Sec+ Remember This

MD5 Message Digest 5

A common hashing algorithm that produces a 128-bit hash and verifies integrity.

HMAC Hash-based message authentication code

A fixed-length string of bits that also uses a shared secret key to add randomness. Verifies integrity and authenticity of a message.

TPM Trusted Platform Module

A hardware chip on the motherboard included on many laptops and provides full disk encryption. Includes a unique RSA asymmetric key.

MTBF Mean time between failures

A measure of a system's reliability. (repairable)

HSM Hardware Security Module

A removable or external device that can generate, store, and manage RSA keys used in asymmetric encryption. Used by many server-based apps to protect keys.

DHE Diffie-Hellman

A secure method of sharing symmetric encryption keys over a public network.

Blowfish

A strong symmetric 64-bit block cipher that is widely used today. Supports key sizes between 32 and 448 bits. Faster than AES-256

AES Advanced Encryption Standard

A strong symmetric block cipher that encrypts data in 128-bit blocks. Uses 128-bit, 192-bit, or 256-bit keys. Selected as current standard and is much less resource intensive than 3DES.

RC4

A strong symmetric stream cipher that can use between 40 and 2,048 bit keys.

DES Data Encryption Standard

A symmetric block cipher that encrypts data in 64-bit blocks. Uses a relatively small key of 56-bits and can be broken with brute force attacks.

3DES Triple Data Encryption Standard

A symmetric block cipher that encrypts in 64-bit blocks and was designed as a replacement to DES. Uses key sizes of 56 bits, 112 bits, or 168 bits.

Ransomware

A type of malware that takes control of a user's system or data. Criminals then attempt to extort payment from the victim by threatening to damage user's system or data.

Vishing

A type of phishing that uses the phone or VoIP. Can be fully automated.

Increase Availability

Add fault tolerance and redundancies (RAID, failover clusters, backups, and generators). HVAC also important.

SAML Security Assertion Markup Language

An XML-based standard used to exchange authentication and authorization info between different parties. Provides SSO for web-based apps.

OCSP Online Certificate Status Protocol

An alternative to CRL, which returns answers such as good, revoked, or unknown.

RSA Rivest, Shamir, and Adleman

An asymmetric encryption method using both a public key and a private key in a matched pair. It's widely used to protect data such as email and other data transmitted over the internet.

Certificates

An important part of asymmetric encryption. Includes public keys along with details on the owner and on the CA that issued it. Owners share their public key by sharing a copy of this.

RAID Redundant array of inexpensive disks

An inexpensive method used to add fault tolerance and increase availability.

SHA Secure Hash Algorithm

Another common algorithm that consists of SHA-0, 1, 2, and 3.

Single Point of Failure

Any component whose failure results in the failure of an entire system. Elements such as RAID, failover clustering, UPSs, and generators remove many single points of failure.

Trojan

Appears to be something useful but includes a malicious component, such as installing a backdoor on a user's system. Can be delivered via drive-by downloads and can also infect from rogueware, pirated software, games, or infected USB drives.

Rogue Access Points

Are malicious and often used to capture and exfiltrate data. Provides access to unauthorized users.

Test Restores

Are the best way to test the integrity of a company's backup data. Backup media should be protected with the same level of protection as the actual data.

XSS Cross-site scripting

Attack allows attackers to capture user info such as cookies. Input validation at the server help mitigate threats.

DDoS Distributed Denial of Service

Attack consists of multiple computers attacking a single target. They typically include sustained, abnormally high network traffic.

DoS Denial of Service

Attack is from a single source that attempts to disrupt the services provided by another system.

WPA cracking

Attackers capture traffic with wireless sniffer waiting for client to connect so they can capture the four-way authentication handshake info. Brute force is then used to discover passphrase.

Honeypots & Honeynets

Attempt to divert attackers from live networks and allow security personnel to observe and gather intel on attack methodologies.

Transitive Access Attack

Attempts to access a back-end server through another server. Example is SQL Injection Attack.

LDAP Injection Attack

Attempts to access or modify data hosted on directory service servers.

MTTR Mean time to recover

Average time it takes to restore a failed system.

Full Backup

Backs up all data specified, but takes a long time and can interfere with operations. It can also be quite expensive purchasing the required media.

Bcrypt

Based on Blowfish used on Unix and Linux to protect passwords by salting password with additional bits before encrypting with Blowfish. Key stretching technique to help prevent brute force and rainbow table attacks.

