H Annex Vocab

Front 1

accounting

Back 1

the ability that provides tracking of events

Front 2

asset

Back 2

an item that has value

Front 3

authorization

Back 3

the act of ensuring that an individual or element is genuine

Front 4

authentication

Back 4

the steps that ensure that the individual is who they claim to be

Front 5

availability

Back 5

security actions that ensure that data is accessible to authorized users

Front 6

California's Database Security Breach Notification Act

Back 6

the first state law that covers any stat agency, person, or company that does business in California

Front 7

confidentiality

Back 7

security actions that ensure only authorized parties can view the information

Front 8

cybercrime

Back 8

targeted attacks against financial networks, unauthorized access to information, and the theft of personal information

Front 9

cybercriminals

Back 9

a network of attackers, identity thieves, spammers, and financial fraudsters

Front 10

cyber-terrorism

Back 10

a premeditated, politically motivated attack against information, computer systems, computer programs, and data that results in violence

Front 11

cyber-terrorists

Back 11

attackers whose motivation may be defined as ideology, or attacking for the sake of their principles or beliefs

Front 12

exploiting

Back 12

the act of taking advantage of a vulnerability

Front 13

Gramm-Leach-Bliley Act (GLBA)

Back 13

a law that requires banks and financial institutions to alert customers of their policies and practices in disclosing customer information

Front 14

Hacker

Back 14

a term used to refer to a person who uses advanced computer skills to attack computers

Front 15

Health Insurance Portability and Accountability Act (HIPAA)

Back 15

a law designed to guard protected health information and implement policies and procedures to safeguard it

Front 16

identity theft

Back 16

stealing another person's personal information, such as a Social Security number, and then using the information to impersonate the victim, generally for financial gain

Front 17

information security

Back 17

the tasks of securing information that is in a digital format

Front 18

integrity

Back 18

security actions that ensure that information is correct and no unauthorized person or malicious software has altered the data

Front 19

risk

Back 19

the likelihood that a threat agent will exploit the vulnerability

Front 20

Sarbanes-Oxley Act (Sarbox)

Back 20

a law designed to fight corporate corruption

Front 21

script kiddies

Back 21

individuals who want to break into computers to create damage, yet lack the advanced knowledge of computers and networks needed to do so

Front 22

spy

Back 22

a person who has been hired to break into a computer and steal information

Front 23

threat

Back 23

a type of action that has the potential to cause harm

Front 24

threat agent

Back 24

a person or element that has the power to carry out a threat

Front 25

vulnerability

Back 25

a flaw or weakness that allows a threat agent to bypass security

Front 26

adware

Back 26

a software program that delivers advertising content in a manner that is unexpected and unwanted by the user

Front 27

backdoor

Back 27

software code that gives access to a program or a service that circumvents normal security protections

Front 28

botnet

Back 28

a logical computer network of zombies under the control of an attacker

Front 29

computer virus (virus)

Back 29

a malicious computer code that, like its biological counterpart, reproduces itself on the same computer

Front 30

dumpster diving

Back 30

the act of digging through trash receptacles to find information that can be useful in an attack

Front 31

hoax

Back 31

a false warning

Front 32

impersonation

Back 32

an attack that creates a fictitious character and then plays out the role of that person on a victim

Front 33

keylogger

Back 33

captures and stores each keystroke that a user types on the computer's keyboard

Front 34

logic bomb

Back 34

computer code that lies dormant until it is triggered by a specific logical event

Front 35

malware

Back 35

software that enters a computer system without the user's knowledge or consent, and then performs an unwanted--and usually harmful--action

Front 36

pharming

Back 36

a phishing attack that automatically redirects the user to a fake site

Front 37

phishing

Back 37

sending an e-mail or displaying a web announcement that falsely claims to be from a legitimate enterprise in an attempt to trick the user into surrendering private information

Front 38

rootkit

Back 38

a set of software tools used by an attacker to hide the actions or presence of other types of malicious software

Front 39

shoulder surfing

Back 39

watching an authorized user enter a security code on a keypad

Front 40

social engineering

Back 40

a means of gathering information for an attack by relying on the weaknesses of individuals

Front 41

spam

Back 41

unsolicited e-mail

Front 42

spear phishing

Back 42

a phishing attack that targets only specific users

Front 43

spim

Back 43

a variation of spam, which targets instant messaging users instead of e-mail users

Front 44

spyware

Back 44

a general term used to describe software that spies on users by gathering information without consent, thus violating their privacy

Front 45

tailgating

Back 45

the act of unauthorized individuals entering a restricted-access building by following an authorized user

Front 46

Trojan horse (Trojan)

Back 46

an executable program advertised as performing one activity, but actually does something else (or it may perform both the advertised and malicious activities)

Front 47

vishing

Back 47

a phishing attack that uses a telephone call instead of using e-mail

Front 48

whling

Back 48

a phishing attack that targets only wealthy individuals

Front 49

word splitting

Back 49

horizontally separating words so that they can still by read by the human eye

Front 50

worm

Back 50

a malicious program designed to take advantage of a vulnerability in an application or an operating system in order to enter a computer and then self-replicate to other computers

