375 - 450 reminders

Mandatory Access Control (MAC)

• An access control model where access decisions are based on classification labels (like top secret, secret, confidential, unclassified) assigned to data, and clearance levels assigned to users.

• Access is enforced by a central authority (like a system administrator or security policy), not by individual data owners, users cannot change or override these classifications/permissions themselves.

• Combines classification level with the need-to-know principle: even if a user has sufficient clearance, they only get access to specific data if they have a legitimate operational need to know that particular information.

• Commonly used in military, government, and highly regulated environments where strict, centrally controlled data protection is critical.

Discretionary Access Control (DAC)

• An access control model where the owner of a resource (like a file or folder) has the discretion to decide who else is granted access to it and what level of access they receive.

• Common in general-purpose operating systems (like traditional Windows or Linux file permissions), where a file's creator/owner can grant or restrict access to other users.

• Highly flexible but less centrally controlled, since individual users, not a central security policy, make access decisions, this can lead to inconsistent or weaker security enforcement compared to more centralized models like MAC.

Data custodian

• The role responsible for the technical, day-to-day management and maintenance of data, including storage, backups, security controls, and system upkeep.

• Focuses on implementing and enforcing the technical safeguards needed to protect data (like access controls, encryption, and backup procedures) based on guidance from the data owner or controller.

• Does not decide why data is collected or how it should be used/processed, they carry out the operational/technical responsibilities to keep the data secure and properly maintained.

Data controller

• The role responsible for determining the purpose for which data is collected and the means/methods by which it will be processed.

• Makes the key decisions about why data is being gathered and how it should be handled, essentially setting the overall direction and legal responsibility for data processing activities.

• Under regulations like GDPR, the data controller bears primary legal accountability for ensuring data processing complies with privacy laws and regulations.

Data protection officer

• A role (often required under regulations like GDPR for certain organizations) responsible for overseeing an organization's overall compliance with data protection laws and privacy regulations.

• Acts as an independent advisor, monitoring data protection practices, advising on data protection impact assessments, training staff, and serving as a point of contact for regulators and individuals regarding privacy concerns.

• Provides oversight and governance, but doesn't make the day-to-day decisions about the specific purpose or processing methods for particular data sets, that responsibility belongs to the data controller.

Data processor

• The role (often a third party or vendor) that processes data on behalf of and according to the instructions given by the data controller.

• Carries out the actual data processing activities (like storing, analyzing, or transmitting data) but does not independently determine the purpose or overall methods of processing, they act under the controller's direction and instructions.

• Still holds specific legal responsibilities under privacy laws (like GDPR) to protect the data they process and ensure they follow the controller's lawful instructions.

tracert (traceroute)

• A network diagnostic tool used to trace the path (route) that packets take from a source device to a destination device across a network.

• Shows each intermediate hop (router) along the path, along with the time taken to reach each one, helping identify where along a route latency or connectivity issues might be occurring.

• Useful for diagnosing routing problems or identifying at which specific hop traffic is being dropped or delayed, but less useful when the issue is confirmed to be a specific port/service being blocked between two devices that already have confirmed connectivity.

PUP (Potentially Unwanted Program)

• Software that isn't necessarily malicious or outright malware, but exhibits behavior that many users or organizations would consider undesirable, intrusive, or unwanted.

• Often bundled with legitimate software installations (sometimes without clear user consent), such as toolbars, browser extensions, adware, or system optimization tools that a user didn't specifically intend to install.

• Common characteristics that trigger a PUP classification include: consuming excessive system resources (CPU, memory, or GPU), displaying unwanted advertisements, modifying browser settings without clear permission, running persistent background processes, or making unusual network connections.

• Cryptomining software is a frequent example flagged as a PUP, even when deployed legitimately, because it shares many of these same behavioral traits (heavy resource consumption, background processing, connections to mining pools) with malicious cryptojacking malware.