LDAP Lightweight Directory Access Protocol

Based on earlier version of X.500. Used to identify objects in query strings with codes. Secure version encrypts with SSL or TLS.

Rule-BAC Rule-based Access Control

Based on set of approved instructions, such as ACL. Rules trigger in response to event.

Forensic Image

Bit-by-bit copy of data which is not modified during the capture to preserve the original and maintain usability as evidence. Hashing provides integrity for captured images.

Web Security Gateway & UTM

Both combine multiple security controls into single appliance. Inspect data streams and include URL filtering, malware inspection, and content inspection components.

Certificate Revocation

CAs revoke certificates when private key is compromised, if CA is compromised, or when an employee leaves.

Hot Spot Configuration

Can be completed with WEP and Open System Authentication or security disabled so that users do not need a pre-shared key.

WAP range

Can be limited by reducing WAPs power level.

Metrics

Can be used to prove the success of a training or security awareness program by comparing incidents before and after the training.

Anomaly-based IDSs

Can detect unknown anomalies. Start with baseline of normal behavior and sends alert when traffic significantly differs.

Network-based DLP

Can examine and analyze network traffic and detect if confidential or any PII data is included in email.

Port Scanner

Can help determine what services and protocols are running on a remote system by identifying open ports.

Vulnerability Scanner

Can identify vulnerabilities, misconfigured systems, and the lack of security controls such as up-to-date patches. Scans are passive and have little impact on a system during a test.

HIDS Host-based intrusion detection system

Can monitor all traffic on single host and may detect malicious activity missed by antivirus software.

Endpoint DLP

Can prevent users from copying or printing sensitive data

RAID-5

Can survive the failure of one disk.

RAID-6

Can survive the failure of two disks.

Replay Attacks

Capture data in a session with the intent of later impersonating one of the parties in the session. Timestamps and sequence numbers are effective countermeasures.

XSRF Cross-site request forgery scripting

Causes users to perform actions on web sites, such as making purchases, without their knowledge. Can be used to steal cookies and harvest passwords.

Wireless Audit

Checks wireless signal footprint, power level, antenna placement, and encryption of wireless traffic. Use war driving to detect rogue access points and identify unauthorized users.

Door Access Systems

Cipher locks (don't identify), proximity cards (with pin = identify and authenticate), biometrics (identify and authenticate).

Security Controls

Classified as technical, management, and operational

SaaS Software as a Service

Cloud-based technologies provides software or applications to users over a network such as the internet. (Web-based email)

Warm Site

Combo of hot and cold site.

Communication Plan

Commonly included in BCPs and DRPs. Identifies alternate methods of comm, such as war room or push-to-talk phones. Also identifies who must be contacted, such as response team members, employees, suppliers, customers, media, and regulatory agencies.

ECC Elliptical Curve Cryptography

Commonly used with small wireless devices since it doesn't take much processing power to achieve desired security.

Dual-Factor Authentication

Consists of two different factors: Users have something (smart card) and know something (pin)

SLE Single loss expectancy

Cost of a single loss.

SHA-1

Creates 160-bit hashes and verifies integrity.

IPsec Internet Protocol Security

Creates secure tunnels for VPNs. Built into IPv6 and can encrypt any type of IPv6 traffic. Uses Internet Key Exchange (IKE) over port 500. Identified with protocol ID 50 for ESP. Must use HMAC for authentication and integrity. Uses AES or 3DES for encryption with ESP(encrypt entire packet).

Account Disablement

Data and security keys associated with account remain available which are no longer accessible if the account is deleted.

Forensic Analysis

Data should be collected from the most volatile to the least volatile. Order: cache memory, regular RAM, swap or paging file, hard drive data, logs stored on remote systems, and archived media.

Incident Response Policy

Defines an incident and incident response procedures. Starts with preparation to prevent incidents.

Change Management

Defines the process and accounting structure for handling modifications and upgrades. Goals are to reduce risks related to unintended outages and provide documentation for all changes.

Antivirus Software

Detects and removes malware, such as viruses, Trojans, and worms. Signature-based detects known malware and heuristic-based detects previously unknown malware.

Vulnerability Assessment

Determines the security posture of a system or network by identifying vulnerabilities and weaknesses.

Port Security

Disable unused ports, limit MAC addresses per port. Prevents rogue devices from connecting.

