Meow's General - CyberSec Appendix A

CyberSec Appendix A

• CyberSec Appendix A
  • Overview
  • Number
  • A
  • B
  • C
  • D
  • E
  • F
  • G
  • H
  • I
  • J
  • K
  • L
  • M
  • N
  • O
  • P
  • Q
  • R
  • S
  • T
  • U
  • V
  • W
  • X
  • Z
  • Key Takeaways
  • References

---

Overview

A comprehensive A-Z glossary of CompTIA Security+ terminology. Terms in red are key defined terms. Terms in blue are core concepts or related references. Terms in orange are comparison targets.

---

Number

• **3DES**

  —Triple Digital Encryption Standard. A symmetric algorithm used to encrypt data and provide confidentiality. Block cipher, encrypts data in 64-bit blocks.

---

A

• **AAA**

  —Authentication, authorization, accounting. A group of technologies used in remote access systems.

  • Authentication

    verifies a user’s identification.

  • Authorization

    determines if a user should have access.

  • Accounting

    tracks / records a user’s access / activity with logs. One method is audit logs that create an audit trail.

  • Sometimes called AAAs of security.
• **ABAC**

  —Attribute-based access control. An access control model that grants access to resources based on attributes assigned to subjects and objects. Uses policies.

• **Acceptable use policy (AUP)**

  —A policy defining proper system usage and the rules of behavior for employees. Describes the purpose of computer systems and networks, how users can access them, and the responsibilities of users.

• **Access point (AP)**

  —A device that connects wireless clients to wireless networks. Also called wireless access point (WAP).

• **accounting**

  —The process of tracking the activity of users and recording this activity in logs. One method is audit logs that create an audit trail.

• **ACLs**

  —Access control lists. Lists of rules used by routers and stateless firewalls. Control traffic based on networks, subnets, IP addresses, ports, and protocols.

• **active reconnaissance**

  /rɪ’kɒnɪs(ə)ns/—A penetration testing method. Sends data to systems and analyzes responses to gain information on the target. Compare with passive reconnaissance.

• **ad hoc mode**

  無線隨意網路—A connection mode where wireless devices connect to each other without an AP.

  • infrastructure mode

    : wireless devices connect through an AP.

• **administrative controls**

  —Security controls implemented via administrative or management methods.

• **AES**

  —Advanced Encryption Standard. A strong symmetric block cipher that encrypts data in 128-bit blocks. Key sizes: 128, 192, or 256 bits.

• **Affinity**

  姻亲关系；类同—A scheduling method used with load balancers. Uses the client’s IP address to ensure the client is redirected to the same server during a web session.

  • round-robin

    : allows a load balancer to send requests to servers one after another.

• **Aggregation switch**

  —A switch used to connect multiple switches together into a network. Switches connect to the aggregation switch → connects to a router.

• **Agile**

  /’ædʒaɪl/—A software development life cycle model that focuses on interaction between customers, developers, and testers. Compare with waterfall.

• **AH**

  —Authentication Header. An option within IPsec to provide authentication and integrity.

• **Airgap**

  —A physical security control, provides physical isolation. Systems separated by an airgap don’t have physical connections to other systems.

• **ALE**

  —Annual (annualized) loss expectancy /’ɪk’spekt(ə)nsɪ/. The expected loss for a year. Used to measure risk with ARO and SLE in a quantitative /'kwɒntɪ,tətɪv/ risk assessment. Calculation: SLE × ARO = ALE.

• **amplification attack**

  —An attack that increases the amount of bandwidth sent to a victim.

• **Anomaly**

  不规则—A type of monitoring on IDS/IPS systems. Detects attacks by comparing operations against a baseline. Also known as heuristic /ˌhjʊ(ə)'rɪstɪk/ detection.

• **ANT**

  —A proprietary /prə’praɪət(ə)rɪ/ wireless protocol used by some mobile devices. Not an acronym.

• **antispoofing**

  —A method on some routers to protect against spoofing attacks. Implements specific rules to block certain traffic.

• **antivirus**

  —Software that protects systems from malware. Protects against viruses, Trojans, worms, and more.

• **application blacklist**

  —A list of applications that a system blocks. Users are unable to install or run any applications on the list.

• **application cell / application containers**

  —A virtualization technology that runs services or applications within isolated containers. Each container shares the kernel of the host.

• **application whitelist**

  —A list of applications that a system allows. Users are only able to install or run applications on the list.

• **APT**

  —Advanced persistent threat. A group that has both the capability and intent to launch sophisticated and targeted attacks.

• **ARO**

  —Annual (annualized) rate of occurrence. The number of times a loss is expected to occur in a year. Used with ALE and SLE in a quantitative risk assessment.

• **arp**

  —A command-line tool used to show and manipulate the Address Resolution Protocol (ARP) cache.

• **ARP poisoning**

  —An attack that misleads systems about the actual MAC address of a system.

• **asset value**

  —An element of a risk assessment. Identifies the value of an asset — monetary or subjective.

• **asymmetric encryption**

  —A type of encryption using two keys to encrypt and decrypt data. Uses a public key and a private key. Compare with symmetric encryption.

• **attestation**

  —A process that checks and validates system files during the boot process. TPMs sometimes use remote attestation, sending a report to a remote system.

• **audit trail**

  足迹—A record of events recorded in one or more logs. Security professionals can re-create events that occurred leading up to a security incident.

• **authentication**

  —The process that occurs when a user proves an identity, such as with a password.

• **authorization**

  —The process of granting access to resources for users who prove their identity, based on their proven identity.

• **availability**

  —One of the three main goals of the CIA security triad. Ensures systems and data are up and operational when needed. Compare with confidentiality and integrity.

---

B

• **backdoor**

  —An alternate method of accessing a system. Malware often adds a backdoor after it infects a system.

• **background check**

  —A check into a person’s history, typically to determine eligibility /ˌelidʒə’biləti/ for a job.

• **Backscatter analysis of DoS Attack**

  —Backscatter 本意是用來指涉反向散射的電磁波, 粒子或者訊號. 對於阻斷服務攻擊, 攻擊者經常修改封包當中的來源位址並送給網路中想要攻擊的對象, 被攻擊的機器無法分辨此來源位址的真偽而根據協定內容將回應封包傳送給此來源位址, 此回應的封包即稱為 backscatter. 藉著分析這些回應封包的來源位址可定序阻斷服務攻擊的特徵值, 此之謂 backscatter analysis.

• **banner grabbing**

  —A method used to gain information about a remote system. Identifies the operating system and other details on the remote system.

• **bcrypt**

  —A key stretching algorithm. Protects passwords by salting passwords with additional bits before encrypting them with Blowfish. Thwarts /θwɔːt/ rainbow table attacks.

• **BIOS**

  —Basic Input/Output System. A computer’s firmware used to manipulate settings (date/time, boot drive, access password). UEFI is the designated /’dɛzɪg,net/ replacement.

• **birthday**

  —A password attack named after the birthday paradox /’pærədɒks/ 悖论 in probability theory. The paradox states that for any random group of 23 people, there is a 50% chance that 2 share a birthday.

• **black box test**

  —A type of penetration test. Testers have zero knowledge of the environment. Compare with gray box test and white box test.

• **block cipher**

  —An encryption method that encrypts data in fixed-sized blocks. Compare with stream cipher.

• **Blowfish**

  —A strong symmetric block cipher. Encrypts data in 64-bit blocks, key sizes 32–448 bits. Compare with Twofish.

• **bluejacking**

  —Attack against Bluetooth: sending unsolicited /ʌnsə’lɪsɪtɪd/ messages to nearby Bluetooth devices.

• **bluesnarfing**

  —Attack against Bluetooth: unauthorized access to Bluetooth devices, can access all data on the device.

• Bluesmacking 猛烈地: simple denial-of-service attack against the device.

• Bluesniffing: to discover Bluetooth-enabled devices, like war driving in wireless hacking.

• Bluebugging: Successfully accessing a Bluetooth-enabled device and remotely using its features. Gaining full access to the phone, the attacker installs a backdoor. Can listen in on phone conversations, enable call forwarding, send messages.

• Blueprinting: footprinting for Bluetooth — involves collecting device info over Bluetooth.

• **bollards**

  /’bɒlɑːd/—Short vertical posts that act as a barricade /ˌbærɪ’keɪd/. Block vehicles but not people.

• **bots**

  —Software robots that function automatically. A botnet is a group of computers joined together. Attackers use malware to join computers to a botnet and use it to launch attacks.

• **BPA**

  —Business partners agreement. A written agreement detailing the relationship between business partners, including their obligations.

• **bridge**

  —A network device used to connect multiple networks together. Can be used instead of a router in some situations.

• **brute force**

  —A password attack that attempts to guess a password.

