1 - 75 reminders

faraday cage

a protective enclosure made of conductive metal that blocks electromagnetic and radio frequency (RF) signals, preventing wireless hacking, data theft, and remote device tracking.

proximity reader

A proximity reader is an electronic access control device that uses radio frequency or electromagnetic fields to wirelessly identify cards, key fobs, or mobile devices. In cybersecurity, managing these hardware endpoints requires addressing unique physical and digital vulnerabilities

snapshots

a point-in-time record of a system's data state or an external assessment of an organization's digital attack surface. It is used for quick system recovery and evaluating security posture.

homomorphic encryption

a special type of encryption that lets you run math and computer programs on encrypted data without needing to decrypt it first.

hips

host intrusion prevention system moinotrs and blcoks malicious behavior on a running host

fim

FIM (File Integrity Monitoring) detects changes to specific files or configurations by comparing hashes over time (e.g., watching system binaries or config files for unauthorized modification). It's useful for catching post-boot tampering with files, but it doesn't establish a hardware root of trust, doesn't validate the boot chain itself, and has no attestation mechanism a remote party can rely on.

tpm

trusted platform module is a hardware-based root of trust that performs measured boot: it hashes and records each component of the boot chain (firmware, bootloader, OS kernel) into secure Platform Configuration Registers (PCRs) as the system starts up. Those measurements can then be checked locally (to confirm the machine hasn't been tampered with before continuing to boot) or reported to a remote server as a signed attestation, letting a remote party verify the system booted into a known-good, unmodified state. That maps directly onto the requirement in the question: ensuring system integrity and supporting both local and remote boot attestation. No other option here provides that hardware root of trust or attestation capability.

volP-associated vulnerabilties

voice over internet protocol systems

eap

Extensible Authentication Protocol) is an authentication framework, it's used to verify who a user or device is before granting network access (commonly paired with 802.1X in enterprise WPA2/WPA3 setups). It controls who gets onto the network, but it isn't itself what encrypts the data once someone (authorized or not) is capturing wireless frames over the air. Authentication and encryption are related but distinct concerns; the question is about protecting data confidentiality, not verifying identity.

tls

encrypts data at the application/transport layer between two endpoints (e.g., a browser and a web server), it's not something you "configure on the wireless network" itself; it operates independently of whatever wireless security is in place and protects specific sessions/connections rather than the wireless link as a whole.

https

just HTTP running over TLS, it's a protocol for securing web traffic specifically, not a wireless network configuration, and it only protects browser-based traffic to HTTPS sites, not all data crossing the wireless network (email clients, file shares, other apps, etc.).

aes

Advanced Encryption Standard) is the strong symmetric encryption algorithm used within WPA2/WPA3 to encrypt data transmitted over the wireless network, ensuring that even though the shared office space means other tenants' devices can physically receive the radio signals, they can't read the actual data content without the encryption key. That directly addresses "confidential data is not exposed," which is a data-confidentiality-in-transit concern specific to the wireless medium.

swg

SWG (Secure Web Gateway) filters and inspects outbound web traffic from users/clients (blocking malicious sites, enforcing content policy, preventing data exfiltration over HTTP/S), it's a client-side/egress control for user web browsing, not a mechanism for restricting which inbound ports a server listens on.

host-based firewall

A host-based firewall runs on each individual server and can be configured to allow or block specific inbound/outbound ports on that host, exactly the requirement here (allow only 443, disable everything else). Since this needs to be applied consistently across 100 servers, the engineer would typically push this configuration out via automation/scripting or a configuration management tool, but the underlying control that enforces the port restriction on each server is the host-based firewall (e.g., iptables, Windows Firewall, or a cloud-native host firewall agent).

access control vestibule

a physical security configuration featuring two interlocking doors where the second door cannot open until the first door safely closes

iso 31000

ISO 31000 is the international standard specifically dedicated to risk management principles and guidelines. It's industry-agnostic, applicable to any organization regardless of size or sector, and provides a structured framework covering the full risk management lifecycle: identifying, analyzing, evaluating, treating, monitoring, and communicating risk. Since the analyst's stated goal is to reference a standard for developing a risk management program specifically, ISO 31000 is the purpose-built answer.