SYN Flood Attack

Disrupts the TCP initiation process by withholding the third packet of the TCP three-way handshake. Flood guards protect against these types of attacks.

Mobile Site

Do not have dedicated locations but can provide temporary support during a disaster.

Stream Ciphers

Encrypt data a single bit, or single byte, at a time in a stream. More efficient than block ciphers.

Block Ciphers

Encrypt data in a specific-sized block such as 64-bit or 128-bit blocks. Not as efficient as stream ciphers.

Digital Signature

Encrypted hash of a message. Sender's private key encrypts and recipient uses sender's public key to decrypt. Provides authentication (ID sender), non-repudiation (prevents denial), and integrity (verifies message).

SSH

Encrypts FTP as SFTP and TCP wrappers using port 22. Used with SCP (Secure copy) to copy encrypted files over network.

SSL Secure Sockets Layer

Encrypts traffic such as SMTP and LDAP with use of certificates. Used by FTPS (File Transfer Protocol Secure) to encrypt FTP traffic.

TLS Transport Layer Security

Encrypts with use of certificates. Designed as replacement for SSL.

SSO Single Sign-on

Enhances security by requiring users to use and remember only one set of credentials for authentication. One set of credentials used throughout user's session.

Succession Planning

Ensures an organization can continue to thrive even if key leaders unexpectedly leave or are unavailable.

Design Review

Ensures systems and software are developed properly.

Logic Bomb

Executes in response to an event, such as when a specific application is executed or a specific time arrives.

Proxy

Forwards requests from client. Provides caching to improve performance and reduce bandwidth usage. Can filter URLs and log activity.

Full/Differential Backup

Full backup followed by differential back up covering several days. Reduce the amount of time needed to perform backups.

Full/Incremental Backup

Full backup followed by incremental back ups each day. Reduce the amount of time needed to perform backups.

Preventive Controls

Hardening systems, security guards, change management process, account disablement policy.

WEP

Has several weaknesses and shouldn't be used. Includes use of weak IVs (initialization vector) to create encryption keys as opposed to RC4 symmetric encryption protocol.

White Box Testers

Have full knowledge of the system prior to a pentest.

Gray Box Testers

Have some knowledge of the system prior to a pentest.

Rootkits

Have system-level or kernel-level access and can modify system files and system access. They can hide their running processes to avoid detection with hooking techniques and tools that can inspect RAM can discover these hidden hooked processes.

Black Box Testers

Have zero prior knowledge of the system prior to a pentest. Often use fuzzing.

Routine Audits

Help an organization ensure they are following their policies, such as principle of lest privilege and account management best practices.

Error & Exception Handling

Helps protect the integrity of the OS and controls errors shown to users. Apps should show generic error message but detailed log info.

Steganography

Hides messages or other data within a file. Hashing is used to detect if steganography has been used.

Password History

History of 24 remembers the last 24 passwords.

ARO Annual rate of occurrence

How many times the loss will occur in a year.

Sniffing

IDS & IPS capability

Application Whitelisting

Identifies authorized software for workstations, servers, and mobile devices. Prevents users from installing or running software that isn't approved.

Signature-based Detection

Identifies issues based on known attacks or vulnerabilities and known anomalies .

BIA Business Impact Analysis

Identifies systems and components that are essential to the organization's successes. It also identifies maximum downtime limits for these systems and components, various scenarios of impact, and potential losses.

RTO Recovery Time Objective

Identifies the maximum amount of time it should take to restore a system after an outage. It's derived from the maximum allowable outage time identified in the BIA.

SSID Service set identifier

Identifies the name of the wireless network and should be changed from the default name. Disabling the broadcast can hide network from casual users, but can be discover by an attacker with a wireless sniffer.

WPA

Immediate replacement for WEP and used TKIP and RC4 for older hardware compatibility.

Group Policy

Implemented on a domain controller within a domain and is used to create password policies, lock down GUI, configure host-based firewalls, etc.

DIAMETER

Improvement over RADIUS supporting additional capabilities including securing transmissions with EAP.

Backup Best Practices

Include storing a copy off-site for retention purposes, labeling media, performing test restores, and destroying media when it is no longer usable.

DNS Domain Name Server

Includes A records for IPv4 and AAAA records for IPv6 addresses. Uses TCP port 53 for zone transfer and UDP port 53 for client queries. Most run BIND software on Linux or Unix Servers.

Transport Encryption

Includes SSH, IPSec, HTTPS, SSL, and TLS to protect the confidentiality of data transmitted over a network.