  • Online brute force attacks guess passwords of online systems.
  • Offline attacks guess passwords contained in a file or database.
• **buffer overflow**

  —An error that occurs when an application receives more input, or different input, than it expects. Exposes system memory that is normally inaccessible.

• **business impact analysis (BIA)**

  /ə’nælɪsɪs/—A process that helps an organization identify critical systems and components essential to the organization’s success.

• **BYOD**

  —Bring your own device. A mobile device deployment model. Employees connect their personally owned device to the network. Compare with COPE (corporate-owned, personally enabled) and CYOD (choose your own device).

---

C

• **CA**

  —Certificate Authority. An organization that manages, issues, and signs certificates. A CA is a main element of a PKI.

• **CAC**

  —Common Access Card. A specialized smart card used by the U.S. Department of Defense. Includes photo identification and provides confidentiality, integrity, authentication, and non-repudiation.

• **Captive portal**

  俘虏入口—A technical solution that forces wireless clients using web browsers to complete a process before accessing a network. Often used to ensure users agree to an AUP or pay for access.

• **carrier unlocking**

  —The process of unlocking a mobile phone from a specific cellular /’seljʊlə/ provider.

• **CBC**

  —Cipher Block Chaining. A mode of operation that effectively converts a block cipher into a stream cipher. Uses an initialization vector (IV) for the first block; each subsequent block is XOR’d with the previous ciphertext block.

• **CCMP**

  —Counter Mode with Cipher Block Chaining Message Authentication Code Protocol. Encryption protocol based on AES and used with WPA2. More secure than TKIP.

• **CER**

  —Canonical Encoding Rules /kə’nɒnɪk(ə)l/ 权威的. A base format for PKI certificates. Binary encoded files. Compare with DER (Distinguished Encoding Rules).

• **certificate**

  —A digital file used for encryption, authentication, digital signatures, and more. Public certificates include a public key used for asymmetric encryption.

• **certificate chaining**

  —A process that combines all certificates within a trust model. Includes all certificates in the trust chain from the root CA down to the end user.

• **chain of custody**

  /’kʌstədɪ/—A process that provides assurances that evidence has been controlled and handled properly after collection.

• **change management**

  —The process used to prevent unauthorized changes. Unauthorized changes often result in unintended outages.

• **CHAP**

  —Challenge Handshake Authentication Protocol. An authentication mechanism where a server challenges a client. Compare with MS-CHAPv2 and PAP.

• **chroot**

  —A Linux command used to change the root directory. Often used for sandboxing.

• **ciphertext**

  —The result of encrypting plaintext. Not in readable format until decrypted.

• **clean desk policy**

  —A security policy requiring employees to keep areas organized and free of papers. Reduces threats by protecting sensitive data.

• **clickjacking**

  —An attack that tricks users into clicking something other than what they think they’re clicking, using multiple transparent or opaque layers.

• **Clipping level**

  —Sets certain thresholds 门槛 for specific errors or mistakes allowed and the amount of these occurrences that can take place before it is considered suspicious.

• **Cloud access security broker (CASB)**

  —A software tool or service that enforces cloud-based security requirements. Placed between the organization’s resources and the cloud, monitors all network traffic, and can enforce security policies.

• **cloud deployment models**

  —Cloud model types that identify who has access to cloud resources.

  • Public clouds

    : for any organization.

  • Private clouds

    : for a single organization.

  • Community clouds

    : shared among community organizations.

  • Hybrid cloud

    : a combination of two or more clouds.

• **code signing**

  —The process of assigning a certificate to code. The certificate includes a digital signature and validates the code.

• **cold site**

  —An alternate location for operations. Has power and connectivity needed for activation, but little else. Compare with hot site and warm site.

• **collision**

  —A hash vulnerability. A hash collision occurs when two different passwords create the same hash.

• **compensating controls**

  —Security controls that are alternative controls used when a primary security control is not feasible.

• **compiled code**

  —Code that has been optimized and converted into an executable file. Compare with runtime code.

• **confidential data**

  —Data meant to be kept secret among a certain group of people.

• **confidentiality**

  —One of the three main goals of the CIA security triad.

  • Ensures unauthorized entities cannot access data.
  • Encryption

    and access controls help protect confidentiality.

  • Compare with availability and integrity.
• **configuration compliance scanner**

  —A type of vulnerability scanner that verifies systems are configured correctly.

• **confusion**

  —A cryptography concept indicating ciphertext is significantly different than plaintext.

• **containerization**

  —A method used to isolate applications in mobile devices. Isolates and protects the application, including data.

• **context-aware authentication**

  —An authentication method using multiple elements to authenticate a user and a mobile device. Can include identity, geolocation, device type, and more.

• **continuity of operations planning**

  —The planning process that identifies an alternate location for operations after a critical outage. Can include hot site, cold site, or warm site.

• **control diversity**

  —The use of different security control types: technical controls, administrative controls, and physical controls. Compare with vendor diversity.

• **controller-based AP / thin AP**

  —An AP that is managed by a controller. Compare with fat AP.

• **COPE**

  —Corporate-owned, personally enabled. A mobile device deployment model. The organization purchases and issues devices to employees. Compare with BYOD and CYOD.

• **corrective controls**

  —Security controls that attempt to reverse the impact of a security incident.

• **CRL**

  —Certificate revocation list. A list of certificates that a CA has revoked. Revoked when compromised or issued to an employee who has left.

• **crossover error rate**

  —The point where the false acceptance rate (FAR) crosses over with the false rejection rate (FRR). A lower CER indicates a more accurate biometric system.

• **cross-site request forgery (XSRF)**

  /’fɔːdʒ(ə)rɪ/—A web application attack. Tricks users into performing actions on web sites without their knowledge.

• **cross-site scripting (XSS)**

  —A web application vulnerability. Attackers embed malicious HTML or JavaScript into a web site’s code, which executes when a user visits the site.

• **crypto-malware**

  —A type of ransomware 勒索软件 that encrypts the user’s data.

• **crypto module**

  —A set of hardware, software, and/or firmware that implements cryptographic functions. Compare with crypto service provider.

• **crypto service provider**

  —A software library of cryptographic standards and algorithms. Typically distributed within crypto modules.

• **CSR**

  —Certificate signing request. A method of requesting a certificate from a CA. Creates an RSA-based private/public key pair and includes the public key in the CSR.

• **CTM / Counter mode**

  —A mode of encryption that combines an IV with a counter. The combined result is used to encrypt blocks.

  • Combines an initialization vector (IV) with a counter

    to effectively convert a block cipher into a stream cipher.

  • Generates a keystream block by encrypting sequential values of a counter.
  • Each block uses the same IV but CTM combines it with the counter value, resulting in a different encryption key per block.
  • Multiprocessor systems can encrypt/decrypt multiple blocks simultaneously — quicker on multiprocessor or multicore systems.
  • CTM is widely used and respected as a secure mode of operation.
• **GCM**

  —Galois/Counter Mode. Combines the Counter mode with hashing techniques for data authenticity and confidentiality.

• **ECB**

  —Electronic Codebook. The simplest mode of operation. Not recommended.

  • Uses the algorithm without any modification.
  • Encrypts blocks with the same key, making it easier for attackers to crack.
  • Examples: DES, AES, Blowfish, GOST — divide plaintext into blocks (often 64-bit or 128-bit) and encrypt each block independently.

• **custom firmware**

  —Mobile device firmware other than the firmware provided with the device. Sometimes used to root Android devices.

• **CIRT**

  —Cyber-incident response team. A group of experts who respond to security incidents.

• **CYOD**

  —Choose your own device. A mobile device deployment model. Employees connect their personally owned device as long as it is on a preapproved list. Compare with BYOD and COPE.

---

D

• **DAC**

  —Discretionary access control. An access control model where owners can modify permissions for objects (files and folders). Microsoft NTFS uses the DAC model.

• **data-at-rest**

  —Any data stored on media. Common to encrypt sensitive data-at-rest.

• **data execution prevention (DEP)**

  —A security feature that prevents code from executing in memory regions marked as nonexecutable. Helps block malware.

• **data exfiltration**

  —The unauthorized transfer of data outside an organization.

• **data-in-transit**

  —Any data sent over a network. Common to encrypt sensitive data-in-transit.

• **data-in-use**

  —Any data currently being used by a computer. Not encrypted while in use (the computer needs to process it).

• **data retention policy**

  /rɪ’tenʃ(ə)n/—A security policy specifying how long data should be kept (retained).

• **data sovereignty**

  最高统治权 /’sɒvrɪntɪ/—A term referring to legal implications of data stored in different countries. Primarily a concern for cloud backups stored in alternate locations.

• **DDoS**

  —Distributed denial-of-service. An attack launched from multiple sources intended to make a computer’s resources or services unavailable. Compare with DoS.

• **dead code**

  —Code that is never executed or used. Often caused by logic errors.

