600 - 675 reminders

WPA-EAP (Wi-Fi Protected Access – Extensible Authentication Protocol)

• A wireless security method that uses 802.1X authentication combined with EAP, requiring each user/device to authenticate individually through a backend authentication server (typically RADIUS), rather than relying on a single shared password.

• Often called "WPA-Enterprise" because it's designed for organizational environments where each user has unique credentials (username/password, certificates, or tokens) to verify their identity before gaining network access.

• Provides strong, granular security since access can be revoked per user without changing a shared password for everyone, and it supports auditing of exactly who connected and when.

• Requires significantly more infrastructure and administrative overhead (a RADIUS/authentication server, individual user account management) compared to simpler pre-shared key methods, making it best suited for corporate networks rather than casual public/guest access.

WEP-TKIP (Wired Equivalent Privacy with Temporal Key Integrity Protocol)

• WEP is the original, legacy wireless encryption standard from the late 1990s, using a static encryption key (typically 64-bit or 128-bit) shared among all connected devices.

• TKIP (Temporal Key Integrity Protocol) was later introduced as a security improvement to dynamically change encryption keys, initially to patch WEP's weaknesses before WPA was developed.

• Despite this improvement, WEP itself is fundamentally broken — its underlying RC4 cipher implementation and short initialization vectors make it crackable within minutes using freely available tools, regardless of TKIP being layered on top.

• Considered obsolete and insecure by modern standards; it should not be used for any network requiring real security, as it fails to protect against eavesdropping, packet injection, or unauthorized access.

WPA-PSK (Wi-Fi Protected Access – Pre-Shared Key)

• A wireless security method (often called "WPA-Personal") where a single shared password (the pre-shared key) is configured on the access point and given to all users who need to connect — everyone uses the same password to join the network.

• Uses stronger encryption than WEP (WPA2-PSK commonly uses AES-CCMP; WPA-PSK originally used TKIP as an interim improvement over WEP), making it far more resistant to cracking than legacy WEP.

• Ideal for smaller networks, home use, or guest networks where creating individual user accounts isn't practical, since it requires minimal setup — just configure one password and share it with those who need access.

• A tradeoff is that if the password needs to be revoked from one user, it must be changed for everyone, since there's no way to individually distinguish or remove a single user's access without changing the shared key.

WPS-PIN (Wi-Fi Protected Setup – PIN method)

• A feature designed to simplify connecting devices to a wireless network without manually entering a long password, using an 8-digit PIN (often printed on the router or displayed during setup) to establish a connection.

• Intended for convenience — a user enters the PIN once, and the router automatically exchanges the actual WPA/WPA2 password with the device behind the scenes.

• Has a well-documented, serious security flaw: due to how the PIN is validated in two separate 4-digit halves, attackers can brute-force the PIN in a matter of hours using tools designed specifically to exploit this weakness (e.g., Reaver), effectively bypassing the network's actual password protection.

• Widely considered insecure and is recommended to be disabled on most routers, since it undermines the security of whatever encryption method (WPA/WPA2) is otherwise configured on the network.

ISO 9001

• An international standard for Quality Management Systems (QMS), published by the International Organization for Standardization (ISO).

• Establishes a framework of principles and processes an organization follows to consistently provide products or services that meet customer and regulatory requirements, with an emphasis on continuous improvement.

• Focuses on areas such as customer satisfaction, process efficiency, leadership commitment, and systematic evaluation of performance — it is not focused on information security or data privacy at all.

• Organizations can be certified against ISO 9001 by an accredited third party, demonstrating that their quality management processes meet the standard's requirements; it's widely used across virtually all industries, not just technology or security-focused ones.

ISO 27002

• A supplementary standard to ISO 27001 that provides detailed guidelines and best practices (a "code of practice") for implementing information security controls, such as access control, cryptography, physical security, and incident management.

• Unlike ISO 27001, ISO 27002 is not a certifiable standard on its own — organizations don't get "ISO 27002 certified." Instead, it serves as a reference/guidance document to help organizations select and implement appropriate controls when building an Information Security Management System (ISMS) that would be certified under ISO 27001.