Front 51

add-ons

Back 51

programs that provide additional functionality to web browsers

Front 52

address resolution protocol (ARP)

Back 52

part of the tcp/IP protocol for determining the mac address based on the IP address

Front 53

arp poisoning

Back 53

an attack that corrupts the arp cache

Front 54

attachments

Back 54

files that are coupled to e-mail messages

Front 55

buffer overflow

Back 55

an attack that occurs when a process attempts to store data in ram beyond the boundaries of a fixed-length storage buffer

Front 56

client-side attack

Back 56

an attack that targets vulnerabilities in client application that interact with a compromised server or processes malicious data

Front 57

cookie

Back 57

a file on a local computer in which a server stores user-specific information

Front 58

command injection

Back 58

injecting and executing commands to execute on a server

Front 59

cross-site scripting (XSS)

Back 59

an attack that injects scripts into a web application server to direct attacks at clients

Front 60

denial of service (DoS)

Back 60

an attack that attempts to prevent a system from performing its normal functions

Front 61

directory traversal

Back 61

an attack that takes advantage of a vulnerability in the web application program or the web server software so that a user can move from the rot directory to other restricted directories

Front 62

distributed denial of service (DDos)

Back 62

an attack that uses multiple zombie computers (even hundreds or thousands) in a botnet to flood a device with requests

Front 63

DNS poisoning

Back 63

an attack that substitutes DNS addresses so that the computer is automatically redirected to another device

Front 64

domain name system (DNS)

Back 64

a hierarchical name system for matching computer names and numbers

Front 65

first-party cookie

Back 65

a cookie that is created from the web site that currently is being viewed

Front 66

flash cookie

Back 66

a cookie named after the adobe flash player. also known as local shared objects (LSOs). flash cookies cannot be deleted through the browser's normal configuration settings as regular cookies can. typically, they are saved in multiple locations on the hard drive and can take up as much as 100,000 bytes of storage per cookie (about 25 times the size of a normal cookie). flash cookies can also be used to reinstate regular cookies that a user has deleted or blocked

Front 67

host table

Back 67

a list of the mappings of names to computer numbers

Front 68

HTTP header

Back 68

part of the HTTP that is composed of fields that contain the different characteristics of the data that is being transmitted

Front 69

HTTP header manipulation

Back 69

modifying HTTP headers to create an attack

Front 70

man-in-the-middle

Back 70

an attack that intercepts legitimate communication and forges a fictitious response to the sender

Front 71

persistent cookie (tracking cookie)

Back 71

a cookie that is recorded on the hard drive of the computer and does not expire when the browser closes

Front 72

ping

Back 72

a utility that sends an icmp echo request message to a host

Front 73

ping flood

Back 73

an attack that uses the internet control message protocol (ICMP) to flood a victim with packets

Front 74

privilege escalation

Back 74

an attack that exploits a vulnerability in software to gain access to resources that the user would normally be restricted from obtaining

Front 75

replay

Back 75

an attack that makes a copy of the transmission before sending it to the recipient

Front 76

secure cookie

Back 76

a cookie that is only used when a browser is visiting a server using a secure connection

Front 77

session cookie

Back 77

a cookie that is stored in random access memory (RAM), instead of on the hard drive, and only lasts for the duration of visiting a web site

Front 78

session hijacking

Back 78

an attack in which an attacker attempts to impersonate the user by using his session token

Front 79

session token

Back 79

a form of verification used when accessing a secure web application

Front 80

smurf attack

Back 80

an attack that broadcasts a ping request to all computers on the network yet changes the address from which the request came to that of the target

Front 81

spoofing

Back 81

impersonating another computer or device

Front 82

SQL injection

Back 82

an attack that targets SQL servers by injection commands to be manipulated by the database

Front 83

syn flood attack

Back 83

an attack that takes advantage of the procedures for initiating a tcp session

Front 84

third-party cookies

Back 84

a cookie that was created by a third party that is different from the primary web site

Front 85

transitive access

Back 85

an attack involving using a third party to gain access rights

Front 86

XML (extensible markup language)

Back 86

a markup language that is designed to carry data instead of indicating how to display it

Front 87

XML injection

Back 87

an attack that injects XML tags and data into a database

Front 88

zero day attacks

Back 88

attacks that exploit previously unknown vulnerabilities, so victims have no time (zero days) to prepare or defend against the attacks

Front 89

annualized loss expectancy (ALE)

Back 89

the expected monetary loss that can be expected for an asset due to a risk over a one-year period

Front 90

annualized rate of occurrence (ARO)

Back 90

the probability that a risk will occur in a particular year

Front 91

architectural design

Back 91

the process of defining a collection of hardware and software components along with their interfaces in order to create the framework for software development