• **defense in depth**

  —The use of multiple layers of security to protect resources.

  • Control diversity

    and vendor diversity are two methods to provide defense in depth.

• **degaussing**

  /di’ɡausiŋ/ 消磁—Removing data from magnetic media using a powerful electronic magnet. Used on backup tapes or to destroy hard disks.

• **DER**

  —Distinguished Encoding Rules. A base format for PKI certificates. BASE64 ASCII encoded files. Compare with CER (Canonical Encoding Rules).

• **DES**

  —Data Encryption Standard. A legacy symmetric encryption standard. Has been compromised — use AES or 3DES instead.

• **detective controls**

  —Security controls that attempt to detect security incidents after they have occurred.

• **deterrent controls**

  —Security controls that attempt to discourage individuals from causing a security incident.

• **dictionary**

  —A password attack that uses a file of words and character combinations. Tries every entry in the file.

• **differential backup**

  —A type of backup that backs up all the data that has changed since the last full backup.

• **Diffie-Hellman (DH)**

  —An asymmetric algorithm used to privately share symmetric keys. DH Ephemeral (DHE) uses ephemeral keys re-created for each session. Elliptic Curve DHE (ECDHE) uses elliptic curve cryptography.

• **diffusion**

  —A cryptography concept that ensures small changes in plaintext result in significant changes in ciphertext.

• **dig**

  —A command-line tool used to test DNS on Linux systems. Compare with nslookup.

• **digital signature**

  —An encrypted hash of a message, encrypted with the sender’s private key. Provides authentication, non-repudiation, and integrity.

• **disablement policy**

  —A policy that identifies when administrators should disable user accounts.

• **disassociation attack**

  —An attack that removes wireless clients from a wireless network.

• **dissolvable agent**

  —A NAC agent that runs on a client but deletes itself later. Checks the client for health. Compare with permanent agent.

• **DLL injection**

  —An attack that injects a Dynamic Link Library (DLL) into memory and runs it. Attackers rewrite the DLL, inserting malicious code.

• **DLP**

  —Data loss prevention. Technologies used to prevent data loss: block USB devices, monitor outgoing email, and monitor data stored in the cloud.

• **DMZ**

  —Demilitarized zone. A buffer zone between the Internet and an internal network. Internet clients can access services in the DMZ, but it protects the internal network.

• **DNS**

  —Domain Name System. A service used to resolve host names to IP addresses. DNS zones include A records (IPv4) and AAAA records (IPv6).

• **DNSSEC**

  —Domain Name System Security Extensions. A suite of extensions to protect the integrity of DNS records and prevent DNS attacks.

• **DNS poisoning**

  —An attack that modifies or corrupts DNS results. DNSSEC helps prevent it.

• **domain hijacking**

  —An attack that changes the registration of a domain name without permission from the owner.

• **DoS**

  —Denial-of-service. An attack from a single source that attempts to disrupt the services provided by the attacked system. Compare with DDoS.

• **downgrade attack**

  —A type of attack that forces a system to downgrade its security. The attacker then exploits the lesser security control.

• **Drive-By Downloads**

  —The unintended download of computer software from the Internet. Happens when visiting a website, opening an email attachment, clicking a link, or clicking a deceptive pop-up. The “supplier” claims the user “consented” to the download. Malicious content may exploit vulnerabilities in the browser or plugins to run malicious code without the user’s knowledge.

  • Drive-by install: refers to installation rather than download (sometimes used interchangeably).
• **DSA**

  —Digital signature algorithm. An encrypted hash of a message for authentication, non-repudiation, and integrity. The sender’s private key encrypts the hash.

• **dumpster diving**

  —Searching through trash looking for information from discarded documents. Shredding or burning papers helps prevent it.

---

E

• **EAP**

  —Extensible Authentication Protocol. An authentication framework that provides general guidance for authentication methods. Variations include PEAP, EAP-TLS, EAP-TTLS, and EAP-FAST.

• **EAP-FAST**

  —EAP-Flexible Authentication via Secure Tunneling. A Cisco-designed replacement for LEAP. Supports certificates, but they are optional.

• **EAP-TLS**

  —Extensible Authentication Protocol-Transport Layer Security. One of the most secure EAP standards. Requires certificates on both the 802.1x server and on the clients.

• **EAP-TTLS**

  —Extensible Authentication Protocol-Tunneled Transport Layer Security. Allows systems to use older authentication methods (such as PAP) within a TLS tunnel. Requires a certificate on the 802.1x server only (not on clients).

• **embedded system**

  —Any device with a dedicated function that uses a computer system. Includes a CPU, an operating system, and one or more applications.

• **EMI**

  —Electromagnetic interference. Interference caused by motors, power lines, and fluorescent lights. EMI shielding prevents outside interference and prevents data from emanating outside the cable.

• **EMP**

  —Electromagnetic pulse. A short burst of energy that can damage electronic equipment. Results from electrostatic discharge (ESD), lightning, and military weapons.

• **encryption**

  —A process that scrambles data to make it unreadable. Normally includes a public algorithm and a private key. Compare with asymmetric and symmetric encryption.

• **Enterprise**

  —A wireless mode that uses an 802.1x server for security. Forces users to authenticate with a username and password. Compare with Open and PSK modes.

• **ephemeral key**

  —A type of key used in cryptography. Ephemeral keys have very short lifetimes and are re-created for each session.

• **error handling**

  —A programming process that handles errors gracefully.

• **ESP**

  —Encapsulating Security Payload. An option within IPsec to provide confidentiality, integrity, and authentication.

• **evil twin**

  —A type of rogue AP. An evil twin has the same SSID as a legitimate AP.

• **exit interview**

  —An interview conducted with departing employees just before they leave an organization.

• **exploitation frameworks**

  —Tools used to store information about security vulnerabilities. Used by penetration testers (and attackers) to detect and exploit software.

• **extranet**

  —The part of an internal network shared with outside entities. Often used to provide access to authorized business partners, customers, or vendors.

---

F

• **facial recognition**

  —A biometric method that identifies people based on facial features.

• **false negative**

  —A security incident that isn’t detected or reported. A NIDS false negative occurs if an attack is active but the NIDS does not raise an alert.

• **false positive**

  —An alert on an event that isn’t a security incident. A NIDS false positive occurs if the NIDS raises an alert but network activity is normal.

• **FAR**

  —False acceptance rate (also called the false match rate). The percentage of times a biometric authentication system incorrectly indicates a match.

• **Faraday cage**

  —A room or enclosure that prevents signals from emanating beyond it.

• **fat AP / stand-alone AP**

  —An AP that includes everything needed to connect wireless clients to a wireless network. Must be configured independently. Compare with thin AP.

• **fault tolerance**

  —The capability of a system to suffer a fault but continue to operate.

• **FDE**

  —Full disk encryption. A method to encrypt an entire disk. Compare with SED.

• **federation**

  —Two or more members of a federated identity management system. Used for single sign-on.

• **fingerprint scanners**

  —Biometric systems that scan fingerprints for authentication.

• **firewall**

  —A software or network device used to filter traffic. Stateful firewalls filter traffic using rules within an ACL. Stateless firewalls filter traffic based on state within a session.

• **firmware OTA updates**

  —Over-the-air updates for mobile device firmware.

• **flood guard**

  —Thwarts flood attacks. On switches, prevents MAC flood attacks. On routers, prevents SYN flood attacks.

• **framework**

  —A structure used to provide a foundation. Cybersecurity frameworks provide guidance on implementing security.

• **FRR**

  —False rejection rate (also called the false nonmatch rate). The percentage of times a biometric system incorrectly rejects a valid match.

• **FTPS**

  —File Transfer Protocol Secure. An extension of FTP that uses TLS. Some implementations use TCP ports 989 and 990.

• **full backup**

  —A type of backup that backs up all the selected data.

• **full tunnel**

  —An encrypted VPN connection where all traffic from the user is encrypted. Compare with split tunnel.

---

G

• **GCM**

  —Galois/Counter Mode. Combines Counter (CTM) mode with hashing techniques for data authenticity and confidentiality.

• **geofencing**

  —A virtual fence or geographic boundary using GPS. Apps respond when a mobile device enters the virtual fence.

• **geolocation**

  —The location of a device identified by GPS. Can help locate a lost or stolen mobile device.

• **GPO**

  —Group Policy Object. A technology within Microsoft Windows to manage users and computers. Implemented on a domain controller.

• **GPS**

  —Global Positioning System. A satellite-based navigation system that identifies the location of a device or vehicle.

• **GPS tagging**

  —Adding geographical data (latitude/longitude) to files such as pictures.

  • Gratuitous ARP: not waiting for a request — just sending the reply.
• **gray box test**

  —A type of penetration test. Testers have some knowledge of the environment. Compare with black box test and white box test.

• **group-based access control**

  —A role-based access control method that uses groups as roles.

