Cybersecurity Fundamentals Reviewer

Comprehensive vocabulary flashcards covering cybersecurity fundamentals, risk management, cryptography, and network defense strategies.

Cybersecurity

The practice of protecting computers, servers, mobile devices, networks, and data from unauthorized access, attacks, theft, and damage.

Confidentiality

A goal of the CIA Triad that ensures information is accessible only to authorized individuals.

Integrity

A goal of the CIA Triad that ensures data remains accurate and unaltered.

Availability

A goal of the CIA Triad that ensures systems and information are available when needed.

Compromises

Occurs when a threat succeeds in causing harm to a business; successful attacks are also called incidents or breaches.

Countermeasures

Tools used to thwart attacks, also referred to as safeguards and controls.

Preventative Countermeasures

Controls designed to keep attacks from succeeding.

Detective Countermeasures

Controls that identify when a threat is attacking or succeeding to minimize damage through fast detection.

Corrective Countermeasures

Controls that get business processes back on track after a compromise occurred.

Employee Sabotage

The destruction of hardware, software, or data by an employee, which may involve planting logic bombs or having financial motives.

Employee Hacking

Intentionally accessing a computer resource without authorization or in excess of authorization by an employee.

IP Address Spoofing

An attack method where false source IP addresses are put in reconnaissance and exploit packets to conceal identity.

Cyberwar

Computer-based attacks conducted by national governments involving espionage or infrastructure damage.

Cyberterror

Attacks by terrorists or terrorist groups that may directly target IT resources.

Weakest-link failure

A security failure where the compromise of a single element of a system ruins the overall security.

Plan-Protect-Respond Cycle

The primary cycle of security management beginning with planning, followed by protection via countermeasures, and ending with recovery.

Asset Value (AV)

The value of the specific asset that is being protected from potential threats.

Exposure Factor (EF)

The percentage of an asset's value that would be lost during a specific security breach.

Single Loss Expectancy (SLE)

The amount of damage sustained in a single breach, calculated as $SLE = AV \times EF$.

Annualized Probability of Occurrence (ARO)

A measure of how often a specific attack or breach happens on an annualized basis.

Annualized Loss Expectancy (ALE)

The yearly average loss expected from a compromise, calculated as $ALE = SLE \times ARO$.

Net Value

The financial benefit of a security decision, calculated as $\text{ALE Reduction} - \text{Cost}$.

Risk

A potential threat that may cause damage to an asset, mathematically expressed as $Risk = \text{Threat} \times \text{Vulnerability} \times \text{Asset Value}$.

Risk Acceptance

A strategy where a company accepts the consequences of a risk rather than spending on backup or prevention.

Risk Reduction

A strategy aimed at lowering the likelihood or impact of a risk through tools like antivirus software.

Risk Transference

Shifting the financial impact of a risk to another party, such as an insurance company.

Risk Avoidance

Eliminating a risk entirely by stopping the activity that creates the vulnerability.

Cryptology

The science of encryption which encompasses both cryptography (writing codes) and cryptanalysis (solving codes).

Symmetric Cryptography

A type of encryption where a single key is used for both encryption and decryption, such as AES or DES.

Asymmetric Cryptography

A type of encryption using two keys (Public Key and Private Key), such as RSA or ECC, which is typically slower than symmetric methods.

Hashing

A cryptographic process used to verify data integrity by ensuring files have not been modified.

Cryptanalysis

The process of obtaining a plaintext message from ciphertext without knowing the encryption keys.

Social Engineering Attack

An attack dependent on the human factor, tricking individuals into revealing passwords or granting unauthorized access.

Implementation Attacks

Attacks where side-channel analysis is used to obtain keys, often requiring physical access to the cryptosystem.

Caesar Cipher

A classical cipher where letters are shifted by a fixed number; for example, a shift of 3 turns A into D.

Transposition Techniques (Rail Fence Cipher)

A cipher method where text is written diagonally to create the ciphertext.

Phishing

Fake emails pretending to be legitimate sources to manipulate people into revealing confidential information.

Smishing

A form of phishing conducted through SMS messages.

Vishing

A form of phishing conducted through voice calls.

Tailgating / Piggybacking

A physical social engineering attack where an unauthorized person follows an authorized employee into a restricted area.