ssae soc 2

SSAE SOC 2 is an auditing standard used to produce a report on a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, it's a compliance/attestation framework for demonstrating controls to customers and auditors, not a guide for building a risk management program from the ground up.

mist csf

is focused specifically on cybersecurity risk, organized around the functions of Identify, Protect, Detect, Respond, and Recover. It's an excellent framework for managing cybersecurity risk in particular, but it's narrower in scope than a general enterprise risk management program and is more of a cybersecurity-specific framework than a broad risk management standard.

arp poisoning

It's used on local networks to map a known IP address to its corresponding MAC (hardware) address. When a device wants to send data to another device on the same local network, it knows the destination's IP address but needs the physical MAC address to actually deliver the frame at Layer 2, ARP handles that lookup by broadcasting a request ("who has this IP?") and getting a reply with the matching MAC address, which is then cached in the device's ARP table for future use.

This is also why ARP poisoning is a real threat: since ARP has no built-in authentication, an attacker can send forged ARP replies claiming their MAC address belongs to a different IP (like the gateway), tricking other devices into sending traffic to the attacker instead, enabling man-in-the-middle interception on the local network.

address resolution protocol

mac flooding

Layer 2 attack against a switch's CAM table, overflowing it with fake MAC addresses so the switch fails open and starts broadcasting traffic to all ports (enabling sniffing). This is an internal LAN attack, it would affect internal network behavior and traffic visibility, and since the internal network here is explicitly not degraded, this doesn't fit.

RFC

Request for Comments.

It refers to a series of documents used mainly by the IETF (Internet Engineering Task Force) to propose, define, and document internet standards, protocols, procedures, and best practices. Despite the informal-sounding name, many RFCs become the actual formal specifications that define how core internet technologies work, things like TCP/IP, HTTP, DNS, and SMTP were all originally defined through RFC documents. The name reflects their origin as drafts circulated for community review and feedback before being finalized as standards.

In the context of the previous question, RFC submission is part of the internet standards development process, not a threat intelligence sharing mechanism, which is why it wasn't the right answer for that scenario.

TAXII server

TAXII (Trusted Automated Exchange of Indicator Information) is a protocol specifically designed for sharing cyber threat intelligence in a standardized, automated way between organizations, it's built to work alongside STIX (Structured Threat Information Expression), which formats the actual threat data. Implementing a TAXII server lets an organization both push and pull threat intelligence to and from peer organizations or sharing communities (like an ISAC), which is exactly what "participate in threat intelligence information sharing with peer groups" requires: active, bidirectional exchange, not just consumption.

False Rejection Rate (FRR)

is the opposite: the rate at which the system incorrectly rejects a legitimate, authorized user, telling a real ticket holder that their fingerprint doesn't match when it actually does. A low FRR means legitimate customers rarely get wrongly turned away, so it favors convenience and smooth user experience. This is why low FRR was the right answer for the park: the owner wants paying customers moving through quickly without hassle, even if that means being slightly more lenient overall.

Crossover Error Rate (CER)

also called EER (Equal Error Rate), is the point on a biometric system's performance curve where FAR and FRR are equal, it's a single number used to summarize a system's overall accuracy. A lower CER generally indicates a better-performing, more accurate biometric system overall (fewer errors of either kind at that balance point), but it doesn't tell you whether the system leans toward favoring security or convenience, it's a general quality benchmark, not a directional priority.

