor manufacturing utility that is part of a validated supply chain (one where hardware and software does not deviate from its documented function); Program is operated by the Department of Defense (DoD)

Hybrid Warfare

A military strategy which employs political warfare and blends conventional warfare, irregular warfare and cyberwarfare with other influencing methods, such as fake news, diplomacy, and foreign electoral intervention

Kill Chain

A model developed by Lockheed Martin that describes the stages by which a threat actor progresses a network intrusion

nxlog

A multi-platform log management tool that helps to easily identify security risks, policy breaches or analyze operational problems in server logs, operation system logs and application logs; is a cross-platform, open-source tool that is similar to rsyslog or syslog-ng

Hot Site

A near duplicate of the original site of the organization that can be up and running within minutes

tracert/traceroute

A network diagnostic command for displaying possible routes and measuring transit delays of packets across an Internet Protocol network

netflow

A network protocol system created by Cisco that collects active IP network traffic as it flows in or out of an interface, including its point of origin, destination, volume and paths on the network

Tunnel Mode

A network tunnel is created which encrypts the entire IP packet (payload and header); is commonly used for transmission between networks

Post-quantum Cryptography

A new kind of cryptographic algorithm that can be implemented using today's classical computers but is also impervious to attacks from future quantum computers § One method is to increase the key size to increase the number of permutations needed to be brute forced § Researchers are working on a wide range of approaches, including latticebased cryptography and supersingular isogeny key exchange

GNU Privacy Guard (GPG)

A newer and updated version of the PGP encryption suite that uses AES for its symmetric encryption functions § has cross-platform availability

Network Tap

A physical device that allows you to intercept the traffic between two points on the network

Downloader

A piece of code that connects to the Internet to retrieve additional tools after the initial infection by a dropper

Personal Identifiable Information (PII)

A piece of data that can be used either by itself or in combination with some other pieces of data to identify a single person- • Full Name • Driver's License • Date of Birth • Place of Birth • Biometric Data • Financial Account Numbers • Email Addresses • Social Media Usernames

Persistent Agents

A piece of software that is installed on the device requesting access to the network

Wireshark

A popular network analysis tool to capture network packets and display them at a granular level for real-time or offline analysis

Virtual Private Cloud (VPC)

A private network segment made available to a single cloud consumer within a public cloud o The consumer is responsible for configuring the IP address space and routing within the cloud o is typically used to provision internet-accessible applications that need to be accessed from geographically remote sites o On-premise solutions maintain their servers locally within the network o Many security products offer cloud-based and on-premise versions o Consider compliance or regulatory limitations of storing data in a cloud-based security solution o Be aware of the possibility of vendor lock in

VPN (Virtual Private Network)

A private network that is configured within a public network such as the Internet; Any traffic you wish to keep confidential crossing the internet should use a ____

Threat Modeling

A process by which developers can understand security threats to a system, determine risks from those threats, and establish appropriate mitigations; helps prioritize vulnerability identification and patching

Risk Management Framework (RMF)

A process that integrates security and risk management activities into the system development life cycle through an approach to security control selection and specification that considers effectiveness, efficiency, and constraints due to applicable laws, directives, Executive Orders, policies, standards, or regulations

Risk Assessments

A process used inside of risk management to identify how much risk exists in a given network or system

Field Programmable Gate Array (FPGA)

A processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture; End customer can configure the programming logic to run a specific application instead of using an ASIC (application-specific integrated circuit)

Idempotence

A property of IaC that an automation or orchestration action always produces the same result, regardless of the component's previous state § IaC uses carefully developed and tested scripts and orchestration runbooks to generate consistent builds

Syslog

A protocol enabling different appliances and software applications to transmit logs or event records to a central server § follows a client-server model and is the de facto standard for logging of events from distributed systems § runs on most operating systems and network equipment using Port 514 (UDP) over TCP/IP § A message contains a PRI code, a header, and a message portion § A PRI code is calculated from the facility and severity level of the data § A header contains the timestamp of the event and the hostname § The message portion contains the source process of the event and related content can refer to the protocol, the server, or the log entries themselves

Secure Shell (SSH) - Port 22

A protocol that can create a secure channel between two computers or network devices to enable one device to control the other device

Point-to-Point Tunneling Protocol (PPTP) - Port 1723

A protocol that encapsulates PPP packets and ultimately sends data as encrypted traffic

Infrastructure as Code (IaC)

A provisioning architecture in which deployment of resources is performed by scripted automation and orchestration § allows for the use of scripted approaches to provisioning infrastructure in the cloud § Robust orchestration can lower overall IT costs, speed up deployments, and increase security

the harvester

A python script that is used to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN database

Public Ledger

A record-keeping system that maintains participants' identities in secure and anonymous form, their respective cryptocurrency balances, and a record book of all the genuine transactions executed between network participants A permissioned blockchain is used for business transactions and promotes new levels of trust and transparency using an immutable ________

OVAL Interpreter

A reference developed to ensure the information passed around by these programs complies with the OVAL schemas and definitions used by the OVAL language

Deep Learning

A refinement of machine learning that enables a machine to develop strategies for solving a task given a labeled dataset and without further explicit instructions o uses complex classes of knowledge defined in relation to simpler classes of knowledge to make more informed determinations about an environment

Evil Twin

A rogue, counterfeit, and unauthorized WAP with the same SSID as your valid one; you can prevent it from being effective by making sure that all of your wireless clients are configured to use a VPN whenever they connect over Wi-Fi even if they're connecting to your own Wi-Fi cause you don't know if anybody has set up an evil twin in your area

Data Steward

A role focussed on the quality of the data and associated metadata

Data Custodian

A role responsible for handling the management of the system on which the data assets are stored

Privacy officer

A role responsible for the oversight of any PII/SPI/PHI assets managed by the company

Invoice Scam

A scam in which a person is tricked into paying for a fake invoice for a service or product that they did not order

Failover Cluster

A secondary server can take over the function when the primary one fails

Virtual Private Networks

A secure connection between two or more computers or device that are not on the same private network

Simultaneous Authentication of Equals (SAE)

A secure password-based authentication and password-authenticated key agreement method § provides forward secrecy

Forward Proxy

A security appliance or host positioned at the client network edge that forwards user traffic to the cloud network if the contents of that traffic comply with policy • WARNING: Users may be able to evade it and connect directly

User Account Control (UAC)

A security component in Windows that keeps every user in standard user mode instead of acting like an administrative user

Control Objectives for Information and Related Technology (COBIT

A security framework that divides IT into four domains: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate

Demilitarized Zone (DMZ)

A segment isolated from the rest of a private network by one or more firewalls that accepts connections from the Internet over designated ports § Everything behind the _____is invisible to the outside network

Data Owner

A senior (executive) role with ultimate responsibility for maintaining the confidentiality, integrity and availability of the information asset; is responsible for labeling the asset and ensuring that it is protected with appropriate controls

Domain Controller

A server that acts as a central repository of all the user accounts and their associated passwords for the network; is up-to-date on its patches, its configurations are hardened, and that it's secure and in place in your network.

DNSSEC

A set of extensions to DNS that provide to DNS clients (resolvers) origin authentication of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attack types.

Cybersecurity Framework (CSF)

A set of industry standards and best practices created by NIST to help organizations manage cybersecurity risks

Incident Response

A set of procedure that an investigator follows when examining a computer security incident

Incident Response

A set of procedures that an investigator follows when examining a computer security incident

Group Policy

A set of rules or policies that can be applied to a set of users or computer accounts within the operating system

Payment Card Industry Data Security Standard (PCI DSS)

A set of security standards that all U.S. companies processing, storing, or transmitting credit card information must follow.

Blockchain

A shared, immutable ledger for recording transactions, tracking assets and building trust § Most famous example of the ____is those used in cryptocurrencies

Spike

A short transient in voltage that can be due to a short circuit, tripped circuit breaker, power outage, or lightning strike

Hotfix

A single problem-fixing piece of software for an operating system or application, doesnt requires a reboot of the system

Patches

A single problem-fixing piece of software for an operating system or application, requires a reboot of the system; while this often solves one issue, it may create a new issue

Warm Site

A site that has computers, phones, and servers but they might require some configuration before users can start working

Cold Site

A site that has tables, chairs, bathrooms, and possibly some technical items like phones and network cabling

Endpoint Protection Platform (EPP)

A software agent and monitoring system that performs multiple security tasks such as anti-virus, HIDS/HIPS, firewall, DLP, and file encryption

Endpoint Detection and Response (EDR)

A software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats; aim is NOT to prevent initial execution but to provide historical visibility in a compromise

Serverless

A software architecture that runs functions within virtualized runtime containers in a cloud rather than on dedicated server instances

Continuous Delivery

A software development method where application and platform requirements are frequently tested and validated for immediate availability

Continuous Deployment

A software development method where application and platform updates are committed to production rapidly § focuses on automated testing of code in order to get it ready for release § focuses on automated testing and release of code in order to get it into the production environment more quickly

OpenSSL

A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end

Microsoft Baseline Security Analyzer (MBSA)

A software tool released by Microsoft to determine the security state of a system by assessing missing security updates and less-secure security settings within Microsoft Windows components such as Internet Explorer, IIS web server, and products such as Microsoft SQL Server and Microsoft Office macro settings.

Dereferencing

A software vulnerability that occurs when the code attempts to remove the relationship between a pointer and the thing it points to.

Race Conditions

A software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events, and those events fail to execute in the order and timing intended by the developer

Broken Authentication

A software vulnerability where the authentication mechanism allows an attacker to gain entry

Spoofing

A software-based attack where the goal is to assume the identity of a user, process, address, or other unique identifier

SIEM

A solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications • solutions can be implemented as software, hardware appliances, or outsourced managed services • Log all relevant events and filter irrelevant data • Establish and document scope of events • Develop use cases to define a threat • Plan incident response to an event • Establish a ticketing process to track events • Schedule regular threat hunting • Provide auditors and analysts an evidence trail

Key Recovery Agent

A specialized type of software that allows the restoration of a lost or corrupted key to be performed

Signature-based

A specific string of bytes triggers an alert

Trusted Platform Module (TPM)

A specification for hardware-based storage of digital certificates, keys, hashed passwords, and other user and platform identification information; can be managed in Windows via the tpm.msc console or through group policy

Open Vulnerability and Assessment Language (OVAL)

A standard designed to regulate the transfer of secure public information across networks and the Internet utilizing any security tools and services available § is comprised of a language and an interpreter

Secure/Multipurpose Internet Mail Extensions (S/MIME)

A standard that provides cryptographic security for electronic messaging; can encrypt emails and their contents ...including malware

Risk Avoidance

A strategy that requires stopping the activity that has risk or choosing a less risky alternative

Risk Acceptance

A strategy that seeks to accept the current level of risk and the costs associated with it if the risk were realized

Risk Mitigation

A strategy that seeks to minimize the risk to an acceptable level

One-Time Pad

A stream cipher that encrypts plaintext information with a secret random key that is the same length as the plaintext input are not commonly used

System and Organization Controls (SOC)

A suite of reports produced during an audit which is used by service organizations to issue validated reports of internal controls over those information systems to the users of those services

implement a jump box

A supplier needs to connect several laptops to an organization's network as part of their service agreement. These laptops will be operated and maintained by the supplier. Victor, a cybersecurity analyst for the organization, is concerned that these laptops could potentially contain some vulnerabilities that could weaken the security posture of the network. What can Victor do to mitigate the risk to other devices on the network without having direct administrative access to the supplier's laptops?

User and Entity Behavior Analytics (UEBA)

A system that can provide automated identification of suspicious activity by user accounts and computer hosts; UEBA solutions are heavily dependent on advanced computing techniques like artificial intelligence (AI) and machine learning; top UEBA Microsoft and Splunk

Key Stretching

A technique that is used to mitigate a weaker key by increasing the time needed to crack it

Banner Grabbing

A technique used to gain information about servers and inventory the systems or services

Intrusion Prevention System (IPS)

A technology that monitors activity like an IDS but will automatically take proactive preventative action if it detects unacceptable activity.

Buffer

A temporary storage area that a program uses to store data

Penetration Test

A test that uses active tools and security utilities to evaluate security by simulating an attack on a system to verify that a threat exists, actively test it, bypass security controls, and then finally exploit vulnerabilities on a given system Test the system to discover vulnerabilities or prove security controls work • Examine the system to identify any logical weaknesses • Interview personnel to gather information

Service Pack

A tested, cumulative grouping of patches, hotfixes, security updates, critical updates, and possibly some feature or design changes

Browser Exploitation Framework (BeEF)

A tool that can hook one or more browsers and can use them as a beachhead of launching various direct commands and further attacks against the system from within the browser context

Timeline

A tool that shows the sequence of file system events within a source image in a graphical format

Password Analysis

A tool used to test the strength of your passwords to ensure your password policies are being followed

Shielded Twisted Pair (STP)

A twisted pair cable that has an aluminum shield inside the plastic jacket that surrounds the pairs of wires, this minimize EMI and RFI and can help with crosstalk

Real-Time Operating System (RTOS)

A type of OS that prioritizes deterministic execution of operations to ensure consistent response for time-critical tasks; typically cannot tolerate reboots or crashes and must have response times that are predictable to within microsecond tolerances

Programmable Logic Controller (PLC)

A type of computer designed for deployment in an industrial or outdoor setting that can automate and monitor mechanical systems § firmware can be patched and reprogrammed to fix vulnerabilities

Supervisory Control and Data Acquisition (SCADA)

A type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographic region; about multiple plants

Unified Extensible Firmware Interface (UEFI)

A type of system firmware providing support for 64-bit CPU operation at boot, full GUI and mouse operation at boot, and better boot

UTP (Unshielded Twisted Pair)

A type of twisted pair cabling that does not include shielding around its conductors.

Internet Protocol Flow Information Export (IPfix)

A universal standard of export for Internet Protocol flow information from routers, probes and other devices that are used by mediation systems, accounting/billing systems and network management systems to facilitate services such as measurement, accounting and billing by defining how IP flow information is to be formatted and transferred from an exporter to a collector

Default Accounts

A user or administrator-level account that is installed on a device by the manufacturer during production

Date and time; One of the common causes of an Invalid or Expired Security Certificate error is the clock on the user's computer being wrong since the website security certificates are issued to be valid within a given date range.

A user reports that every time they try to access https://www.diontraining.com, they receive an error stating "Invalid or Expired Security Certificate". The technician attempts to connect to the same site from other computers on the network, and no errors or issues are observed. Which of the following settings needs to be changed on the user's workstation to fix the "Invalid or Expired Security Certificate" error?

Cloud Computing

A way of offering on-demand services that extend the traditional capabilities of a computer or network § relies on virtualization to gain efficiencies and cost savings

setting the secure attributes on the cookie; When a cookie has the Secure attribute, the user agent includes the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTPS). Although seemingly useful for protecting cookies from active network attackers, the Secure attribute protects only the cookie's confidentiality. Forcing the web application to use TLS or SSL does not force the cookie to be sent over TLS/SSL, so you still would need to set the Secure attribute on the cookie. Hashing the cookie provides integrity of the cookie, not confidentiality.

A web developer wants to protect their new web application from a man-in-the-middle attack. Which of the following controls would best prevent an attacker from stealing tokens stored in cookies?

WPA3 - Enterprise Mode

AES-256 encryption with a SHA-384 hash for integrity checking

secure authentication and authorization

APIs should use ________such as SAML or OAuth/OIDC before accessing data

VLAN segmentation and DHCP snooping

ARP Poisoning is prevented by _____ and _____

Persistence

Ability of attackers to maintain a foothold inside a compromised network o A pentester can also simulate an insider threat

hardening

Act of configuring an operating system securely by updating it, creating rules and policies to govern it, and removing unnecessary applications and services

Subnetting

Act of creating subnetworks logically through the manipulation of IP addresses

Social Engineering

Act of manipulating users into revealing confidential information or performing other detrimental actions

Purging (Sanitizing)

Act of removing data in such a way that it cannot be reconstructed using any known forensic techniques

War Driving

Act of searching for wireless networks by driving around until you find them § Attackers can use wireless survey or open source attack tools

Log File Maintenance

Actions taken to ensure the proper creation and storage of a log file, such as the proper configuration, saving, back up, security, and encryption of the log files

Kerberos

Active Directory relies on ____________ and its ticket granting system to conduct its user authentication functions.