• Differs from traditional malware in that a PUP isn't necessarily designed with malicious intent (like stealing data or causing direct harm), it's more about the program being unwanted, resource-intensive, or exhibiting behavior a security tool considers borderline suspicious.

• Antivirus and endpoint protection software typically include heuristic detection rules specifically designed to flag PUPs, sometimes requiring administrators to create explicit exceptions/allowlist entries for legitimate software (like authorized mining applications) that would otherwise be flagged and blocked.

iptables

• A command-line firewall utility built into the Linux kernel, used to configure rules that control incoming, outgoing, and forwarded network traffic (packet filtering).

• Works by organizing rules into chains (like INPUT for incoming traffic, OUTPUT for outgoing traffic, and FORWARD for traffic being routed through the system) grouped within tables (like the default filter table, or specialized tables like nat and mangle).

• Each rule defines criteria (such as source/destination IP, port, protocol) and an action to take when traffic matches, such as ACCEPT, DROP, or REJECT.

• Rules are processed in order within a chain, and traffic is compared against them sequentially until a matching rule is found; if no rule matches, the chain's default policy (like ACCEPT or DROP) is applied.

• Common administrative commands include: -A (append a rule), -D (delete a rule), -F (flush/remove all rules in a chain), -L (list current rules), -P (set the default policy for a chain), and -Z (zero out packet/byte counters).

• Historically the standard Linux firewall tool, though it has increasingly been succeeded by nftables in more modern Linux distributions, which offers similar functionality with an updated, more efficient syntax and framework.

• Misconfigured iptables rules (like an overly restrictive default policy or a rule blocking essential traffic) can easily cause exactly the kind of connectivity outage described in the previous question, making it critical to understand how to safely flush or modify rules when troubleshooting.

Cron job

• A scheduled task on Linux/Unix systems that runs automatically at specified times or intervals, managed by a background service called cron (the daemon that executes these scheduled tasks).

• Defined using a crontab (cron table) file, which lists the commands or scripts to run along with a schedule specifying when they should execute.

• The schedule uses a five-field time format: minute, hour, day of month, month, and day of week, each field can be a specific value, a range, a list, or an asterisk (*) meaning "every" (e.g., */10 in the minute field means "every 10 minutes").

• Each user on a system can have their own crontab (viewable with crontab -l, as in the earlier question), and there's also a system-wide crontab that can run jobs as any user, including root.

• Commonly used for routine automated tasks like backups, log rotation, system maintenance, sending scheduled reports, or running periodic scripts.

• Security relevance: if a cron job (especially one running as root) references a script or file that has weak/overly permissive file permissions (like being writable by a lower-privileged user), it creates a privilege escalation opportunity, an attacker can modify that script, and the next time cron executes it, their injected code runs with whatever privilege level the cron job was configured to use (in the earlier question's case, root).

SIP (Session Initiation Protocol)

• A signaling protocol used to initiate, manage, and terminate real-time communication sessions, most commonly for VoIP (Voice over IP) calls, but also used for video conferencing and instant messaging sessions.

• Handles the setup process for a call or session, things like establishing the connection between two parties, negotiating session parameters (like which audio/video codecs to use), and tearing down the session once it ends.

• Does not carry the actual voice/media data itself, that's typically handled by a separate protocol like RTP (Real-time Transport Protocol) or its secure version, SRTP, SIP is just responsible for the signaling (setting up and controlling the session).

• Commonly used by VoIP phone systems, video conferencing platforms, and unified communications systems within organizations.

• Security considerations: SIP traffic can be vulnerable to eavesdropping, spoofing, or toll fraud (unauthorized use of a VoIP system to make calls) if not properly secured, often mitigated using encryption (like SIPS, SIP over TLS) and authentication mechanisms.

• Relevant to the earlier question because SIP traffic logs specifically capture voice/video call signaling activity, not web browsing behavior, which is why they wouldn't be useful for tracing a malware infection that occurred through a user browsing malicious websites.