Front 92

attack surface

Back 92

the code that can be executed by unauthorized users in a software program

Front 93

baseline reporting

Back 93

a comparison of the present state of a system compared to its baseline

Front 94

black box

Back 94

a test in which the tester has no prior knowledge of the network infrastructure that is being tested

Front 95

code review

Back 95

presenting the code to multiple reviewers in order to reach agreement about its security

Front 96

design review

Back 96

an analysis of the design of a software program by key personnel from different levels of the project

Front 97

exposure factor (EF)

Back 97

the proportion of an asset's value that is likely to be destroyed by a particular risk (expressed as a percentage)

Front 98

fail-open

Back 98

a control that errs on the side of permissiveness in the event of a failure

Front 99

fail-safe (fail-secure)

Back 99

a control that errs on the side of security in the event of a failure

Front 100

gray box

Back 100

a test where some limited information has been provided to the tester

Front 101

hardening

Back 101

the process of eliminating as many security risks as possible and making the system more secure

Front 102

honeynet

Back 102

a network set up with intentional vulnerabilities

Front 103

honeypot

Back 103

a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, yet they are actually imitations of real data files, to trick attackers into revealing their attack techniques

Front 104

penetration testing

Back 104

a test by an outsider to actually exploit any weaknesses in systems that are vulnerable

Front 105

port scanner

Back 105

software to search a system for any port vulnerabilities

Front 106

protocol analyzer (sniffer)

Back 106

hardware or software that captures packets to decode and analyze the contents

Front 107

single loss expectancy (SLE)

Back 107

the expected monetary loss every time a risk occurs

Front 108

vulnerability assesment

Back 108

a systematic and methodical evaluation of the exposure of assets to attackers, forces of nature, or any other entity that is a potential harm

Front 109

vulnerability scan

Back 109

an automated software search through a system for any known security weaknesses that then creates a report of those potential exposures

Front 110

vulnerability scanner

Back 110

generic term for a range of products that look for vulnerabilities in networks or systems

Front 111

white box

Back 111

a test where the tester has an in-depth knowledge of the network and systems being tested, including network diagrams, IP addresses, and even the source code of custom applications

Front 112

Xmas tree port scan

Back 112

sending a packet with every option set on for whatever protocol is in use to observer how a host responds

Front 113

access list

Back 113

a record or list of individuals who have permission to enter a secure area, the time that they entered, and the time they left the area

Front 114

access log

Back 114

a log that can provide details regarding requests for specific files on a system

Front 115

anti-spyware

Back 115

software that helps prevent computers from becoming infected by different types of spyware

Front 116

anti-virus (AV)

Back 116

software that can examine a computer for any infections as well as monitor computer activity and scan new documents that might contain a virus

Front 117

audit log

Back 117

a log that can track user authentication attempts

Front 118

audit records

Back 118

logs that are the second common type of security-related operating system logs

Front 119

Bayesian filtering

Back 119

spam filtering software that analyzes the contents of every word in an e-mail and determines how frequently a word occurs in order to determine if it is spam

Front 120

cable lock

Back 120

a device that can be inserted into the security slot of a portable device and rotated so that the cable lock is secured to the device to prevent it from being stolen

Front 121

closed-circuit television (CCTV)

Back 121

using video cameras to transmit a signal to a specific and limited set of receivers used for surveillance in areas that require security monitoring

Front 122

cross-site request forgery (XSRF)

Back 122

an attack that uses the user's web browser settings to impersonate the user

Front 123

data loss prevention (DLP)

Back 123

a system that can identify critical data, monitor how it is being accessed, and protect it from unauthorized users

Front 124

deadbolt lock

Back 124

a door lock that extends a solid metal bar into the door frame for extra security

Front 125

errors (exceptions)

Back 125

faults in a program that occur while the application is running

Front 126

event logs

Back 126

logs that can document any unsuccessful events and the most significant successful events

Front 127

fencing

Back 127

securing a restricted area by erecting a barrier

Front 128

firewall (packet filter)

Back 128

hardware or software that is designed to prevent malicious packets from entering or leaving computers

Front 129

fuzz testing (fuzzing)

Back 129

a software testing technique that deliberately provides invalid, unexpected, or random data as inputs to a computer program

Front 130

GPS tracking

Back 130

using the global positioning system (GPS) to detect the location of a portable device

Front 131

heuristic detection

Back 131

creating a virtualized environment to simulate the central processing unit (CPU) and memory of the computer to check for the presence of a virus

Front 132

host-based software firewall

Back 132

a firewall that runs a program on a local system to protect it against attacks

Front 133

hotfix

Back 133

software that addresses a specific customer situation and often may not be distributed outside that customer's organization

Front 134

input validation

Back 134

verifying a user's input to an application

Front 135

locking cabinet

Back 135

a secure storage unit that can be used for storing portable devices

Front 136

log

Back 136

a record of events that occur

Front 137

mantrap

Back 137

a device that monitors and controls two interlocking doors to a small room (a vestibule), designed to separate secure and nonsecure areas