• Covers a broad set of security domains (organizational controls, people controls, physical controls, technological controls) but does not specifically focus on privacy or personal data protection.

ISO 27701

• An extension to ISO 27001 and ISO 27002 specifically focused on Privacy Information Management Systems (PIMS).

• Provides requirements and guidance for managing personally identifiable information (PII), helping organizations demonstrate compliance with privacy laws and regulations (such as GDPR or other data protection frameworks).

• Builds directly on top of an existing ISO 27001-certified Information Security Management System, adding privacy-specific controls covering both PII controllers (organizations that determine why/how personal data is processed) and PII processors (organizations that process personal data on behalf of others).

• This is the standard organizations pursue specifically to be certified for privacy management, distinguishing it from the broader security-focused ISO 27001/27002 standards.

ISO 31000

• An international standard providing principles, a framework, and a process for managing risk, applicable to any type of organization regardless of industry, size, or the type of risk being managed (financial, operational, strategic, security, etc.).

• Offers general guidance on how to identify, assess, prioritize, and treat risks as part of an organization's broader risk management strategy, rather than prescribing specific technical or security controls.

• Unlike ISO 27001 or ISO 27701, ISO 31000 is a guidance document, not a certifiable management system standard — organizations cannot obtain formal "ISO 31000 certification," though they can align their risk management practices with its principles.

• Not privacy-specific or security-specific; it's meant to be a foundational, cross-disciplinary approach to risk management that other standards (like ISO 27001) may reference or build upon.

Black-box testing

• A penetration testing methodology in which the tester has no prior knowledge of the target system's internal workings, source code, architecture, or credentials before starting.

• Simulates the perspective of a real external attacker who must discover information about the target from scratch (reconnaissance, scanning, enumeration) before attempting exploitation.

• Provides a realistic view of what an outside threat actor could achieve with zero insider knowledge, but can take longer and may not uncover every internal flaw since the tester lacks visibility into the system's design.

Gray-box testing

• A penetration testing methodology in which the tester is given partial knowledge of the target system — such as limited credentials, network diagrams, or some architectural details — but not full access or complete internal visibility.

• Strikes a balance between black-box (no knowledge) and white-box (full knowledge) testing, allowing testers to focus more efficiently on specific areas while still simulating a semi-informed attacker (e.g., a malicious insider with limited access, or an attacker who has already gained a foothold).

• Often used to test specific application logic or privilege escalation paths without requiring the time investment of a full black-box reconnaissance phase.

White-box testing

• A penetration testing methodology in which the tester is given full knowledge of the target system, including source code, architecture diagrams, credentials, and internal documentation.

• Allows for the most thorough and efficient assessment, since testers can directly examine internal logic, configurations, and code for vulnerabilities rather than spending time discovering this information themselves.

• Commonly used for in-depth code reviews, secure software development lifecycle (SDLC) testing, and situations where the goal is to find as many vulnerabilities as possible rather than simulate a realistic external attack scenario.

APT (Advanced Persistent Threat)

• A type of highly sophisticated, well-resourced, and organized threat actor (often, though not always, sponsored by a nation-state) that conducts prolonged, targeted cyberattacks against a specific organization or set of targets, rather than opportunistic, one-off attacks.

• "Advanced" refers to the group's use of sophisticated tools, custom malware, zero-day exploits, and highly skilled personnel capable of adapting their techniques to bypass defenses and evade detection.

• "Persistent" refers to the attacker's goal of maintaining long-term, stealthy access within the target's network — often for months or even years — rather than achieving a quick, immediate objective. This allows for extended espionage, data exfiltration, or positioning for future disruptive action.

• "Threat" reflects the significant capability and intent to cause harm, distinguishing APTs from less capable or less motivated attackers.

• Typical goals include espionage (stealing intellectual property, government/military secrets, or sensitive corporate data), long-term surveillance, or establishing footholds for potential future sabotage, rather than immediate financial gain (which more commonly characterizes organized crime groups).

