Various

Front 1

Order of Volatility -1

Back 1

Data in cache memory - processor cache/hard drive cache

Front 2

Order of Volatility - 2

Back 2

Data in RAM, including system and network processes

Front 3

Order of Volatility - 3

Back 3

Swap file or paging file on system disk drive

Front 4

Order of Volatility - 4

Back 4

Data stored on local disk drives

Front 5

Order of Volatility - 5

Back 5

Logs stored on remote systems

Front 6

Order of Volatility - 6

Back 6

Archive media

Front 7

Port 21

Back 7

FTP control/command

Front 8

Port 22

Back 8

Ssh/ SFTP/scp/ secure logins, port forwarding

Front 9

Port 25

Back 9

SMTP, client --->>>servers

Front 10

Port 53

Back 10

DNS

Front 11

Port 80

Back 11

Http

Front 12

Port 110

Back 12

Popv3; exchange --->>>client

Front 13

Port 139

Back 13

NetBIOS session service; osi-5 session layer

Front 14

Port 143

Back 14

IMApv4; used to store email on servers and for clients to manage email; app layer

Front 15

Port 443

Back 15

Https; app layer

Front 16

Port 3389

Back 16

Rdp; app layer

Front 17

802.1x

Back 17

Port-based Authentication protocol; used in WPA-2802.1X authentication involves three parties: a local machine, an authenticator, and an authentication server. The local machine (Supplicant) that wishes to attach to the LAN/WLAN. The term 'local machine' is also used interchangeably to refer to the software running on the client that provides credentials to the authenticator. The authenticator is a network device, such as an Ethernet switch or wireless access point; and the authentication server is typically a host running software supporting the RADIUS and EAP protocols

Front 18

AAA

Back 18

Authentication, Authorization, and Accounting

Front 19

ACE

Back 19

Access Control Entry

Front 20

ACL

Back 20

Access Control List

Front 21

ALE

Back 21

Annualized Loss Expectancy = SLE x ARO

Front 22

Ascii

Back 22

American standard code for information interchange

Front 23

API

Back 23

Application Programming Interface

Front 24

ARO

Back 24

Annualized Rate of Occurrence = ale/sle

Front 25

ASP

Back 25

Application Service Provider

Front 26

BAC

Back 26

Business Availability Center; app showing Availability/perf of business owned or licensed apps

Front 27

BIOS

Back 27

Basic Input/output

Front 28

BPA

Back 28

Business partners agreement; includes obligations toward the partnership

Front 29

CAC

Back 29

Common access card

Front 30

CAN

Back 30

Controller Area Network; standard that allows microcontrollers and devices to communicate

Front 31

CAR

Back 31

Corrective action report; part of IRP

Front 32

CCMP

Back 32

Counter-mode cipher block chaining message authentication code protocol; encryption based on AES and used with WPA2; more secure than TKIP

Front 33

CERT

Back 33

Computer Emergency Response Team; Carnegie-Melon

Front 34

CIRT

Back 34

Computer incident response team

Front 35

COOP

Back 35

Continuity of Operations planning; sites, succession plan

Front 36

CP

Back 36

Contingency Planning

Front 37

CRC

Back 37

Cyclical Redundancy Check; error detection code used to check for accidental changes which can affect data integrity

Front 38

CSR

Back 38

Cert signing request

Front 39

CSU

Back 39

Control service unit- line bridging device

Front 40

CVE

Back 40

Common vulnerabilities and Exchange

Front 41

DAC

Back 41

Discretionary Access Control; owners can modify permissions from files/folders; highly flexible insecure

Front 42

DACL

Back 42

Discretionary Access Control List; AD list of ACE (access control entries

Front 43

dBd

Back 43

Decibels-dipole; identifies gain of antenna compared with a dipole antenna; higher dBd = higher transmission/reception power

Front 44

dBi

Back 44

Decibels-isotropic; measures gain of antenna; used with omni directional attennas

Front 45

dBm

Back 45

Decibels-milliwatt; identifies power level of the WAP and refers to the power ratio in decibels referenced to one milliwatt

Front 46

DEP

Back 46

Data execution prevention; prevents all or program from running code in nonexecutable area

Front 47

DLL

Back 47

Dynamic link library; compiled set of code which can be linked to other programs

Front 48

DNAT

Back 48

Dynamic network address translation; dnat format that uses multiple public IP addresses

Front 49

DNAT.