Front 138

patch

Back 138

a general software security update intended to cover vulnerabilities that have been discovered

Front 139

pop-up blocker

Back 139

either a program or a feature incorporated within a browser that stops pop-up advertisements from appearing

Front 140

proximity reader

Back 140

a device that detects an emitted signal in order to identify the owner

Front 141

remote wipe/sanitation

Back 141

a technology that can remotely erase data from a portable device and reset it to its default factory settings

Front 142

safe

Back 142

a ruggedized steel box with a lock

Front 143

security logs

Back 143

logs that are considered the primary source of log data

Front 144

security policy

Back 144

a document or series of documents that clearly defines the defense mechanisms an organization will employ to keep information secure

Front 145

service pack

Back 145

software that is a cumulative package of all security updates plus additional features

Front 146

signature file

Back 146

a sequence of bytes (a string) found in the virus as a virus signature

Front 147

voice encryption

Back 147

using encryption to mask the content of voice communications

Front 148

all-in-one network security appliance

Back 148

network hardware that provides multiple security functions

Front 149

anomaly-based monitoring

Back 149

a monitoring technique used by an IDS that creates a baseline of normal activities and compares actions against eh baseline. whenever a significant deviation from this baseline occurs, an alarm is raised

Front 150

behavior-based monitoring

Back 150

a monitoring technique used by an IDS that uses the normal processes and actions as the standard and compares actions against it

Front 151

demilitarized zone (DMZ)

Back 151

a separate network that rests outside the secure network perimeter; untrusted outside users can access the DMZ but cannot enter the secure network

Front 152

heuristic monitoring

Back 152

a monitoring technique used by an IDS that uses an algorithm to determine if a threat exits

Front 153

host intrusion detection system (HIDS)

Back 153

a software-based application that runs on a local host computer that can detect an attack as it occurs

Front 154

intrusion detection system (IDS)

Back 154

a device designed to be active security; it can detect an attack as it occurs

Front 155

load balancer

Back 155

a device that can direct request to different servers based on a variety of factors, such as the number of server connections, the server's processor utilization, and overall performance of the server

Front 156

network access control (NAC)

Back 156

a technique that examines the current state of a system or network device before it is allowed to connect to the network

Front 157

network address translation (NAT)

Back 157

a technique that allows private IP addresses to be used on the public internet

Front 158

network intrusion detection system (NIDS)

Back 158

a technology that watches for attacks on the network and reports back to a central device

Front 159

network intrusion prevention system (NIPS)

Back 159

a technology that monitors network traffic to immediately react to block a malicious attack

Front 160

proxy server

Back 160

a computer or an application program that intercepts a user request form the internal secure network and then processes that request on behalf of the user

Front 161

remote access

Back 161

any combination of hardware and software that enables remote users to access a local internal network

Front 162

reverse proxy

Back 162

a computer or an application program that routes incoming request to the correct server

Front 163

router

Back 163

a device that can forward packets across computer networks

Front 164

signature-based monitoring

Back 164

a monitoring technique used by an IDS that examines network traffic to look for well-known patterns and compares the activities against a predefined signature

Front 165

subnetting (subnet addressing)

Back 165

a technique that uses IP addresses to divide a network into network, subnet, and host

Front 166

switch

Back 166

a device that connects network segments and forwards only frames intended for that specific device or frames sent to all devices

Front 167

virtual LAN (VLAN)

Back 167

a technology that allows scattered users to be logically grouped together even though they may be attached to different switches

Front 168

virtual private network (VPN)

Back 168

a technology to use an unsecured public network, such as the internet, like a secure private network

Front 169

VPN concentrator

Back 169

a device that aggregates hundreds or thousands of VPN connections

Front 170

web application firewall

Back 170

a special type of firewall that looks more deeply into packets that carry HTTP traffic

Front 171

web security gateway

Back 171

a device that can block malicious content in "real time" as it appears (without first knowing the URL of a dangerous site)

Front 172

cloud computing

Back 172

a pay-per-use computing model in which customers pay only for the computing resources that they need, and the resources can be easily scaled

Front 173

disabling unused ports

Back 173

a security technique to turn off ports on a network device that are not required

Front 174

file transfer protocol (FTP)

Back 174

an unsecure TCP/IP protocol that is commonly used for transferring files

Front 175

flood guard

Back 175

a feature that controls a device's tolerance for unanswered service requests and helps to prevent a DoS attack

Front 176

FTP using secure sockets layer (FTPS)

Back 176

a TCP/IP protocol that uses secure sockets layer/ transport layer security (SSL/TLS) to encrypt commands sent over the control port (port 21) in an FTP session

Front 177

IEEE 802.1x

Back 177

a standard that blocks all traffic on a port-by-port basis until the client is authenticated using credentials stored on an authentication server

Front 178

internet control message protocol (ICMP)

Back 178

a TCP/IP protocol that is used by devices to communicate updates or error information to other devices