• **Guest account**

  —A pre-created account in Windows systems. Disabled by default.

---

H

• **hacktivist**

  —An attacker who launches attacks as part of an activist movement or to further a cause.

• **hardware root of trust**

  —A known secure starting point.

  • TPMs

    have a private key burned into the hardware that provides a hardware root of trust.

• **hash**

  —A number created by executing a hashing algorithm against data (such as a file or message). Used for integrity. Common algorithms: MD5, SHA-1, HMAC.

• **heuristic / behavioral**

  启发式的—A type of monitoring on IDS/IPS systems. Detects attacks by comparing traffic against a baseline. Also known as 异常 anomaly detection.

• **HIDS**

  —Host-based intrusion detection system. Software installed on a system to detect attacks.

  • HIPS (host-based intrusion prevention system)

    : extension of HIDS that also blocks attacks.

• **high availability**

  —A term indicating a system or component remains available close to 100 percent of the time.

• **HMAC**

  —Hash-based Message Authentication Code. A hashing algorithm used to verify integrity and authenticity of a message with a shared secret. Typically combined with SHA.

  • Hashes the secret key with messages. Usually used between server and client.
  • The secret key should be time-limited and random. Server sends a form and a random key to the client; client finishes the form and hashes it with the random secret key; server verifies the stored hash against the received hash.
• **hoax**

  —A message (often circulated through email) that tells of impending doom from a virus or security threat that doesn’t exist.

• **honeypot**

  —A server designed to attract an attacker. Has weakened security encouraging attackers to investigate it.

• **honeynet**

  —A group of honeypots in a network. Often configured in virtual networks.

• **hot and cold aisles**

  —A data center cooling method. Cool air flows from the front of cabinets to the back.

• **HOTP**

  —HMAC-based One-Time Password. An open standard for creating one-time passwords. Combines a secret key and a counter, then uses HMAC to create a hash.

• **hot site**

  —An alternate location for operations. Typically operational within 60 minutes. Compare with cold site and warm site.

• **HSM**

  —Hardware security module. A removable or external device that can generate, store, and manage RSA keys used in asymmetric encryption. Compare with TPM.

• **HTTPS**

  —Hypertext Transfer Protocol Secure. Encrypts HTTP traffic with TLS using TCP port 443.

• **HVAC**

  —Heating, ventilation, and air conditioning. A physical security control that increases availability by regulating airflow within data centers.

---

I

• **IaaS**

  —Infrastructure as a Service. A cloud computing model that allows an organization to rent access to hardware in a self-managed platform. Compare with PaaS and SaaS.

• **ICS**

  —Industrial control system. Controls large systems such as power plants or water treatment facilities. A SCADA system controls the ICS.

• **identification**

  —The process that occurs when a user claims an identity, such as with a username.

• **IEEE 802.1x**

  —An authentication protocol used in VPNs and wired/wireless networks. VPNs often implement it as a RADIUS server. Wired networks use it for port-based authentication. Wireless networks use it in Enterprise mode.

• **ifconfig**

  —A command-line tool on Linux systems to show and manipulate NIC settings. Similar to ipconfig on Windows.

• **IMAP4**

  —Internet Message Access Protocol version 4. Stores and manages email on servers. Uses TCP port 143.

• **impact**

  —The magnitude of harm related to a risk. The negative result of an event (loss of confidentiality, integrity, or availability). Compare with likelihood of occurrence.

• **implicit deny**

  —A rule in an ACL that blocks all traffic that hasn’t been explicitly allowed. The last rule in an ACL.

• **Incident response**

  —The process of responding to a security incident.

• **incident response plan (IRP)**

  —The procedures documented in an incident response policy.

• **incident response process**

  —The phases: preparation, identification, containment, eradication, recovery, and lessons learned.

• **incremental backup**

  —A type of backup that backs up all data changed since the last full or incremental backup.

• **injection attack**

  —An attack that injects code or commands. Common types: DLL injection, command injection, SQL injection.

• **inline**

  —A configuration that forces traffic to pass through a device. A NIPS is placed inline. Sometimes called in-band. Compare with out-of-band.

• **input validation**

  —A programming process that verifies data is valid before using it.

• **insider**

  —An attacker who launches attacks from within an organization, typically as an employee.

• **integer overflow**

  —An application attack that attempts to use or create a numeric value too big for an application to handle. Input handling and error handling thwart the attack.

• **integrity**

  —One of the three main goals of the CIA security triad. Provides assurance that data or system configurations have not been modified. Audit logs and hashing ensure integrity. Compare with availability and confidentiality.

• **intranet**

  —An internal network. People use an intranet to communicate and share content.

• **IoT**

  —Internet of things. The network of physical devices connected to the Internet. Refers to smart devices with an IP address, such as wearable technology and home automation.

• **ipconfig**

  —A command-line tool on Windows systems to show NIC configuration settings.

• **IPsec**

  —Internet Protocol security. A suite of protocols to encrypt data-in-transit. Operates in Tunnel mode (for VPN traffic) and Transport mode (in private networks).

• **IP spoofing**

  —An attack that changes the source IP address.

• **iris scanners**

  —Biometric systems that scan the iris of an eye for authentication.

• **ISA**

  —Interconnection security agreement. An agreement that specifies technical and security requirements for connections between two or more entities. Compare with MOU/MOA.

• **IV (initialization vector) attack**

  —A wireless attack that attempts to discover the IV. Legacy wireless security protocols are susceptible to IV attacks.

---

J

• **jailbreaking**

  —The process of modifying an Apple mobile device to remove software restrictions. Allows a user to install software from any third-party source. Compare with rooting.

• **jamming**

  —A DoS attack against wireless networks. Transmits noise on the same frequency used by a wireless network.

• **job rotation**

  —A process that ensures employees rotate through different jobs to learn the processes and procedures in each job. Can sometimes detect fraudulent activity.

---

K

• **KDC**

  —Key Distribution Center. Also known as a TGT server. Part of the Kerberos protocol used for network authentication. Issues timestamped tickets that expire.

• **Kerberos**

  —A network authentication mechanism used with Windows Active Directory domains and some Unix environments (realms). Uses a KDC to issue tickets.

• **kernel**

  —The central part of the operating system. In container virtualization, guests share the kernel.

• **key escrow**

  —The process of placing a copy of a private key in a safe environment.

• **keylogger**

  —Software or hardware used to capture a user’s keystrokes. Keystrokes are stored in a file and can be manually retrieved or automatically sent to an attacker.

• **key stretching**

  —A technique used to increase the strength of stored passwords. Adds additional bits (salts) and can help thwart brute force and rainbow table attacks.

• **known plaintext**

  —A cryptographic attack that decrypts encrypted data. The attacker knows the plaintext used to create ciphertext.

---

L

• **labeling**

  —The process of ensuring data is tagged clearly so users know its classification. Labels can be physical (on backup tapes) or digital (embedded in files).

• **LDAP**

  —Lightweight Directory Access Protocol. A protocol used to communicate with directories such as Microsoft Active Directory. Identifies objects with query strings using codes such as CN=Users and DC=GetCertifiedGetAhead.

• **LDAPS**

  —Lightweight Directory Access Protocol Secure. A protocol used to encrypt LDAP traffic with TLS.

• **least functionality**

  —A core principle of secure systems design. Systems should be deployed with only the applications, services, and protocols needed to meet their purpose.

• **least privilege**

  —A security principle that specifies individuals and processes are granted only the rights and permissions needed to perform assigned tasks, but no more.

• **legal hold**

  —A court order to maintain data for evidence.

• **likelihood of occurrence**

  —The probability that something will occur. Used with impact in a qualitative risk assessment. Compare with impact.

• **load balancer**

  —Hardware or software that balances the load between two or more servers.

  • Scheduling methods

    include source address IP affinity and round-robin.

  • Affinity

    : uses the client’s IP address to redirect to the same server during a web session.

  • round-robin

    : sends requests to servers one after another.

• **location-based policies**

  —Policies that prevent users from logging on from certain locations, or require that they log on only from specific locations.

• **logic bomb**

  —A type of malware that executes in response to an event (a specific date/time, or a user action such as launching a specific program).

• **loop prevention**

  —A method of preventing switching loop or bridge loop problems. Both STP and RSTP prevent switching loops.

---

M

• **MAC**

  —Mandatory access control. An access control model that uses sensitivity labels assigned to objects (files and folders) and subjects (users). MAC restricts access based on need to know. Every resource has a sensitivity label matching a clearance level assigned to a user.

• **MAC**

  —Media access control. A 48-bit address used to identify network interface cards. Also called a hardware address or physical address.

• **MAC filtering**

  —A form of network access control to allow or block access based on the MAC address.

  • Configured on switches for port security or on APs for wireless security.
• **MAC spoofing**

  —An attack that changes the source MAC address.