Equal Error Rate (ERR)

also called EER (Equal Error Rate), is the point on a biometric system's performance curve where FAR and FRR are equal, it's a single number used to summarize a system's overall accuracy. A lower CER generally indicates a better-performing, more accurate biometric system overall (fewer errors of either kind at that balance point), but it doesn't tell you whether the system leans toward favoring security or convenience, it's a general quality benchmark, not a directional priority.Fis

False Acceptance Rate (FAR)

is the rate at which a biometric system incorrectly accepts an unauthorized user as if they were a legitimate match, essentially letting the wrong person in. A low FAR means the system is strict and rarely lets an impostor through, which favors security. In the amusement park scenario, a low FAR would mean the system is very good at catching someone trying to use a fingerprint that isn't actually theirs (i.e., stopping ticket-sharing), but pushing FAR very low often comes at the cost of also rejecting some legitimate users more often.

International Organization for Standardization (ISO)

is an independent, non-governmental international body that develops and publishes voluntary standards across a huge range of industries, not just security. In the security world, its best-known standard is ISO/IEC 27001, which defines requirements for an Information Security Management System (ISMS), essentially a framework for how an organization should structure its overall approach to managing information security risk, policies, and governance. ISO standards tend to be broad, process- and management-level frameworks rather than granular technical configuration instructions.

General Data Protection Regulation (GDPR)

is a legal regulation enacted by the European Union, not a standards body or set of technical controls. It governs how organizations collect, store, process, and protect the personal data of EU residents, giving individuals rights over their data (like the right to access, correct, or delete it) and imposing strict obligations and penalties on organizations that mishandle personal data. It's about legal compliance and privacy rights, not system hardening.

Payment Card Industry Data Security Standard (PCI DSS)

is an industry-specific standard created by the major credit card companies (Visa, Mastercard, American Express, etc.) through the PCI Security Standards Council. It applies specifically to any organization that stores, processes, or transmits credit card/payment card data, setting requirements like encryption of cardholder data, network segmentation, access controls, and regular vulnerability scanning. Its scope is narrow and payment-card-focused rather than general-purpose.

National Institute of Standards and Technology (NIST)

is a U.S. federal agency (part of the Department of Commerce) that produces detailed technical standards, guidelines, and best practices across many fields, including cybersecurity. Its cybersecurity publications (like the 800-series Special Publications, e.g., SP 800-53 for security controls, SP 800-171 for protecting sensitive data, and the NIST Cybersecurity Framework) offer specific, actionable guidance for configuring, hardening, and securing systems, which is why NIST was the correct answer to the earlier question about system security configuration frameworks.

logic bomb

Malicious code embedded in a system or application that remains inactive until a predefined condition or trigger occurs (a date, an event, a specific user action like a login), at which point it executes a harmful payload, deleting files, corrupting data, disabling systems, etc. Because the file deletion here is tied specifically to the CFO's login event, this matches the definition precisely.

Cryptomalware

Malware that encrypts a victim's files and demands payment (a ransom) in exchange for the decryption key, commonly known as ransomware. This scenario involves outright deletion, not encryption or a ransom demand, so it doesn't match

Spyware

Malware designed to covertly monitor and collect information about a user's activity, keystrokes, browsing habits, credentials, etc., and send that data back to an attacker. Spyware is about silent surveillance and data theft, not actively deleting files, so it doesn't explain this behavior.

Remote Access Trojan (RAT)

Malware that gives an attacker covert remote control over an infected system, letting them execute commands, access files, or manipulate the machine as if they were sitting at it. While a RAT could theoretically be used to delete files remotely, it wouldn't explain why the deletion happens specifically and consistently tied to the CFO's login events, that precise conditional trigger is the hallmark of a logic bomb rather than a RAT, which implies ongoing attacker-driven, not automatically triggered, actions.

Computer Security Incident Response Team (CSIRT)

. It's the dedicated group within an organization (sometimes a formal team, sometimes assembled from IT, security, legal, management, and communications staff on an as-needed basis) responsible for managing the organization's response to a security incident. Their job spans detecting, analyzing, containing, eradicating, and recovering from incidents, as well as coordinating communication, preserving evidence, and documenting lessons learned once it's over. Activating the CSIRT essentially means "the formal incident response process is now underway."