.pfx (Personal Information Exchange)

• A file format that bundles together a certificate and its associated private key into a single, typically password-protected file.

• Commonly used when you need to transfer or back up both the public certificate and the private key together, such as when moving a certificate between servers or systems.

• Because it contains the private key, a .pfx file must be kept secure and should never be shared publicly or with a third party, doing so would expose the private key and compromise the security of anything encrypted or signed with that key pair.

.csr (Certificate Signing Request)

• A file generated by an applicant (like a website owner or organization) containing their public key and identifying information (such as domain name, organization name, and location), which is then submitted to a Certificate Authority (CA) to request a signed digital certificate.

• Does not contain the private key, only the public key and requester information needed for the CA to verify identity and issue a certificate.

• Represents an intermediate step in the certificate issuance process, it's the request itself, not the final issued certificate.

.pvk (Private Key)

• A file format specifically used to store a private key on its own, separate from any certificate.

• Historically used mainly on Windows systems (often paired with a corresponding .spc or .cer file containing the public certificate).

• Like any private key file, a .pvk file must be kept strictly confidential and secure, since possessing the private key would allow someone to decrypt data or forge signatures associated with that key pair.

.cer (Certificate)

• A common file format used to store and share a public key certificate, containing the public key along with identifying information and the issuing CA's digital signature.

• Safe to share openly and publicly, since it only contains public information, no private key material is included.

• The correct and standard format for sharing a public key with a third party for purposes like secure communication, encryption, or verifying a digital signature.

Data steward

• A role responsible for the practical, day-to-day management of data quality, ensuring information is accurate, consistent, properly formatted, and well-organized within an organization.

• Focuses on the operational aspects of data governance, implementing the data policies and standards set by data owners or governance committees, rather than making high-level decisions about data classification or usage purpose.

• Typically works closely with data owners and data custodians, translating governance policies into practical data management practices, like maintaining data definitions, resolving data quality issues, and ensuring proper metadata/documentation.

• Often acts as a subject matter expert for a specific data domain (e.g., a "customer data steward" ensuring customer records are accurate and properly maintained across systems).

• Different from a data custodian (who handles technical security and storage controls) and a data owner (who sets policy and is ultimately accountable for the data), the data steward's focus is specifically on data quality, usability, and proper handling/labeling of the data itself.

Elliptic-curve cryptography (ECC)

• A type of asymmetric (public-key) cryptography based on the mathematical properties of elliptic curves over finite fields, rather than the large prime number factorization used by traditional algorithms like RSA.

• Provides equivalent security strength to older algorithms like RSA, but with significantly smaller key sizes, for example, a 256-bit ECC key can offer security roughly comparable to a much larger 3072-bit RSA key.

• Smaller key sizes translate to faster computations, lower processing power requirements, reduced memory usage, and less bandwidth needed for key exchange, making ECC especially well-suited for resource-constrained environments like mobile devices, IoT devices, and smart cards.

• Commonly used in modern protocols and applications, including TLS/SSL (for securing web traffic), digital signatures, and key exchange mechanisms like ECDH (Elliptic Curve Diffie-Hellman) and its ephemeral variant ECDHE, which is specifically used to achieve perfect forward secrecy.

• The security of ECC relies on the difficulty of solving the "elliptic curve discrete logarithm problem," a mathematically hard problem that underpins its cryptographic strength.

• Important distinction from perfect forward secrecy: ECC is simply the underlying cryptographic algorithm/method used for keys and signatures, it doesn't by itself guarantee forward secrecy. Forward secrecy specifically requires generating unique, ephemeral session keys for each session (as with ECDHE), rather than reusing a long-term key across multiple sessions.

Pharming

• A social engineering/cyberattack technique that redirects users from a legitimate website to a fraudulent, malicious one, without the user's knowledge or any action on their part (unlike phishing, which typically requires the victim to click a malicious link).