Front 179

internet protocol version 6 (IPv6)

Back 179

the next generation of the IP protocol that addresses weaknesses of IPv4 and provides several significant improvements

Front 180

IP telephony

Back 180

using a data-based IP network to add digital voice clients and new voice applications onto the IP network

Front 181

loop protection

Back 181

preventing broadcast storms by using the IEEE 802.1d standard spanning-tree algorithm (STA)

Front 182

MAC limiting and filtering

Back 182

a security technique to limit the number of media access control (MAC) addresses allowed on a single port

Front 183

rule-based management

Back 183

the process of administration that relies on following procedural and technical rules

Front 184

secure copy protocol (SCP)

Back 184

a TCP/IP protocol used mainly on UNIX and Linux devices that securely transports files by encrypting files and commands

Front 185

secure FTP (SFTP)

Back 185

a secure TCP/IP protocol that is used for transporting files by encrypting and compressing all data and commands

Front 186

simple network management protocol (SNMP)

Back 186

a TCP/IP protocol that exchanges management information between networked devices. it allows network administrators to remotely monitor, manage, and configure devices on the network

Front 187

transmission control protocol/internet protocol (TCP/IP)

Back 187

the most common protocol suite used today for local area networks (LANs) and the internet

Front 188

virtualization

Back 188

a means of managing and presenting computer resources by function without regard for their physical layout or location

Front 189

AES-CCMP

Back 189

the encryption protocol standard for WPA2

Front 190

bluejacking

Back 190

an attack that sends unsolicited messages to Bluetooth-enabled devices

Front 191

bluesnarfing

Back 191

an attack that accesses unauthorized information from wireless device through a Bluetooth connection, often between cell phones and laptop computers

Front 192

bluetooth

Back 192

a wireless technology that uses short-range radio frequency (RF) transmissions and provides for rapid ad hoc device pairings

Front 193

evil twin

Back 193

an AP set up by an attacker to mimic an authorized AP and capture transmissions, so a user's device will unknowingly connect to this evil twin instead

Front 194

Extensible authentication protocol (EAP)

Back 194

a framework for transporting authentication protocols that defines the format of the messages

Front 195

initialization vector (IV)

Back 195

a 24-bit value used in WEP that changes each time a packet is encrypted

Front 196

keystream attack (IV attack)

Back 196

a method of determining the keystream by analyzing two packets that were created from the same initialization vector (IV)

Front 197

lightweight EAP (LEAP)

Back 197

a proprietary EAP method developed by Cisco Systems requiring mutual authentication used for WLAN encryption using Cisco client software

Front 198

media access control (MAC) address filtering

Back 198

a method for controlling access to a WLAN based on the device's MAC address

Front 199

preshared key (PSK)

Back 199

a key value that must be created and entered into both the access point and all wireless devices ("Shared") prior to ("pre") the devices communicating with he AP

Front 200

protected EAP (PEAP)

Back 200

an EAP method designed to simplify the deployment of 802.1x by using Microsoft Windows logins and passwords

Front 201

rogue access point

Back 201

an unauthorized AP that allows an attacker to bypass many of the network security configurations and opens the network and its users to attacks

Front 202

service set identifier (SSID)

Back 202

the user-supplied network name of a WLAN; it can generally be alphanumeric from 2 to 32 characters

Front 203

SSID broadcast

Back 203

the transmission of the SSID from the access point to wireless devices

Front 204

temporal key integrity protocol (TKIP)

Back 204

a WPA encryption technology

Front 205

war chalking

Back 205

the process of documenting and then advertising the location of wireless LANs for others to use. wireless networks were identified by drawing on sidewalks or walls around the area of the network

Front 206

war driving

Back 206

searching for wireless signals from an automobile or on foot using a portable computing device

Front 207

Wi-Fi protected access (WPA)

Back 207

the original set of protections form the Wi-Fi alliance in 2003 designed to protect both present and future wireless devices

Front 208

Wi-Fi protected access 2 (WPA2)

Back 208

the second generation of WPA security from the Wi-Fi alliance in 2004 to address authentication and encryption on WLANs

Front 209

Wired Equivalent Privacy (WEP)

Back 209

an IEEE 802.11 security protocol designed to ensure that only authorized parties can view transmitted wireless information. WEP has significant vulnerabilities and is not considered secure

Front 210

access control

Back 210

the mechanism used in an information system to allow or restrict access to data or devices

Front 211

access control list (ACL)

Back 211

a set of permissions that are attached to an object

Front 212

access control model

Back 212

a standard that provides a predefined framework for hardware and software developers who need to implement access control in their devices or applications

Front 213

account expiration

Back 213

the process of setting a user's account to expire

Front 214

discretionary access control (DAC)

Back 214

the least restrictive access control model in which the owner of the object has total control over it

Front 215

extended TACACS

Back 215

the second version of the Terminal Access Control Access Control System (TACACS) authentication service