Behavior-based

Activity is evaluated based on the previous behavior of applications, executables, and the operating system in comparison to the current activity of the system

Spam

Activity that abuses electronic messaging systems, most commonly through email

Easter egg

Acts just like a backdoor; Non-malicious code that when invoked, displays an insider joke, hidden message or secret feature

Remote Access Trojan (RAT)

Acts just like a backdoor; is placed by an attacker to maintain persistent access

Worm

Acts like a virus but can self-replicate

Salting

Adding random data into a one-way cryptographic hash to help protect against password cracking techniques

Privacy Act of 1974

Affects U.S. government computer systems that collects, stores, uses, or disseminates personally identifiable information

Non-Disclosure Agreement (NDA)

Agreement between two parties that defines what data is considered confidential and cannot be shared outside of the relationship ; are a binding contract

0 =

All Users (no access) in Linux

Implicit Deny

All access to a resource should be denied by default and only be allowed when explicitly stated

revoked

All of a CA's certificates must be ______ if it is compromised

Full Backup

All of the contents of a drive are backed up

OCSP Stapling

Allows the certificate holder to get the OCSP record from the server at regular intervals and include it as part of the SSL or TLS handshake

Redundant Array of Independent Disks (RAID)

Allows the combination of multiple physical hard disks into a single logical hard disk drive that is recognized by the operating system

Near Field Communication (NFC)

Allows two devices to transmit information when they are within close range through automated pairing and transmission § devices are operated within 4 cm from each other

SIM Cloning

Allows two phones to utilize the same service and allows an attacker to gain access to the phone's data; SIM v1 cards were easy to clone but newer SIM v2 cards are much harder

Locally Shared Object (LSO)

Also known as Flash cookies, they are stored in your Windows user profile under the Flash folder inside of your AppData folder; used by Adobe flash

network-based IDS

An IDS system that primarily uses passive hardware sensors to monitor traffic on a specific segment of the network.

host-based IDS

An IDS system that primarily uses software installed on a specific host such as a web server.

network security

An IPS, proper firewall configs, network segmentation, and firmware updates are the keys to having ______

OVAL Language

An XML schema used to define and describe the information being created by OVAL to be shared among the various programs and tools

Mandatory Access Control (MAC)

An access control policy where the computer system determines the access control for an object • The computer chooses the permissions

Role-Based Access Control (RBAC)

An access model that is controlled by the system (like MAC) but utilizes a set of permissions instead of a single data label to define the permission level

Attribute-Based Access Control (ABAC)

An access model that is dynamic and context-aware using IF-THEN statements

Service-Level Agreement (SLA)

An agreement concerned with the ability to support and respond to problems within a given timeframe and continuing to provide the agreed upon level of service to the user; may promise 99.999% uptime

Interconnection Security Agreement (ISA)

An agreement for the owners and operators of the IT systems to document what technical requirements each organization must meet

Hardware Security Module (HSM)

An appliance for generating and storing cryptographic keys that is less susceptible to tampering and insider threats than software-based storage

Reverse Proxy

An appliance positioned at the cloud network edge and directs traffic to cloud services if the contents of that traffic comply with policy • WARNING: This approach can only be used if the cloud application has proxy support

Artificial Neural Network (ANN)

An architecture of input, hidden, and output layers that can perform algorithmic analysis of a dataset to achieve outcome objectives o A machine learning system adjusts its neural network to reduce errors and optimize objectives

VM Escape

An attack that allows an attacker to break out of a normally isolated VM by interacting directly with the hypervisor

Reidentification

An attack that combines a deidentification dataset with other data source to discover how secure the deidentification method used is

Cross-Site Scripting (XSS)

An attack that injects scripts into a Web application server to direct attacks at clients.

Driver Manipulation

An attack that relies on compromising the kernel-mode device drivers that operate at a privileged or system level

Ping of Death

An attack that sends an oversized and malformed packet to another computer or server

Kerberos

An authentication protocol used by Windows to provide for two-way (mutual) authentication using a system of tickets; Port 88; A domain controller can be a single point of failure for this

sn1per

An automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities across a network

Runbook

An automated version of a playbook that leaves clearly defined interaction points for human analysis

Backup Generator

An emergency power system used when there is an outage of the regular electric grid power

Redundant Power Supply

An enclosure that provides two or more complete power supplies; mitigates a single point of failure

Homomorphic Encryption

An encryption method that allows calculations to be performed on data without decrypting it first § _______ can be used for privacy-preserving outsourced storage and computation

Pretty Good Privacy

An encryption program used for signing, encrypting, and decrypting emails § The IDEA algorithm is used Symmetric functions use 128-bit or higher keys and the asymmetric functions use 512-bit to 2048-bit key sizes

Whole Disk Encryption

An encryption technique that performs a sector-by-sector encryption of an entire drive. Each sector is encrypted in its entirety, making it unreadable when copied with a static acquisition method.

Public Key Infrastructure (PKI)

An entire system of hardware, software, policies, procedures, and people that is based on asymmetric encryption

Crossover Error Rate (CER)

An equal error rate (ERR) where the false acceptance rate and false rejection rate are equal § measures the effectiveness of a biometric system;

Magnitude of Impact or risk impact

An estimation of the amount of damage that a negative risk might achieve

Unified Extensible Firmware Interface (UEFI)

An interface between firmware on the motherboard and the operating system and improves on legacy BIOS processes for booting, handing over the boot to the OS, and loading device drivers and applications before the OS loads.

ISO 31000

An international standard for enterprise risk management that provides a universally recognized paradigm for practitioners and companies employing risk management processes to replace the myriad of existing standards, methodologies, and paradigms that differed between industries, subject matters, and regions

Certificate Revocation List (CRL)

An online list of digital certificates that the certificate authority has revoked

Cuckoo

An open source software for automating analysis of suspicious files

OpenID

An open standard and decentralized protocol that is used to authenticate users in a federated identity management system • User logs into an Identity Provider (IP) and uses their account at Relying Parties (RP); is easier to implement than SAML but SAML is more efficient than this

Graylog

An open-source SIEM with an enterprise version focused on compliance and supporting IT operations and DevOps

supply chain assessment

An organization must ensure that the operation of every element (hardware, firmware, driver, OS, and application) is consistent and tamper resistant to establish a trusted computing environment

DevOps

An organizational culture shift that combines software development and systems operations by referring to the practice of integrating the two disciplines within a company o Operations and developers can build, test, and release software faster and more reliably

Rogue Access Point

An unauthorized WAP or Wireless Router that allows access to the secure network; To prevent this, you should enable MAC filtering on the network, network access control, and run a good IDS or IPS on your network that can detect or prevent these devices when they initially try to connect.

Sag

An unexpected decrease in the amount of voltage provided

Surge

An unexpected increase in the amount of voltage provided

Dynamic Analysis

Analysis and testing of a program occurs while it is being executed or run

volatility

Analysts should always follow the order of _______ when collecting evidence

Anomaly-based

Analyzes the current traffic against an established baseline and triggers an alert if outside the statistical average

Apple

Android update is a bit complicated, google create the patches for vulnerability found and they pass it to their manufacturers that have modified the base code somehow, so the android user gets their updates from their manufacturer 3 or 4 months later. This said ______ is more secure that Android devices

Insecure Components

Any code that is used or invoked outside the main program development process o Code Reuse o Third-party Library o Software Development Kit (SDK)

Sensitive Data

Any information that can result in a loss of security, or loss of advantage to a company, if accessed by unauthorized persons

Never Trust User Input

Any input that is received from a user should undergo input validation prior to allowing it to be utilized by an application

Shellcode

Any lightweight code designed to run an exploit on the target, which may include any type of code format from scripting languages to binary code (use this definition for the exam)

Unnecessary Ports

Any port that is associated with a service or function that is non-essential to the operation of your computer or network

Insufficient Logging and Monitoring

Any program that does not properly record or log detailed enough information for an analyst to perform their job; must support your use case and answer who, what, when, where, and how

Physical Controls

Any security measures that are designed to deter or prevent unauthorized access to sensitive information or the systems that contain it

disabled

Any services that are unneeded should be _______ in the OS

Snowflake Systems

Any system that is different in its configuration compared to a standard template within an infrastructure as code architecture § Lack of consistency leads to security issues and inefficiencies in support

identifies

Anything that uniquely ________ a user or system can be spoofed

Trojan

Appears to do a desired function but also does something malicious

LDAP

Application layer protocol for accessing and modifying directory services data (Active Directory uses it)

Authenticity and Integrity

Applications should be deployed using code signing to ensure the program is not changed inadvertently or maliciously prior to delivery to an end user

Input Validation

Applications verify that information received from a user matches a specific format or range of values

Armored

Armored viruses have a layer of protection to confuse a program or person analyzing it

RSA (Rivest, Shamir, and Adleman)

Asymmetric algorithm that relies on the mathematical difficulty of factoring large prime numbers § is widely used for key exchange, encryption, and digital signatures § can use key sizes of 1024-bits to 4096-bits

Public Key Cryptography

Asymmetric algorithms are also known as ____- Confidentiality § Integrity § Authentication § Non-repudiation Two keys are used

Fork Bomb

Attack that creates a large number of processes to use up the available processing power of a computer

Domain Name Kiting

Attack that exploits a process in the registration process for a domain name that keeps the domain name in limbo and cannot be registered by an authenticated buyer

ARP Poisoning

Attack that exploits the IP address to MAC resolution in a network to steal, modify, or redirect frames within the local area network; Allows an attacker to essentially take over any sessions within the LAN

WiFi Disassociation Attack

Attack that targets an individual client connected to a network, forces it offline by deauthenticating it, and then captures the handshake when it reconnects § Used as part of an attack on WPA/WPA2

Clickjacking

Attack that uses multiple transparent layers to trick a user into clicking on a button or link on a page when they were intending to click on the actual page

switch spoofing

Attacker configures their device to pretend it is a switch and uses it to negotiate a trunk link to break out of a VLAN

Smurf Attack

Attacker sends a ping to subnet broadcast address and devices reply to spoofed IP (victim server), using up bandwidth and processing

Hoax

Attempt at deceiving people into believing that something is false when it is true (or vice versa)

Rubber Hose Attack

Attempt to crack a password by threatening or causing a person physical harm in order to make them tell you the password

DOM-based XSS

Attempt to exploit the victim's web browser

MAC Flooding

Attempt to overwhelm the limited switch memory set aside to store the MAC addresses for each port; Switches can fail-open when flooded and begin to act like a hub; Compromise confidentiality

Network Intrusion Detection Systems

Attempts to detect, log, and alert on malicious network activities § use promiscuous mode to see all network traffic on a segment

Stored/Persistent XSS

Attempts to get data provided by the attacker to be saved on the web server by the victim

Reflected XSS

Attempts to have a non-persistent effect activated by a victim clicking a link on the site

Network Intrusion Prevention Systems

Attempts to remove, detain, or redirect malicious traffic § should be installed in-line of the network traffic flow § can also perform functions as a protocol analyzer

Caching Proxy

Attempts to serve client requests by delivering content from itself without actually contacting the remote server

Security Assertion Markup Language (SAML)

Attestation model built upon XML used to share federated identity management information between systems

Challenge Handshake Protocol (CHAP)

Authentication scheme that is used in dial-up connections

Motivation Factors of Social Engineering

Authority, Urgency, Social Proof, Scarcity, Likeability; Fear

WiFi Protected Setup (WPS)

Automated encryption setup for wireless networks at a push of a button, but is severely flawed and vulnerable § Always disable WPS

light

Because fiber optic cables work with _____ instead of electricity, there's no radiation outside of the cable, and they're not affected by EMI or radio frequency either.

o Improve detection capabilities o integrate intelligence o reduces attack surface o Block attack vectors o identify critical assets

Benefits of threat hunting (5)

Data Classification

Category based on the value to the organization and the sensitivity of the information if it were to be disclosed

Stealth

Category of virus that is using various techniques to avoid detection of anti virus software. Encrypted, polymorphic and metamorphic are example of this virus

RADIUS

Centralization administration system for dial-up, VPN, and wireless authentication that uses either ports 1812/1813 (UDP) or 1645/1646 (UDP)

Mobile Device Management (MDM)

Centralized software solution for remote administration and configuration of mobile devices; can prevent certain applications from being installed on the device

Mobile Device Management (MDM)

Centralized software solution that allows system administrators to create and enforce policies across its mobile devices

Atomic Execution

Certain operations that should only be performed once or not at all, such as initializing a memory location

TACACS+

Cisco's proprietary version of RADIUS that provides separate authentication and authorization functions over port 49 (TCP)

This includes insecure APIs, improper key management, improper logging and monitoring, and unprotected storage.

Cloud Threats

Cloud DLP System

Cloud software as a service that protects data being stored in cloud services

buckets or blobs

Cloud storage containers are referred to as ___ or _____

Logs

Cloud threat- ______must be copied to non-elastic storage for long-term retention

Cloud-based vulnerability scans

Cloud-based ________ ________an better provide the attacker's perspective;

Backdoors

Code placed in computer programs to bypass normal authentication and other security mechanisms

Virus

Code that infects a computer when a file is opened or executed

ELK/Elastic Stack

Collection of free and open-source SIEM tools that provides storage, search, and analysis functions • Elasticsearch (query/analytics) • Logstash (log collection/normalization) • Kibana (visualization) • Beats (endpoint collection agents) may installed locally or as a cloud-based solution

Unified Threat Management

Combination of network security devices and technologies to provide more defense in depth within a single device § may include a firewall, NIDS/NIPS, content filter, anti-malware, DLP, and VPN § is also known as a Next Generation Firewall (NGFW)

Uninterruptible Power Supply (UPS)

Combines the functionality of a surge protector with that of a battery backup

System Virtual Machine

Complete platform designed to replace an entire physical computer and includes a full desktop/server operating system

active

Configure your browsers to prevent ActiveX controls, Java applets, JavaScript, Flash, and other _______ content

Secure Socket Layer (SSL) and Transport Layer Security (TLS)

Cryptographic protocols that provide secure Internet communications for web browsing, instant messaging, email, VoIP, and many other services; We already covered how TLS works in the PKI lesson

Data in Use

Data that is undergoing constant change

Acceptable Use Policy

Defines the rules that restrict how a computer, network, or other systems may be used

Network Access Control can control access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do.

