4.1 — Security Techniques for Computing Resources

Security Baseline

A defined collection of secure settings and configurations that should be consistently applied to systems, applications, operating systems, and devices.

Baseline Compliance

Verifying that systems continue to match the established security baseline and correcting configuration drift.

Security Compliance Toolkit (SCT)

Microsoft tools and security baselines used to help deploy recommended Windows and Windows Server security configurations.

Group Policy

Centralized method for deploying and enforcing Windows configuration and security settings.

Hardening

Changing a system's configuration to improve security and reduce its attack surface.

Hardening Guide

Manufacturer or third-party recommendations describing secure configuration settings for a system or product.

Attack Surface

The applications, services, interfaces, and other components that could potentially be exploited; removing unnecessary components reduces it.

Mobile Device Management (MDM)

Centralized system used to monitor mobile devices and deploy security configurations, policies, applications, and updates.

Mobile Data Segmentation

Separating corporate and personal data on a mobile device so compromise or removal of one does not automatically affect the other.

Least Privilege

Giving accounts, applications, and systems only the minimum permissions required to perform their functions.

Endpoint Detection and Response (EDR)

Endpoint security technology used to monitor, detect, investigate, and respond to potentially malicious activity.

Server Hardening

Securing servers through patching, strong authentication, least privilege, disabling unused accounts, network restrictions, and endpoint protection.

SCADA

Supervisory Control and Data Acquisition; systems used to monitor and control industrial equipment and processes.

ICS

Industrial Control Systems; computing and networking systems that manage or control industrial processes.

SCADA and ICS Isolation

Using separate networks, restricted connectivity, or air gaps to protect industrial systems from unauthorized access.

Embedded System

An operating system and computing platform built into a purpose-specific device, often with limited administrative access and patching options.

Real-Time Operating System (RTOS)

A deterministic operating system designed to execute processes within predictable time frames.

Deterministic Processing

Processing in which operations are expected to complete within predictable time limits; important for RTOS environments.

Internet of Things (IoT)

Internet-connected purpose-specific devices such as lighting, heating, cooling, and automation systems.

IoT Hardening

Prioritize security patches and segment IoT devices from other networks to limit the impact of compromise.

Wireless Site Survey

Analysis of a wireless environment to identify access points, frequencies, channels, interference, and coverage.

Wireless Heat Map

Visual representation of wireless signal strength and coverage throughout a physical location.

Spectrum Analyzer

Tool used to identify radio-frequency signals and interference, including signals not generated by Wi-Fi access points.

BYOD

Bring Your Own Device; the employee owns the device and uses it for personal and organizational purposes.

COPE

Corporate Owned, Personally Enabled; the organization owns the device but allows personal use.

CYOD

Choose Your Own Device; the organization owns the device but allows the employee to choose from approved device options.

BYOD vs. COPE

BYOD means the employee owns the device; COPE means the organization owns it but permits personal use.

COPE vs. CYOD

Both are organization-owned; COPE emphasizes personal use while CYOD emphasizes employee choice among corporate devices.

Personal Area Network (PAN)

Short-range network commonly created between Bluetooth devices such as a phone and headset or smartwatch.

Bluetooth Pairing

Formal process for establishing a trusted connection between Bluetooth devices; unknown devices should not be automatically trusted.

Wireless Confidentiality

Protecting wireless transmissions from unauthorized viewing through encryption.

Message Integrity Check (MIC)

Mechanism used to verify that wireless information received is identical to what was originally transmitted.

WPA2 Four-Way Handshake Risk

WPA2 handshake information can be captured and used in offline attempts to recover a pre-shared key.

WPA3

Wireless security standard that improves authentication and key exchange compared with WPA2.

GCMP

Galois Counter Mode Protocol; WPA3 technology providing confidentiality, stronger encryption, and message integrity.

SAE

Simultaneous Authentication of Equals; WPA3 authentication and key-exchange method providing mutual authentication.

Dragonfly Handshake

Another name associated with WPA3 Simultaneous Authentication of Equals.

WPA3-Personal

Wireless authentication designed for environments using a shared pre-shared key.

Pre-Shared Key (PSK)

Shared wireless password known by users connecting to a personal wireless network.

WPA3-Enterprise

Enterprise wireless security using 802.1X and centralized authentication rather than one shared password.

AAA

Authentication, Authorization, and Accounting; framework for controlling and recording access.

Authentication

Verifies who a user or system is.

Authorization

Determines what an authenticated user or system is permitted to access.

Accounting

Records activity such as login time, logout time, session activity, and transferred data.

RADIUS

Remote Authentication Dial-In User Service; centralized AAA service commonly used for network, VPN, device, and wireless authentication.

802.1X

Network access control standard requiring users or devices to authenticate before receiving network access; works on wired and wireless networks.

Network Access Control (NAC)

Controls whether a user or device can access a network based on authentication or security requirements.

EAP

Extensible Authentication Protocol; flexible authentication framework used with 802.1X.

Supplicant

802.1X client or user requesting network access.

Authenticator

802.1X device, such as a switch or access point, through which the supplicant requests access.

Authentication Server

AAA server that validates credentials during 802.1X authentication.

802.1X Sequence

Supplicant connects, authenticator requests identity, authentication information is forwarded to the authentication server, credentials are validated, and access is allowed if successful.

Input Validation

Checking user-supplied data for expected length, characters, and format and rejecting unexpected input.

Fuzzing

Automatically sending random or unexpected input to an application to identify crashes, errors, or weaknesses in input handling.

Cookie

Small piece of browser-stored data used for functions such as tracking, personalization, or maintaining sessions; it is data rather than executable software.

Secure Cookie

Cookie configured to be transmitted only through an encrypted connection such as HTTPS.

Static Application Security Testing (SAST)

Examines application source code for security weaknesses such as buffer overflows and database injections.

SAST False Positive

A source-code analyzer reports a potential vulnerability that is not actually a vulnerability and must be reviewed by developers.

Code Signing

Digital signing of software to verify its source and determine whether it has been modified since release.

Sandbox

Restricted or isolated environment that limits what an application can access or allows software to be tested without affecting production.

Application Monitoring

Monitoring application activity and logs for attacks, unexpected file transfers, unusual access, and other abnormal behavior.

Static vs. Dynamic Application Testing

Static testing examines source code; dynamic testing such as fuzzing evaluates a running application using unexpected input