• Commonly achieved through DNS poisoning/spoofing (corrupting DNS records so a legitimate domain name resolves to a malicious IP address) or by modifying a victim's local hosts file to redirect specific domain lookups.

• Since the redirection happens at the DNS/network level rather than relying on a deceptive email or link, victims can be redirected even when they type the correct, legitimate URL directly into their browser.

• The fraudulent website is typically designed to look identical to the real one, aiming to trick victims into entering sensitive information like login credentials or financial details, which the attacker then captures.

• Considered more dangerous than typical phishing in some respects, since it doesn't require the victim to make an obvious mistake (like clicking a suspicious link), the attack works even with normal, careful browsing behavior, as the manipulation happens at the DNS resolution level.

• Mitigations include DNSSEC (which cryptographically verifies DNS responses), keeping systems and routers patched against known DNS vulnerabilities, and monitoring for unusual DNS/hosts file changes.

Bluejacking

• An attack in which an unauthorized person sends unsolicited messages, contact cards (vCards), or other data to a nearby Bluetooth-enabled device, without the victim's knowledge or consent.

• Exploits Bluetooth's discovery/messaging features to push content onto a nearby device, rather than actually accessing or stealing any data already stored on it.

• Generally considered more of a nuisance/prank-style attack than a serious data breach, since it doesn't extract private information from the victim's device, it just sends unwanted content to it.

• Requires the attacker to be within Bluetooth range (typically a relatively short distance) of the target device.

• Different from bluesnarfing, which involves an attacker actually accessing and stealing data (contacts, messages, files) from a victim's device via Bluetooth, bluejacking is one-directional (sending unsolicited data to the device), while bluesnarfing is about extracting data from the device.

• In the context of the earlier question, an attacker used bluejacking to push/insert new or modified contact entries onto the employee's corporate device without ever needing physical access to it, just Bluetooth proximity.

SSRF (Server-Side Request Forgery)

• An attack where an attacker tricks a vulnerable server into making unintended HTTP (or other) requests on the attacker's behalf, often to internal resources that wouldn't normally be reachable from outside the network.

• Exploits application functionality that fetches data from a URL supplied by the user (like an image loader, webhook, or PDF generator) without properly validating or restricting the destination.

• Commonly used to access internal-only systems (like cloud metadata services, internal APIs, or admin panels) that are normally protected by network segmentation, since the request originates from the trusted server itself rather than from the external attacker directly.

• Can lead to serious consequences like exposing sensitive internal data, credentials, or cloud service metadata (a well-known real-world example involves attackers using SSRF to access AWS EC2 instance metadata to steal temporary cloud credentials).

• Mitigations include validating and restricting allowed URLs/destinations, using allowlists for outbound requests, and disabling unnecessary URL-fetching functionality.

CSRF (Cross-Site Request Forgery)

• An attack that tricks a victim's browser into submitting an unintended, unauthorized request to a web application where the victim is currently authenticated, without their knowledge or consent.

• Exploits the fact that browsers automatically include stored session cookies with requests to a site, so if a victim is logged into a vulnerable application and visits a malicious page (or clicks a crafted link), that page can silently trigger actions (like transferring funds or changing account settings) using the victim's already-authenticated session.

• The victim's browser does the "forging" of the request, the victim doesn't realize a request was even sent on their behalf, that's the deceptive core of the attack.

• Commonly seen in scenarios like the one from an earlier question in this conversation: hidden image tags or auto-submitting forms embedded on a malicious page that trigger state-changing GET/POST requests (like a fund transfer) using the victim's active session.

• Mitigations include using anti-CSRF tokens (unique, unpredictable values tied to a session that must be included in legitimate requests), checking the Referer/Origin header, and using SameSite cookie attributes to restrict when cookies are sent with cross-site requests.