Dion Training allows its visiting business partners from CompTIA to use an available Ethernet port in their conference room to establish a VPN connection back to the CompTIA internal network. The CompTIA employees should be able to obtain internet access from the Ethernet port in the conference room, but nowhere else in the building. Additionally, if a Dion Training employee uses the same Ethernet port in the conference room, they should be able to access Dion Training's secure internal network. Which of the following technologies would allow you to configure this port and support both requirements?

root or jailbreak

Do not ____ or _____your devices

full

Do not create one key with ______ control to access an application's functions

default

Don't allow Bluetooth devices to use _______ PINs for pairing

Encryption

Electronic key- ensure confidentiality

Geotagging

Embedding of the geolocation coordinates into a piece of data (i.e., a photo)

636

Encrypted

lower

Encryption adds security but has ______ performance

Symmetric Algorithm (Private Key)

Encryption algorithm in which both the sender and the receiver must know the same secret using a privately-held key § Confidentiality can be assured with symmetric encryption § Key distribution can be challenging with symmetric encryption

Asymmetric Encryption (Public Key)

Encryption algorithm where different keys are used to encrypt and decrypt the data

Data Encryption Standard (DES)

Encryption algorithm which breaks the input into 64-bit blocks and uses transposition and substitution to create ciphertext using an effective key strength of only 56-bits used to be the standard for encryption

Triple DES (3DES)

Encryption algorithm which uses three separate symmetric keys to encrypt, decrypt, then encrypt the plaintext into ciphertext in order to increase the strength of DES

patched and updated

Ensure your mobile device is _____________

Cloud Access Security Broker (CASB)

Enterprise management software designed to mediate access to cloud services by users across all types of devices; provide visibility into how clients and other network nodes use cloud services

Annualized Loss Expectancy (ALE)

Expected cost of a realized threat over a given year

Hijacking

Exploitation of a computer session in an attempt to gain unauthorized access to data, services, or other resources on a computer or server

Administrative Controls

Focused on changing the behavior of people instead of removing the actual risk involved

Recovery

Focused on data restoration, system repair, and re-enabling any server or networks taken offline during the incident response

Recovery

Focused on data restoration, system repair, and re-enabling any servers or networks taken offline during the incident response

Identification

Forensic Procedure that Ensure the scene is safe, secure the scene to prevent evidence contamination, and identify the scope of evidence to be collected

security policies

Geotagging should be considered when developing your organization's _____ _________

counterfeited or compromised

Greater risk of inadvertently obtaining _____ or ______ devices when purchasing from second-hand or aftermarket sources

recreate the events

HIDS logs are used to _______ _______ _______ after an attack has occurred, you transfer the syslog to a separate centralized location

Organized Crime

Hackers who are part of a crime group that is well-funded and highly sophisticated

Blue Hats

Hackers who attempt to hack into a network with permission of the company but are not employed by the company

Gray Hats

Hackers without any affiliation to a company who attempt to break into a company's network but risk the law by doing so

not

Hard drives, files, or applications are ____accessible anymore; one of symptoms of infection

risk

Hardening, We are not guaranteed security, but we can minimize the ____ ...

Public Data

Has no impact to the company if released and is often posted in the open-source environment.

Confidential Data

Highest classification level that contains items such as trade secrets, intellectual property data, source code, and other types that would seriously affect the business if disclosed

Network Zones

Home, Work, Public. Enables and disables features depending on what zone it is in.

Bastion Hosts

Hosts or servers in the DMZ which are not configured with any services that run on the local network

§ Dropper or downloader § Maintain access § Strengthen access § Actions on objectives § Concealment

How does an APT use modern malware to operate? (5)

copy

If you _____a folder, then permissions are inherited from the parent folder it is copied into

audit

It is important to ______ the client's status after patch deployment

incident response team

Key people that are available to respond to any incident that meets the severity and priority thresholds set out by the incident response plan • Incident Response Manager • Security Analyst • Triage Analyst • Forensic Analyst • Threat Researcher • Cross-functional Support

1701 UDP

L2TP

389 TCP/UDP

LDAP

636 TCP/UDP

LDAP SSL/TLS

Application Layer

Layer from which the message is created, formed, and originated; Consists of high-level protocols like HTTP, SMTP, and FTP

Defense in Depth

Layering of security controls is more effective and secure than relying on a single control

True negative

Legitimate activity is identified as legitimate traffic

patch management

Linux and OSX also have built-in ________ _________systems

md5sum, sha1sum, sha256sum, sha512sum

Linux tools can you use to calculate a hash value

Rainbow Table

List of precomputed valued used to more quickly break a password since values don't have to be calculated for each password being guessed

standard tools and processes

Living of the land exploit detection is more difficult when they are executing malware code within _____ _______ and _______

Secure Coding Standards

Logic bombs and Easter eggs should not be used according to ____ ____ _____

Technical Controls

Logical controls that are put into a system to help secure it

VLANs

Logically separate networks within networks.

archived and backed

Logs should be _________ and ________up to ensure they are available when required

Application Logs

Logs the events for the operating system and third-party applications

System Logs

Logs the events such as a system shutdown and driver failures

Security Logs

Logs the events such as successful and unsuccessful user logins to the system

Data Backup

Maintaining a good backup is crucial to disaster recovery

False negative

Malicious activity is identified as legitimate traffic

Logic Bomb

Malicious code that has been inserted inside a program and will execute only when certain conditions have been met

Viruses

Malicious code that runs on a machine without the user's knowledge and infects the computer when executed

Black Hats

Malicious hackers who break into computer systems and networks without authorization or permission

Trojan Horse

Malicious software that is disguised as a piece of harmless or desirable software

Worm

Malicious software, like a virus, but is able to replicate itself without user interaction

Dropper

Malware designed to install or run other types of malware embedded in a payload on an infected host

Watering holes

Malware is placed on a website that you know your potential victims will access

Ransomware

Malware that restricts access to a victim's computer system until a ransom is received

Hypervisors

Manages the distribution of the physical resources of a host machine (server) to the virtual machines being run (guests)

Session Layer

Manages the establishment, termination, and synchronization of a session over the network

implement

Manually or automatically deploy the patch to all your clients to ________it

anti-malware suites

Many ____________ _____also contain software firewalls

evidence

Many forensics tools can generate a timeline based on your _________

Mean Time Between Failures (MTBF)

Measures the average time between failures of a device

Mean Time To Repair (MTTR)

Measures the average time it takes to repair a network device when it breaks

timeliness, relevancy, accuracy and confidence levels

Measuring quality of intelligence

Attack Vector

Method used by an attacker to gain access to a victim's machine in order to infect it with malware; how we get into the machine and infect them- download and installation

Address Space Layout Randomization

Method used by programmers to randomly arrange the different address spaces used by a program or process to prevent buffer overflow exploits

Security Controls

Methods implemented to mitigate a particular risk

hybrid

Methods may be combined monitoring into a ____approach in some IDS/IPS systems

Anti-Tamper

Methods that make it difficult for an attacker to alter the authorized execution of software; mechanisms include a field programmable gate array (FPGA) and a physically unclonable function (PUF)

Signature-based o Anomaly-based o Behavior-based

Monitoring Types

fileless

Most modern malware uses _______techniques to avoid detection by signaturebased security software

RAID arrays

NAS systems often implement ____ _______to ensure high availability

management, operational, and technical

NIST categories Security control

119 TCP

NNTP

Storage Area Network (SAN)

Network designed specifically to perform block storage functions that may consist of NAS devices

User Education

Never share authentication information; Train users how to encrypt emails and data; Follow organizational data handling and disposal policies

REST or SOAP, the simple object access protocol

Now these APIs are commonly going to use either _____ or _____as their frameworks.

Annualized Rate of Occurrence (ARO)

Number of times per year that a threat is realized

System Failure

Occurs when a computer crashes or an individual application fails

Buffer Overflow

Occurs when a process stores data outside the memory range allocated by the developer; Over 85% of data breaches were caused by by this. This also attempt to put more data into memory than it is designed to hold

Key Escrow

Occurs when a secure copy of a user's private key is held in case the user accidently loses their key

Crosstalk

Occurs when a signal transmitted on one copper wire creates an undesired effect on another wire; in very close proximity; it also happens if you have punch-down blocks and you decide to use an older terminal, like the old 66 blocks that were used for phone lines, and tried to use that for networks.

Privilege Escalation

Occurs when a user is able to gain the rights of another user or administrator

Privilege Elevation

Occurs when a user is able to grant themselves the ability to run functions as a higher-level user

Authorization

Occurs when a user is given access to a certain piece of data or certain areas of a building

Unauthorized Access

Occurs when access to computer resources and data occurs without the consent of the owner

Blind Hijacking

Occurs when an attacker blindly injects data into the communication stream without being able to see if it is successful or not

Brute Force Attack

Occurs when an attacker continually guesses a password until the correct one is found ; will always find the password...eventually!

Cross-Site Scripting (XSS)

Occurs when an attacker embeds malicious scripting commands on a trusted website

"Smash the Stack"

Occurs when an attacker fills up the buffer with NOP so that the return address may hit a NOP and continue on until it finds the attacker's code to run

Cross-Site Request Forgery (XSRF/CSRF)

Occurs when an attacker forces a user to execute actions on a web server for which they are already authenticated

Remote Code Execution (RCE)

Occurs when an attacker is able to execute or run commands on a remote computer

Arbitrary Code Execution

Occurs when an attacker is able to execute or run commands on a victim computer

MAC Spoofing

Occurs when an attacker masks their own MAC address to pretend they have the MAC address of another device

Spoofing

Occurs when an attacker masquerades as another person by falsifying their identity

Pivot

Occurs when an attacker moves onto another workstation or user account

IV Attack

Occurs when an attacker observes the operation of a cipher being used with several different keys and finds a mathematical relationship between those keys to determine the clear text data; This happened with WEP and makes it easy to crack

Pharming

Occurs when an attacker redirects one website's traffic to another website that is bogus or malicious

Unauthorized zone transfers

Occurs when an attacker requests replication of the DNS information to their systems for use in planning future attacks

TCP/IP Hijacking

Occurs when an attacker takes over a TCP session between two computers without the need of a cookie or other host access

Watering Hole

Occurs when malware is placed on a website that the attacker knows his potential victims will access

Propagation

Occurs when permissions are passed to a subfolder from the parent through inheritance

DNS Poisoning

Occurs when the name resolution information is modified in the DNS server's cache § If the cache is poisoned, then the user can be redirected to a malicious website

Brownout

Occurs when the voltage drops low enough that it typically causes the lights to dim and can cause a computer to shut off

Blackout

Occurs when there is a total loss of power for a prolonged period

Collision

Occurs when two different inputs to a hash create an identical hash digest output

Job Rotation

Occurs when users are cycled through various jobs to learn the overall operations better, reduce their boredom, enhance their skill level, and most importantly, increase our security ; helps the employee become more well-rounded and learn new skills ; also helps the organization identify theft, fraud, and abuse of position

Virtualization Sprawl

Occurs when virtual machines are created, used, and deployed without proper management or oversight by the system admins

Privilege Escalation

Occurs when you are able to exploit a design flaw or bug in a system to gain access to resources that a normal user isn't able to access

anti-spam

One of the most effective forms of Security as a Service solutions is found in the form of _______ products. These products allow all of the organization's email to be routed through this cloud server first in order to detect any malware or ______. Any suspect emails are placed in a quarantine area that's accessible through a web browser by the local administrator for review and possible release to the end user.

Application Whitelist

Only applications that are on the list are allowed to be run by the operating system while all other applications are blocked

Differential Backup

Only conducts a backup of the contents of a drive that has changed since the last full backup; take more time to create but less time to restore

Trusted Third-Party

Organizations are able to place their trust in a single third-party (also called the bridge model); is more efficient than a cross certification or web of trust model

Wired Equivalent Privacy

Original 802.11 wireless security standard that claims to be as secure as a wired network; not as secured; weakness is its 24-bit IV (Initialization Vector)

7

Owner can RWX in Linux

dial-up

PAP and CHAP used mostly with ______

not

PKI and public key encryption are related but they are ___ the same thing

public key cryptography

PKI is the entire system and just uses ________ to function

110 TCP

POP3

995 TCP

POP3 (SSL/TLS)

1723 TCP/UDP

PPTP

One-Time Passwords

Passwords created to be used only once. Because it's used only once, there's little risk of the password being reused even if an attacker is able to capture it while it is transmitted.

salted

Passwords not "______" with a random value make the ciphertext vulnerable to rainbow table attacks.

Baselining o Baseline Reporting o Security Posture

Performance Baselining

Permissions in Windows

Permissions are assigned to Owners (U), Groups (G), and All Users (O or A)

User Rights

Permissions assigned to a given user

Pharming

Phishing attempt to trick a user to access a different or fake website (usually by modifying hosts file)

Smishing

Phishing conducted over text messaging (SMS)

Vishing

Phishing conducted over voice and phone calls

Hardware Security Module (HSM)

Physical devices that act as a secure cryptoprocessor during the encryption process

Dry Pipe Sprinkler System

Pipes are filled with pressurized air and only push water into the pipes when needed to combat the fire

Wet Pipe Sprinkler System

Pipes are filled with water all the way to the sprinkler head and are just waiting for the bulb to be melted or broken

Well-Known Ports

Ports 0 to 1023 are considered well-known and are assigned by the Internet Assigned Numbers Authority (IANA)

Registered Ports

Ports 1024 to 49,151 are considered registered and are usually assigned to proprietary protocols

Dynamic or Private Ports

Ports 49,152 to 65,535 can be used by any application without being registered with IANA

65,535

Ports can be any number between 0 and _____

Vulnerability Management

Practice of finding and mitigating the vulnerabilities in computers and networks

tokens, encryption, XML file scanning, and cookie verification

Prevent XSRF with these 4 ways

output encoding and proper input validation

Prevent XSS with ___ ____ and proper _____ _______

configuration and network segmentation

Prevent split tunneling through proper

User Account Control

Prevents unauthorized access and avoid user error in the form of accidental changes

Least Functionality

Process of configuring workstation or server to only provide essential applications and services

Fire Suppression

Process of controlling and/or extinguishing fires to protect an organization's employees, data, equipment, and buildings

Encryption

Process of converting ordinary information (plaintext) into an unintelligible form (ciphertext); protects data at rest, data in transit, or data in use

Baselining

Process of measuring changes in networking, hardware, software, and applications

Baselining

Process of measuring changes in the network, hardware, and software environment

Patch Management

Process of planning, testing, implementing, and auditing of software patches

Identification

Process of recognizing whether an event that occurs should be classified as an incident

Identification

Process of recognizing whether an event that occurs should be classified as an incident

Context-aware Authentication

Process to check the user's or system's attributed or characteristics prior to allowing it to connect; Restrict authentication based on the time of day or location

User Access Recertification

Process where each user's rights and permissions are revalidated to ensure they are correct

Intel

Processor that has Trusted Execution Technology (TXT) Software Guard Extensions (SGX)

Incident Management Program

Program consisting of the monitoring and detection of security events on a computer network and the execution of proper response to those security events • Preparation • Identification • Containment • Eradication • Recovery • Lesson Learned

Incident Management Program

Program consisting of the monitoring and detection of security events on a computer network and the execution of proper responses to those security events

chmod

Program in Linux that is used to change the permissions or rights of a file or folder using a shorthand number system

authentication

Proper _________ is used to detect and prevent spoofing

Timeliness

Property of an intelligence source that ensures it is up-to-date

Relevancy

Property of an intelligence source that ensures it matches the use cases intended for it

Accuracy

Property of an intelligence source that ensures it produces effective results; eliminating false positives

Confidence Levels

Property of an intelligence source that ensures it produces qualified statements about reliability

General Data Protection Regulation (GDPR)

Proposed set of regulations adopted by the European Union to protect Internet users from clandestine tracking and unauthorized personal data usage.

port 1646

Proprietary variation authorization port

War Dialing

Protect dial-up resources by using the callback feature

Fault-tolerant RAID

Protects against the loss of the array's data if a single component fails (RAID 1, RAID 5, RAID 6)

Fault-resistant RAID

Protects against the loss of the array's data if a single disk fails (RAID 1 or RAID 5)

Infrastructure as a Service (IaaS)

Provides all the hardware, operating system, and backend software needed in order to develop your own software or service

Remote Authentication Dial-In User Service (RADIUS)

Provides centralized administration of dial-up, VPN, and wireless authentication services for 802.1x and the Extensible Authentication Protocol (EAP) § operates at the application layer; authenticate users, authorize them to services, and account for their usage of those services.