Back 49

Destination Network Address Translation. A form of NAT tha t changes the destination IP address for incoming traffic; used for port forwarding

Front 50

DRP

Back 50

Disaster recovery plan

Front 51

DSU

Back 51

Data service unit; system used to connect equip on T1 line

Front 52

EFS

Back 52

Encrypting file system; windows ntfs

Front 53

FACL

Back 53

File system access control list; acl used for file systrms

Front 54

FDE

Back 54

Full disk encryption

Front 55

FCoE

Back 55

Fibre Channel over Ethernet

Front 56

GRE

Back 56

Generic Routing Encapsulation; is a tunneling protocol developed by Cisco Systems that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network.

Front 57

HIDS

Back 57

Host based intrusion detection system

Front 58

HIPS

Back 58

Host-based intrusion prevention system

Front 59

HOTP

Back 59

HMAC-based one time PW; open standard for creating one time passwords

Front 60

ICMP

Back 60

Internet control message protocol; used to control network devices; common to block at firewall/router; if ping fails but other connections work ICMP is blocked

Front 61

IGMP

Back 61

Internet group management protocol; used for multicasting; comps belong to multicasting group have a multicasting IP address

Front 62

IIS

Back 62

INTERNET info services

Front 63

IR

Back 63

Incident response

Front 64

IRC

Back 64

Internet Relay Chat; a form of real-time internet text messaging sometimes used by botnets

Front 65

IRT

Back 65

Incident response team; group of experts who respond to Sec incidents

Front 66

ISA

Back 66

Interconnection Security agreement; specifies technical and Sec requirements

Front 67

ITCP

Back 67

IT Contingency Planning; ; part of risk management

Front 68

KDC

Back 68

Key distribution center; typical operation with a KDC involves a request from a user to use some service. The KDC will use cryptographic techniques to authenticate requesting users as themselves. It will also check whether an individual user has the right to access the service requested. If the authenticated user meets all prescribed conditions, the KDC can issue a ticket permitting access.

Front 69

LANMAN

Back 69

LANMAN; older authentication protocol used to provide backward compatibility to Windows9x clients

Front 70

L2TP

Back 70

Does not encrypt or provide confidentiality by itself; commonly used with IPSec for the purpose of encryption confidentiality

Front 71

Ldap

Back 71

Port 389; SLDAP -port 636

Front 72

LEAP

Back 72

Lightweight extensible authentication protocol; modified version of CHAP - Challenge authentication handshake protocol; used in WEP; WEP and mutual authentication (between a Radius server). Allows for clients to re-authenticate frequently.

Front 73

MBR

Back 73

Master Boot Record - area on hd in first sector

Front 74

MAN

Back 74

Metropolitan Area Network

Front 75

MITM

Back 75

Man in the middle; kerberos provides authentication and helps prevent MITM attacks

Front 76

MPLS

Back 76

Multi-protocol layer switch; WAN topology provided by telecoms

Front 77

MS-CHAP

Back 77

MS-CHAPv2 provides mutual authentication

Front 78

MTBF

Back 78

Mean time between failures

Front 79

MTTF

Back 79

Mean Time to Failure; meausre of systems reliability in hours

Front 80

MTTR

Back 80

Mean time to recovery; average time it takes to recover

Front 81

MTU

Back 81

Maximum transmission unit

Front 82

NDA

Back 82

Non disclosure agreement

Front 83

NDP

Back 83

Neighbor discovery protocol; ipv6 - similar to arp; performs autoconfig of device IPv6 addresses and discovers other devices on the network

Front 84

NIDS

Back 84

Network Based Intrusion Detection SyStem

Front 85

NIPS

Back 85

Network intrusion prevention system

Front 86

NOP

Back 86

No operation; used in buffer overflow attacks

Front 87

Network Operating System

Back 87

Software that runs on a server to manage resources on a network

Front 88

NTFS

Back 88

NT file system uses DAC model

Front 89

NTLM

Back 89

New tech LANMAN; stores pws in two 7 character blocks and then converting all lowercase letters to uppercase

Front 90

OCSP

Back 90

Online certificate status protocol; alternative to CRL; returns good, revoked, unknow

Front 91

OSI

Back 91

Open systems interconnection; osi model

Front 92

OVAL

Back 92

Open Vulnerability Assessment Language; international standard proposed for Vulnerability Assessment scanners to follow

Front 93

PAC

Back 93

Proxy Auto configuration; method used to autoconfig systems to use a proxy server

Front 94

PAM

Back 94

Pluggable authentication module; library of APIs used for authentication-related services

