Chapter 4: Vulnerability Assessment And Mitigating Attacks

Front 1

Annualized Loss Expectancy(ALE):

Back 1

The expected monetary loss that that can be expected for an asset due to a risk over a one-year period

Front 2

Annualized Rate of Occurrence(ARO):

Back 2

The probability that a risk will occur in a particular year.

Front 3

architectural design:

Back 3

The process of defining a collection of hardware and software components along with their interfaces in order to create the framework for software develpment

Front 4

attack surface:

Back 4

The code that can be executed by unauthorized users in a software program.

Front 5

baseline reporting:

Back 5

A comparison of the present state of a system compared to its baseline.

Front 6

blackbox:

Back 6

A test in which the tester has no prior knowledge of the network infrastructure that is being tested.

Front 7

code review:

Back 7

Presenting the code to multiple reviewers in order to reach agreement about its security.

Front 8

design review:

Back 8

an analysis of the design of a software program by key personnal from different levels of the project

Front 9

Exposure Factor(EF):

Back 9

The proportion of an assets value that is likely to be destroyed by a particular risk(expressed as a percentage)

Front 10

fail-open:

Back 10

A control that errs on the side of permissiveness in the event of failure.

Front 11

fail-safe(fail-secure):

Back 11

A control that errs on the side of security in the event of a failure.

Front 12

gray box:

Back 12

A test where some limited information has been provided to the tester.

Front 13

hardening:

Back 13

The process of eliminating as many security risk as possible and making the system more secure.

Front 14

honeynet:

Back 14

A network set up with intentional vulnerabilities

Front 15

honeypot:

Back 15

A computer typically located in an area with limited security and loaded with software and data files that appears to be authentic yet they are actually imitations of real data files, to trick attackers into revealing their attack techniques.

Front 16

penetration testing:

Back 16

A test by an outsider to actually exploit any weaknesses in systems that are vulnerable.

Front 17

port scanner:

Back 17

Software to search a system for any port vulnerabilities.

Front 18

Protocol analyzer(sniffer):

Back 18

Hardware or software that captures packets to decode and analyze the contents

Front 19

Single Loss Expectancy(SLE):

Back 19

The expected monetary loss everytime a rick occurs.

Front 20

Vulnerability assessment:

Back 20

A systematic and methodical evaluation of the exposure of assets to attackers, forces of nature, or any other entity, that is a potential harm.

Front 21

Vulnerability scan:

Back 21

An automated software search through a system for any known security weaknesses that then creates a report of those potential exposures.

Front 22

Vulnerability scanner:

Back 22

Generic term for a range of products that look for vulnerabilities in networks or systems.

Front 23

white box:

Back 23

A test where the tester has an in-depth knowledge of the network and systems being tested, including network diagrams, IP addresses, and even the source code of custom applications.

Front 24

Xmas Tree port scan:

Back 24

Sending a packet with every option set on for whatever protocol is in use to observe how a host responds.