• **mail gateway**

  —A server that examines and processes all incoming and outgoing email. Typically includes a spam filter and DLP capabilities.

• **Malware**

  —Malicious software. Includes viruses, worms, ransomware, rootkits, logic bombs, and more.

• **Malvertising**

  —The use of online advertising to spread malware. Injecting malicious advertisements into legitimate online advertising networks and webpages.

• **Mandatory vacation**

  —A policy that forces employees to take a vacation. Goals: deter malicious activity (such as fraud and embezzlement /ɪmˈbezlmənt/) and detect malicious activity when it occurs.

• **Man-in-the-browser**

  —An attack that infects vulnerable web browsers. Can capture browser session data, including keystrokes.

• **man-in-the-middle (MITM)**

  —An attack using active interception or eavesdropping. Uses a third computer to capture traffic sent between two other systems.

• **mantrap**

  —A physical security mechanism designed to control access to a secure area. Prevents tailgating.

• **MD5**

  —Message Digest 5. A hashing function used to provide integrity. Creates 128-bit hashes (MD5 checksums). Considered cracked.

• **MDM**

  —Mobile device management. Technologies used to manage mobile devices. Can monitor devices and ensure compliance with security policies.

• **memory leak**

  —An application flaw that consumes memory without releasing it.

• **MFDs**

  —Multi-function devices. Devices that perform multiple functions (print, scan, copy, fax).

• **MMS**

  —Multimedia Messaging Service. An extension of SMS that supports sending multimedia content.

• **MOU/MOA**

  —Memorandum 记录 of understanding / agreement. A type of agreement that defines responsibilities of each party. Compare with ISA (interconnection security agreement).

• **MS-CHAPv2**

  —Microsoft Challenge Handshake Authentication Protocol version 2. Provides mutual authentication. Compare with CHAP and PAP.

• **MTBF**

  —Mean time between failures. A metric that provides the average time between failures.

• **MTTR**

  —Mean time to recover. A metric identifying the average time it takes to restore a failed system.

• **multifactor authentication**

  —A type of authentication that uses methods from more than one factor of authentication.

---

N

• **NAC**

  —Network access control. A system that inspects clients to ensure they are healthy.

  • NAC systems use health: indicating that a client meets predetermined characteristics.
  • Agents inspect clients and can be permanent or dissolvable (agentless).
• **NAT**

  —Network Address Translation. Translates public IP addresses to private IP addresses and vice versa. Compare with PAT.

• **NDA**

  —Non-disclosure agreement. An agreement designed to prohibit personnel from sharing proprietary data.

• **Netcat**

  —A command-line tool used to connect to remote systems.

• **netstat**

  —A command-line tool used to show network statistics on a system.

• **network mapping**

  —A process used to discover devices on a network, including how they are connected.

• **network scanner**

  —A tool used to discover devices on a network, including their IP addresses, operating system, and services/protocols running.

• **NFC**

  —Near field communication. A group of standards that allow mobile devices to communicate with nearby mobile devices.

• **NFC attack**

  —An attack against mobile devices that use near field communication (NFC).

• **NIDS**

  —Network-based intrusion detection system. A device that detects attacks and raises alerts. Installed on network devices (routers or firewalls), monitors network traffic.

• **NIPS**

  —Network-based intrusion prevention system. A device that detects and stops attacks in progress. Placed inline with traffic.

• **NIST**

  —National Institute of Standards and Technology. Part of the U.S. Department of Commerce. Its Information Technology Laboratory (ITL) publishes special publications related to security.

• **Nmap**

  —A command-line tool used to scan networks. A type of network scanner.

• **nonce**

  —A number used once. Cryptography elements frequently use a nonce to add randomness.

• **non-persistence**

  —A method used in virtual desktops where changes made by a user are not saved. When users log off, the desktop reverts to its original state.

• **non-repudiation**

  —The ability to prevent a party from denying an action.

  • Digital signatures

    and access logs provide non-repudiation.

• **normalization**

  —The process of organizing tables and columns in a database. Reduces redundant data and improves overall database performance.

• **nslookup**

  —A command-line tool used to test DNS on Microsoft systems. Compare with dig.

• **NTLM**

  —New Technology LAN Manager. A suite of protocols that provide confidentiality, integrity, and authentication within Windows systems. Versions: NTLM, NTLMv2, NTLM2 Session.

---

O

• **OAuth**

  —An open source standard used for authorization with Internet-based single sign-on solutions.

• **Obfuscation**

  /ɔbfʌ’skeiʃən/—An attempt to make something unclear or difficult to understand.

  • Steganography methods use obfuscation to hide data within data.
• **OCSP**

  —Online Certificate Status Protocol. An alternative to using a CRL. Allows entities to query a CA with the serial number of a certificate. The CA answers with good, revoked, or unknown.

• **onboarding**

  —The process of granting individuals access to an organization’s computing resources after being hired.

• **Open**

  —A wireless mode that doesn’t use security. Compare with Enterprise and PSK modes.

• **OpenID Connect**

  —An open source standard used for identification on the Internet. Typically used with OAuth. Allows clients to verify the identity of end users without managing their credentials.

• **open-source intelligence**

  —A method of gathering data using public sources, such as social media sites and news outlets.

• **order of volatility**

  /ˌvɑlə’tɪləti/—The order in which evidence should be collected. Data in memory is more volatile than data on disk, so it should be collected first.

  • From most volatile to least volatile:
    • Data in cache memory (processor cache, hard drive cache)
    • Data in RAM (random access memory), including system and network processes
    • A paging file (swap file) on the system disk drive
    • Data stored on local disk drives
    • Logs stored on remote systems
    • Archive /ˈɑ:kaiv/ media
• **OSI model**

  —Open Systems Interconnection reference model. Defines how applications communicate across the network. Goal: interoperability 互用性 of diverse communication systems.

  • Layer 1: Physical — transmission and reception of unstructured raw data. Converts digital bits into electrical, radio, or optical signals.
  • Layer 2: Data Link — node-to-node data transfer between two directly connected nodes. Detects and corrects physical layer errors. (Frames)
  • Layer 3: Network — transferring variable-length data sequences (packets) between nodes in different networks.
  • Layer 4: Transport — transferring variable-length data sequences from a source to a destination host, maintaining quality of service. (TCP/UDP)
  • Layer 5: Session — controls the dialogues 对话 (connections) between computers. Establishes, manages, and terminates connections between local and remote applications.
  • Layer 6: Presentation — responsible for formatting of data being exchanged, translating between application and network formats.
  • Layer 7: Application — provides basic underlying network infrastructure, allows applications to communicate with each other.
• **out-of-band**

  —A configuration that allows a device to collect traffic without the traffic passing through it. Sometimes called passive. Compare with inline.

---

P

• **P7B**

  —PKCS#7. A common format for PKI certificates. DER-based (ASCII), commonly used to share public keys.

• **P12**

  —PKCS#12. A common format for PKI certificates. CER-based (binary), often holds certificates with the private key. Commonly encrypted.

• **PaaS**

  —Platform as a Service. A cloud computing model that provides a preconfigured computing platform. Compare with IaaS and SaaS.

• **PAP**

  —Password Authentication Protocol. An older authentication protocol where passwords or PINs are sent across the network in cleartext. Compare with CHAP and MS-CHAPv2.

• **passive reconnaissance**

  —A penetration testing method that typically uses open-source intelligence. Compare with active reconnaissance.

• **pass the hash**

  —A password attack that captures and uses the hash of a password. Attempts to log on as the user with the hash. Commonly associated with Microsoft NTLM.

• **password cracker**

  —A tool used to discover passwords.

• **patch management**

  —The process used to keep systems up to date with current patches. Typically includes evaluating and testing patches before deploying them.

• **PBKDF2**

  —Password-Based Key Derivation Function 2. A key stretching technique that adds additional bits as a salt. Helps prevent brute force and rainbow table attacks.

• **PEAP**

  —Protected Extensible Authentication Protocol. An extension of EAP used with 802.1x. Requires a certificate on the 802.1x server.

• **PEM**

  —Privacy Enhanced Mail. A common format for PKI certificates. Can use CER (ASCII) or DER (binary) formats.

• **penetration testing**

  —A method of testing targeted systems to determine if vulnerabilities can be exploited. Penetration tests are intrusive. Compare with vulnerability scanner.

• **perfect forward secrecy**

  —A characteristic of encryption keys ensuring that keys are random. Does not use deterministic algorithms.

• **permanent agent**

  —A NAC agent that is installed on a client. Checks the client for health. Compare with dissolvable agent.

• **permission auditing review**

  —An audit that analyzes user privileges. Identifies privileges granted to users and compares them against what users need.

• **PFX**

  —Personal Information Exchange. A common format for PKI certificates. The predecessor to P12 certificates.