Front 95

PAN

Back 95

Personal Area Network

Front 96

PAP

Back 96

PW authentication protocol; older authentication protocol; used clear text to send PWs;

Front 97

PAT

Back 97

Port address translation; form of NAT that translates public IP addresses to private IP addresses; private IPs --->>>Public IPs

Front 98

PBX

Back 98

Private branch exchange; telephone switch used with telephone calls

Front 99

PCAP

Back 99

Packet capture

Front 100

PEAP

Back 100

Protected extensible authentication protocol; extra layer protection for peap; sometimes used with 802.1x; requires a cert on 802.1x server, doesn't require a cert on client side; uses MSCHAP primarily

Front 101

PIV

Back 101

Personal Identity Verification card

Front 102

POTS

Back 102

Plain-old telephone system; voice-grade telephone service using traditional telephone wires

Front 103

RADIUS

Back 103

Remote Authentication Dial-In user system; provides central Authentication for remote access users; e.g. AOL; uses symmetric encryption to encrypt PW packets and UDP for rest of Authentication process; TACACS+ encrypts full process

Front 104

RAID

Back 104

Redundant Array of Disks

Front 105

RAID-0

Back 105

Disk stirping; no parity

Front 106

RAID-1

Back 106

Disk mirroring

Front 107

RAID-5

Back 107

Disk striping with parity; 3 or more disks; can survive single drive failure

Front 108

RAID-6

Back 108

Disk striping with parity; uses four or more disks and can survive the failure of two drives

Front 109

RAS

Back 109

Remote Access Service; dial-up or vpn to connect to network

Front 110

RAT

Back 110

Remote Access Tool; commonly used by APTs; gives attacker full control over a user's system from remote location; e.g. RDP

Front 111

RC

Back 111

Ron's code

Front 112

RFI

Back 112

Radio Frequency Interference; interference from AM/FM transmitters etc.

Front 113

RFID

Back 113

Radio Frequency ID; often used in inventory control

Front 114

RPO

Back 114

Recovery Point Objective; amount of data you can afford to lose; point in time where data loss is accepable; related to

Front 115

RTP

Back 115

Real-time protocol; standard used for delivering audio and video over an IP network;

Front 116

S/MIME

Back 116

Secure/Multipurpose Internet Mail Extensions; provides confidentiality, integrity, authentication, and non-repudiation; can digitally sign and encrypt email, including encyrption of email at rest; uses RSA with public and private keys for encyrption/decryption and PKI for certificates

Front 117

RTSP

Back 117

Rapid Tree Spanning protocol

Front 118

SAML

Back 118

Security Assertions Markup Language; XML-based standard used to exchange authentication and authorization info between different parties

Front 119

SAN

Back 119

Storage Area Network; specialized network of high-speed storage devices

Front 120

SCADA

Back 120

Supervisory Control and data acquisitions

Front 121

SCAP

Back 121

Security content Automation Procol; set of security specifications for various applications OSs

Front 122

SCEP

Back 122

Simple Certificate Enrollment Protocol; method for requesting a cert from a CA

Front 123

SCSI

Back 123

Small Computer Sys interface; set of standards used to connect peripherals to computers;

Front 124

SDLM

Back 124

Software Dev Life Cycle Management

Front 125

SEH

Back 125

Structured Exception Handler; module within an app that handles errors or exceptions; prevents applications from crashing or responding to events that can be exploited by attackers

Front 126

SELinux

Back 126

Sec-Enhanced Linux; Uses MAC model

Front 127

SHTTP

Back 127

SecureHTTP; https alternative rarely used

Front 128

SID

Back 128

Sec Identifier; Used in MS environs

Front 129

SIEM

Back 129

Sec Info and Event Management; sec system looking at sec events throughout an organization

Front 130

SIM

Back 130

Subscriber Identity Module

Front 131

SIRT

Back 131

Sec Identity Response team

Front 132

SONET

Back 132

Sychron Optical Network Tech; multiplexing protocol used to transfer data over fiber-optics

Front 133

SPOF

Back 133

Single Point of Failure

Front 134

SSTP

Back 134

Securee Socket Tunneling Protocol; encrypts VPN traffic over TCP 443

Front 135

TACACS+

Back 135

Terminal Access Controller Access-Control System+; Provides central authentication for remote access clients; used as alternative to RADIUS; port 49

Front 136

TFTP

Back 136

port 69; Trivial File Transfer Protocol

Front 137

TGT

Back 137

Ticket Granting Ticket

Front 138

TKIP

Back 138

Trusted Key Integrity Protocol; addressed problem with WEP; used with WPA; uses RC4