DRP Disaster Recovery Plan

Includes a hierarchical list of critical systems and often prioritizes services to restore after an outage. Testing validates the plan and the final phase includes a review to identify any lessons learned and possible plan update.

CRL Certificate revocation list

Includes a publicly available list of revoked certs.

Mobile Device Security

Includes device encryption, screen locks, and remote wipe.

NAC Network Access Control

Includes methods to inspect clients for health (up to date antivirus software). Can restrict access of unhealthy clients to remediation network. Can be used for VPN clients and for internal clients.

SHA-3

Includes multiple versions with hashes of 224, 256, 384, and 512 bits.

Hot Site

Includes personnel, equipment, software, and comm capabilities of the primary site with all the data up to date. Provides shortest recovery time and is the most effective disaster recovery solution but also the most expensive.

SHA-2

Includes versions consisting of 224, 256, 384, and 256 hashes. Each number represents the number of bits in the hash. Verifies integrity.

Load Balancing

Increases the overall processing power of a service by sharing the load among multiple servers. Also ensure availability when a service has an increased number of requests.

NIDS Network-based intrusion detection system

Installed on network devices to monitor traffic and detect attacks. It cannot monitor encrypted traffic or monitor traffic on individual hosts.

Twofish

Is a symmetric 128-bit block cipher and supports 128, 192, or 256-bit keys.

Pentest

Is an active test that can assess deployed security controls and determine impact of threat. It starts with vulnerability scan then tries to exploit the vulnerabilities by attacking or simulating an attack. It is obtrusive and can potentially compromise a system.

MTTF Mean time to failure

Length of time you can expect a device to remain in operation before it fails. (nonrepairable)

Risk

Likelihood that threat will exploit a vulnerability.

Detective Controls

Log monitoring, trend analysis, security audits, CCTV systems

Phishing

Malicious spam used to trick into revealing personal info or clicking on a link.

Written Security Policies

Management controls that identify a security plan. Technical, operational, and additional management controls enforce securtiy policies.

Spyware

Monitors a user's computer.

CHAP Challenge Handshake Authentication Protocol

More secure than PAP in that it doesn't send info in clear text. Uses PPP.

Enterprise Mode

More secure than personal mode. Uses 802.1X server (RADIUS server) to add authentication

Discovery Mode

Must be disabled to provide protection for Bluetooth devices.

Kerberos

Network authentication protocol within MS Active Directory Domain. Issues time stamped tickets that expire after a certain time period. Uses UDP port 88.

False Negative

Network doesn't detect active attack.

Buffer Overflow

Occurs when app receives more data than it can handle, or receives unexpected data that exposes system memory.

Data Leakage

Occurs when users install P2P software and unintentionally share files. P2P software is often blocked on an organization's firewall.

Failover Clusters

One method of server redundancy that provides high availability for servers. Can remove a server as a single point of failure.

HOTP HMAC-based One-time password

Password that does not expire. Open source standard.

TOTP Time-based one-time password

Password that expires after 30 seconds. Open source standard.

WPA2

Permanent replacement for WEP and WPA supporting stronger AES encryption algorithm. Supports CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol).

Separation of Duties

Prevents any single person or entity from being able to complete all the functions of a critical or sensitive process by dividing the tasks between employees. Helps prevent fraud that can occur if a single person prints and signs checks.

EMI Shielding Electromagnetic interference shielding

Prevents outside interference sources from corrupting data and prevents data from emanating outside the cable.

Security Awareness

Primary goal is to reinforce user compliance with security policies and help reduce risks posed by users.

LEAP Lightweight EAP

Proprietary to Cisco and does not require a digital cert.

Account Lockout

Protects against brute force attacks.

Full Disk Encryption

Protects entire disks, including USB flash drives and drives on mobile devices.

Data Column Encryption

Protects individual fields within a database.

Host-based Firewall

Provide protection for individual hosts. Linux systems support xtables.

Baseline Reporting

Provides a report after comparing baselines with current systems. Can be used for security baselines, operating system baselines, application configuration baselines, and software baselines.

Backdoor

Provides another way of accessing a system created by many types of malware.

RADIUS Remote Authentication Dial-In User Service

Provides centralized authentication.

Encryption

Provides confidentiality and helps ensure that data is viewable only by authorized users.

ESP Encapsulating Security Payload

Provides confidentiality, integrity, and authentication for VPN traffic.