• APT groups often use multi-stage attack techniques: initial reconnaissance, spear phishing or exploiting vulnerabilities for initial access, lateral movement within the network, privilege escalation, and establishing persistence mechanisms (backdoors) to maintain access even if initially detected and partially remediated.

• Because of their resources, patience, and adaptability, APTs are considered one of the most difficult threat categories to detect and fully eradicate, often requiring advanced threat hunting, behavioral analytics, and dedicated incident response capabilities to identify and contain.

ISO 22301

• The international standard for Business Continuity Management Systems (BCMS), published by the International Organization for Standardization (ISO).

• Provides a framework for organizations to plan, establish, implement, operate, monitor, review, maintain, and continually improve a documented management system that ensures the organization can continue critical operations during and after a disruptive incident (e.g., natural disasters, cyberattacks, pandemics, supply chain failures, power outages).

• Focuses on business continuity planning (BCP) principles such as conducting business impact analyses (BIA), identifying critical business functions, setting recovery time objectives (RTO) and recovery point objectives (RPO), and developing continuity and recovery strategies to minimize downtime and financial/operational impact.

• Distinct from information security standards like ISO 27001 — while ISO 27001 focuses specifically on protecting the confidentiality, integrity, and availability of information assets, ISO 22301 focuses more broadly on the organization's overall ability to keep operating (or recover quickly) after any type of disruptive event, not just security incidents.

• Organizations can achieve formal certification against ISO 22301 through an accredited auditor, demonstrating to customers, regulators, and partners that they have a structured, tested business continuity program in place.

• Commonly used by organizations in critical industries (finance, healthcare, government, utilities) where extended downtime could have severe financial, safety, or reputational consequences.

BPDU guard

• A switch port security feature used in networks running the Spanning Tree Protocol (STP), which prevents Bridge Protocol Data Units (BPDUs) from being received on specific "edge" ports (ports connected to end-user devices like laptops or workstations, not other switches).

• If a BPDU is detected on a port configured with BPDU guard, the switch automatically disables (shuts down) that port, since receiving a BPDU there suggests either a misconfiguration or a malicious attempt to manipulate the network's STP topology (e.g., an attacker plugging in a rogue switch to become the root bridge and intercept traffic).

• Primarily a wired network security control, protecting against Layer 2 topology attacks rather than wireless authentication issues.

WIDS (Wireless Intrusion Detection System)

• A security monitoring system designed to detect unauthorized or malicious wireless activity on a network, such as rogue access points, unauthorized client connections, deauthentication attacks, or attempts to brute-force wireless encryption keys.

• Operates similarly to a traditional network IDS but is specifically focused on the wireless spectrum, analyzing radio frequency traffic and wireless protocol behavior for signs of attack or policy violations.

• Functions as a detective control — it identifies and alerts administrators to suspicious wireless activity as it happens (or shortly after), but it does not actively block or prevent the activity from occurring; a WIPS (Wireless Intrusion Prevention System) would be the corresponding active/preventive counterpart capable of automatically responding to threats.

ESP (Encapsulating Security Payload)

• One of the two core protocols within the IPSec (Internet Protocol Security) suite (the other being AH), used to secure data transmitted over a VPN tunnel or between two networked systems.

• Provides confidentiality by encrypting the payload of each packet, ensuring that even if the traffic is intercepted, the actual data content cannot be read without the decryption key.

• Provides data integrity by using a cryptographic hash to verify that the packet's contents haven't been altered or tampered with during transmission.

• Provides authentication by verifying the identity of the sender, ensuring the data genuinely originated from the expected source and not an impersonator.

• Provides anti-replay protection through the use of sequence numbers on each packet, allowing the receiving device to detect and reject duplicate or previously captured packets that an attacker might attempt to retransmit to disrupt or exploit the connection.