IP schema

• A defined plan or structure for how IP addresses are allocated and organized across an organization's network, including how subnets are divided, which address ranges are assigned to specific departments, locations, or device types, and how the overall addressing hierarchy is structured.

• Helps ensure IP addresses are assigned logically and consistently (e.g., all devices in a specific building or VLAN fall within a particular subnet range), making the network easier to manage, troubleshoot, and scale.

• Typically includes details like subnet masks, gateway addresses, DHCP scope ranges, and reserved/static IP ranges for critical infrastructure.

• Focused specifically on numerical IP addressing structure, not on naming or labeling conventions for devices, that's the role of a standard naming convention policy instead.

MTBF (Mean Time Between Failures)

• A reliability metric that measures the average, predicted time a system, component, or device is expected to operate correctly before experiencing a failure.

• Calculated by dividing the total operational time of a system (or fleet of similar systems) by the number of failures that occurred during that period.

• Used primarily for repairable systems, it represents the average time between one failure and the next, assuming the system is repaired and put back into service after each failure.

• A higher MTBF indicates a more reliable system, one expected to run longer, on average, before encountering another failure.

• Commonly used by manufacturers and IT teams to estimate hardware reliability, plan maintenance schedules, and make decisions about when equipment might need replacement or increased monitoring.

• Different from MTTR (Mean Time To Repair), which measures how long it takes to fix a system after it fails, MTBF focuses on the time between failures, while MTTR focuses on the speed of recovery once a failure has already occurred.

• Not related to determining a specific point in time for data recovery after an outage, that's the role of RPO, MTBF is purely about the expected frequency/reliability of hardware or system failures over time.

Soft token

• A software-based authentication method, typically an app installed on a smartphone or computer, that generates time-based one-time passwords (TOTP) or push notifications used as a second authentication factor.

• Functions similarly to a hardware token but exists purely as software rather than a physical device (examples include Google Authenticator, Microsoft Authenticator, or Duo Mobile).

• Requires installing an application on a device, and is typically used alongside a password as part of multi-factor authentication, rather than replacing password-based authentication entirely.

CSR (Certificate Signing Request)

• A file generated by an entity (like a server administrator or organization) requesting a digital certificate from a Certificate Authority (CA).

• Contains the requester's public key along with identifying information (such as domain name, organization, and location), but does not include the private key.

• Represents an intermediate step in the process of obtaining a digital certificate, it's submitted to a CA, which then verifies the information and issues a signed certificate in return.

• Not itself an authentication method or access mechanism, it's part of the certificate issuance process used to eventually support things like HTTPS or code signing.

Smart card

• A physical card embedded with a microchip that stores authentication credentials, certificates, or cryptographic keys, used for identity verification and access control.

• Requires a smart card reader (hardware) attached to or built into the device, along with supporting drivers/software installed on the system to communicate with the card.

• Commonly used in government, military, and enterprise environments (like the U.S. Department of Defense's Common Access Card) for both physical access (building entry) and logical access (logging into systems) requiring dual authentication factors (something you have, the card, plus something you know, a PIN).

SSH key

• A cryptographic key pair (public and private key) used to authenticate to remote systems, most commonly Linux/Unix servers, over the SSH (Secure Shell) protocol, without needing a password.

• The public key is placed on the server being accessed, while the private key remains securely stored on the user's local device, during authentication, the server verifies that the connecting client possesses the matching private key.

• Provides strong, passwordless authentication using standard, typically pre-installed SSH client software, avoiding the need for additional software installation, exactly why it fit the requirements in the previous question (remote access to a Linux server without password management or extra software).

• Considered a best practice for securing SSH access, since key-based authentication is generally much stronger and less vulnerable to brute-force attacks than password-based authentication.

cat (concatenate)

• A command-line utility used to display the contents of one or more files directly to the terminal (standard output).

• Named "concatenate" because it can also combine multiple files together and display them as one continuous output.