Whaling

a highly targeted form of phishing aimed specifically at high-value, high-profile individuals within an organization, typically executives, C-suite leaders (CEO, CFO, etc.), or other senior decision-makers. The name comes from the idea of going after the "big fish." Whaling attacks are usually more sophisticated and personalized than generic phishing: the attacker often researches the target extensively (their role, communication style, business relationships, recent activities) to craft a highly convincing, tailored message, commonly impersonating another executive, a legal authority, or a trusted business partner, and often centered on urgent, high-stakes requests like wire transfers, sensitive data disclosure, or contract approvals.

HIDS Host-based Intrusion Detection System)

is software installed on an individual host/endpoint that monitors that system's activity, file changes, logs, processes, for signs of malicious behavior. It's detection only, it alerts on suspicious activity but does not actively block or stop an attack, which disqualifies it regardless of layer.

WAF (Web Application Firewall)

operates specifically at Layer 7, sitting in front of web applications to inspect HTTP/HTTPS traffic and block attacks targeting the application layer, things like SQL injection, cross-site scripting, and other malicious payloads embedded in web requests. This is the most directly Layer-7-focused, blocking-capable control of the group.

HSM (Hardware Security Module)

is a dedicated physical device used to generate, store, and manage cryptographic keys securely, and to perform cryptographic operations (encryption, signing, etc.). It has nothing to do with inspecting or blocking network traffic or application attacks, it's a key management/crypto tool, not a traffic control.

NAC (Network Access Control)

governs whether a device is allowed onto the network in the first place, based on things like device compliance, posture checks, certificates, or authentication, it operates more at the network admission/access level (closer to Layers 2/3), not by inspecting or blocking application-layer content.

NIDS (Network Intrusion Detection System)

is the network-based counterpart to HIDS, monitoring network traffic for suspicious patterns and generating alerts. Like HIDS, it's detection only, it doesn't actively block traffic, so even though it can analyze various layers, it fails the "block" requirement.

NIPS Network Intrusion Prevention System

sits inline on the network and actively inspects traffic in real time, including deep packet inspection that can reach into Layer 7 application data, and can actively block or drop malicious traffic before it reaches its destination. Because it's a prevention system (not just detection) and capable of Layer 7 inspection, it qualifies.

SSL stripping

An attack where a man-in-the-middle downgrades a victim's HTTPS connection to unencrypted HTTP, intercepting supposedly secure traffic. This has nothing to do with SIP processing, resource exhaustion, or device reloads.

Memory leak

A software flaw where a program fails to properly release memory it no longer needs, causing memory consumption to grow over time until the system runs out of resources and fails or restarts. This matches the CVE's description of resource exhaustion and system reloads triggered by exploiting SIP handling, exactly the mechanism behind the outage pattern.

Shimming

A technique where a piece of code (a "shim") is inserted between two components to intercept calls and alter behavior, often used by malware to bypass security controls or by legitimate software for compatibility. It's unrelated to SIP-based resource exhaustion or service outages.

Refactoring

A software development practice of restructuring existing code to improve its design or readability without changing its external behavior. This is a development/engineering term, not an attack or vulnerability type, and doesn't belong in this context at all.

Since the CVE explicitly ties the exploit to resource

TFTP (Trivial File Transfer Protocol),

runs on port 69 (UDP) and is a stripped-down, simplified version of FTP used for transferring files with minimal overhead. It has no authentication, no encryption, and very limited command set (basically just reading and writing files), which makes it fast and lightweight but also inherently insecure. It's most commonly used in specific, narrow contexts: transferring firmware or configuration files to network devices (routers, switches, VoIP phones), network booting (PXE boot, where a diskless machine pulls its OS image over TFTP at startup), and similar embedded/infrastructure use cases. Because it lacks authentication, anyone who can reach a TFTP server on the network can potentially read or write files to it, which is why it's generally restricted to trusted internal network segments and never exposed to the internet.