Structured Exception Handling (SEH)

Provides control over what the application should do when faced with a runtime or syntax error

RAID 0

Provides data striping across multiple disks to increase performance

EAP-FAST

Provides flexible authentication via secure tunneling (FAST) by using a protected access credential instead of a certificate for mutual authentication

Encapsulating Security Payload (ESP)

Provides integrity, confidentiality, and authenticity of packets by encapsulating and encrypting them

RAID 1

Provides redundancy by mirroring the data identically on two hard disks

RAID 6

Provides redundancy by striping and double parity data across the disk drives

RAID 5

Provides redundancy by striping data and parity data across the disk drives

Help America Vote Act (HAVA) of 2002

Provides regulations that govern the security, confidentiality, and integrity of the personal information collected, stored, or processed during the election and voting process

Remote Access Trojan (RAT)

Provides the attacker with remote control of a victim computer and is the most commonly used type of Trojan

Disaster-tolerant RAID

Provides two independent zones with full access to the data (RAID 10)

Platform as a Service (PaaS)

Provides your organization with the hardware and software needed for a specific service to operate

Security as a Service (SECaaS)

Provides your organization with various types of security services without the need to maintain a cybersecurity staff § Anti-malware solutions were one of the first _products; downsides to using this approach. The main one is that it's highly reliant on a good Internet connection.

wireless

RFI causes more problems for _______networks

135 TCP/UDP

RPC/DCOM-scm

False Acceptance Rate (FAR)

Rate that a system authenticates a user as authorized or valid when they should not have been granted access to the system

False Rejection Rate (FRR)

Rate that a system denies a user as authorized or valid when they should have been granted access to the system

Windows Update

Recommended update to fix a noncritical problem that users have found, as well as to provide additional features or capabilities

Remote Wipe

Remotely erases the contents of the device to ensure the information is not recovered by the thief

Clearing

Removal of data with a certain amount of assurance that it cannot be reconstructed

o Identify symptoms of a malware infection o Quarantine the infected systems o Disable System Restore (if using a Windows machine) o Remediate the infected system o Schedule automatic updates and scans o Enable System Restore and create a new restore point o Provide end user security awareness training o If a boot sector virus is suspected, reboot the computer from an external device and scan it

Removing Malware (8)

WiFi Protected Access (WPA)

Replacement for WEP which uses TKIP, Message Integrity Check (MIC), and RC4 encryption ; was flawed, so it was replaced by WPA2

Remote Lock

Requires a PIN or password before someone can use the device; mac findmy +iphone features

Federal Information Security Management (FISMA) Act of 2002

Requires each agency to develop, document, and implement an agencywide information systems security program to protect their data

Separation of Duties

Requires more than one person to conduct a sensitive task or operation; can be implemented by a single user with a user and admin account

Stack

Reserved area of memory where the program saves the return address when a function call instruction is received

difficult

Rootkits are activated before booting the operating system and are ________to detect

Port Address Translation (PAT)

Router keeps track of requests from internal hosts by assigning them random high number ports for each request

maintenance

SDLC final phase involves bug fixes, patches and update; training your end users in using the system

testing

SDLC phase that we get the code, ____ each application and system to test using different testing techniques

integration

SDLC phase were the application is integrated to the larger network environment and focus on the end to end service to ensure that each part can communicate effectively. Connecting to the outside world.

Deployment

SDLC phase were your application is move to the production environment were end users can utilize it to perform their work

Software/ System Design

SDLC phase where application is defined, outline and and diagramed in detailed; focus on the final input and output

Planning, Software/System Design, Implementation, Testing, Integration, Deployment and Maintenance

SDLC phases PSITIDM

o Use passwords to protect the contents of your documents o Digital signatures and digital certificates are used by MS Outlook for email security

Securing Applications

-Limit connectivity between the virtual machine and the host § Remove any unnecessary pieces of virtual hardware from the virtual machine § Using proper patch management is important to keeping your guest's operating system secure

Securing VMs 3

Network Access Control (NAC)

Security technique in which devices are scanned to determine its current state prior to being allowed access onto a given network; can be used as a hardware or software solution

Bluejacking

Sending of unsolicited messages to Bluetooth-enabled devices such as mobile phones and tablets; sends information

administrative

Separation of Duties is a preventative type of _______ control

Technical Controls

Smart cards, encryption, access control lists (ACLs), intrusion detection systems, and network authentication

Anti-virus (AV)

Software capable of detecting and removing virus infections and (in most cases) other types of malware, such as worms, Trojans, rootkits, adware, spyware, password crackers, network mappers, DoS tools, and others

Security Update

Software code that is issued for a product-specific security-related vulnerability

Rootkits

Software designed to gain administrative level control over a system without detection

Malware

Software designed to infiltrate a computer system and possibly damage it without the user's knowledge or consent

Agile

Software development is performed in time-boxed or small increments to allow more adaptivity to change

Storage DLP systems

Software installed on servers in the datacenter to inspect the data at rest

Data Historian

Software that aggregates and catalogs data from multiple sources within an industrial control system

Agents

Software that is loaded on a managed device to redirect information to the network management system

VPN Concentrator

Specialized hardware device that allows for hundreds of simultaneous VPN connections for remote workers

cloud

Specialized security services _____providers can stop DDoS attacks

Extranet

Specialized type of DMZ that is created for your partner organizations to access over a wide area network

White Team

Staff administering, evaluating, and supervising a penetration test or incident response exercise

-Reconnaissance -Weaponization -Delivery -Exploitation -Installation -Command & Control - Action on Objectives

Stages of Kill Chain (RWDEICA)

X.509

Standard used PKI for digital certificates and contains the owner/user's information and the certificate authority's information

Protected EAP (PEAP)

Supports mutual authentication by using server certificates and Microsoft's Active Directory to authenticate a client's password

Rivest Cipher (RC4)

Symmetric stream cipher using a variable key size from 40-bits to 2048- bits that is used in SSL and WEP; exam tip ___is the only stream cipher covered

Data Loss Prevention

Systems designed to protect data by conducting content inspection of data being sent out of the network o Also called Information Leak Protection (ILP) or Extrusion Prevention Systems (EPS) o is used to ensure your private data remains secure

Premise Systems

Systems used for building automation and physical access security § Many system designs allow the monitoring to be accessible from the corporate data network or even directly from the Internet

§ Windows 7 (and newer) § Mac OS X 10.6 (and newer) § FreeBSD (TrustedBSD) § Red Hat Enterprise Server

TOS

Ransomware

Takes control of your computer or data unless you pay

Removable media controls

Technical limitations placed on a system in regards to the utilization of USB storage devices and other removable media; Create administrative controls such as policies

§ Masquerading § DLL injection § DLL sideloading § Process hollowing

Techniques of Code injection

Write Once Read Many (WORM)

Technology like a DVD-R that allows data to be written only once but read unlimited times

Telephony

Term used to describe devices that provide voice communication to users

Cookies

Text files placed on a client's computer to store information about the user's browsing habits, credentials, and other data

Trusted Execution

The CPU's security extensions invoke a TPM and secure boot attestation to ensure that a trusted operating system is running

Lock picking

The art of unlocking a lock without a key.

Weaponization

The attacker couples payload code that will enable access with exploit code that will use a vulnerability to execute on the target system

Reconnaissance

The attacker determines what methods to use to complete the phases of the attack

Delivery

The attacker identifies a vector by which to transmit the weaponized code to the target environment

Actions on Objectives

The attacker typically uses the access he has achieved to covertly collect information from target systems and transfer it to a remote system (data exfiltration) or achieve other goals and motives

Orchestration

The automation of multiple steps in a deployment process o is the automation of the automations

Legal

The business or organizations legal council is responsible for mitigating risk from civil lawsuits

Secure Enclave

The extensions allow a trusted process to create an encrypted container for sensitive data

Single Point of Failure

The individual elements, objects, or parts of a system that would cause the whole system to fail if they were to fail

Work Recovery Time (WRT)

The length of time in addition to the RTO of individual systems to perform reintegration and testing of a restored or upgraded system following an event

Recovery Time Objective (RTO)

The length of time it takes after an event to resume normal business operations and activities

Maximum Tolerable Downtime (MTD)

The longest period of time a business can be inoperable without causing irrevocable business failure; sets the upper limit on the recovery time that system and asset owners need to resume operations

Data Acquisition

The method and tools used to create a forensically sound copy of data from a source device, such as system memory or a hard disk

Basic Encoding Rules (BER)

The original ruleset governing the encoding of data structures for certificates where several different encoding types can be utilized

Hardware Source Authenticity

The process of ensuring that hardware is procured tamper-free from trustworthy suppliers

Artificial Intelligence (AI)

The science of creating machines with the ability to develop problem solving and analysis strategies without significant human direction or intervention

Key

The strength of an encryption system lies in the ___ strength o ___ must be securely stored o Periodically change your ____

Identity Fraud

The use by one person of another person's personal information, without authorization, to commit a crime or to deceive or defraud that other person or a third person; involves stealing another person's identity and using it as your own

Command & Control (C2)

The weaponized code establishes an outbound channel to a remote server that can then be used to control the remote access tool and possibly download additional tools to progress the attack

Exploitation

The weaponized code is executed on the target system by this mechanism

services.msc

This command opens the services window in this window, services can be started, stopped, restarted enabled and disabled

DAC is Discretionary Access Control

This is an access control policy that's determined by the owner.

service orchestration.

This is going to be used to deploy services into cloud environments.

resource orchestration

This is to provision and allocate resources within a cloud environment or other solution.

white-box test

This means they'll give them some kind of information about the network, usually IP addresses, the types of servers being run, maybe the software, and sometimes, even a basic standard user account.

explicit, implicit

Threat feeds are form of _____ knowledge, but ______ knowledge from experience practitioners is also useful

resources and time

Threat hunting consumes a lot of _______ and _______to conduct, but can yield a lot of benefits

regular

Threat hunting relies on the usage of the tools developed for ________ security monitoring and incident response

Proprietary

Threat intelligence is very widely provided as a commercial service offering, where access to updates and research is subject to a subscription fee; repackaging information from other sources without providing their own data, not nearly useful

risk analysis

is conducted before a business impact analysis; otherwise, the threats would not yet have been identified.

Towers of Hanoi

Three sets of backup tapes (like the grandfather-father-son) that are rotated in a more complex system

WiFi Protected Access 2 (WPA2)

is the highest level of wireless security

Certificate revocation

lists track the serial numbers of revoked PKI certificates.

Cloud-based infrastructure

must be configured to provide the same level of security as a local solution

Single-sided certificates

only require the server to be validated

Software Development Life Cycle

organized process of developing a secure application throughout the life of the project

reimage

removal of a rootkit is difficult and the best plan is to _________ the machine

Web servers

should be placed in your DMZ

Legal Hold

§ A process designed to preserve all relevant information when litigation is reasonably expected to occur § A computer or server could be seized as evidence § Appoint a liaison with legal knowledge and expertise who can be the point of contact with law enforcement • Analysis must be performed without bias • Analysis methods must be repeatable by third parties • Evidence must not be changed or manipulated

Remote Desktop Protocol

§ Microsoft's proprietary protocol that allows administrators and users to remotely connect to another computer via a GUI § doesn't provide authentication natively; Port 3389

Community Cloud

§ Resources and costs are shared among several different organizations who have common service needs

Advanced Encryption Standard (AES)

§ Symmetric block cipher that uses 128-bit, 192-bit, or 256-bit blocks and a matching encryption key size to encrypt plaintext into ciphertext § is the standard for encrypting sensitive U.S. Government data

jumpbox

§ To configure devices in the DMZ, a _____is utilized

Weak of Default Configurations

• Any program that uses ineffective credentials or configurations, or one in which the defaults have not be changed for security • Many applications choose to simply run as root or as a local admin • Permissions may be too permissive on files or directories due to weak configurations

encryption and authentication

• Basic security controls like ____ and ______ are not included by default within syslog

System and Processor Virtual Machines

2 VM Types

perimeter, building, and the room itself.

3 areas of Physical security

Proprietary, closed source, open source

3 types of intelligence or where you can find information

journalctl

A Linux command line utility used for querying and displaying logs from journald, the systemd logging service on Linux

IPSec

A TCP/IP protocol that authenticates and encrypts IP packets and effectively securing communications between computers and devices using this protocol; provides confidentiality (encryption), integrity (hashing), and authentication (key exchange)

dd

A command line utility used to copy disk images using a bit by bit copying process

Quantum Computing

A computer that uses quantum mechanics to generate and manipulate quantum bits (qubits) in order to access enormous processing powers

Electromagnetic Interference (EMI)

A disturbance that can affect electrical circuits, devices, and cables due to radiation or electromagnetic conduction

Diamond Model of Intrusion Analysis

A framework for analyzing cybersecurity incidents and intrusions by exploring the relationships between four core features: adversary, capability, infrastructure, and victim

Extensible Authentication Protocol (EAP)

A framework of protocols that allows for numerous methods of authentication including passwords, digital certificates, and public key infrastructure

Scam

A fraudulent or deceptive act or operation

Hash

A function that converts an arbitrary length string input to a fixed length string output

Mimikatz

A penetration testing tool used to automate the harvesting of hashes and conducting the Pass the Hash attack

Next-gen SIEM

A security information and event monitoring system with an integrated SOAR • Scans security/threat data • Analyze it with ML • Automate data enrichment • Provision new resources

Public cloud

A service provider makes resources available to the end users over the Internet

Pseudo-Random Number Generator (PRNG)

A simulated random number stream generated by a computer that is used in cryptography, video games, and more o There are no such thing as truly random numbers in computers

Honeypot

A single computer (or file, group of files, or IP range) that might be attractive to an attacker; are normally used in security research

Application Containerization

A single operating system kernel is shared across multiple virtual machines but each virtual machine receives its own user space for programs and data; Containerization allows for rapid and efficient deployment of distributed applications; examples: o Docker o Parallels Virtuozzo o OpenVZ

FTP Server

A specialized type of file server that is used to host files for distribution across the web § _ should be configured to require TLS connections

Risk Transfer

A strategy that passes the risk to a third party

tcpreplay

A suite of free open source utilities for editing and replaying previously captured network traffic

Data Loss Prevention (DLP)

A system that can identify critical data, monitor how it is being accessed, and protect it from unauthorized users.

File Integrity Monitoring (FIM)

A type of software that reviews system files to ensure that they have not been tampered with

Spam

Abuse of electronic messaging systems

System-Specific Policies

Address the security needs of a specific technology, application, network, or computer system

Type II

Addresses the operational effectiveness of the specified controls over a period of time (usually 9-12 months)

Virtual Private Network (VPN)

Allows end users to create a tunnel over an untrusted network and connect remotely and securely back into the enterprise network

encrypted channel (HTTPS)

An API must only be used over an _____

Man-in-the-Middle Attack

An attack where the attacker sits between two communicating hosts and transparently captures, monitors, and relays all communication between the hosts

Ping Flood

An attacker attempts to flood the server by sending too many ICMP echo request packets (which are known as pings)

Phishing

An attempt to fraudulently obtain information from a user (usually by email); is a more specific type of social engineering; is a generic category with specific techniques

Spear Phishing

An attempt to fraudulently obtain information from a user, usually by email that targets a specific individual

Legacy Systems

An old method, technology, computer system, or application program which includes an outdated computer system still in use

vulnerability

Any open port represents a possible _________ that might be exposed

Mantrap

Area between two doorways that holds people until they are identified and authenticated

Kerberos

Authentication protocol used in Windows to identify clients to a sever using mutual authentication (Uses tickets)

Trusted Platform Module (TPM)

Chip residing on the motherboard that contains an encryption key for bitlocker

Groups

Collection of users based on common attributes (generally work roles)

Malware infections, Watering holes,

Common delivery methods of Threat and Attack vectors

Data Link Layer

Describes how a connection is established, maintained, and transferred over the physical layer and uses physical addressing (MAC addresses); Frames; ie mac addresses, switches and bridges

BYOD

Don't allow _______

anti-forensics

Droppers are likely to implement ____________ techniques to prevent detection and analysis

§ FileVault § BitLocker

Encryption software is most commonly used, encryption software is commonly used as it is more affordable than SED

security policy

Ensure your organization has a good _____ _______ for mobile devices

patches and adopt

Ensure your web browser is up-to-date with ___________... ...but don't ___________ the newest browser immediately

Due Diligence

Ensuring that IT infrastructure risks are known and managed properly

Security Association (SA)

Establishment of secure connections and shared security information using certificates or cryptographic keys

Senior leadership

Executives and managers who are responsible for business operations and functional areas

Tabletop Exercise (TTX)

Exercise that uses an incident scenario against a framework of controls or a red team; is a discussion of simulated emergency situations and security incidents

Code Injection

Exploit technique that runs malicious code with the identification number of a legitimate process

Living Off the Land

Exploit techniques that use standard system tools and packages to perform intrusions

Analysis

Forensic Procedure that Create a copy of evidence for analysis and use repeatable methods and tools during analysis

Reporting

Forensic Procedure that Create a report of the methods and tools used in the investigation and present detailed findings and conclusions based on the analysis

Collection

Forensic Procedure that Ensure authorization to collect evidence is obtained, and then document and prove the integrity of evidence as it is collected

ICS and SCADA

HVAC systems may be connected to networks____ and ______

Hacktivists

Hackers who are driven by a cause like social change, political agendas, or terrorism

Advanced Persistent Threats

Highly trained and funded groups of hackers (often by nation states) with covert and open-source intelligence at their disposal

Transport Mode

Host-to-host transport mode only uses encryption of the payload of an IP packet but not its header; used for transmission between hosts on a private network

802.1x

IEEE standard that defines Port-based Network Access Control (PNAC) and is a data link layer authentication technology used to connected devices to a wired or wireless LAN

993 TCP

IMAP4 with SSL/TLS

SPAN

If you cannot configure a _____ port, then you can use a network tap

log files or monitoring tools

If you're dealing with a software as a service, many times, you're not going to have any ability to access ___- or ______

Profiling Threat Actors and Activities

Involves the creation of scenario that show how a prospective attacker might attempt an intrusion and what their objectives might be

file system

Level of security of a system is affected by its ____ _____ type

datasets

Machine learning is only as good as the _______ used to train it

True positive

Malicious activity is identified as an attack

Replay Attack

Network-based attack where a valid data transmission is fraudulently or malicious rebroadcast, repeated, or delayed

Altered Hosts File

Occurs when an attacker modifies the host file to have the client bypass the DNS server and redirects them to an incorrect or malicious website

Physical, data link, network, transport, session, presentation, application

Please do not throw sausage pizza away

Quality of Service (QoS)

Policies that control how much bandwidth a protocol, PC, user, VLAN, or IP address may use.