• **Pharming**

  —Obtain personal information by domain spoofing, ‘poisons’ a DNS server, infuses false information into the DNS server, resulting in a user's request being redirected elsewhere.

• **PHI**

  —Personal Health Information. PII that includes health information.

• **phishing**

  —The practice of sending email to users with the purpose of tricking them into revealing personal information or clicking on a link.

• **physical controls**

  —Security controls that can be physically touched.

• **PII**

  —Personally Identifiable Information. Information about individuals that can be used to trace a person’s identity (full name, birth date, biometric data, etc.).

• **ping**

  —A command-line tool used to test connectivity with remote systems.

• **pinning**

  —A security mechanism used by some web sites to detect impersonation.

  • Public key pinning: provides clients with a list of public key hashes in HTTPS responses that clients use to detect web site impersonation attempts.
  • HTTP Public Key Pinning (HPKP): A security mechanism that allows HTTPS websites to resist impersonation by attackers using fraudulent certificates.
  • OCSP stapling: reduces OCSP traffic by appending a timestamped, digitally signed OCSP response to a certificate.
  • Perfect forward secrecy: ensures that the compromise of a long-term key does not compromise keys used in the past.
  • Key stretching techniques: add additional bits (salts) to passwords.
• **PIV**

  —Personal Identity Verification card. A specialized smart card used by U.S. federal agencies. Includes photo identification; provides confidentiality, integrity, authentication, and non-repudiation.

• **Pivot**

  枢轴—One of the steps in penetration testing. After escalating privileges, the tester uses additional tools to gain information on the exploited computer or network.

  • The process of accessing other systems through a single compromised system.
• **plaintext**

  —Text displayed in a readable format. Encryption converts plaintext to ciphertext.

• **pointer dereference**

  —A programming practice that uses a pointer to reference a memory area.

  • A failed dereference operation can corrupt memory and sometimes cause an application to crash.
• **POP3**

  —Post Office Protocol version 3. Protocol used to transfer email from mail servers to clients.

• **port mirror**

  —A monitoring port on a switch. All traffic going through the switch is also sent to the port mirror.

• **preventive controls**

  —Security controls that attempt to prevent a security incident from occurring.

• **privacy impact assessment**

  —An assessment used to identify and reduce risks related to potential loss of PII. Compare with privacy threshold assessment.

• **privacy threshold assessment**

  —An assessment used to help identify if a system is processing PII.

• **private data**

  —Information about an individual that should remain private.

  • Examples: Personally Identifiable Information (PII) and Personal Health Information (PHI).
• **private key**

  —Part of a matched key pair used in asymmetric encryption. The private key always stays private. Compare with public key.

• **privilege escalation**

  —The process of gaining elevated rights and permissions.

• **privileged account**

  —An account with elevated privileges, such as an administrator account.

• **proprietary data**

  —Data related to ownership. Common examples: patents or trade secrets.

• **protocol analyzer**

  —A tool used to capture network traffic. Can be used to view data sent in clear text.

• **proximity cards**

  —Small credit card-sized cards that activate when in close proximity to a card reader.

• **proxy/proxies**

  —A server (or servers) used to forward requests for services such as HTTP or HTTPS.

  • Forward proxy: forwards requests from internal clients to external servers.
  • Reverse proxy: accepts requests from the Internet and forwards them to an internal web server.
  • Transparent proxy: does not modify requests.
  • Application proxy: used for a specific application.
• **PSK**

  —Pre-shared key. A wireless mode that uses a pre-shared key (similar to a password or passphrase). Compare with Enterprise and Open modes.

• **public data**

  —Data that is available to anyone. Found in brochures, press releases, or web sites.

• **public key**

  —Part of a matched key pair used in asymmetric encryption. The public key is publicly available. Compare with private key.

• **Public Key Infrastructure (PKI)**

  —A group of technologies used to request, create, manage, store, distribute, and revoke digital certificates.

• **pulping**

  —A process performed after shredding papers. Reduces the shredded paper to a mash or puree.

• **pulverizing**

  —A process used to physically destroy items such as optical discs.

• **purging**

  —A general sanitization term indicating that all sensitive data has been removed from a device.

• **push notification services**

  —The services that send messages to mobile devices.

---

Q

• **qualitative risk assessment**

  —A risk assessment that uses judgment to categorize risks. Based on impact and likelihood of occurrence.

• **quantitative risk assessment**

  —A risk assessment that uses specific monetary amounts to identify cost and asset value. Uses SLE and ARO to calculate ALE.

---

R

• **race condition**

  —A programming flaw that occurs when two sets of code attempt to access the same resource. The first one to access the resource wins, which can result in inconsistent results.

• **RADIUS**

  —Remote Authentication Dial-In User Service. An authentication service that provides central authentication for remote access clients. Alternatives: TACACS+ and Diameter.

• **RAID**

  —Redundant array of inexpensive disks. Multiple disks added together to increase performance or provide fault protection. Common types: RAID-1, RAID-5, RAID-6, RAID-10.

• **rainbow table**

  —A file containing precomputed hashes for character combinations. Used to discover passwords. PBKDF2 and bcrypt thwart rainbow table attacks.

• **ransomware**

  —A type of malware used to extort money. Typically encrypts the user’s data and demands a ransom before decrypting.

• **RAT**

  —Remote access Trojan. Malware that allows an attacker to take control of a system from a remote location.

• **RC4**

  —A symmetric stream cipher that can use between 40 and 2,048 bits. Considered cracked — recommend using stronger alternatives.

• **record time offset**

  —An offset used by recorders to identify times on recordings. If the recording start time is known, the offset identifies the actual time at any point.

• **recovery site**

  —An alternate location for business functions after a major disaster.

• **redundancy**

  —The process of adding duplication to critical system components and networks to provide fault tolerance.

• **refactoring**

  —A driver manipulation method. Developers rewrite code without changing the driver’s behavior.

• **remote wipe**

  —The process of sending a signal to a remote device to erase all data. Useful when a mobile device is lost or stolen.

• **replay attack**

  —An attack where data is captured and replayed. Attackers typically modify data before replaying it.

• **resource exhaustion**

  —The malicious result of many DoS and DDoS attacks. Overloads a computer’s resources (processor, memory), resulting in service interruption.

• **retina scanners**

  —Biometric systems that scan the retina of an eye for authentication.

• **RFID attacks**

  —Attacks against radio-frequency identification (RFID) systems. Common attacks: eavesdropping, replay, and DoS.

• **RIPEMD**

  —RACE Integrity Primitives Evaluation Message Digest. A hash function for integrity. Creates fixed-length hashes of 128, 160, 256, or 320 bits.

• **risk**

  —The possibility or likelihood of a threat exploiting a vulnerability resulting in a loss. Compare with threat and vulnerability.

• **risk assessment**

  —A process used to identify and prioritize risks. Includes quantitative and qualitative risk assessments.

• **risk management**

  —The practice of identifying, monitoring, and limiting risks to a manageable level.

• **risk mitigation**

  —The process of reducing risk by implementing controls. Reduces vulnerabilities or reduces the impact of a threat.

• **risk register**

  —A document listing information about risks. Includes risk scores and recommended security controls.

• **risk response techniques**

  —Methods used to manage risks: accept, transfer, avoid, and mitigate.

• **rogue AP**

  —An unauthorized AP. Can be placed by an attacker or an employee without permission.

• **role-BAC**

  —Role-based access control. An access control model that uses roles based on jobs and functions to define access. Often implemented with groups.

• **root certificate**

  —A PKI certificate identifying a root CA.

• **rooting**

  —The process of modifying an Android device, giving the user root-level (administrator) access. Compare with jailbreaking.

• **rootkit**

  —A type of malware that has system-level access to a computer. Rootkits can hide themselves from users and antivirus software.

• **ROT13**

  —A substitution cipher that uses a key of 13. Rotate each letter 13 spaces to encrypt or decrypt.

• **round-robin**

  —A scheduling method used with load balancers. Redirects each client request to servers in a predetermined order.

• **router**

  —A network device that connects multiple network segments together. Routes traffic based on destination IP address. Does not pass broadcast traffic. Routers use ACLs.

• **RPO**

  —Recovery point objective. The amount of data the organization can afford to lose. Identifies a point in time where data loss is acceptable. Often identified in a BIA.

• **RSA**

  —Rivest, Shamir, and Adleman. An asymmetric algorithm used to encrypt data and digitally sign transmissions.

• **RSTP**

  —Rapid Spanning Tree Protocol. An improvement of STP to prevent switching loop problems.

• **RTO**

  —Recovery time objective. The maximum amount of time it should take to restore a system after an outage. Derived from the maximum allowable outage time identified in the BIA.

• **RTOS**

  —Real-time operating system. An operating system that reacts to input within a specific time. Many embedded systems include an RTOS.