• Can operate in two modes: Transport mode, which encrypts only the payload (data) of the IP packet while leaving the original IP header intact (commonly used for end-to-end communication between two hosts), and Tunnel mode, which encrypts the entire original IP packet (including the header) and wraps it inside a new IP packet (commonly used for site-to-site VPNs, since it fully conceals the original source/destination information).

• Because ESP alone provides encryption, integrity, authentication, and anti-replay protection all together, it's commonly used as the primary protocol for secure VPN tunnels — unlike AH, which offers integrity, authentication, and anti-replay, but no encryption/confidentiality.

CRL (Certificate Revocation List).

• A list published and digitally signed by a Certificate Authority (CA) containing the serial numbers of all certificates that have been revoked before their scheduled expiration date, along with the revocation date and reason.

• Clients or systems can download the CRL periodically and store it locally, then check certificates against this locally stored list without needing to contact an external server every time a check is needed.

• Well-suited for offline, air-gapped, or environments with limited/intermittent internet connectivity, since the list can be checked locally once it has been downloaded, without requiring a live connection at the moment of verification.

• Can become large and unwieldy over time as more certificates are revoked, potentially making full-list downloads slower and more resource-intensive compared to a single real-time OCSP query — though this is less of a concern in offline environments where local checks are still faster than requiring live connectivity at all.

RA (Registration Authority)

• An entity within the Public Key Infrastructure (PKI) hierarchy that acts as an intermediary between users requesting digital certificates and the Certificate Authority (CA) that ultimately issues them.

• Responsible for verifying the identity of individuals or organizations requesting a certificate before forwarding the request to the CA — essentially handling the vetting/registration process so the CA doesn't have to directly manage every identity verification itself.

• Does not actually issue certificates or sign anything cryptographically; it only validates requestor identity and passes along approved requests to the CA, which then performs the actual certificate issuance.

• Useful in large PKI deployments where distributing the identity-verification workload across multiple registration points (while keeping the actual certificate-issuing authority centralized at the CA) improves scalability and administrative efficiency.

OCSP (Online Certificate Status Protocol)

• A real-time protocol used to check whether a specific digital certificate has been revoked, without needing to download an entire revocation list.

• Works by having a client send a query (containing the certificate's serial number) to an OCSP responder — a server maintained by or on behalf of the CA — which replies with the certificate's current status: "good," "revoked," or "unknown."

• Faster and more efficient than checking a full CRL for a single certificate, since only the relevant certificate's status is checked rather than searching through a potentially large list.

• Requires an active, live network connection to the OCSP responder at the time of the check, making it unsuitable for offline or air-gapped environments where real-time external communication isn't available.

RAID 10 (RAID 1+0)

• A RAID configuration that combines mirroring (RAID 1) and striping (RAID 0) by first mirroring pairs of drives for redundancy, then striping data across those mirrored pairs for performance.

• Data is written simultaneously to both drives in each mirrored pair (providing fault tolerance/redundancy), while data is also striped across multiple mirrored pairs (providing improved read/write speed through parallel access).

• Offers strong fault tolerance: it can survive multiple drive failures, as long as both drives within the same mirrored pair don't fail simultaneously — losing one drive from each pair still leaves the array fully functional.

• Provides excellent performance, particularly for read operations, since data can be read from multiple drives in parallel; write performance is also strong compared to parity-based RAID levels (like RAID 5) since there's no parity calculation overhead.

• Requires a minimum of four drives and effectively uses only half of the total raw storage capacity (since every drive is mirrored), making it more storage-costly than RAID 5, but delivering better performance and more robust fault tolerance in exchange.

Captive portal

• A web-based authentication page that users are redirected to when they first connect to a network (commonly seen on guest Wi-Fi, hotel networks, airports, or coffee shops), requiring them to accept terms of service, enter a code, or log in through a browser interface before being granted full internet/network access.

• Typically used for guest or public-facing networks where the goal is to control access, display an acceptable use policy, or collect basic user information, rather than provide strong cryptographic authentication.

• Doesn't inherently involve certificate-based (PKI) authentication or verify device identity in a cryptographically secure way — it's more about presenting a gate/login screen at the browser level.