Network Address Translation (NAT)

Process of changing an IP address while it transits across a router; Using this can help us hide our network IPs

4

R (Read) in Linux

Physical Layer

Represents the actual network cables and radio waves used to carry data over a network; Bits

Rely on Trusted SDKs

SDKs must come from trusted source to ensure no malicious code is being added

rootkit before

Scanners can detect a file containing a _________ _________it is installed...but once installed, it is very have to detect

Management Controls

Security controls that are focused on decision-making and the management of risk

Network DLP System

Software or hardware-based solution that is installed on the perimeter of the network to detect data in transit

Network Management System (NMS)

Software running on one or more servers to control the monitoring of network-attached devices and computers

Network Attached Storage (NAS)

Storage devices that connect directly to your organization's network

International Data Encryption Algorithm (IDEA)

Symmetric block cipher which uses 64-bit blocks to encrypt plaintext into ciphertext

Rivest Cipher (RC5)

Symmetric block cipher with a key size up to 2048-bits

100-1000x

Symmetric is ______ faster than asymmetric

Advanced Encryption Standard (AES)

Symmetric key encryption that supports 128-bit and 256-bit keys, used by both filevault and bitlocker

514 UDP

Syslog

6514 TCP

Syslog over TLS

HVAC (Heating, Ventilation and Air Conditioning)

Systems that provide and regulate heating and cooling.

terminal access controller access control system plus

TACACS+ stands for

Recovery Point Objective (RPO)

The longest period of time that an organization can tolerate lost data being unrecoverable; is focused on how long can you be without your data

third-party orchestration platforms.

These allow you to work on your product and your orchestration across multiple vendors, and allows you to prevent this vendor lock-in.

input validation and encryption

To prevent XML vulnerabilities from being exploited, use proper

Presentation Layer

Translates the information into a format that the sender and receiver both understand

TCP

Transmission Control Protocol - provides reliable, ordered, and error-checked delivery of a stream of packets on the internet. TCP is tightly linked with IP and usually seen as TCP/IP in writing.

Snapshot Backup

Type of backup primarily used to capture the entire operating system image including all applications and data; are also commonly used with virtualized systems

netcat

Utility for reading from and writing to network connections using TCP or UDP which is a dependable back-end that can be used directly or easily driven by other programs and scripts

arp

Utility for viewing and modifying the local Address Resolution Protocol (ARP) cache on a given host or server

ipconfig/ifconfig

Utility that displays all the network configurations of the currently connected network devices and can modify the DHCP and DNS settings

netstat

Utility that displays network connections for Transmission Control Protocol, routing tables, and a number of network interface and network protocol statistics

dnsenum

Utility that is used for DNS enumeration to locate all DNS servers and DNS entries for a given organization

scanless

Utility that is used to create an exploitation website that can perform Open port scans in a more stealth-like manner

route

Utility that is used to view and manipulate the IP routing table on a host or server

Active Assessments

Utilize more intrusive techniques like scanning, hands-on testing, and probing of the network to determine vulnerabilities

Stream Cipher

Utilizes a keystream generator to encrypt data bit by bit using a mathematical XOR function to create the ciphertext

SYN Flood

Variant on a Denial of Service (DOS) attack where attacker initiates multiple TCP sessions but never completes the 3-way handshake

Multipartite

Virus that is persistent, combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer;

Vulnerabilities

Weaknesses in the design or implementation of a system

unpatched

Worm take advantage of _______OS, application or software

self-replicate and spread

Worms ______ and ______ without a user's consent or action

Proxies cache

____ _____ the website to reduce requests and bandwidth usage

DDoS (Distributed Denial of Service)

a type of attack where multiple virus-infected computers are used to target a single system, overwhelming it with traffic, rendering it useless or unresponsive

Procedures

are specific

Corrective controls

are used after an event occurs.

Phish Insight

free phishing tool campaign where you can register

Gray-box testing

is a combination of white-box testing and black-box testing.

compensating control

is used whenever you can't meet the requirements for a normal control.

Usernames and Passwords

most commonly used authentication system

Onboard Diagnostics (OBD-II)

primary external interface

ext4

recommended file system for linux

Hired, Fired or Promoted

user recertification should be triggered when an employee is ___, ___, _____

SHA-1

uses a 160-bit hash digest, but isn't considered strong

SHA-2

uses a 256-bit or 512-bit hash digest and is the current version in used in modern forensics

EAP-TTLS

uses a server-side digital certificate and a client-side password for mutual authentication

Infrastructure as a Service (IaaS)

virtual private cloud infrastructure be classified as_____

infrared system

which looks at things based on their heat

Accounting

▪ Tracking of data, computer usage, and network resources ▪ Non-repudiation occurs when you have proof that someone has taken an action

Public Key Cryptographic Systems #7 (PKCS#7)

.p7b

- boot sector -Metamorphic -Macro -Multipartite - Program -Polymorphic -Encrypted -Stealth -Armored -Hoax

10 types of viruses (BM3P2ESAH)

Class B

172.16.0.0 to 172.31.255.255

Class C

192.168.0.0 to 192.168.255.255

procedural and Legal or regulatory control

2 categories of Administrative controls

WPA3 enterprise mode and wpa 3 personal mode

2 different mode of WPA3

sc stop or net stop [name of program]

2 functions on the command prompt, to stop a program

version control and configuration management

2 important concepts of maintenance

Wet Pipe Sprinkler System & Dry Pipe Sprinkler System

2 types Sprinklers systems

Vertical Privilege Escalation § Horizontal Privilege Escalation

2 types of Privilege Escalation

active or passive

2 types of assessment

Type 1 and Type II

2 types of hypervisors

further

2.4 GHz signals can travel ______ than 5 GHz

Authentication, Authorization, Accounting

3 A's of Security

WEP, WPA, WPA2

3 encryption in wireless network

Physical Controls, Technical Control and Administrative Control

3 main categories in Mitigating threat

§ Update your anti-malware software automatically and scan your computer § Update and patch the operating system and applications regularly § Educate and train end users on safe Internet surfing practices

3 main tips to remember in order to avoid malware

1. What is the value of the information? § 2. What is the threat your system is facing? § 3. What is the mitigation that could be deployed?

3 questions can help to scope your assessments

-Remove email addresses from website o Use whitelists and blacklists o Train and educate end users

3 tips to prevent spam going to your oraganization

Resource Orchestration § Workload Orchestration § Service Orchestration

3 types of orchestration

o Collocated data can become a security risk o Configure, manage, and audit user access to virtualized servers o Utilizing the cloud securely requires good security policies o Data remnants may be left behind after deprovisioning

4 Cloud Security concerns

1. implement policies 2. Train your users 3. Use proxy & content filter 4. Prevent malicious code

4 General Security for Web Browsers

Malware, Unauthorized access, System failure and social engineering

4 main categories of security threats

Script kiddies, hacktivists, organized crime, advance persistent threats

4 main groups of threat actors

DNS poisoning, Unauthorized Zone Transfer, Altered Hosts File, Pharming, Domain Name Kiting

5 different DNS Attacks

• Flood Attacks • Ping of Death • Teardrop Attack • Permanent DoS • Fork Bomb

5 subcategory of DoS

white hats, black hats, gray hats, blue hats and Elite

5 types of hackers

Session theft § TCP/IP hijacking § Blind hijacking § Clickjacking § Man-in-the-Middle § Man-in-the-Browser § Watering hole § Cross-site scripting

8 types of session hijacking

WiFi Protected Access version 2 (WPA2)

802.11i standard to provide better wireless security featuring AES with a 128-bit key, CCMP, and integrity checking § is considered the best wireless encryption available

fiber optic

To prevent data emanations from happening, you should switch your networks to _____ cables because they don't have any emanation at all.

read-only

To prevent your host file from being manipulated, it should always be set to _____; Windows stores the hosts file in the following directory: \%systemroot%\system 32\drivers\etc

official mobile stores

To protect your phone from malware, only install apps from the ___________

Explicit Allow

Traffic is allowed to enter or leave the network because there is an ACL rule that specifically allows it § Example: allow TCP 10.0.0.2 any port 80

Explicit Deny

Traffic is denied the ability to enter or leave the network because there is an ACL rule that specifically denies it § Example: deny TCP any any port 23

Implicit Deny

Traffic is denied the ability to enter or leave the network because there is no specific rule that allows it § Example: deny TCP any any port any

unnecessary

Turn off all _________features

TEMPEST

U.S. Government standards for the level of shielding required in a building to ensure emissions and interference cannot enter or exit the facility; facilities are also resistant to EMPs (electromagnetic pulses)

cheaper

UTP is commonly used more often than STP because it is ____

Bluesnarfing

Unauthorized access of information from a wireless device through a Bluetooth connection sends information; takes information

Bluesnarfing

Unauthorized access or taking of information from a wireless device over a Bluetooth connection

The ALE is less than the cost of mitigating the risk

Under what circumstance might a risk be acceptable? (Choose the best answer.)

Diffie-Hellman (DH)

Used to conduct key exchanges and secure key distribution over an unsecured network § Diffie-Hellman is used for the establishment of a VPN tunnel using IPSec

Routers

Used to connect two or more networks to form an internetwork; rely on a packet's IP Addresses to determine the proper destination; Once on the network, it conducts an ARP request to find final destination

Human Resources (HR)

Used to ensure no breaches of the employment law or employee contract is made during an incident response

OSI Model

Used to explain network communications between a host and remote device over a LAN or WAN

Public Relation (PR)

Used to manage negative publicity from a serious incident

Password Authentication Protocol (PAP)

Used to provide authentication but is not considered secure since it transmits the login credentials unencrypted (in the clear)

Challenge Handshake Authentication Protocol (CHAP)

Used to provide authentication by using the user's password to encrypt a challenge string of random numbers

Security Awareness Training

Used to reinforce to users the importance of their help in securing the organization's valuable resources; User security awareness training has the best return on investment

Security Training

Used to teach the organization's personnel the skills they need to perform their job in a more secure manner

Registration Authority

Used to verify information about a user prior to requesting that a certificate authority issue the certificate

UDP

User Datagram Protocol. Used instead of TCP when guaranteed delivery of each packet is not necessary. UDP uses a best-effort delivery mechanism.

training

User ________ will prevent many issues inside your organization

Least Privilege

Users and processes should be run using the least amount of access necessary to perform a given function

Least Privilege

Users are only given the lowest level of access needed to perform their job functions

Non-Persistent Agents

Uses a piece of software that scans the device remotely or is installed and subsequently removed after the scan

password cracker

Uses comparative analysis to break passwords and systematically continues guessing until the password is determined o Cain & Abel and John the Ripper

Network Layer

Uses logical address to route or switch information between hosts, the network, and the internetworks; Packets; ie router, IP address

logger

Utility that provides an easy way to add messages to the /var/log/syslog file from the command line or from other files

SSH

Utility that supports encrypted data transfer between two computers for secure logins, file transfers, or general purpose connections

nslookup/dig

Utility used to determine the IP address associated with a domain name, obtain the mail server settings for a domain, and other DNS information

baseline

Utilize a secure _______ image when adding new computers. This will have the OS, strict configuration policies, and minimum application needed

Passive Assessments

Utilize open source information, the passive collection and analysis of the network data, and other unobtrusive methods without making direct contact with the targeted systems o are limited in the amount of detail they find

Cross-Certification

Utilizes a web of trust between organizations where each one certifies others in the federation

Hybrid Implementation

Utilizes asymmetric encryption to securely transfer a private key that can then be used with symmetric encryption

Lattice-based Access Control

Utilizes complex mathematics to create sets of objects and subjects to define how they interact

Sandboxing

Utilizes separate virtual networks to allow security professionals to test suspicious or malicious files

physical requirements

Virtualization continues to rise in order to reduce the ____ _____ for data centers

- lockheed martin kill chain - MITRE ATT&CK Framework -Diamond Model of Intrusion Analysis

What are the 3 attack framework?

Physical hardware

What is the lowest layer (bottom layer) of a bare-metal virtualization environment?

DNS poisoning and ARP cache poisoning

What types of attacks cannot be mitigated by virus scanners?

Back up your files

What's one good practice to combat ransomware?

Diversion Theft

When a thief attempts to take responsibility for a shipment by diverting the delivery to a nearby location

Watering Hole Attack

When an attacker figures out where users like to go, and places malware to gain access to your organization

failed

When threat hunting, you need to assume that these existing rules have _______

Wi-Fi

Whenever possible, though, you should just avoid _____ in the first place because it is just an additional vulnerability. And by going to a wired network, you're going to be much more secure.

Recipient's public key

Which key is used when you send an encrypted e-mail message?

VM escape

Which of the following vulnerabilities involves leveraging access from a single virtual machine to other machines on a hypervisor?

Cross-site request forgery

Which type of attack exploits a web site's trust of a user session?

Domain Controller

Whitelisting and blacklisting can be centrally managed using _____ ________ group policies

Windows Update program (wuapp.exe)

Windows 10 uses the ____- ______ _______ to manage updates

NTFS or FAT32

Windows systems can utilize ______ or ______

secure

Wired devices are almost always more _______than wireless ones; if your wireless device is not using AES, that means the encryption is weak

Wireless Access Points (WAP)

Wireless security also relies upon proper ______

disruption

Worms can cause ________to normal network traffic and computing activities, slowing down your system

anti-malware solutions

Worms, Trojans, and Ransomware are best detected with _______ __________

Forensic Procedures

Written procedures ensure that personnel handle forensics properly, effectively, and in compliance with required regulations

XML Bomb (Billion Laughs Attack)

XML encodes entities that expand to exponential sizes, consuming memory on the host and potentially crashing it

ESSID broadcasting has been disabled

You are attempting to connect to a corporate wireless network, but the WLAN name does not appear for you to connect to it. Why might this be?

Virtualization

You need to determine the best way to test operating system patches in a lab environment prior to deploying them to your automated patch management system. Unfortunately, your network has several different operating systems in use, but you only have one machine available to test the patches on. What is the best environment to utilize to perform the testing of the patches prior to deployment?

infected

Your computer might have been _______ if it begins to act strangely

Change the Wi-Fi channel is correct. 802.11g wireless routers run in the 2.4 GHz frequency range. In North America, you can configure your wireless router to use one of eleven channels to reduce interference. For example, if both neighbors are using channel 3 in the 2.4 GHz range, you might configure your wireless router to use channel 11 to reduce or eliminate interference. Each channel is spaced approximately 5 MHz from the next, so choosing a closer channel, such as channel 4, may still produce problems.