• **rule-BAC**

  —Rule-based access control. An access control model that uses rules to define access. Based on a set of approved instructions (such as an ACL) or rules that trigger in response to an event.

• **runtime code**

  —Code that is interpreted when it is executed. Compare with compiled code.

---

S

• **SaaS**

  —Software as a Service. A cloud computing model that provides applications over the Internet (e.g., webmail). Compare with IaaS and PaaS.

• **salt**

  —A random set of data added to a password when creating the hash. PBKDF2 and bcrypt use salts.

• **SAML**

  —Security Assertion Markup Language. An XML-based standard used to exchange authentication and authorization information between different parties. Provides SSO for web-based applications.

• **sandboxing**

  —The use of an isolated area on a system, typically for testing. Virtual machines are often used to test patches in an isolated sandbox.

• **sanitize**

  —The process of destroying or removing all sensitive data from systems and devices. Methods: burning, shredding, pulping, pulverizing, degaussing, purging, and wiping.

• **SCADA**

  —Supervisory control and data acquisition. A system used to control an ICS (power plant, water treatment facility). Ideally within an isolated network.

• **screen filter**

  —A physical security device used to reduce visibility of a computer screen. Helps prevent shoulder surfing.

• **script kiddie**

  —An attacker with little expertise or sophistication. Uses existing scripts to launch attacks.

• **Scrubbing center**

  —Centralized data cleaning stations where traffic to a website is analyzed and malicious traffic is removed.

• **SDN**

  —Software defined network. A method of using software and virtualization technologies to replace hardware routers. Separates the data and control planes.

• **secure boot**

  —A process that checks and validates system files during the boot process. A TPM typically uses a secure boot process.

• **secure DevOps**

  —A software development process using an agile-aligned methodology. Considers security through the lifetime of the project.

• **security incident**

  —An adverse event or series of events that can negatively affect the confidentiality, integrity, or availability of an organization’s IT systems and data.

• **SED**

  —Self-encrypting drive. A drive that includes the hardware and software necessary to encrypt a hard drive. Users typically enter credentials to decrypt and use the drive.

• **separation of duties**

  —A security principle that prevents any single person or entity from controlling all the functions of a critical or sensitive process. Designed to prevent fraud, theft, and errors.

• **service account**

  —An account used by a service or application.

• **session hijacking**

  —An attack that attempts to impersonate a user by capturing and using a session ID. Session IDs are stored in cookies.

• **SFTP**

  —Secure File Transfer Protocol. An extension of Secure Shell (SSH) used to encrypt FTP traffic. Uses TCP port 22.

• **SHA**

  —Secure Hash Algorithm. A hashing function used to provide integrity. Versions: SHA-1, SHA-2, SHA-3.

• **Shibboleth**

  —An open source federated identity solution.

• **shimming**

  —A driver manipulation method. Uses additional code to modify the behavior of a driver.

• **shoulder surfing**

  —The practice of looking over someone’s shoulder to obtain information. A screen filter helps reduce success.

• **shredding**

  —A method of destroying data or sanitizing media. Cross-cut paper shredders cut papers into fine particles. File shredders remove all remnants by overwriting contents multiple times.

• **sideloading**

  —The process of copying an application package to a mobile device. Useful for developers, but risky if users sideload unauthorized apps.

• **SIEM**

  —Security information and event management. A security system that looks at security events throughout the organization.

• **signature-based**

  —A type of monitoring on IDS/IPS systems. Detects attacks based on known attack patterns (attack signatures).

• **single point of failure**

  —A component within a system that can cause the entire system to fail if it fails.

• **SLA**

  —Service level agreement. An agreement between a company and a vendor that stipulates performance expectations (minimum uptime, maximum downtime).

• **SLE**

  —Single loss expectancy. The monetary value of any single loss. Used with ALE and ARO. Calculation: SLE × ARO = ALE.

• **smart card**

  —A credit card-sized card with an embedded microchip and a certificate. Used for authentication in the “something you have” factor.

• **S/MIME**

  —Secure/Multipurpose Internet Mail Extensions. A popular standard used to secure email. Provides confidentiality, integrity, authentication, and non-repudiation.

• **SMS**

  —Short Message Service. A basic text messaging service. Compare with MMS.

• **snapshot**

  —A copy of a virtual machine (VM) at a moment in time. Can be used to revert the VM if problems arise later.

• **SNMPv3**

  —Simple Network Management Protocol version 3. A protocol used to monitor and manage network devices such as routers and switches.

• **SoC**

  —System on a chip. An integrated circuit that includes a computing system within the hardware. Many mobile devices include an SoC.

• **social engineering**

  —The practice of using social tactics to gain information. Social engineers attempt to gain information from people or get people to do things they wouldn’t normally do.

• **something you are**

  —An authentication factor using biometrics, such as a fingerprint scanner.

• **something you do**

  —An authentication factor indicating action, such as gestures on a touch screen.

• **something you have**

  —An authentication factor using something physical, such as a smart card or token.

• **something you know**

  —An authentication factor indicating knowledge, such as a password or PIN.

• **somewhere you are**

  —An authentication factor indicating location, often using geolocation technologies.

• **spam**

  —Unwanted or unsolicited email.

• **spam filter**

  —A method of blocking unwanted email.

• **spear phishing**

  —A targeted form of phishing. Attempts to target specific groups of users or even a single user.

• **split tunnel**

  —An encrypted VPN connection where only traffic going to private IP addresses is encrypted. Compare with full tunnel.

• **spyware**

  —Software installed on users’ systems without their awareness or consent. Monitors the user’s computer and activity.

• **SRTP**

  —Secure Real-time Transport Protocol. A protocol used to encrypt and provide authentication for RTP traffic (audio/video streaming).

• **SSH**

  —Secure Shell. A protocol used to encrypt network traffic. Uses TCP port 22.

• **SSID**

  —Service set identifier. The name of a wireless network. Disabling SSID broadcast hides it from casual users.

• **SSL**

  —Secure Sockets Layer. The predecessor to TLS. Used to encrypt data-in-transit with the use of certificates.

• **SSL decryptors**

  —Devices used to create separate SSL/TLS sessions. Allow other security devices to examine encrypted traffic.

• **SSL/TLS accelerators**

  —Devices used to handle TLS traffic. Servers can off-load TLS traffic to improve performance.

• **SSO**

  —Single sign-on. An authentication method where users can access multiple resources using a single account.

• **standard operating procedures (SOPs)**

  —A document that provides step-by-step instructions on how to perform common tasks or routine operations.

• **stapling**

  —The process of appending a digitally signed OCSP response to a certificate. Reduces OCSP traffic sent to a CA.

• **STARTTLS**

  —A command (not an acronym) used to upgrade an unencrypted connection to an encrypted connection on the same port.

• **steganography**

  —The practice of hiding data within data. Example: embedding text files within an image.

• **storage segmentation**

  —A method used to isolate data on mobile devices. Allows personal data and encrypted corporate data to be stored separately.

• **stored procedures**

  —A group of SQL statements that execute as a whole. Developers use stored procedures to prevent SQL injection attacks.

• **STP**

  —Spanning Tree Protocol. A protocol enabled on most switches that protects against switching loops.

• **stream cipher**

  —An encryption method that encrypts data as a stream of bits or bytes. Compare with block cipher.

• **substitution cipher**

  —An encryption method that replaces characters with other characters.

• **supply chain assessment**

  —An evaluation of the supply chain needed to produce and sell a product.

• **switch**

  —A network device used to connect devices. Layer 2 switches send traffic based on MAC addresses. Layer 3 switches send traffic based on IP addresses and support VLANs.

• **symmetric encryption**

  —A type of encryption using a single key to encrypt and decrypt data. Compare with asymmetric encryption.

• **system sprawl**

  —A vulnerability that occurs when an organization has more systems than it needs, and systems it owns are underutilized. Compare with VM sprawl.

---

T

• **tabletop exercise**

  —A discussion-based exercise where participants talk through an event while sitting at a table or in a conference room. Often used to test business continuity plans.

• **TACACS+**

  —Terminal Access Controller Access-Control System Plus. An authentication service that provides central authentication for remote access clients. Can be used as an alternative to RADIUS.

• **tailgating**

  —A social engineering attack where one person follows behind another without using credentials. Mantraps help prevent tailgating.

• **taps**

  —Monitoring ports on a network device. IDSs use taps to capture traffic.

• **tcpdump**

  —A command-line protocol analyzer. Used to capture packets.

• **technical controls**

  —Security controls implemented through technology.

• **tethering**

  —The process of sharing an Internet connection from one mobile device to another.

• **thin AP / controller-based AP**

  —An AP that is managed by a controller. Compare with fat AP.

• **third-party app store**

  —An app store other than the primary source for mobile device apps (App Store or Google Play).

• **threat**

  —Any circumstance or event that has the potential to compromise confidentiality, integrity, or availability. Compare with risk and vulnerability.