Front 216

implicit deny

Back 216

rejecting access unless a condition is explicitly met

Front 217

job rotation

Back 217

the act of moving individuals from one job responsibility to another

Front 218

kerberos

Back 218

an authentication system developed by the Massachusetts Institute of Technology (MIT) and used to verify the identity of networked users

Front 219

least privelege

Back 219

providing only the minimum amount of privileges necessary to perform a job or function

Front 220

LDAP injection attack

Back 220

an attack that constructs LDAP statements based on user input statements, allowing the attacker to retrieve information form the LDAP database or modify its content

Front 221

Lightweight directory access protocol (LDAP)

Back 221

a protocol for a client application to access an X.500 directory

Front 222

mandatory access control (MAC)

Back 222

the most restrictive access control model, typically found in military settings in which security is of supreme importance

Front 223

mandatory vacations

Back 223

requiring that all employees take vactions

Front 224

remote authentication dial in user service (RADIUS)

Back 224

an industry standard authentication service with widespread support across nearly all vendors of networking equipment

Front 225

role based access control (RBAC)

Back 225

a "real-world" access control model in which access is based on a user's job function within the organization

Front 226

rule based access control (RBAC)

Back 226

an access control model that dynamically assigns roles to subjects based on a set of rules defined by a custodian

Front 227

separation of duties

Back 227

the practice of requiring that processes should be divided between two or more individuals

Front 228

TACACS+

Back 228

the current version of the TACACS authentication service

Front 229

Terminal Access Control Access Control System (TACACS)

Back 229

an authentication service commonly used on UNIX devices that communicates by forwarding user authentication information to a centralized server.

Front 230

time of day restrictions

Back 230

limitations imposed as to when a user can log on to a system

Front 231

behavioral biometrics

Back 231

authenticating a user by the normal actions that the user performs

Front 232

brute force attack

Back 232

a password attack in which every possible combination of letters, numbers, and characters is used to create encrypted passwords that are matched with those in a stolen password file

Front 233

cognitive biometrics

Back 233

authenticating a user through the perception, thought process, and understanding of the user

Front 234

common access card (CAC)

Back 234

a department of defense (DoD) smart card used for identification for active-duty and reserve military personnel along with civilian employees and special contractors

Front 235

dictionary attack

Back 235

a password attack that creates encrypted versions of common dictionary words and compares them against those in a stolen password file

Front 236

hybrid attack

Back 236

a password attack that slightly alters dictionary words by adding numbers to the end of the password, spelling word backward, slightly misspelling words, or including special characters

Front 237

multifactor authentication

Back 237

using more than one type of authentication credential

Front 238

password

Back 238

a secret combination of letters, numbers, and/or characters that only he user should know

Front 239

personal identity verification (PIV)

Back 239

a government standard for smart cards that covers all government employees

Front 240

rainbow tables

Back 240

larger pregenerated data sets of encrypted passwords used in password attacks

Front 241

single sign-on (SSO)

Back 241

using one authentication credential to access multiple accounts or applications

Front 242

single-factor authentication

Back 242

using one type of authentication credentials

Front 243

smart card

Back 243

a card that contains an integrated circuit chip that can hold information used as part of the authentication process

Front 244

standard biometrics

Back 244

using fingerprints or other unique physical characteristics of a person's face, hands, or eyes for authentication

Front 245

token

Back 245

a small device that can be affixed to a keychain with a window display that shows a code to be used for authentication

Front 246

trusted operating system (trusted OS)

Back 246

a hardened operating system that can keep attackers from accessing and controlling critical parts of a computer system

Front 247

advanced encryption standard (AES)

Back 247

a symmetric cipher that was approved by the NIST in late 2000 as a replacement for DES

Front 248

algorithm

Back 248

procedures based on a mathematical formula; used to encrypt data

Front 249

asymmetric cryptographic algorithm

Back 249

encryption that uses two mathematically related keys

Front 250

block cipher

Back 250

a cipher that manipulates an entire block of plaintext at one time

Front 251

blowfish

Back 251

a block cipher that operates on 64-bit blocks and can have a key length from 32 to 448 bits

Front 252

ciphertext

Back 252

data that has been encrypted

Front 253

cryptography

Back 253

the science of transforming information into a secure form while it is being transmitted or stored so that unauthorized persons cannot access it

Front 254

cleartext

Back 254

unencrypted data

Front 255

data encryption standard (DES)

Back 255

a symmetric block cipher that uses a 56-bit key and encrypts data in 64-bit blocks

Front 256

decryption

Back 256

the process of changing ciphertext into plaintext

Front 257

digital signature

Back 257

an electronic verification of the sender

Front 258

elliptic curve cryptography (ECC)

Back 258

an algorithm that uses elliptic curves instead of prime numbers to compute keys

Front 259

encryption

Back 259

the process of changing plaintext into ciphertext

Front 260

GNU privacy guard (GPG)

Back 260

free and open-source software that is commonly used to encrypt then decrypt e-mail messages

Front 261

hardware security module (HSM)