Your new 802.11g home wireless network seems to be unpredictable. At times, you are disconnected for no apparent reason. You have ensured that you are running the latest driver for your Wi-Fi network card and you have updated the firmware in your wireless router, yet the network is still unreliable. The neighbors on either side of you both have wireless networks as well. What should you do next to increase the stability of your wireless network?

Live migration

___ ____ occurs when a VM is moved from one physical server to another over the network

FTK and EnCase

___ _____re popular forensic tools

Secure Boot

____ _____ is a security system offered by UEFI. It is designed to prevent a computer from being hijacked by a malicious OS. Under secure boot, UEFI is configured with digital certificates from valid OS vendors. The system firmware checks the operating system boot loader using the stored certificate to ensure that it has been digitally signed by the OS vendor. This prevents a boot loader that has been changed by malware (or an OS installed without authorization) from being used.

firmware exploit

____ ______ gives an attacker an opportunity to run any code at the highest level of CPU privilege

Rapid Elasticity

____ _____in cloud computing would not be possible without orchestration

Elasticity

_____ allows for scaling up or down to meet user demands

Content filter

______ _______can be used to blacklist specific websites or entire categories of sites

Flood guards

_______, time outs, and an IPS can prevent SYN Floods

Secure Volumes

are a method of keeping data at rest, secure from prying eyes. When data on the volume is needed, a secure volume is mounted and it's properly decrypted to allow that access. Once the volume is no longer needed, though, it's encrypted again and unmounted from the virtual server. This is the same concept that's used by BitLocker on a Windows laptop, or FileVault on a MacBoo

Class K fires

are composed of cooking oil. So, if your organization has a kitchen inside of its facilities, you should have a fire extinguisher system that's built-in to handle grease and oil fires that could occur during cooking.

Class C fires

are electrical fires, CO2-based extinguisher

Log files

are important to your ability to reconstruct an event after it occurs

SNMP v1/v2

are insecure due to the use of community strings to access a device

Username and password

are only considered single-factor authentication

Preventative controls

are security controls that are installed before an event happens and they're designed to prevent something from occurring.

Cable locks

are the best solution, as it will allow the laptops to be physically connected to the desks in the computer lab and can prevent theft.

Switches

are the combined evolution of hubs and bridges

Detective controls

are used during an event to find out whether or not something bad may have happened

Honeypots and honeynets

are used to attract and trap potential attackers

Backdoors

are used to bypass normal security and authentication functions

Protocol Analyzers

are used to capture and analyze network traffic

Standards

are used to implement a policy in an organization

File Servers

are used to store, transfer, migrate, synchronize, and archive files for your organization

Transitive Attacks

aren't really an attack but more of a conceptual method, based on trust

Steganography

attempts to conceal the fact that any communication is taking place by placing messages or files within other files.

current version and build

before OS update, you need to identify the____ _____ ______ prior to updating a system

o Segment the network o Reduce collisions o Organize the network o Boost performance o Increase security

benefit of VLANs

Efficient use of IP addresses § Reduced broadcast traffic § Reduced collisions § Compartmentalized

benefit of subnetting

Ensure your browser and its extensions are updated regularly

best protection from unwanted ads and disable pop up and only allows the sites you need

port 445 smb and 139 net bios

block ports ___ and ____ to stop null connection

shim

both DLL and Driver manipulation occurs by the use of _____; is placed between two components to intercept calls and redirect them

good host base firewall

by doing this you are preventing outside unauthorized people accessing your machine

updating your OS and do needed patching

by doing this you are preventing viruses from exploiting some known exploit

use encrypted websites (https)

by doing this you ensure that there's no man in the middle connection when you browse the internet between you and your destination site

Hashing

can also be used to prove file integrity of the operating system and application files

Windows Firewall with Advance security

can be access by typing wf.msc at the command prompt; suitable for businesses

basic mac OS

can be access from security and privacy panel

pairing key

change default ______ ___of your bluetooth device to avoid bluesnarfing and bluejacking

MISP project

codifies the use of the admiralty scale for grading data and estimative language

PF (packet filter)

command line version of basic mac firewall

convert drive:/FS:NTFS

command to convert FAT32 file system to NTFS

Fire Eye

company that uses proprietary closed source intelligence

quantum bit

composed of electrons or photons that can represent numerous combinations of 1s and 0s at the same time through superposition § Cryptography is used to secure our communications and data by relying on how difficult a math problem is to compute... § Asymmetric encryption algorithms have been mathematically proven to be broken by _____ computers

Identify assets o Identify vulnerabilities o Identify threats o Identify the impact

conduct a risk assessment, you only have to use four steps

Application-layer gateway

conducts an in-depth inspection based upon the application being used; also known as level 7 firewall

Class B fire

consist of flammable gases or liquids. To put out a Class B fire, you should use a dry chemical agent or a CO2-based fire extinguisher

Class A fires

consist of solid combustible materials, things like wood and paper; a water-based extinguisher.

stateful packet filtering

creates and maintains a table in memory that lists all established connections between the organization's computers and the Internet

HSM

devices perform cryptographic calculations, thus eliminating this task from the host computer system.

RADIUS

dialing user service

jailbreaking/rooting

do not _______/_____ device, if you do, that means your bi-passing that your system has and makes you vulnerable to attacks

warm site

dormant alternate location, or a location that performs noncritical functions under normal conditions, but can be rapidly converted to a main operations site with minimal effort.

DLL injection

dropper will force a process to load as part of the dll

Masquerading

dropper will replace genuine exe file with a malicious one

microservice

everything in serverless is developed as a function or a .

§ Single sign-on § Malware and rogue device detection § Monitor/audit user activity § Mitigate data exfiltration

features of CASB

knowledge, ownership, characteristic, location, and action.

five basic factors of authentication

custom firmware or a custom ROM

for android mobile - using this means your using an alternate firmware, so when google made patches for vulnerability, it doesn't necessarily makes it way to your device

Sherwood Applied Business Security Architecture (SABSA) Framework

for developing risk-driven enterprise information security and information assurance architectures. It also aids in delivering security infrastructure solutions that support critical business initiatives.

ALE= SLE X ARO

formula of ALE

DAC, MAC, RBAC, and ABAC.

four access control models

can avoid it, you can transfer it, you can mitigate it, and you can accept it.

four things that you can do with risk

hot site

fully configured alternate network that can be quickly brought online after a disaster. With a hot site, systems and data are usually up-to-date.

Discretionary access control (DAC)

gives the resource owner (the user owns his or her home directory and its contents) control of assigning permissions to that resource.

data loss prevention systems.

greatest ways to protect IP Theft; can see when people are trying to take data out of your organization, data from your shared drive, data from your database, data over email, whatever it is, if people are trying to steal that data from you, if you have a protective with it, you'll be able to identify it and possibly prevent it.

APT, Organized crimes, hacktivist, script kiddies

hackers skill levels

MTD and RPO

help to determine which business functions are critical and to specify appropriate risk countermeasures

Google Voice number

how to really protect your phone number from ID theft, you can use _____ ______ _____ , it uses alternate number that you can use and your real number is hidden

breaking inheritance

if you dont want propagation to occur, you do this

cloud service provider

in FAAS The underlying architecture is managed by the ________

IPS

install ___ at the boundary to prevent null connection

Intranets

internal corporate networks based on internet technology

User account control

is a Windows operating system mechanism that requires administrator approval to modify operating system configurations.

Multi-cloud

is a cloud deployment model where the cloud consumer uses multiple public cloud services.

software development kit (SDK)

is a collection of software development tools in one installable package. They facilitate the creation of applications by having compiler, debugger and perhaps a software framework.

Frames

is a digital data transmission unit in computer networking and telecommunication.

Mandatory access control (MAC)

is a model whereby administrators or computer operating systems determine what permissions are granted in accordance with established policies.

Jack the Ripper

is a popular open source password cracking tool that combines several different cracking programs and runs in both brute force and dictionary attack modes. ... Originally developed for Unix-derived systems

Cisco's TACACS+

is a proprietary version of RADIUS

protected distribution system (PDS)

is a secured system of cable management to ensure that the wired network remains free from eavesdropping, tapping, data emanations, and other threats. They are kind of expensive, though, because they add locks to every network closet. They enclose every cable distribution point. And they run cables through a protected conduit that runs throughout the ceiling.

Continuous integration

is a software development method where code updates are tested and committed to a development or build server or code repository rapidly; can test and commit updates multiple times per day; detects and resolves development conflicts early and often

Jumpbox

is a system on a network used to access and manage devices in a separate security zone.

Man-in-the-browser (MitB)

is an attack that intercepts API calls between the browser process and its DLLs

knowledge factor

is concerned with the user providing a piece of memorized information

ownership factor

is concerned with a user proving that they have something in their possession that uniquely identifies them

penetration test

is conducted by a team of professionals to simulate an attack on your network, its system, or its applications.

characteristic factor

is defined as something that the person is

Containment

is focused on isolating the incident

Wireless Network

is less secure than wired network, because the data stream is floating in the network

LEAP

is proprietary to Cisco-based networks

Perfmon.exe

is the Windows program for Performance Monitor

User training

is the administrative control that is cost effective security control to use

Minimum password age

is the amount of time that must pass before users can reset their passwords again.

ITIL

is the de facto standard for IT service management

Legal hold

is the legally required implementation of evidence preservation.

ICS

is used for electrical power stations, water suppliers, health services, telecommunications, manufacturing, and defense needs; one plant

Session Initiation Protocol (SIP)

is used to establish and maintain network sessions related to voice and video, such as with VoIP.

Risk management

is used to minimize the likelihood of a negative outcome from occurring

nonce

is used to prevent password reuse

endpoint analysis

is used when we do monitoring, logging and analysis of our endpoint

terminal>top>kill pid [number]

linux command to stop a program

# sudo stop service

linux command to stop service

Deidentification

methods and technologies that remove identifying information from data before it is distributed; is often implemented as part of database design

context-aware authentication, Single Sign-On authentication, and Federated Identity Management.

models of authentication

PTZ - Pan Tilt Zoom

move the camera to look at different direction and tilt it up and down, pan it left and right, or zoom in or zoom out.

unidirectional

moving in only one direction

hardware based encryption

much faster than software based encryption, but expensive

Newer implementations can use port 1468 (TCP) for consistent delivery § Newer implementations can use TLS to encrypt messages sent to servers § Newer implementations can use MD-5 or SHA-1 for authentication and integrity § Some newer implementations can use message filtering, automated log analysis, event response scripting, and alternate message formats

newer syslog implementations added new features and capabilities

Hoax

not actually a virus but a form of social engineering, trying to trick the user in infecting their own machine.

Residual risk

not covered by a compensating control is an accepted risk

Threat Hunting

o A cyber security PROACTIVE technique designed to detect presence of threat that have not been discovered by a normal security monitoring o Threat Hunting is potentially less disruptive that penetration testing

Security Protocols (4)

o Emails o Websites o Remote control o Remote access

function or microservice

o Everything in serverless is developed as a ____ or _____

Perimeter Security

o Security devices focused on the boundary between the LAN and the WAN in your organization's network o relies on several different devices

Physical tampering

occurs when an attacker attempts to gain physical access

content filtering

occurs when organizations use software that filters content, such as emails, to prevent the accidental or malicious transmission of unauthorized information

Asset disposal

occurs whenever a system is no longer needed

IPFW

older version of PF

golden ticket

one common attack against Active Directory servers is known as the ____ ________. This attack uses a program known as Mimikatz to exploit a vulnerability in the Kerberos ticket-granting system, to generate a ticket that acts as a skeleton key for all of the devices in the domain.

restart in safemode and scan or boot from external drive and scan with a good anti virus software

one effective way to scan your computer for malware

vulnerability data may be stored on their systems, as well.

one major disadvantage of cloud based vulnerability scan

Typosquatting

one way how watering holes works in a effective way; a problem that occurs when someone registers purposely misspelled variations of well-known domain names

Legal or regulatory control

ones you have to do because the law says you must

• CPU registers and cache memory • Contents of system memory (RAM), routing tables, ARP cache, process table, temporary swap files • Data on persistent mass storage (HDD/SDD/flash drive) • Remote logging and monitoring data • Physical configuration and network topology • Archival media

order of volatility

Planning and Analysis

phase in SDLC that goals determine, needs are accessed and all high level work is conducted; ideas formulated to concepts

entrances and exits

placement of the camera should be at the ____ and _____

single point of failure

point in a system where redundancy or failover does not exist, and failure causes obstruction to all functionality.

Bring-your-own-device (BYOD)

policies complicate data acquisition since you may not be able to legally search or seize the device

Bring Your Own Device (BYOD)

policy allows employees to use their personal mobile devices and computers to access enterprise data and applications

AMD

processor that has Secure Memory Encryption (SME) Secure Encrypted Virtualization (SEV)

syntax error

program failed to run due to coding error

Security Threats

purpose is to break in to your computer, server or network

Data sovereignty

refers to applicable laws and regulations based on the physical location of digital data. describes the sociopolitical outlook of a nation concerning computing technology and information. Some nations may respect data privacy more or less than others. Care needs to be considered when storing such data.

action factor

refers to something that a user does

location factor

refers to where a person is when they're trying to log into their account

Dual-sided certificates

require both the server and the user to be validated

chain of custody

requires evidence to be gathered in a legal manner, documented, and securely stored at all times.

Omnidirectional

sending or receiving signals in all directions

host-based firewall

set by applying a set of rules for the traffic that goes into and out of your computer; also referred to as personal firewalls; will use a lot of the computer

remote administration

should be disabled on your wireless access points. it is something that allows you to connect over the Internet and then make changes to your wireless access point. You don't need that. Instead, you should turn it off and make sure that you're doing it locally inside your network only

Log files

should be saved to a different partition or an external server

CSIRT

should be the single point of contact for security incident and may be a part of the SOC or and independent team

Disaster Recovery Plan (DRP)

should be written down § Contact Information § Impact Determination § Recovery Plan § Business Continuity Plan (BCP) § Copies of Agreements § Disaster Recovery Exercises § List of Critical Systems and Data

§ Hard drives, files, or applications are not accessible anymore § Strange noises occur § Unusual error messages § Display looks strange § Jumbled printouts § Double file extensions are being displayed, such as textfile.txt.exe § New files and folders have been created or files and folders are missing/corrupted § System Restore will not function

signs that your computer is infected (8)

- see a lot of popup ads - your homepage is changed

signs your infected with spyware or adware

-password Contain uppercase letters, lowercase letters, numbers, special characters, and at least 8 characters or more (preferably 14 or more) -change the default password - password is changed frequently - change the default Administrator or Root password - Disable the Guest account - Enable CTRL+ALT+DEL for logging into the system - Use good, strong policies in regards to your passwords

six key tips for keeping your usernames and passwords

hardening

the process of modifying the default configuration of endpoints to eliminate unnecessary settings and services

Third-party orchestration platform

these are some example of _____: § Chef § Puppet § Ansible § Docker § Kubernetes § GitHub

fiber optic splitter

they can attach it to a fiber port on one side, and get two copies of every piece of communication, one that will go into their machine, and one that will go into your network.

cross-origin sharing policy,

this is a content delivery network policy that instructs the browser to treat requests from nominated domains as safe.

workload orchestration

this is for the management of applications and other cloud workloads that need to be performed, and basically looking at the components to create the product you need.

preventive, detective, and corrective

three that can be used to describe security controls.

