Computer Security and Network Defense Comprehensive Review

A comprehensive vocabulary review set covering wireless security, web application and injection attacks, secure development methodologies, endpoint defenses, vulnerability scoring, and incident monitoring tools from Chapters 6, 7, 8, 9, and 12.

Mirai Botnet

Malware created in 2016 from Minecraft server rivalries to launch DDoS attacks against competitors by compromising Internet of Things (IoT) devices into remotely controlled bots, notably used to attack DNS provider Dyn.

Radio Frequency (RF)

The rate of oscillation of alternating electromagnetic fields.

Narrowband

A wireless signal type that occupies a small frequency range and has low bandwidth.

Broadband

A signal transmission type that carries multiple signals simultaneously on one analog frequency, commonly utilized for internet and television services.

Baseband

The original form of a signal prior to modulation, such as raw audio or tone.

Channel Bonding

A wireless technique that combines adjacent channels (such as $40$, $80$, or $160\,\text{MHz}$) to achieve higher transmission throughput.

MIMO (Multiple-Input Multiple-Output)

An antenna technology that utilizes multiple antennas to improve wireless transmission speed and signal quality.

MU-MIMO (Multi-User Multiple-Input Multiple-Output)

A wireless antenna standard that transmits tailored, simultaneous signals to multiple users at once.

Site Survey

An evaluation of radio frequency (RF) behavior conducted before, during, and after WLAN deployment to ensure seamless roaming and proper device association.

WLAN Controller

A network appliance that centrally manages multiple wireless access points (APs) using centralized or distributed deployment models.

WPA2 (Wi-Fi Protected Access 2)

A wireless security standard that implements AES-CCMP encryption ($128$-bit, $192$-bit, or $256$-bit) and supports WPA2-Personal (passphrase-based) and WPA2-Enterprise (802.1X/EAP with a RADIUS server).

Rogue AP

An unauthorized wireless access point installed within an organization's network without administrative authorization.

Evil Twin

A rogue wireless access point that masquerades as a legitimate network by cloning its SSID to intercept user credentials or sensitive traffic.

Bluejacking

A Bluetooth attack in which an unauthorized user sends unsolicited short text messages to nearby discoverable devices.

Bluesnarfing

A Bluetooth exploit that utilizes OBEX to connect to a target device without authorization to steal data, such as contacts and photos, or alter files.

Bluebugging

A Bluetooth exploit that grants an attacker full remote control of a device to eavesdrop, forward calls, or send messages.

SCADA (Supervisory Control and Data Acquisition)

A category of industrial control systems used to remotely monitor and operate geographically distributed industrial equipment in facilities like power grids, water distribution, and pipelines.

Stuxnet

A sophisticated worm that propagated via USB drives into Windows machines using stolen digital certificates to target Siemens industrial control systems running Iranian uranium enrichment centrifuges, exploiting zero-day vulnerabilities to spin centrifuges to failure while sending false normal feedback.

Cross-Site Scripting (XSS)

A web application vulnerability where an attacker injects malicious client-side script into a vulnerable website, allowing the script to execute in victim browsers to harvest session cookies or impersonate users.

Cross-Site Request Forgery (CSRF)

A client-side web vulnerability where an attacker tricks an authenticated user's browser into transmitting unauthorized commands or state-changing requests to a trusted web application.

Server-Side Request Forgery (SSRF)

A server-side attack where an attacker induces a web server to make unauthorized requests to internal network services or back-end databases that are normally shielded by firewalls.

Buffer Overflow

A memory vulnerability that occurs when data written beyond an allocated buffer boundary overwrites adjacent memory spaces, leading to crashes or arbitrary code execution.

Integer Overflow

A condition in which an arithmetic operation produces a value that exceeds the maximum capacity of an integer variable type, causing the number to wrap around to an unexpected value.

Memory Leak

A software defect where dynamically allocated heap memory is not released when no longer needed, causing steady memory exhaustion and performance degradation.

Pointer Dereferencing

The programmatic action of accessing the value located at the address held by a pointer, which results in crashes or security exploits when the pointer is null or uninitialized.

Replay Attack

A security compromise where an attacker intercepts valid login credentials or data transmissions and re-sends them at a later time to authenticate unauthorized access.

Pass-the-Hash

An exploit where an attacker captures an NTLM password hash from a user transmission and submits it directly to a server for authentication without needing to crack the underlying password.

SQL Injection (SQLi)

An input validation attack that injects malicious SQL statements into web form inputs, manipulating back-end database queries to access or alter unauthorized records.

Blind SQL Injection

A type of SQL injection where the database does not directly return data to the web page, requiring the attacker to reconstruct data by interpreting True/False application behaviors or response timings.

Directory Traversal

A path-manipulation vulnerability where an attacker supplies dot-dot-slash sequence inputs to access directories and private system files outside the designated web root directory.

SSL Stripping

A downgrade attack that forces an attempted HTTPS connection between a web server and client down to an unencrypted HTTP connection, stripping away confidentiality and integrity.

Code Signing

The cryptographic practice of applying digital certificates to executable code to confirm the identity of the publisher and guarantee that the software has not been altered.