Back 261

a secure cryptographic processor

Front 262

hash

Back 262

the unique digital fingerprint created by a hashing algorithm

Front 263

hashed message authentication code (HMAC)

Back 263

a variation of a hash that encrypts the hash with a shared secret key before transmitting it

Front 264

hashing

Back 264

the process for creating a unique digital fingerprint signature for a set of data

Front 265

key

Back 265

a mathematical value entered into the algorithm to produce ciphertext

Front 266

message digest (MD)

Back 266

a common hash algorithm of several different versions

Front 267

message digest 5 (MD5)

Back 267

a revision of MD4 that is designed to address its weaknesses

Front 268

nonrepudiation

Back 268

the process of proving that a user performed an action

Front 269

NTLM (new technology LAN manager) hash

Back 269

a password hash for Microsoft Windows systems that is no longer recommended for use

Front 270

NTLMv2 (new technology LAN manager version 2) hash

Back 270

an updated version of NTLM that uses HMAC with MD5

Front 271

one-time pad (OTP)

Back 271

using a unique truly random key to create ciphertext

Front 272

plaintext

Back 272

data input into an encryption algorithm

Front 273

pretty good privacy (PGP)

Back 273

a commercial product that is commonly used to encrypt e-mail messages

Front 274

private key

Back 274

an asymmetric encryption key that does have to be protected

Front 275

private key cryptography

Back 275

cryptographic algorithms that use a single key to encrypt and decrypt a message

Front 276

public key

Back 276

an asymmetric encryption key that does not have to be protected

Front 277

public key cryptography

Back 277

encryption that uses two mathematically related keys

Front 278

quantum cryptography

Back 278

an asymmetric cryptography that attempts to use the unusual and unique behavior of microscopic objects to enable users to securely develop and share keys

Front 279

RACE integrity primitives evaluation message digest (RIPEMD)

Back 279

a hash algorithm that uses two different and independent parallel chains of computation and then combines the result at the end of the process

Front 280

RC4

Back 280

an RC stream cipher that will accept keys up to 128 bits in length

Front 281

Rivest Cipher (RC)

Back 281

a family of cipher algorithms designed by Ron Rivest

Front 282

RSA

Back 282

an asymmetric algorithm published in 1977 and patented by MIT in 1983

Front 283

Secure Hash Algorithm (SHA)

Back 283

a secure hash algorithm that creates hash values of longer lengths than message digest (MD) algorithms

Front 284

steganography

Back 284

hiding the existence of data within a text, audio, image, or video file

Front 285

stream cipher

Back 285

an algorithm that takes one character and replaces it with one character

Front 286

symmetric cryptographic algorithm

Back 286

encryption that uses a single key to encrypt and decrypt a message

Front 287

triple data encryption standard (3DES)

Back 287

a symmetric cipher that was designed to replace DES

Front 288

trusted platform module (TPM)

Back 288

a chip on the motherboard of the computer that provides cryptographic services

Front 289

twofish

Back 289

a later derivation of the blowfish algorithm that is considered to be strong

Front 290

whole disk encryption

Back 290

cryptography that can be applied to entire disks

Front 291

bridge trust model

Back 291

a trust model with one CA that acts as a facilitator to interconnect all other CAs

Front 292

certificate authority (CA)

Back 292

a trusted third-party agency that is responsible for issuing the digital certificates

Front 293

certificate repository (CR)

Back 293

a publicly accessible centralized directory that contains digital certificates that can be used to view the status of a digital certificate

Front 294

certificate revocation list (CRL)

Back 294

a repository that lists revoked digital certificates

Front 295

digital certificate

Back 295

a technology used to associate a user's identity to a public key, in which the user's public key is "digitally signed" by a trusted third party

Front 296

direct trust

Back 296

a type of trust model in which a relationship exists between two individuals because one person knows the other person

Front 297

distributed trust model

Back 297

a trust model that has multiple CAs that sign digital certificates

Front 298

hierarchical trust model

Back 298

a trust model that has a single hierarchy with one master CA

Front 299

hypertext transport protocol over secure sockets layer (HTTPS)

Back 299

a secure version of HTTP sent over SSL/TLS

Front 300

IP security (IPsec)

Back 300

a set of protocols developed to support the secure exchange of packets

Front 301

key escrow

Back 301

a process in which key are managed by a third party, such as a trusted CA called the root

Front 302

key recovery agent (KRA)

Back 302

a highly trusted person responsible for recovering lost or damaged digital certificates

Front 303

M-of-N control

Back 303

a technique to recover a private key by distributing parts to different individuals

Front 304

public key infrastructure (PKI)

Back 304

a framework for all of the entities involved in digital certificates for digital certificate management

Front 305

registration authority (RA)

Back 305

a subordinate entity designed to handle specific CA tasks such as processing certificate requests and authenticating users

Front 306

Secure shell (SSH)

Back 306

a UNIX-based command interface and protocol for securely accessing a remote computer