port 3389

RDP (Remote Desktop Protocol) runs on port 3389 (TCP) and is Microsoft's protocol for remotely accessing a Windows machine's full graphical desktop interface, essentially letting someone log in and interact with the server exactly as if they were sitting in front of it. It's the standard tool for Windows server administration, but it's also a heavily targeted attack surface: exposed RDP endpoints on the internet are frequently brute-forced or exploited (via stolen/weak credentials or RDP-specific vulnerabilities) to gain that exact kind of hands-on access, which is why it was the correct vector to block in the previous scenario, the malware in that case was manually deployed by someone logging directly into the server, and RDP is precisely how that kind of interactive Windows login happens remotely

port 445

SMB (Server Message Block) runs on port 445 (TCP) and is the protocol Windows systems use for file sharing, printer sharing, and various inter-process communication between machines on a network (mapped network drives, shared folders, etc.). It's also historically been a major attack surface, vulnerabilities in SMB implementations have enabled major worm outbreaks, most notably EternalBlue, which was exploited by WannaCry and NotPetya to spread automatically across networks without any user interaction

port 22

SSH (Secure Shell) runs on port 22 (TCP) and provides an encrypted, authenticated method for remotely logging into and executing commands on a system, most commonly used to administer Linux/Unix servers and network devices via a command-line interface. It replaced older, insecure remote access protocols like Telnet by encrypting the entire session, including credentials, so traffic can't be easily intercepted or read in transit.

SAML

SAML (Security Assertion Markup Language) is an XML-based standard used to exchange authentication and authorization data between an identity provider and a service provider, most commonly in federated identity setups where a user logs in once with one organization's credentials and gains access to services across multiple, separate domains or organizations (think single sign-on across a university, a partner company's portal, or various SaaS applications).

TOTP (Time-based One-Time Password

is an algorithm that generates a temporary numeric code that changes at fixed time intervals, usually every 30 seconds, based on a shared secret key combined with the current timestamp. Both the server and the user's device (like an authenticator app such as Google Authenticator or Authy) run the same algorithm independently, so they generate matching codes at the same time without needing to communicate beforehand. It's commonly used as a second factor in multi-factor authentication (MFA).

Federation

refers to a system where multiple separate organizations or domains agree to trust each other's authentication, allowing a user to log in once with credentials from one identity provider and then access resources or services across multiple, otherwise independent systems without having to log in again to each one. This is the foundation of single sign-on (SSO) across organizational boundaries, and SAML is one of the key protocols used to implement it, which is why federation was the correct answer to the original question.

Kerberos

is a network authentication protocol that uses a trusted third party, called a Key Distribution Center (KDC), to issue encrypted "tickets" that prove a user's identity to various services without repeatedly transmitting passwords over the network. It's the default authentication protocol used within Microsoft Active Directory environments: a user authenticates once to get a Ticket Granting Ticket (TGT), then uses that to request service tickets for accessing specific resources (file shares, applications, etc.) within that same domain.

HOTP (HMAC-based One-Time Password)

is similar in purpose to TOTP, generating a one-time passcode for authentication, but instead of being based on time, it's based on a counter value that increments each time a new code is requested/used. Both the server and the token/device keep track of the same counter, and each one is combined with a shared secret using an HMAC (Hash-based Message Authentication Code) function to produce the one-time code. It's less commonly used today than TOTP since counter-based systems can fall out of sync if codes are generated but not used, but it operates on similar MFA principles.

MSSP (Managed Security Service Provider)

is a third-party company that organizations hire to handle some or all of their cybersecurity operations, things like 24/7 security monitoring, threat detection, incident response, vulnerability management, and firewall/SIEM administration. Rather than building and staffing an in-house Security Operations Center (SOC), a company can outsource that function to an MSSP, which typically monitors multiple client organizations simultaneously from a centralized team. In the scenario you asked about earlier, the "SOC for a large MSSP" means this is the security operations team responsible for monitoring and responding to incidents across many different client environments at once, which is exactly why efficiency and automation matter so much: the same recurring incident type happening across many clients multiplies the manual workload fast.