Obfuscation

A secure coding technique that masks program code logic by renaming variables, methods, and functions and stripping comments to make reverse engineering difficult.

Sandboxing

An isolated runtime environment that executes untrusted programs or code separately from the host operating system to contain potential damage and observe behavior safely.

Elasticity

The capability of a system or cloud architecture to automatically provision and deprovision computing resources dynamically in response to varying workloads.

Scalability

The capacity of a system to handle increasing computational demand, achieved either by adding more nodes (horizontal scaling) or by adding more processing power and memory (vertical scaling).

Software Diversity

A software security strategy where compilers create slight internal variations in compiled binaries, such as randomizing variable and function layouts, to prevent a single binary exploit from working universally.

Database Normalization

The systematic organization of database tables and relations to eliminate data redundancy, prevent update anomalies, and ensure consistent record integrity.

Stored Procedure

A precompiled, reusable set of SQL queries stored on the database server that applications call instead of executing direct, user-constructed SQL statements.

Parameterized Query

A database query technique that uses bound placeholders for user inputs, ensuring that the database engine treats input exclusively as literal data rather than executable SQL logic.

Salting

The cryptographic technique of appending a unique, random string of characters to each password prior to hashing to defeat precomputed rainbow table attacks.

Static Code Analysis

A software testing procedure that reviews source code for security vulnerabilities, logic defects, and insecure functions without executing the program.

Dynamic Code Analysis

A testing technique that evaluates software during execution by supplying diverse test inputs to identify runtime bugs, memory leaks, and crash vulnerabilities.

Fuzzing

An automated testing technique that feeds high volumes of invalid, malformed, or random data into software to uncover unhandled exceptions and memory vulnerabilities.

Endpoint Detection and Response (EDR)

An endpoint security system that continuously records, monitors, and analyzes system activities to detect anomalies, isolate infected machines, and facilitate forensic investigation.

Data Loss Prevention (DLP)

A suite of technologies and policies designed to classify data and monitor, block, or alert on unauthorized storage, transmission, or exfiltration of sensitive information.

Host-Based Intrusion Detection System (HIDS)

A monitoring program installed directly on a single host to detect unauthorized activities and configuration changes by reviewing log files, system processes, and registry modifications.

Host-Based Intrusion Prevention System (HIPS)

An endpoint security control running on an individual host that monitors running processes and system activity to actively intercept and block malicious behavior in real time.

Unified Extensible Firmware Interface (UEFI)

A modern platform firmware interface designed to replace legacy BIOS, facilitating the initialization of hardware and the operating system bootloader with enhanced speed and security.

Secure Boot

A UEFI security feature that checks the cryptographic digital signatures of boot loaders, kernel modules, and drivers against a trusted database to prevent unsigned bootkits from executing.

Measured Boot

A boot mechanism that calculates cryptographic hashes of each startup component, stores the hash values in the TPM (Trusted Platform Module), and facilitates boot attestation.

Root of Trust

A secure hardware component that contains immutable startup code and serves as the uncompromised starting foundation for all cryptographic verification processes.

Chain of Trust

A sequential verification architecture in which each booted software component cryptographically validates the signature and integrity of the succeeding stage prior to transferring execution.

Common Vulnerabilities and Exposures (CVE)

A publicly accessible catalog of cybersecurity vulnerabilities managed by MITRE that assigns a standardized, unique identification tag to each disclosed flaw.

National Vulnerability Database (NVD)

The U.S. government repository operated by NIST that integrates CVE lists with CVSS severity scores and SCAP compliance standards.

Common Vulnerability Scoring System (CVSS)

A standardized scoring framework with a scale from $1$ to $10$ used to evaluate and rank the severity and technical impact of identified software vulnerabilities.

Security Information and Event Management (SIEM)

A platform combining Security Information Management (SIM log collection and aggregation) and Security Event Management (SEM real-time correlation and alerting) to manage enterprise security events.

Security Orchestration, Automation, and Response (SOAR)

A framework that integrates diverse security tools and executes automated incident response playbooks to accelerate threat mitigation and ticketing workflows.

Threat Hunting

A proactive security methodology wherein defense analysts manually interrogate logs, threat intelligence, and telemetry under the operational assumption that an adversary has already compromised the network.

Rules of Engagement (ROE)

A governing document established before a penetration test that defines the authorized target scope, operational boundaries, legal liabilities, and rules for handling confidential data.

Pivoting

A penetration testing tactic where a tester uses an initially compromised internal host as a staging system to route traffic and exploit other segmented internal network resources.

Structured Threat Information Expression (STIX)

A standardized structured language used to document, organize, and share cyber threat intelligence in a consistent, machine-readable format.

Trusted Automated Exchange of Intelligence Information (TAXII)

An application transport protocol designed specifically to facilitate the secure exchange of STIX-formatted cyber threat intelligence between servers.

Indicator of Attack (IoA)

A proactive, behavior-based piece of evidence or abnormal activity pattern observed in network traffic or system logs that signals ongoing unauthorized attacker behavior before an exploit succeeds.