Front 139

TOTP

Back 139

Time-based one time password

Front 140

TPM

Back 140

TRusted platform module; chip on motherboard included on newer laptops

Front 141

TSIG

Back 141

Transaction Signature; a method of securely providing updates to DNS with use of authentication

Front 142

UAT

Back 142

User Acceptance Testing

Front 143

UDP

Back 143

user datagram protocol

Front 144

UEFI

Back 144

Unified Extensible Firmware Interface;

Front 145

UPS

Back 145

Uninterruptible Power supply

Front 146

URI

Back 146

Unfirom Resource IDentifier; always includes the protocol; https://, https

Front 147

UTM

Back 147

Unified Threat management; sec appliance that combined multiple sec controls into a single solution;

Front 148

UTP

Back 148

Unshielded twisted pairs

Front 149

VDI

Back 149

virtualization desktop interface

Front 150

VLAN

Back 150

Virtualization local area network

Front 151

VSAN

Back 151

Virtual Storage Area Network

Front 152

WAF

Back 152

Web-app firewall; put it on a web server

Front 153

WAP

Back 153

Wireless application point

Front 154

WEP

Back 154

Wired equivalent privacy; wifi v1; security flaws; used RC4 incorrectly;; 10-26 hexadecimal

Front 155

WIPS

Back 155

Wireless Intrusion detection system

Front 156

WIDS

Back 156

Wireless Intrusion Detection System

Front 157

WPA

Back 157

Wifi protected access; replaced WEP; used TKIP with RC4; later versions used AES; in WPA attacks hackers captured four-way authentication handshake and then used brute-force to break it; 40-104bit encryption key which must be manually entered and doesn't change; WPA PSK - WPA personal; WPA-Enterpise - WPA-802.1x mode Enterprise , requires Radius server

Front 158

WPA2

Back 158

Wifi protected access 2; uses CCMP (AES-based); uses 802.1x authentication server in WPA2 enterprise

Front 159

WTLS

Back 159

Wireless transport Layer Security; used to encrypt traffic for smaller wireless devices

Front 160

XML

Back 160

Xtensible Markup Language; used by many DBs for inputting or exporting data

Front 161

XTACACS

Back 161

Extended Terminall Access Controller Access-Control system; Cisco propietary

Front 162

Security Baselining

Back 162

First step is create written security policy different tools to deploy the policy: sec templates, imaging, and Group Policy - account settings, password and account lockout policies, audit policies, user rights system service software restrictions;

Front 163

IMaging

Back 163

Three parts: 1) Source system; 2) Image Server; 3) Deploy images to clients

Front 164

Configuration Baseline

Back 164

config settings for a system (e.g. printer configuration, application settings, and TCP/IP settings

Front 165

USGCB

Back 165

US Gov Config Baseline: standard images

Front 166

Host Software Baselines

Back 166

all software installed on a system, along with a list of approved software; app baseline

Front 167

App COnfig Baselines

Back 167

Proper settings for applications; only refer to settings for applications

Front 168

performance baselines

Back 168

overall performance of a system at a point in time; difference between baseline and actual performance allows admin to identify problems

Front 169

EAP

Back 169

Extensible authentication protocol; Authentication framework-not a specific authentication mechanism; EAP-MD5;

Front 170

EAP- TLS

Back 170

uses/require client side certificates

Front 171

OSI Layers

Back 171

Please do not teach students pointless acronyms; physical data network transport session presentation application

Front 172

PPP

Back 172

Point to Point tunnelling protocol; typically is in phone lines; supports EAP

Front 173

CHAP

Back 173

Challenge handshake authentication protocol; primarily used for RA PPP connections; PAPs successor; When client wants to logon --

Server---Challenge --> Client .

Client---Challenge (hashed) un/pw combo and a random number-->> Server

Server performs same encryption

Front 174

Kerberos

Back 174

Port 88

3 players: Client, Target Server, KDC

3 parts: a) Authentication exchange, - client logs on after verfication gets TGT from KDC

b) TGS - using TGT and logon session key - client request a new session key and tick for use w/target server

c) CS Exchange - client sends the new ticket to target server

Front 175

Mutual Authentication

Back 175

Client authenticates to service

Service Authenticates to client

Front 176

x500

Back 176

used by LDAP

Front 177

Diameter

Back 177

AAA protocol; replaced RADIUS; uses TCP and SCTP instead of UDP; can encapsulate EAP messages