• Simply outputs everything in the file, it doesn't filter, search, or process the content in any way on its own.

• Commonly used as the first step in a pipeline, feeding a file's full contents into another command (like grep) for further processing.

grep (Global Regular Expression Print)

• A command-line utility used to search through text (either from a file directly, or from input piped to it) for lines matching a specific pattern or string.

• Displays only the lines that match the search pattern, filtering out everything else, making it ideal for finding specific entries within large files, like searching for a specific IP address within a log file.

• Supports powerful pattern matching using regular expressions, allowing for flexible and complex searches beyond simple exact text matches.

• Can be used directly on a file (e.g., grep "10.1.1.1" /var/messages) or as part of a pipeline receiving input from another command (e.g., cat /var/messages | grep 10.1.1.1).

RAID (Redundant Array of Independent Disks)

• A data storage technology that combines multiple physical hard drives into a single logical unit, using various configurations (called "levels") to improve performance, provide redundancy, or both.

• Primary goal in a security/availability context: protecting against data loss and downtime if one (or more) drives fail, by storing data redundantly across multiple disks so the system can continue operating and preserve data even after a drive failure.

• Common RAID levels include:

  • RAID 0 (striping): splits data across multiple drives for improved performance, but provides no redundancy, if one drive fails, all data is lost.

  • RAID 1 (mirroring): duplicates the exact same data across two drives, if one fails, the other still has a complete copy, providing strong fault tolerance.

  • RAID 5: stripes data across three or more drives with distributed parity information, allowing the array to survive the failure of a single drive while also improving performance.

  • RAID 6: similar to RAID 5 but with additional parity, allowing the array to survive the failure of two drives simultaneously.

  • RAID 10 (1+0): combines mirroring and striping, offering both strong redundancy and improved performance, though it requires more drives.

• Directly supports server-data fault tolerance because even if a physical drive fails, the system can continue functioning without data loss (depending on the RAID level used), and the failed drive can often be replaced and rebuilt without taking the system offline.

• Different from backups: RAID protects against hardware failure in real time, keeping systems running continuously, but it doesn't protect against things like accidental deletion, corruption, or ransomware, that's what backups are specifically for, RAID and backups serve complementary but distinct purposes.

SEAndroid (Security-Enhanced Android)

• A security framework built into the Android operating system, based on SELinux (Security-Enhanced Linux), that implements mandatory access control (MAC) at the OS level.

• Restricts what actions apps, processes, and system components are allowed to perform, even if a process is compromised or running with elevated privileges, SEAndroid can limit the damage it's able to do by enforcing strict, predefined policies about what it's allowed to access.

• Helps contain the impact of malware or exploited vulnerabilities by confining processes to only the specific resources and actions they're explicitly permitted to use, rather than relying solely on traditional discretionary permissions.

• Operates at a deep system/kernel level, focused on containing and limiting malicious behavior and privilege escalation within the OS itself, rather than controlling physical device access (like unlocking the phone) or authenticating a specific user trying to pick up and use the device.

• Not related to preventing someone from physically accessing an unattended, unlocked device, that's a device-level access control issue (like screen lock), not an OS-level process containment issue.

GPS tagging

• The use of a mobile device's built-in GPS (Global Positioning System) capability to record and track its physical location, often embedding location data into files (like photos) or reporting real-time location to a management system.

• Commonly used in MDM (Mobile Device Management) solutions to locate a lost or stolen device on a map, or to enforce geofencing policies (restricting or allowing certain actions based on the device's current location).

• Useful for after-the-fact tracking, helping locate a missing device or verify where it has been, but it doesn't prevent someone from physically accessing an unattended device that's still within the user's own location, it's a location-tracking feature, not an access control mechanism.

• Different from screen lock timers or biometric authentication, GPS tagging tells you where a device is, it doesn't control who can unlock and use it while it's sitting there.

PPTP (Point-to-Point Tunneling Protocol)

• One of the earliest VPN protocols developed to create encrypted tunnels for remote network connections.

