675 - 754 reminders

SCAP (Security Content Automation Protocol)

Got it, I'll keep definitions shorter going forward, just the key points.

SCAP — a NIST framework that automates vulnerability and configuration compliance checks across systems. Combines standards like CVE (known vulnerabilities), CCE (config issues), CPE (platform naming), CVSS (severity scoring), and OVAL (system state checks) so different tools can interoperate. Used heavily by federal agencies/compliance tools to automate baseline and vulnerability checks — not for detecting sensitive data like PII.

HSMaaS (Hardware Security Module as a Service)

cloud-based service providing HSM (hardware security module) capabilities without owning physical hardware. Enables centralized, consistent key management across multicloud environments, supports importing existing keys (BYOK), and offers low latency plus compliance (FIPS 140-2/3) without the overhead of managing separate physical HSMs.

CHAP (Challenge-Handshake Authentication Protocol)

Authenticates a user/device over a point-to-point link using a challenge-response method (server sends challenge, client responds with a hash using a shared secret) rather than sending the password itself. Periodically re-authenticates during the session to prevent replay attacks

OpenID

federated identity protocol that lets a user log in to a third-party application/website using credentials from an existing trusted account (like Google or Facebook), without creating a new separate login. Relies on an identity provider to verify the user and pass proof of identity to the relying application.

MS-CHAPv2

Microsoft's version of CHAP. Password-based authentication protocol, no certificate support.

SCEP (Simple Certificate Enrollment Protocol.)

Automates the process of requesting/enrolling and issuing digital certificates, commonly used for provisioning devices at scale.

Cold aisle

data center row where equipment intakes face each other, receiving cool air to keep servers at optimal operating temperature

Hot aisle

data center row where equipment exhausts face each other, channeling hot air away for removal/cooling, paired with cold aisles for efficient airflow

Security control matrix

a mapping document showing which security controls address which requirements/frameworks; used for planning/compliance tracking, not active config checks.

NXDOMAIN attack

an attack where an adversary floods a DNS server with queries for non-existent domains (causing "NXDOMAIN" — non-existent domain — responses), overwhelming the server's resources/cache and potentially causing denial of service or performance degradation for legitimate DNS resolution.

SIMULATION - A newly purchased corporate WAP needs to be configured in the MOST secure manner possible. INSTRUSTIONS - Please click on the below items on the network diagram and configure them accordingly: •WAP •DHCP Server •AAA Server •Wireless Controller •LDAP Server If at any time you would like to bring back the initial state of the simulation, please dick the Reset All button

DRAG DROP A security engineer is setting up passwordless authentication for the first time. INSTRUCTIONS Drag and drop the MINIMUM set of commands to set this up and verify that it works. Commands may only be used If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

LEAP

Lightweight EAP. Cisco-proprietary wireless authentication protocol; outdated and vulnerable, used for Wi-Fi, not SaaS app login.

PEAP

Protected EAP. Wraps another EAP method in a TLS tunnel for secure wireless/network authentication, not used for SaaS credential federation.

RTOS

Real-Time Operating System. Designed for predictable, time-critical processing with guaranteed response times; used in systems requiring precise timing, not flexibility.

Skimming

physically capturing card data (magnetic stripe/chip) using a hidden device attached to a card reader/ATM/kiosk, without the victim's knowledge.

NFC attack

exploiting Near Field Communication (used in contactless/tap payments) to intercept or manipulate short-range wireless payment data.

DHCP snooping

a Layer 2 network security feature (typically on switches) that filters and monitors DHCP traffic, allowing DHCP responses only from trusted/authorized ports (like the legitimate DHCP server). Prevents rogue DHCP servers from handing out malicious IP configurations, which could otherwise be used for attacks like on-path/man-in-the-middle interception. It's a mitigation control, not a vulnerability.