• **threat assessment**

  —An evaluation of potential threats. Common types: environmental, manmade, internal, and external.

• **three-way handshake**

  —A method used by TCP to create a TCP/IP connection between a local host/client and server.

  • Both client and server exchange SYN, SYN-ACK, ACK packets before actual data communication begins.

• **time-of-day restrictions**

  —An account restriction that prevents users from logging on at certain times.

• **TKIP**

  —Temporal Key Integrity Protocol. A legacy wireless security protocol.

  • TKIP: older encryption protocol used with WPA. Upgrade of WEP.
  • CCMP

    : newer encryption protocol used with WPA2. (recommended replacement)

• **TLS**

  —Transport Layer Security. The replacement for SSL. Used to encrypt data-in-transit. Uses certificates issued by CAs.

• **token**

  —An authentication device or file. A hardware token is a physical device (something you have factor). A software token is a small file indicating a user has logged on.

• **TOTP**

  —Time-based One-Time Password. Similar to HOTP. Uses a timestamp instead of a counter. One-time passwords created with TOTP expire after 30 seconds.

• **TPM**

  —Trusted Platform Module. A hardware chip on the motherboard included with many laptops and mobile devices. Provides full disk encryption. Compare with HSM.

• **Tracert / Traceroute**

  —Network diagnostic commands for displaying the route (path) and measuring transit delays of packets across an IP network. Uses small TTL values. Helps identify where a connection stops or breaks (firewall, ISP, router, etc.).

• **transitive trust**

  —An indirect trust relationship created by two or more direct trust relationships.

• **Trojan**

  —Malware also known as a Trojan horse. Often looks useful, but is malicious.

• **trusted operating system**

  —An operating system configured to meet a set of security requirements. Ensures only authorized personnel can access data based on their permissions.

• **Twofish**

  —A symmetric key block cipher. Encrypts data in 128-bit blocks, supports 128-, 192-, or 256-bit keys. Compare with Blowfish.

• **Type I hypervisors**

  —Bare-metal hypervisors that run directly on the system hardware. Do not need to run within an operating system.

• **Type II hypervisors**

  —Hypervisors that run as software within a host operating system. Example: Microsoft Hyper-V.

• **Typo squatting / URL hijacking**

  —The purchase of a domain name close to a legitimate domain name. Attackers try to trick users who inadvertently use the wrong domain name.

---

U

• **UAVs**

  —Unmanned aerial vehicles. Flying vehicles piloted by remote control or onboard computers.

• **UEFI**

  —Unified Extensible Firmware Interface. A method used to boot some systems. Intended to replace BIOS firmware.

• **URL hijacking**

  —The purchase of a domain name close to a legitimate domain name. Also called typo squatting.

• **USB OTG**

  —Universal Serial Bus On-The-Go. A cable used to connect mobile devices to other devices.

• **use case**

  —A methodology used in system analysis and software engineering to identify and clarify requirements to achieve a goal.

• **UTM**

  —Unified threat management. A group of security controls combined in a single solution. UTM appliances inspect data streams for malicious content and block it.

---

V

• **VDI/VDE**

  —Virtual desktop infrastructure / environment. Users access a server hosting virtual desktops and run the desktop operating system from the server.

• **vendor diversity**

  —The practice of implementing security controls from different vendors to increase security. Compare with control diversity.

• **version control**

  —A method of tracking changes to software as it is updated.

• **virtualization**

  —A technology that allows hosting multiple virtual machines on a single physical system. Types: Type I, Type II, and application cell/container virtualization.

• **virus**

  —Malicious code that attaches itself to a host application. The host application must be executed to run, and the malicious code executes when the host application runs.

• **VLAN**

  —Virtual local area network. A method of segmenting traffic. Logically groups different computers together without regard to their physical location.

• **VM escape**

  —An attack that allows an attacker to access the host system from within a virtual machine. Primary protection: keep hosts and guests up to date with current patches.

• **VM sprawl**

  蔓延—A vulnerability that occurs when an organization has many VMs that aren’t properly managed. Unmanaged VMs are not kept up to date with current patches. Compare with system sprawl.

• **Voice recognition**

  —A biometric method that identifies who is speaking using speech recognition methods.

• **VPN**

  —Virtual private network. A method that provides access to a private network over a public network such as the Internet.

  • VPN concentrators

    : dedicated devices used to provide VPN access to large groups of users.

• **Vulnerability**

  —A weakness. Can be a weakness in hardware, software, configuration, or users.

  • threat

    —Any circumstance or event that has the potential to compromise confidentiality, integrity, or availability.

  • risk

    —The possibility or likelihood of a threat exploiting a vulnerability resulting in a loss.

• **Vulnerability scanner**

  —A tool used to detect vulnerabilities. Identifies vulnerabilities, misconfigurations, and lack of security controls. Tests security controls passively.

---

W

• **warm site**

  —An alternate location for operations. A compromise between an expensive hot site and a cold site. Compare with cold site and hot site.

• **waterfall**

  —A software development life cycle model using a top-down approach.

  • Uses multiple stages with each stage starting after the previous stage is complete.
  • Compare with agile.
• **watering hole attack**

  —An attack method that infects web sites that a group is likely to trust and visit.

• **wearable technology**

  —Smart devices that a person can wear or have implanted.

• **web application firewall (WAF)**

  —A firewall specifically designed to protect a web application. Inspects the contents of traffic to a web server and can detect and block malicious content.

• **WEP**

  —Wired Equivalent Privacy / Wireless Encryption Protocol. Initialization vectors are relatively small and get reused frequently. Legacy wireless security protocol.

• **whaling**

  —A form of spear phishing that attempts to target high-level executives.

• **white box test**

  —A type of penetration test. Testers have full knowledge of the environment. Compare with black box test and gray box test.

• **Wi-Fi Direct**

  —A standard that allows devices to connect without a wireless access point.

• **wildcard certificate**

  —A certificate that can be used for multiple domains with the same root domain. Starts with an asterisk (*).

• **wiping**

  —The process of completely removing all remnants of data on a disk. A bit-level overwrite writes patterns of 1s and 0s multiple times.

• **wireless scanners**

  —A network scanner that scans wireless frequency bands. Can discover rogue APs and crack passwords used by wireless APs.

• **worm**

  —Self-replicating malware that travels through a network. Worms do not need user interaction to execute.

• **WPA**

  —Wi-Fi Protected Access. A legacy wireless security protocol. Superseded by WPA2.

• **WPA2**

  —Wi-Fi Protected Access II. A wireless security protocol.

  • Supports CCMP for encryption, based on AES.
  • Can use Open mode, a pre-shared key, or Enterprise mode.
• **WPS**

  —Wi-Fi Protected Setup. A method that allows users to easily configure a wireless network using only a PIN. WPS brute force attacks can discover the PIN.

• **WPS attack**

  —An attack against an AP. Discovers the eight-digit WPS PIN and uses it to discover the AP passphrase.

---

X

• **XML**

  —Extensible Markup Language. A language used by many databases for inputting or exporting data. Uses formatting rules to describe the data.

• **XOR**

  —A logical operation used in some encryption schemes.

  • XOR operations compare two inputs (^). If the two inputs are the same, it outputs 0. If the two inputs are different, it outputs 1.
  • 1 XOR 0 = 1, 0 XOR 1 = 1
  • 1 XOR 1 = 0, 0 XOR 0 = 0
• **XSS (Cross-Site Scripting)**

  —A type of injection in which malicious scripts are injected into trusted websites.

  • XSS attacks occur when an attacker uses a web application to send malicious code (generally a browser-side script) to a different end user.

---

Z

• **zero-day vulnerability**

  —A vulnerability or bug that is unknown to trusted sources but can be exploited by attackers.

  • Zero-day attacks

    take advantage of zero-day vulnerabilities.

---

Key Takeaways

• The CIA triad (Confidentiality, Integrity, Availability) underpins all of security.
• Risk formula: SLE × ARO = ALE.
• Authentication factors: something you know, have, are, do, or somewhere you are.
• Encryption modes: ECB (weakest), CBC (IV + XOR chain), CTM (IV + counter), GCM (CTM + hash).
• Access control models: DAC (owner-controlled), MAC (label-based), RBAC (role-based), ABAC (attribute-based), Rule-BAC (rule-triggered).
• Mobile deployment models: BYOD, COPE, CYOD.
• Backup types: full, differential (since last full), incremental (since last full or incremental).
• Recovery sites: hot (60 min), warm (hours), cold (days).
• Penetration test types: black box (zero knowledge), gray box (some knowledge), white box (full knowledge).
• Wireless security evolution: WEP → WPA (TKIP) → WPA2 (CCMP/AES).

References

• CompTIA Security+ Study Guide (source: Scrivener backup Appendix A, created 2019-2020)