Front 307

secure sockets layer (SSL)

Back 307

a protocol developed by Netscape for securely transmitting documents over the Internet that uses a private key to encrypt data

Front 308

third-party trust

Back 308

a trust model in which two individuals trust each other because each individually trusts a third party

Front 309

transport layer security (TLS)

Back 309

a protocol that is an extension of SSL and guarantees privacy and data integrity between applicationstr

Front 310

trust model

Back 310

the type of trusting relationship that can exist between individuals or entities

Front 311

trust model

Back 311

the type of trusting relationship that can exist between individuals or entities

Front 312

X.509

Back 312

the most widely accepted format for digital certificates as defined by the international telecommunication union (ITU)

Front 313

asymmetric server cluster

Back 313

a technology in which a standby server exists only to take over for another server in the event of its failure

Front 314

backout/contingency option

Back 314

rolling back a disaster recovery implementation to the starting point so that a different approach can be taken

Front 315

business continuity

Back 315

the ability of an organization to maintain its operations and services in the face of a disruptive event

Front 316

business continuity planning and testing

Back 316

the process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient

Front 317

business impact analysis (BIA)

Back 317

an analysis of the most important mission-critical business functions, which identifies and quantifies the impact such a loss of the functions may have on the organization in terms of its operational and financial position

Front 318

chain of custody

Back 318

a process of documentation that shows that the evidence was under strict control at all times and no unauthorized individuals were given the opportunity to corrupt the evidence

Front 319

cold site

Back 319

a remote site that provides office space; the customer must provide and install all the equipment needed to continue operations

Front 320

computer forensics

Back 320

using technology to search for computer evidence of a crime

Front 321

data backups

Back 321

the process of copying information to a different medium and storing it (preferably at an off-site location) so that it can be used in the event of a disaster

Front 322

disaster recovery

Back 322

the procedures and processes for restoring and organizations's IT operations following a disaster

Front 323

disaster recovery plan (DRP)

Back 323

a written document that details the process for restoring IT resources following an event that causes a significant disruption in service

Front 324

Faraday cage

Back 324

a metallic enclosure that prevents the entry or escape of an electromagnetic field

Front 325

forensics (forensic science)

Back 325

the application of science to questions that are of interest to the legal profession

Front 326

heating, ventilation, and air conditioning (HVAC)

Back 326

systems that provide and regulate heating and cooling

Front 327

high availability

Back 327

a system that can function for an extended period of time with little downtime

Front 328

hot aisle/cold aisle

Back 328

a layout in a data center that can be used to reduce heat by managing the air flow

Front 329

hot site

Back 329

a duplicate of the production site that has all the equipment needed for an organization to continue running, including office space and furniture, telephone jacks, computer equipment, and a live telecommunications link

Front 330

mean time between failures (MTBF)

Back 330

a statistical value that is the average time until a component fails, cannot be repaired, and must be replaced

Front 331

mean time to restore (MTTR)

Back 331

the average time needed to reestablish services to their former state

Front 332

order of volatility

Back 332

the sequence of volatile data that must be preserved in a computer forensic investigation

Front 333

RAID (redundant array of independent drives)

Back 333

a technology that uses multiple hard disk drives for increased reliability and performance

Front 334

recovery point objective (RPO)

Back 334

the maximum length of time that an organization can tolerate between backups

Front 335

recovery time objective (RTO)

Back 335

the length of time it will take to recover the data that has been backed up

Front 336

server cluster

Back 336

a combination (clustering) of two or more servers that are interconnected to appear as one

Front 337

single point of failure

Back 337

a component or entity in a system which, if it no longer functions, would adversely affect the entire system

Front 338

succession planning

Back 338

determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees

Front 339

symmetric server cluster

Back 339

a technology in which every server in the cluster performs useful work and if one server fails, the remaining servers continue to perform their normal work as well as that of the failed server

Front 340

system image

Back 340

a snapshot of the current state of the computer that contains all settings and data

Front 341

warm site

Back 341

a remote site that contains computer equipment but does not have active internet or telecommunication facilities, and does not have backups of data

Front 342

acceptable use policy (AUP)

Back 342

a policy that defines the actions users may perform while accessing systems and networking equipment

Front 343

change management

Back 343

a methodology for making modifications to a system and keeping track of those changes

Front 344

incident management

Back 344

the "framework" and functions required to enable incident response and incident handling within an organization

Front 345

peer-to-peer (P2P) network

Back 345

a network that does not have servers, so each device simultaneously functions as both a client and a server to all other devices connected to the network

Front 346

privacy policy

Back 346

a policy that outlines how the organization uses personal information it collects

Front 347

security policy

Back 347

a written document that states how an organization plans to protect the company's information technology assets

Front 348

social networking

Back 348

grouping individuals and organizations into clusters or groups based on a like affiliation

Front 349

social networking sites

Back 349

web sites that facilitate linking individuals with common interests like hobbies, religion, politics, or school or work contacts