PaaS Platform as a Service

Provides customers with a fully managed platform, which the vendor keeps up to date with current patches.

IaaS Infrastructure as a Service

Provides customers with access to hardware in a self-managed platform where customers are responsible for keeping up to date.

UPS Uninterruptible power supply

Provides fault tolerance for power and can protect against power fluctuations. Provides short-term power. Generators provide long-term power.

Virtualization

Provides increased availability with lower operating costs and high level of flexibility when testing security controls, updates, and patches since they can be easily reverted with snapshots.

Host software baseline

Provides list of approved software and a list of software installed on systems. Can be used to identify unauthorized software.

POP3 Post Office Protocol v3

Receives email on port 110.

Email Encryption

Recipient's public key encrypts and recipient's private key decrypts.

Recovery Agents

Recover user messages and data when users lose access to their private keys. In some cases, they can recover the private key from a key escrow.

Pharming Attack

Redirects a web site's traffic to another site and can do so by modifying the hosts file on the user's system.

Wildcard Certs

Reduce the management burden associated with certificates.

Humidity Controls

Reduce the potential for damage from electrostatic discharge and damage from condensation.

RPO Recovery Point Objective

Refers to the amount of data you can afford to lose.

PEAP & EAP-TTLS Protected EAP and EAP Tunneled TLS

Require a cert on the 802.1x server

Job Rotation Policies

Require employees to change roles on a regular basis to help ensure they cannot continue with fraudulent activities.

EAP-TLS Extensible Authentication Protocol-TLS

Requires certs on both the 802.1x server and each of the clients

Mandatory Vacation Policy

Requires employees to take time away from their job. Also helps to deter fraud and discover malicious activities while the employee is away.

Clean Desk Policy

Requires users to organize their areas to reduce the risk of possible data theft. Reminds users to secure sensitive data and may include a statement about not writing down passwords.

ARP Address Resolution Protocol

Resolves MAC addresses to IPv4

MAC filtering

Restricts access to wireless networks to specific clients. Attacker can use sniffer to discover allowed MAC addresses and spoof MAC address.

Code Review

Reviews software line-by-line to identify potential vulnerabilities such as race conditions or susceptibility to buffer overflow attacks.

Evil Twin

Rogue access point using same SSID as legitimate access point.

ALE Annual loss expectancy

SLE x ARO

SMTP Simple Mail Transfer Protocol

Sends email on TCP port 25

Fuzzing

Sends random strings of data to apps looking for vulnerabilities. Admin uses this technique to test apps, while attackers use it to detect attack methods.

Typo Squatting

Similar domain names used for malicious purposes.

NDP Neighbor Discovery Protocol

Similar to ARP with IPv6

IPS Intrusion Prevention System

Similar to IDS except it is placed in-line with traffic. Can actively monitor data streams, detect malicious content and stop attacks in progress. Can be used internally to protect private networks.

Standardized Image

Snapshot of a single system used to streamline deployments allowing for a secure starting point and reduced cost. Used as baseline to identify anomalies.

Authentication

Something you know(password or pin = weakest factor). Can also be something you are such as biometrics (strongest) and something you have (smart card, token). User proves claimed identity (password or pin) and credentials are verified.

DAC Discretionary Access Control

Specifies that every object has an owner, and owner has full, explicit control of object. MS NTFS uses this.

Incremental Backup

Starts with full backup, then only backs up data that has changed or is different since the last full backup or last incremental backup.

Differential Backup

Starts with full backup, then only backs up data that has changed or is different since the last full backup.

Whaling

Targets high-level executives.

Spear Phishing

Targets specific groups of users. Digital signatures provide assurances as to who sent the email and if its valid.

CSR Certificate signing request

The first step to create a RSA-based private key, which is used to create a public key. The public key is included in this and after the CA validates your identity, embeds the public key in the certificate.

Hardening

The practice of making an OS or application more secure from its default installation.

Key Escrow

The process of placing a copy of a private key in a safe environment useful for recovery.

COOP Continuity of operations planning

These sites provide an alternate location for operations after a critical outage. Most common sites are hot, cold, warm, and mobile.

PKI Public Key Infrastructure

This requires a trust model between CAs. Most trust models are hierarchical and centralized with a central root CA.

NAT Network Address Translation

Translates public IP addresses to private and private back to public. Dynamic version uses multiple public IP addresses and PAT uses single public IP address.