Supplicant, Authenticator, and Authentication Server

three roles that are required for an authentication

o Attach the exploit to OBD-II o Exploit over onboard cellular o Exploit over onboard Wi-Fi

three vehicular vulnerabilities

open mail relays or SMTP open relays

to prevent SPAM sending email on your behalf, Verify your email servers aren't configured as _____ _____ ____ or _____ ______

o 1. Eliminates unnecessary admin-level requests for Windows resources o 2. Reduces risk of malware using admin-level privileges to cause system issues

two main benefits to using UAC

Basic windows firewall & Windows Firewall with Advance security

two types of windows firewall

Software § Hardware § Embedded

types of firewalls

Access control

unprotected cloud storage- ____ _______to storage is administered through container policies, IAM authorizations, and object ACLs

content delivery networks

unprotected cloud storage-Incorrect origin settings may occur when using ____ _____ _____

leftover

unprotected cloud storage-Incorrect permissions may occur due to default read/write permissions________ from creation

Encrypted

use a cypher to encrypt itself to avoid detection

Microsoft System Center Configuration Management

use by large organization to manage, push policies and update their systems

raised floors

use in dissipating that heat much more effectively in server rooms

EAP-TLS

uses digital certificates for mutual authentication

Qualitative Risk

uses intuition, experience, and other methods to assign a relative value to risk; Experience is critical and uses relative comparison

Quantitative Risk

uses numerical and monetary values to calculate risk; can calculate a direct cost for each risk

Identity federation

uses security tokens generated by a trusted identity source to allow access to resources such as web sites.

EAP-MD5

uses simple passwords for its challenge-authentication; challenge handshake authentication process

Redundancy

usually refers to when you have something extra or unnecessary; helps ensure fault-tolerance to continue operations

Malware infections

usually starts within software, messaging, and media

Tracking Cookies

usually used by spywares; can be used to track your path through a web site, the time you spend there, what links you click, and other details that the company wants to record, usually for marketing purposes.

Secure Enclaves

utilize two distinct areas that the data may be stored and accessed from. Each enclave can be accessed by the proper processor. This is a technique that's used by Microsoft Azure and many other cloud service providers.

anti-virus software

virus are most commonly detected by a good ______ _______

Boot sector

viruses are stored in the first sector of a hard drive and are loaded into memory upon boot up; typical anti virus couldn't detect this so you need to use a anti virus that intended for this detection

Program

viruses infect an executable or application

• Process and memory vulnerabilities in PLC • Plaintext credentials or keys in application code • Code injection via web user interface

vulnerabilities in Building Automation System

1. Define the desired state of security § 2. Create a baseline § 3. Prioritize the vulnerabilities § 4. Mitigate vulnerabilities § 5. Monitor the network and systems

vulnerability management process in five steps

black-box test

where the pentesters have to hunt for any information that they need in order to be able to penetrate the network's defenses.

authentication server

which is going to be the centralized device that performs the authentication, which is usually going to be your RADIUS or your TACACS+ server.

authenticator

which is the device through which the supplicant is attempting to access the network.

to avoid possible compromise of your 2 factor authentication

why do you protect your phone number?

anti-spyware

windows defender has this capability of scanning unauthorized snooping and collection of your data

Basic windows firewall

windows firewall that can be found in the control panel; suited for home usage

File Checksum Integrity Verifier

windows tools can you use to calculate a hash value

certutil

windows tools can you use to calculate a hash value

Embedded Firewall

work as a single function out of many function in one device ie. UTM device, router

sources

you must consider the _____ of your intelligence

infected

your computer might have been ______ if it begins to act strangely

Administrative Controls

▪ Policies, procedures, security awareness training, contingency planning, and disaster recovery plans ▪ User training is the most cost-effective security control to use

Elite

● Skilled Hackers who find and exploit vulnerabilities before anyone else does ● 1 in 10,000 are elite

Time of Check to Time of Use (TOCTTOU)

The potential vulnerability that occurs when there is a change between when an app checked a resource and when the app used the resource

Cryptography

The practice and study of writing and solving codes in order to hide the true meaning of information

Network Sniffing

The process of finding and investigating other computers on the network by analyzing the network traffic or capturing the packets being sent

Data Ownership

The process of identifying the person responsible for the confidentiality, integrity availability and privacy of information assets

Residual Risk

The risk remaining after trying to avoid, transfer, or mitigate the risk

Steganography

The science and art of hiding messages within other messages o is a form of obfuscation, NOT encryption

desired and malicious

Trojans perform _______functions and _________ functions

SOC 2

Trust Services Criteria

latest

Update your device to the _____ version of the software

Driver Update

Updated device driver to fix a security issue or add a feature to a supported piece of hardware

Multi-factor Authentication

Use of two or more authentication factors to prove a user's identity

passwords

Use strong ______ or biometrics

Internet Content Filter

Used in organizations to prevent users from accessing prohibited websites and other content

ping/pathping

Utility used to determine if a host is reachable on an Internet Protocol network

2

W (Write) in Linux

Defense attorneys

WARNING: _______ will try to use any deviation from these ethics as a reason to dismiss your findings and analysis

Piggybacking

When an unauthorized person tags along with an authorized person to gain entry to a restricted area

Failover

a specific type of fault tolerance, occurs when a redundant storage server offers an exact replica of the real-time data, and if the primary server crashes, the users are automatically directed to the secondary server or backup server

Kill chain analysis

________ _______ _______ can be used to identify a defensive course-of-action matrix to counter the progress of an attack at each stage

Policies

________ are generic

Encryption

________ scrambles data into unreadable information; ensure confidentiality

Type I (bare metal)

_________ ____ ______ _____hypervisors are more efficient than Type II, acts a stripped-down specialized operating system to provide physical resources to the virtual machine that it host.

Group Policy objectives (GPOs)

__________ ______ _______ aid in the hardening of the operating system

DLL injection

_____________ is commonly used by rootkits to maintain their persistent control; Malicious code is inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries that are loaded at runtime

NIST SP 800-53

__________is a security control framework developed by the Dept. of Commerce

Enumeration tools and vulnerability

________scanners can cause problems on Operational Technology Network

Encryption and VPNs

_____and ___ are always a good idea to secure your network

Network devices

_____include switches, routers, firewalls, and more

null connection

a connection to the windows interprocess communications share

CAN-SPAM Act of 2003

a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.

IT Security Frameworks

a series of documented processes used to define policies and procedures around the implementation and ongoing management of information security controls in an enterprise environment.

ARP spoofing

aka ARP poisoning - faking your MAC address; usually combined with MAC spoofing

pre-ATT&CK tactics matrix

aligns to the reconnaissance and weaponization phases of the kill chain

Virtual Desktop Infrastructure (VDI)

allows a cloud provider to offer a full desktop operating system to an end user from a centralized server

Hyperconvergence

allows providers to fully integrate the storage, network, and servers

managerial control

also referred as administrative controls

cold site

alternate location where a network can be rebuilt after a disaster has occurred. A cold site can take some time to implement, as systems and assets (including data) are not readily configured and available for full use.

Host-based IDS/IPS (HIDS/HIPS)

and A type of IDS or IPS that monitors a computer system for unexpected behavior or drastic changes to the system's state on an endpoint; use signature based detection system and file integrity monitoring

Double file

another sign that your computer has malware is ____ _____ extension are being displayed i.e. textfile.txt.exe

endpoint

any device we use to connect to a network

Hybrid

approaches that combine quantitative and qualitative analysis are commonly used

Spyware

can get installed covertly when you install free software. The _____ then monitors your computer activity and may inventory what type of files or software you have installed. All of this can take its toll on performance over time.

Spectrum Analyzer tool

capture all of the radio frequencies that are openly available in the area.

C:\ net stop service

command line - stop service

§ 1. Remove temporary files by using Disk Cleanup § 2. Periodic system file checks § 3. Defragment your disk drive § 4. Back up your data § 5. Use and practice restoration techniques

delay failure of your hard drive by these 5 tips

Trojan Horse

delivery mechanism of ransomware

Public Key Infrastructure

describes a hierarchy of trusted certificates used for security.

Order of volatility

describes the fragility of digital evidence and, as a result, the order in which it should be gathered.

Asset Value x Exposure Factor; SLE=AV X EF

formula SLE

threats

hardening, Mitigate risk by minimizing vulnerabilities to reduce exposure to _____

Pass the hash and birthday attack

hashing attacks

Script kiddies

have limited skill and only run other people's exploits and tools

New Technology File System (NTFS)

highly recommended to use this file system; is the default file system format for Windows and is more secure because it supports logging, encryption, larger partition sizes, and larger file sizes than FAT32

key escrow

holds decryption keys in trust and is not related to the company, institution, or government agency that issued the keys. The keys can be used in the event of a catastrophe or because of legal requirements.

by encryption

how do protect your data's confidentiality?

o 1. Flash the BIOS o 2. Use a BIOS password o 3. Configure the BIOS boot order o 4. Disable the external ports and devices o 5. Enable the secure boot option

how do we secure the BIOS (5)

segment these devices off into their own network so they're not talking to the rest of the corporate network

how do you ensure security within your network when connecting IoT

vulnerability assessments are conducted often as a credentialed scan, where the tool can be provided with a username and password for the systems. This is going to provide you with an inside out look of your networks, just like a system administrator would see. Now, instead, a pentest is seeking to look at your networks as an attacker would, from the outside in.

how does a penetration test differ from a vulnerability assessment?

zone transfers should always be restricted between two known and trusted servers only and not let other people ask for zone transfers.

how to prevent Unauthorized zone transfers

§ 1. Use data encryption § 2. Use proper authentication § 3. Log NAS access

how to secure your NAS properly

860 TCP

iSCSI

3260 TCP

iSCSI Target

business impact analysis

identifies how personnel, data systems, clients, and revenue will be affected if a threat is realized.

Security audits

identify vulnerabilities and policy noncompliance.

CIA triad (Confidentiality, Integrity, Availability)

if we have all 3 then our data and information have good security

throttling/rate-limiting

in an API, Implement mechanisms _______to protect from a DoS

key

in an API, WARNING: Do not hardcode or embed a ______into the source code

● Something you know ● Something you are ● Something you have ● Something you do ● Somewhere you are

in the digital world, this is how you establish Authentication (5 - something)

Hybrid Cloud

includes two or more private, public, or community clouds, but each cloud remains separate and is only linked by technology that enables data and application portability

Insider Threat

is the most dangerous threat to organizational security; A person who works for or with your organization but has ulterior motives; Employees who steal your information are insider threats

Procedural Control

is the things that your organization chooses to do on their own

Certificate authorities (CAs)

issue, renew, and revoke PKI certificates and should be kept offline for increased security

sflow

it provides a means for exporting truncated packets, together with interface counters for the purpose of network monitoring

Rooting

jail brake is for mac; ______ is for android

backup

just like your computer, make sure your data on your phone is _________, data availability in case of mobile theft

applications

least functionality is also uninstalling unnecessary ________

functionality, ports and protocols

least functionality is restricting unneeded _____, _______, ______

§ Password complexity § Account lockout policy § Software restrictions § Application restrictions

local group policies contains rules 4

utilities>activity monitor

mac command to stop a program

Class D fires

made up of combustible metals like magnesium, titanium, and lithium; laptops have lithium batteries; yellow extinguisher

Server Cache Poisoning

malicious activity on a Domain Name System server that tries to subvert the name service used by the client. It aims to corrupt the records held by the DNS server, so the client queries fail.

RAIDs

provide redundancy and high-availability

Cipher Lock

provides excellent protection using a mechanical locking mechanism with push buttons that are numbered that require a person to enter the correct combination in order to open that door

APFS

recommended file system for OSX

risk of malware infection; data segmentation

risks of BYOD

Encryption

scrambles, or encrypts, data with a public key. A private key is used to decrypt the data.

Firewalls

screen traffic between two portions of a network

Windows Firewall

software based firewall available in Windows OS

privacy

some apps have location or gps services, turn it off to ensure _______

Privacy and Security

some organization block cookies because they are concerned about _____ & _______

retirement plan

sometimes includes as part of the maintenance migrate your product into a more supported version of OS

SPIM

spam instant messaging

FM-200 or even a CO2-based system

special hazard protection system in server room

Email servers

specialized computers whose sole function is to store, process, and send email; are a frequent target of attacks for the data they hold

IEEE 802.1x

standard is used in port-based NAC

port 1812

standard ports authentication

port 1813

standard ports authorization

ID theft or account takeover

stealing someone's identity (their personal information).

Adware

subcategory of spyware; Displays advertisements based upon its spying on you;

Public Key Infrastructure (PKI)

system uses digital certificates and a certificate authority to allow secure communication across a public network.

pre-action sprinkler

system will activate when heat or smoke is detected

Data Loss Prevention

systems can be used to help identify insider threats

Physical Security

tangible protection such as alarms, guards, fireproof doors, fences, and vaults

perimeter

the outside of the building ie gate, etc.

Bits

the smallest unit of data in a computer

Class A

10.0.0.0 to 10.255.255.255

o Closed Circuit TV (CCTV) o Pan Tilt Zoom (PTZ)

2 types of surveillance camera

Application Programming Interface (API)

A library of programming utilities used to enable software developers to access functions of another application o allow for the automated administration, management, and monitoring of a cloud service

Port

A logical communication endpoint that exists on a computer or server

Outbound Port

A logical communication opening created on a client in order to call out to a server that is listening for a connection

Memorandum of Understanding (MOU)

A non-binding agreement between two or more organizations to detail an intended common line of action; can be between multiple organizations

Time-based One Time Password (TOTP)

A password is computed from a shared secret and current time

HMAC-based One Time Password (HOTP)

A password is computed from a shared secret and is synchronized between the client and the server

Cain and Abel

A password recovery tool that can be used through sniffing the network, cracking encrypted passwords using dictionary, brute-force, and cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, and analyzing routing protocols

14

A password should be long, strong, and complex. This should require at least ___ characters with a mix of uppercase, lowercase, numbers, and special characters

Online Certificate Status Protocol (OCSP)

A protocol that allows you to determine the revocation status of a digital certificate using its serial number

Split Tunneling

A remote worker's machine diverts internal traffic over the VPN but external traffic over their own internet connection

Canonical Encoding Rules (CER)

A restricted version of the BER that only allows the use of only one encoding type

Multiparty

A risk that refers to the connection of multiple systems or organizations with each bringing their own inherent risks

Business Impact Analysis (BIA)

A systematic activity that identifies organizational risks and determines their effect on ongoing, mission critical operations; is governed by metrics that express system availability

PowerShell

A task automation and configuration management framework from Microsoft, consisting of a command-line shell and the associated scripting language

Auditing

A technical assessment conducted on applications, systems, or networks; is a detective control

Prepending

A technical method used in social engineering to trick users into entering their username and passwords by adding an invisible string before the weblink they click; (data:text) converts the link into a Data URI (or Data URL) that embeds small files inline of documents

Pass the Hash

A technique that allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LM hash instead of requiring the associated plaintext password

Vulnerability Scanning

A technique that identifies threats on the network without exploiting them

War Chalking

Act of physically drawing symbols in public places to denote the open, closed, and protected networks in range ; digitally is becoming more commonplace

Information Security

Act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure, corruption, and destruction

Information Systems Security

Act of protecting the systems that hold and process our critical data

more advanced

Active Directory domain controllers have a ________ ________ Group Policy Editor

Polymorphic

Advanced version of an encrypted virus that changes itself every time it is executed by altering the decryption module to avoid detection; complicated version of encrypted virus, it morphs itself

Gramm-Leach-Bliley Act (GLBA)

Affects banks, mortgage companies, loan offices, insurance companies, investment companies, and credit card providers

Health Insurance Portability and Accountability Act (HIPAA)

Affects healthcare providers, facilities, insurance companies, and medical data clearing houses

Sarbanes-Oxley (SOX)

Affects publicly-traded U.S. corporations and requires certain accounting methods and financial reporting requirements

Physical Controls

Alarm systems, locks, surveillance cameras, identification cards, and security guards

Elliptic Curve Cryptography (ECC)

Algorithm that is based upon the algebraic structure of elliptic curves over finite fields to define the keys § with a 256-bit key is just as secure as RSA with a 2048-bit key is most commonly used for mobile devices and low-power computing device

Wildcard Certificates

Allow all of the subdomains to use the same public key certificate and have it displayed as valid; are easier to manage

Subject Alternative Name (SAN)

Allows a certificate owner to specify additional domains and IP addresses to be supported

Public Key Pinning

Allows an HTTPS website to resist impersonation attacks by presenting a set of trusted public keys to the user's web browser as part of the HTTP header

test

Always ____a patch prior to automating its deployment

Fail Securely

Applications should be coded to properly conduct error handling for exceptions in order to fail securely instead of crashing