Denial of Service (DoS)

An attack that attempts to make services unavailable by exhausting system resources.

Bot

A software application, or robot, designed to perform automated tasks ranging from simple scripts to AI simulations.

Botnet

A network of semi-autonomous infected computers working together to carry out an attacker's goals.

Handlers

A layer of compromised hosts used to manage and control large groups of bots.

Reflected Attack

A DoS method where an attacker uses responses from legitimate services to flood a victim.

SYN Flood

A DoS attack that exploits TCP handshakes by sending many SYN packets without completing the connections.

Ping Flood

An attack that overwhelms a system with excessive ICMP requests.

Rogue Access Point (Evil Twin)

A fake Wi-Fi network designed to look legitimate in order to capture victim passwords.

Drive-by Hacking

The act of accessing an unsecured wireless network from a nearby location, such as from a car outside a building.

Death of the Perimeter

A phrase indicating that creating a 100 percent secure network is impossible and traditional boundary defense is no longer sufficient.

Castle Model

A traditional network defense model with a well-guarded single point of entry between internal and external users.

Suricata Rules

Instructions that tell an IDS/IPS what specific suspicious activity to watch for and how to respond.

IDS (Intrusion Detection System)

A passive security system that monitors traffic, detects threats, and generates alerts.

IPS (Intrusion Prevention System)

An active security system that detects and automatically blocks attacks by dropping malicious packets.

Signature-Based Detection

A detection method that compares traffic against known attack signatures, accurate for known threats but ineffective against zero-day attacks.

Anomaly-Based Detection

A detection method that identifies unusual behavior, allowing it to detect new attacks albeit with higher false positive rates.

SIEM

Security Information and Event Management; a centralized platform that combines SIM (log collection) and SEM (real-time monitoring).

Log Normalization

The SIEM process of converting different log formats from various systems into a single standard format.

Event Correlation

The SIEM function of combining events from different systems to identify potential compromises.

Access Control Phases

The three-step process consisting of Identification (claiming identity), Authentication (verifying identity), and Authorization (determining permissions).

RBAC (Role-Based Access Control)

An access control model where permissions are assigned based on a user's job role within the organization.

DAC (Discretionary Access Control)

An access control model where the owner of the resource controls the permissions.

MAC (Mandatory Access Control)

An access control model where the system enforces permissions, often used for military classified documents.

Security Hardening

The overall process of reducing vulnerabilities in a system.

Host

Any device with an IP address, including servers, clients, routers, firewalls, and mobile phones.

Systems Administrators

IT employees who manage individual hosts or groups of hosts, typically staying separate from network administration.

Vulnerabilities

Security weaknesses that open a program to attack.

Exploits

Programs specifically designed to take advantage of a vulnerability.

Zero-day-attacks

Attacks that occur before security fixes or patches have been released by the vendor.

Work-arounds

Manual actions taken to address vulnerabilities when no new software fix is available; they are often labor-intensive and error-prone.

Patches

Small programs that fix specific vulnerabilities and are usually easy to download and install.

SQL Injection

A web application attack where malicious SQL commands are injected to bypass login systems or manipulate databases.

Cross-Site Scripting (XSS)

An attack involving the injection of malicious scripts into web pages, preventable by input validation and output encoding.

Directory Traversal

A vulnerability allowing an attacker to access files and directories outside of the web server's root directory.

LDAP

A system used to store user accounts, groups, and permissions, commonly seen in Active Directory.

SSO (Single Sign-On)

A centralized authentication service that allows a user to login once and access multiple systems.

FAR (False Acceptance Rate)

A biometric error where an unauthorized user is incorrectly accepted by the system.

FRR (False Rejection Rate)

A biometric error where an authorized user is incorrectly rejected by the system.

Honeypot

A decoy system designed to attract attackers to monitor their behavior and collect intelligence.

Padded Cell System

An isolated environment where detected attackers are redirected to prevent damage and monitor their techniques.

Buffer Overflow

A widespread vulnerability occurring when the volume of data exceeds the storage capacity of a memory buffer.

Website Defacement

An attack where the visual appearance of a website is unauthorizedly altered, often replacing the home page with a hacker-produced page.

Production Server

The deployment server where the live or operational version of software is accessed by end-users.