Smurf Attacks

Typically use directed broadcasts to launch through amplifying networks. Disabling directed broadcasts on routers can mitigate this threat.

Bluesnarfing

Unauthorized access to or theft of info from Bluetooth device.

Bluejacking

Unauthorized sending of text messages to nearby Bluetooth device.

Zero-day Exploits

Undocumented and unknown to the public.

Spam

Unwanted email.

Technical Controls

Use technology to reduce vulnerabilities. Includes encryption, antivirus software, IDSs, firewalls, and principle of least privilege. Also motion detectors and fire suppression.

PBKDF2

Used by WPA2, Apple iOS, and Cisco to increase security of passwords. Adds a salt of at least 64-bits. Key stretching technique to help prevent brute force and rainbow table attacks.

Omnidirectional Antenna

Used by most WAPs to transmit and receive signals in all directions at the same time.

L2TP Layer 2 Tunneling Protocol

Used for VPNs and commonly combined with IPSec. Uses UDP port 1701.

Isolation Mode

Used in an access point to prevent clients from connecting to each other. Sometimes used in public networks to protect wireless clients.

Yagi Antenna

Used to connect two WAPs together since it can focus into a single direction while also increasing gain and reducing the radiation pattern.

Public Key

Used to decrypt info encrypted with a matching private key.

Private Key

Used to decrypt info encrypted with a matching public key.

SNMP Simple Network Management Protocol

Used to manage and monitor network devices via UDP ports 161 and 162.

SQL Injection Attack

Used to pass queries to back-end databases through web servers. Input validation and stored procedures reduce threat. It's an example of a transitive access attack that can bypass many other security controls.

Identification

User claims identity such as username or email address

Switch Loop Protection

Uses STP or RSTP to protect against

PPTP Point-to-Point Tunneling Protocol

Uses TCP port 1723

Client-side Attack

Uses an app on the client computer, such as a web browser.

ECDHE Elliptical Curve Diffie-Hellman Ephemeral

Uses ephemeral keys generated using ECC.

Armored Virus

Uses one or more technologies to make it difficult to reverse engineer. Common techniques include using complex code, using encryption, or hiding the location.

PAP Password Authentication Protocol

Uses password or pin to send info across network in clear text making it susceptible to sniffing attacks. Uses PPP.

IMAP4 Internet Message Access Protocol version 4

Uses port 143

Role-BAC Role-based Access Control

Uses roles based on jobs and functions.

Symmetric Encryption

Uses same key to encrypt and decrypt data. Used by RADIUS.

MAC Mandatory Access Control

Uses sensitivity labels for users and data such as classification levels and clearances.

Quantitative Risk Assessment

Uses specific monetary amounts to identify cost and asset values. Uses judgment to categorize risks based on probability and impact. ALE = SLE x ARO

Asymmetric Encryption

Uses two keys in a matched pair to encrypt and decrypt data. Require a certificate and a PKI.

HMAC-MD5

Verifies integrity and authenticity. Creates 128-bit hashes. Used by IPSec and TLS.

HMAC-SHA1

Verifies integrity and authenticity. Creates 160-bit hashes. Used by IPSec and TLS.

Hashing

Verifies integrity for data such as email, downloaded files, and files stored on a disk. It is a number created with an algorithm. It's a one way function that cannot be reversed to re-create the original file.

Input Validation

Verifies validity of inputted data before using it. Server-side validation is more secure than client side. Lack of this is the most common security issue on web-based apps.

Digital Signatures

Verify integrity of emails and files. Require certs that provide authentication and non-repudiation

Personal Mode

WPA-PSK & WPA2-PSK. A mode that uses a pre-shared key and does not provide individual authentication.

Web site Encryption

Web site's public key encrypts (symmetric key), web site's private key decrypts (asymmetric), and the symmetric key encrypts the data in the web session.

False Positive

When an alert or alarm is actually harmless. Ex: scan detects a vulnerability, but vulnerability doesn't exist.

Cold Site

Will have power and connectivity needed for COOP activation, but little else. Least expensive and the hardest to test.

Implicit Deny

deny any any. Forces firewall to block any traffic not previously allowed in ACL. Used on routers and firewalls as last rule on ACL.

Protocol Analyzer

(aka sniffer) Used by admin to capture, display, and analyze packets sent over a network. Useful as troubleshooting tool for comm problems between systems and to detect attacks that manipulate or fragment packets. To capture traffic, NIC must be in promiscuous mode.