Zero Day

Attack against a vulnerability that is unknown to the original developer or manufacturer

SQL Injection

Attack consisting of the insertion or injection of an SQL query via input data from the client to a web application; most common type of injection attack

individually or combined

Attack framework models can be used _____ or ______

Teardrop Attack

Attack that breaks apart packets into IP fragments, modifies them with overlapping and oversized payloads, and sends them to a victim machine

Man-in-the-Middle (MITM)

Attack that causes data to flow through the attacker's computer where they can intercept or manipulate the data

Permanent Denial of Service

Attack which exploits a security flaw to permanently break a networking device by reflashing its firmware

Session Theft

Attacker guesses the session ID for a web session, enabling them to take over the already authorized session of the client

Fraggle Attack

Attacker sends a UDP echo packet to port 7 (ECHO) and port 19 (CHARGEN) to flood a server with UDP packets

scripted installations and baseline configuration templates

BEST PRACTICE: Utilize to secure ___________ ___________ and _______ _______ ________applications during installation

security issues

BYOD introduces a lot of _____ ______ to consider

poor coding

Backdoors are a ______ _______practice and should not be utilized

Vulnerability Assessment

Baselining of the network to assess the current security state of computers, servers, network devices, and the entire network in general

The access control policy is determined by the owner

Best Practices for Access Control

Content Filters

Blocking of external files containing JavaScript, images, or web pages from loading in a browser

symmetric

Blowfish and RC4 are both _____ algorithms.

processor-intensive

Botnets can be utilized in other _______ __________functions and activities

Block Cipher

Breaks the input into fixed-length blocks of data and performs the encryption on each block are easier to implement through a software solution

Advanced Security Options

Browser configuration and settings for numerous options such as SSL/TLS settings, local storage/cache size, browsing history, and much more

Password Spraying

Brute force attack in which multiple user accounts are tested with a dictionary of common passwords

Credential Stuffing

Brute force attack in which stolen user account names and passwords are tested against multiple websites

Issue-Specific Policies

Built to address a specific security issue, such as email privacy, employee termination procedures, or other specific issues

WPA2

CCMP and AES

WPA3 - Personal Mode

CCMP-128 as minimum encryption required for secure connectivity

policies

CORS policy can expose your site to vulnerabilities, such as cross-site scripting attacks. So, you want to be aware of this and you want to make sure that your _______ are written properly.

Keylogger

Captures keystrokes made by the victim and takes screenshots that are sent to the attacker

Building Automation System (BAS)

Components and protocols that facilitate the centralized configuration and monitoring of mechanical and electrical systems within offices and data centers; need to be segmented from your other network

Physical Access Control System (PACS)

Components and protocols that facilitate the centralized configuration and monitoring of security mechanisms within offices and data centers; can either be implemented as part of a building automation system or a separate system; are often installed and maintained by an external supplier and are therefore omitted from risk and vulnerability assessments by analysts

Managed Devices

Computers and other network-attached devices monitored through the use of agents by a network management system

Business Partnership Agreement (BPA)

Conducted between two business partners that establishes the conditions of their relationship; can also include security requirements

Center for Internet Security (CIS)

Consensus-developed secure configuration guidelines for hardening (benchmarks) and prescriptive, prioritized, and simplified sets of cybersecurity best practices (configuration guides)

Containment

Containment is focused on isolating the incident

Private Data

Contains data that should only be used within the organization

Data Remnants

Contents of a virtual machine that exist as deleted files on a cloud-based server after deprovisioning of a virtual machine

Network Media

Copper, fiber optic, and coaxial cabling used as the connectivity method in a wired network

Single Loss Expectancy (SLE)

Cost associated with the realization of each individualized threat that occurs

administrative or technical

Create and implement web browsing policies as an __________ control or _________control

Baseline

Created as reference points which are documented for use as a method of comparison during an analysis conducted in the future

RAID 10

Creates a striped RAID of two mirrored RAIDs (combines RAID 1 & RAID 0)

AP Isolation

Creates network segment for each client when it connects to prevent them from communicating with other clients on the network

storage segmentation

Creating a clear separation between personal and company data on a single device

Virtualization

Creation of a virtual resource

Virtual Network Computing (VNC)

Cross-platform version of the Remote Desktop Protocol for remote user GUI access; requires a client, server, and protocol be configured; Port 5900

Symmetric Algorithm (Private Key)

DES, 3DES, IDEA, AES, Blowfish, Twofish, RC4, RC5, RC6

53 TCP/UDP

DNS

Data in Transit

Data crossing the network or data that resides in a computer's memory

Logs

Data files that contain the accounting and audit trail for actions performed by a user on a computer or network

Bus Encryption

Data is encrypted by an application prior to being placed on the data bus; Ensures that the device at the end of the bus is trusted to decrypt the data

validation routines

Data received by an API must pass service-side _______ _____

forever

Data should never be stored ________

Top Secret Data

Data that could gravely damage national security if it were known to those who are not authorized for this level of information

Confidential Data

Data that could seriously affect the government if unauthorized disclosure were to happen

Secret Data

Data that could seriously damage national security if disclosed

Metadata

Data that describes other data by providing an underlying definition or description by summarizing basic information about data that makes finding and working with particular instances of data easier • Email • Mobile • Web • File

Open-Source

Data that is available to use without subscription, which may include threat feeds similar to the commercial providers and may contain reputation lists and malware signature databases

Closed-Source

Data that is derived from the provider's own research and analysis efforts, such as data from honeynets that they operate, plus information mined from its customers' systems, suitably anonymized

Create Secure Defaults

Default installations should include secure configurations instead of requiring an administrator or user to add in additional security

Policies

Defines the role of security in an organization and establishes the desired end state of the security program; are very broad

Exploit Technique

Describes the specific method by which malware code infects a target host

Processor Virtual Machine

Designed to only run a single process or application like a virtualized web browser or a simple web server

Cloud Security Alliance's Cloud Control Matrix

Designed to provide fundamental security principles to guide cloud vendors and to assist prospective cloud customers in assessing the overall security risk of a cloud provider

Procedures

Detailed step-by-step instructions that are created to ensure personnel can perform a given action

shift-left

DevSecOps utilizes a ________mindset § Integrate security from the beginning § Test during and after development § Automate compliance checks

SDLC Principles

Developers should always remember confidentiality, integrity, and availability; Threat modeling helps prioritize vulnerability identification and patching

Intrusion Detection System (IDS)

Device or software application that monitors a system or network and analyzes the data passing through it in order to identify an incident or attack

3868 TCP

Diameter

Onboarding and Offboarding Policy

Dictates what type of things need to be done when an employee is hired, fired, or quits; Terminated employees are often not cooperative

Job Rotation

Different users are trained to perform the tasks of the same position to help prevent and identify fraud that could occur if only one employee had the job

Asymmetric Algorithms

Diffie-Hellman, RSA, and ECC

Voice Over Internet Protocol (VoIP)

Digital phone service provided by software or hardware devices over a data network

Certificates

Digitally-signed electronic documents that bind a public key with a user's identity

3225 TCP/UDP

FCIP

Port 21 (TCP)

FTP

989/990 TCP

FTPS

NAT filtering

Filters traffic based upon the ports being utilized and type of connection

Clean Agent System

Fire suppression system that relies upon gas (HALON, FM-200, or CO2) instead of water to extinguish a fire

Web Application Firewall

Firewall installed to protect your server by inspecting traffic being sent to a web application § can prevent a XSS or SQL injection

BIOS- Basic Input/Output System

Firmware that provides the computer instructions for how to accept input and send output

Network Redundancy

Focused on ensuring that the network remains up; Redundant Internet connections

De-militarized Zone (DMZ)

Focused on providing controlled access to publicly available servers that are hosted within your organizational network; Sub-zones can be created to provide additional protection for some servers

Operational Controls

Focused on the things done by people

80 TCP

HTTP

443 TCP

HTTPS

IP Proxy

IP Proxy is used to secure a network by keeping its machines anonymous during web browsing

Blackholing or Sinkholing

Identifies any attacking IP addresses and routes all their traffic to a nonexistent server through the null interface

reboot the computer from an external device and scan it

If a boot sector virus is suspected, how will you detect and remove the malware

digital quarantine

If a device fails the inspection, it is placed into _____ ______

Fix Security Issues

If a vulnerability is identified then it should be quickly and correctly patched to remove the vulnerability

security

If we make operations easier, then _____is reduced

move

If you ______ a folder, then permissions are retained from its original permissions

Fuzzing

Injection of randomized data into a software program in an attempt to find system failures, memory leaks, error handling issues, and improper input validation

Human Machine Interface (HMI)

Input and output controls on a PLC to allow a user to configure and monitor the system

Injection Attack

Insertion of additional information or code through data input from a client to an applications: SQL,HTML, XML, LDAP

Packet filtering

Inspects each packet passing through the firewall and accepts or rejects it based on the rules

AntiVirus

Install ____

Subscriber Identity Module (SIM)

Integrated circuit that securely stores the international mobile subscriber identity (IMSI) number and its related key

Jamming

Intentional radio frequency interference targeting your wireless network to cause a denial of service condition § Wireless site survey software and spectrum analyzers can help identify _______

Public Branch Exchange (PBX)

Internal phone system used in large organizations

Transport Layer

Manages and ensures transmission of the packets occurs from a host to a destination using either TCP or UDP; Segments (TCP) or Datagrams (UDP)

Hybrid

Many companies are now marketing advanced threat protection (ATP), advanced endpoint protection (AEP), and NextGen AV (NGAV) which is a ______ of EPP, EDR, and UEBA

Directory Traversal

Method of accessing unauthorized directories by moving through the directory structure on a remote server

Internet Key Exchange (IKE)

Method used by IPSec to create a secure tunnel by encrypting the connection between authenticated peers

Threat Vector

Method used by an attacker to access a victim's machine; how we get into the machine- weakness of your machine

Open-Source Intelligence (OSINT)

Methods of obtaining information about a person or organization through public records, websites, and social media

Access Control

Methods used to secure data and information by verifying a user has permissions to read, write, delete, or otherwise modify it

137-139 TCP/UDP

NetBIOS

Lambda

Netflix is using this AWS _______ to essentially build this rule-based self-managing infrastructure that replaces a lot of the old inefficient processes.

Non-promiscuous Mode

Network adapter can only capture the packets directly addressed to itself

Promiscuous Mode

Network adapter is able to capture all of the packets on the network, regardless of the destination MAC address of the frames carrying them To capture the most information

regulatory, advisory, or informative

Policies may be (3)

Clean Desk Policy

Policy where all employees must put away everything from their desk at the end of the day into locked drawers and cabinets

Software as a Service (SaaS)

Provides all the hardware, operating system, software, and applications needed for a complete service to be delivered

Distinguished Encoding Rules (DER)

Restricted version of the BER which allows one encoding type and has more restrictive rules for length, character strings, and how elements of a digital certificate are stored in X.509

Software Compliance/Licensing

Risk associated with a company not being aware of what software or components are installed within its network

IP Theft

Risk associated with business assets and property being stolen from an organization in which economic damage, the loss of a competitive edge, or a slowdown in business growth occurs

Security Posture

Risk level to which a system or other technology element is exposed

Internal Risk

Risks that are formed within the organization, arise during normal operations, and are often forecastable

External Risk

Risks that are produced by a non-human source and are beyond human control

Implementation

SDLC phase that involves coding, debugging

445 TCP

SMB

Port 25 TCP

SMTP

465/587 TCP

SMTP with SSL/TLS

161 UDP

SNMP

162 TCP/UDP

SNMPTRAP

input validation and using least privilege

SQL injection is prevented through _________ _______when accessing a database

Port 22 TCP & UDP

SSH, SCP, SFTP

Technical Controls

Safeguards and countermeasures used to avoid, detect, counteract, or minimize security risks to our systems and information

Pre-Shared Key

Same encryption key is used by the access point and the client

physical, technical, or administrative

Security controls are categorized

virtualized runtime containers

Serverless is a software architecture that runs functions within _________ in a cloud rather than on dedicated server instances.

Load-balancing Cluster

Servers are clustered in order to share resources such as CPU, RAM, and hard disks

Remote Access Services (RAS)

Service that enables dial-up and VPN connections to occur from remote clients

malware code

Shellcode originally referred to _____ ______ that would give the attacker a shell (command prompt) on the target system (pentest exam)

Faraday Cage

Shielding installed around an entire room that prevents electromagnetic energy and radio frequencies from entering or leaving the room

Malware

Short-hand term for malicious software

Out-of-band communication

Signal that are sent between two parties or two device that are sent via a path or method different from that of the primary communication between the two parties or devices

UDP

Since syslog relied on ______, there can be delivery issues within congested networks

Add-Ons

Smaller browser extensions and plugins that provide additional functionality to the browser

DevOps

Software development and information technology operations

Spyware

Software that collects your information without your consent

Grayware

Software that isn't benign nor malicious and tends to behave improperly without serious consequences

Pop-up Blockers

Software that prevents pop-ups from sites that are unknown or untrusted and prevents the transfer of unwanted code to the local system.

Protocol Analyzer

Software tool that allows for the capture, reassembly, and analysis of packets from the network

Endpoint DLP System

Software-based client that monitors the data in use on a computer and can stop a file transfer or alert an admin of the occurrence; can be set to detection or prevention mode

collected

Some data can only be _______ once the system is shutdown or the power suddenly disconnected

Static Analysis

Source code of an application is reviewed manually or with automatic tools without running the code

open mail relays

Spammers often exploit a company's ____________ to send their messages

influence campaign

The collection of tactical information about an adversary as well as the dissemination of propaganda in pursuit of a competitive advantage over an opponent

least privilege

The concept of _______ states that only needed rights to perform a certain task should be given and no more.

Blue Team

The defensive team in a penetration test or incident response exercise

Packets

The defined block of information consisting of header, data, and trailer that serves as the information exchange method on the network.

Disaster Recovery Planning

The development of an organized and in-depth plan for problems that could affect the access of data or the organization's building • Fire • Flood • Long-term Power Loss • Theft or Attack • Loss of Building

Data Emanation

The electromagnetic field generated by a network cable or device when transmitting

Certificate Authority

The entity that issues certificates to a user; Verisign, Digisign, and many others act as Root CA

syslog-ng or rsyslog

The newer version of the server is called

Wireless Encryption

_____ of data in transit is paramount to security

Train

_____ users on proper security and use of the device

Multi-factor authentication

______ can help prevent successful replay attacks

Security education

______ is generalized training (like Security+)

Public Key Cryptographic System #12 (PKCS#12)

.p12

Privacy-enhanced Electronic Mail

.pem, .cer, .crt, or .key

Personal Information Exchange

.pfx

Degaussing

Exposes the hard drive to a powerful magnetic field which in turn causes previously-written data to be wiped from the drive

Spyware

Malware that secretly gathers information about the user without their consent

apps

Only install _____from the official mobile stores

1

X (Execute) in Linux

Microsoft, Symantec and crowdstrike

top 3 EPP

WPA3

was introduced in 2018 to strengthen WPA2 o has an equivalent cryptographic strength of 192-bits in ____ - Enterprise Mode; • Largest improvement in _______ is the removal of the Pre-Shared Key (PSK) exchange instead it uses Simultaneous Authentication of equals (SAE)

§ Limit static MAC addresses accepted § Limit duration of time for ARP entry on hosts § Conduct ARP inspection

ways to prevent MAC Spoofing

anonymous

well known hacktivist

Net use command

what command do you use to established null connection

Software Development Life Cycle

what does SDLC stands for?

off

when your not using your bluetooth, turn it ____

supplicant

which is the device or user that's requesting access to the network


Set pelajaran terkait

Chapter 70: Constipation/ Diarrhea

View Set

Quality and Evidence-Based Respiratory Care

View Set

Maternity and Women's Health Nursing - Women's Health

View Set

Social Studies - G 7 - Ch 3 Lesson 4 (new)

View Set

Cambridge Checkpoint Study Guide

View Set