• Now considered outdated and insecure, it has well-documented cryptographic weaknesses and has largely been replaced by more secure protocols like IPSec, OpenVPN, and SSL/TLS-based VPNs.

• While technically a tunneling/encryption protocol, its known vulnerabilities make it a poor and inappropriate choice whenever strong, modern security is required for establishing a communication channel.

PGP (Pretty Good Privacy)

• An encryption program used to provide cryptographic privacy and authentication for data communication, most commonly associated with securing email content.

• Uses a combination of symmetric and asymmetric encryption: it encrypts the actual message using a fast symmetric algorithm, then encrypts that symmetric key using the recipient's public key (asymmetric encryption), combining speed and security.

• Also supports digital signatures, allowing the sender to sign a message with their private key so the recipient can verify both the authenticity (who sent it) and integrity (that it wasn't altered) of the message using the sender's public key.

• Provides end-to-end encryption at the application/content level, meaning the email itself is encrypted regardless of which mail servers or protocols are used to transmit it, making it a cost-effective solution since it doesn't require additional network infrastructure to implement.

• GPG (GNU Privacy Guard) is a widely used, free, open-source implementation of the PGP standard.

POP (Post Office Protocol)

• A protocol used by email clients to retrieve messages from a mail server, typically downloading emails to the local device and often removing them from the server afterward (though configurations can vary).

• Currently on version 3 (POP3), it's one of the oldest and simplest email retrieval protocols, historically designed for a time when users accessed email primarily from a single device.

• Does not provide any encryption or security for the content of the emails being retrieved, POP itself is just a mechanism for downloading messages, it doesn't protect sensitive data within those messages.

• Different from IMAP, which keeps messages synchronized on the server and allows access from multiple devices, POP is more suited to single-device, download-and-remove style email access.

• Can be run over an encrypted connection (POP3S, using SSL/TLS) to protect the connection itself during retrieval, but this only secures the transmission between the client and server, it doesn't provide the end-to-end message encryption that PGP does for the actual email content.

Wardriving

• The practice of searching for and mapping wireless networks, typically by driving (or walking/biking) around an area with a laptop, smartphone, or specialized equipment equipped with Wi-Fi scanning tools and often a GPS device to log locations.

• Originally used by security researchers and hobbyists to identify and catalog open or poorly secured wireless networks, but the same technique can be used maliciously to locate vulnerable networks to exploit.

• Can reveal networks using weak or outdated encryption (like WEP), networks with default credentials, or completely open/unsecured access points, all of which present potential entry points for an attacker.

• Sometimes paired with related practices like "warchalking" (marking physical locations, like sidewalks, with symbols indicating the type and security status of a nearby wireless network for others to find).

• Highlights the importance of using strong encryption (like WPA2/WPA3), disabling unnecessary broadcast of SSIDs where appropriate, and regularly auditing wireless network security to avoid being an easy target discovered through wardriving.

MSA (Master Service Agreement)

• A foundational legal contract that establishes the overall terms and conditions governing an ongoing business relationship between two organizations, typically a customer and a service provider.

• Covers broad, general terms that apply across the entire relationship, such as payment terms, liability limitations, confidentiality obligations, dispute resolution processes, intellectual property rights, and termination conditions.

• Acts as an "umbrella" agreement, once in place, it allows the two parties to enter into additional, more specific work arrangements without having to renegotiate the same foundational legal terms each time.

• Specific, detailed operational requirements (like exact service performance metrics, audit schedules, attestation frequency, or particular project deliverables) are typically defined in separate, more granular documents that fall under the MSA, such as an SLA (Service Level Agreement) or SOW (Statement of Work), rather than in the MSA itself.

• Useful for organizations that expect to have an ongoing, potentially multi-project relationship with a vendor or service provider, since it streamlines future agreements by having the core legal framework already established.