Switched POrt ANalyser (Switched Port Analyzer),

often just called port mirroring, is a feature on network switches that copies (mirrors) traffic from one or more switch ports to another designated port, so a monitoring tool, like a NIDS (Network Intrusion Detection System) or a packet analyzer like Wireshark, can inspect that traffic without being directly in the path of the actual data flow. Normally a switch only sends traffic to the specific port it's addressed to, so a monitoring device wouldn't otherwise see other hosts' traffic; SPAN solves that by duplicating the relevant traffic to the monitoring port. It's a passive, out-of-band way to feed traffic into detection tools, which is why the earlier answer option mentioned configuring "a NIDS appliance using a Switched Port Analyzer," it's describing the standard method of feeding network traffic into an intrusion detection sensor for visibility, not something that automates incident response itself.

SOAR (Security Orchestration, Automation, and Response)

is a category of security tools/platforms designed to reduce manual analyst work by automating repetitive tasks and coordinating actions across multiple security tools. It has three main pieces baked into the name: orchestration (connecting and coordinating different security tools like firewalls, SIEMs, EDR, and threat intel feeds so they work together), automation (executing predefined sequences of actions automatically, like enriching an alert with threat intel, isolating an infected host, or blocking a malicious IP, without a human manually doing each step), and response (managing the overall incident workflow, including case management, playbooks, and reporting). A playbook in this context is essentially a documented, automatable set of steps for handling a specific type of incident, and SOAR platforms let you build, customize, and trigger these playbooks so recurring incidents get handled faster and more consistently.

SPAN (Switched Port Analyzer), often just called port

OSINT

OSINT stands for Open Source Intelligence. It refers to information gathered from publicly available sources, sources anyone can access without needing special authorization, hacking, or covert methods. This includes things like social media profiles and posts, news articles, public records, company websites, domain registration (WHOIS) data, job postings, forums, public code repositories (like GitHub), search engines, and even publicly indexed documents or metadata.

In cybersecurity, OSINT is used both defensively and offensively. Security teams and threat intelligence analysts use it to research emerging threats, track threat actor activity, and understand what information about their own organization is publicly exposed (which could aid an attacker). Penetration testers and attackers alike use OSINT during the reconnaissance phase of an attack, gathering details about a target organization (employee names, email formats, technologies in use, physical locations, etc.) to inform social engineering, phishing, or technical attacks.

The key distinguishing feature of OSINT is that it's all legally and openly accessible, no exploitation or unauthorized access is involved in collecting it; the skill lies in finding, correlating, and drawing useful conclusions from information that's already public.

PKI (Public Key Infrastructure)

is a framework of policies, roles, hardware, software, and procedures used to create, manage, distribute, store, and revoke digital certificates and manage public-key encryption. At its core, a trusted entity called a Certificate Authority (CA) issues digital certificates that bind a public key to an identity (a person, organization, or device). Those certificates and their associated key pairs (a public key and a private key) let parties sign data (proving authenticity and integrity, and providing non-repudiation), encrypt data (so only the intended recipient with the matching private key can decrypt it), and verify identity, all without needing to have pre-shared a secret in advance. This is why PKI was the right answer for the transaction scenario: one company acting as the CA, issuing the certificates everyone else uses to sign and encrypt/decrypt files, is exactly how PKI operates.

Blockchain

is a distributed, decentralized digital ledger technology where transactions are recorded across a network of many independent nodes rather than being controlled by one central authority. Each block of data is cryptographically linked to the previous one, forming a chain that's extremely difficult to alter retroactively, which is what makes blockchain valuable for scenarios needing tamper-resistant, transparent record-keeping without relying on a single trusted party (think cryptocurrencies like Bitcoin, or supply chain tracking). Its whole design philosophy is decentralization and consensus among many parties, the opposite of a scenario where one specific company is designated as the trusted issuer.

OAuth

is an authorization framework (not authentication) that allows a user to grant a third-party application limited access to their resources on another service, without handing over their actual username and password. The classic example is clicking "Sign in with Google" or "Connect your Twitter account," OAuth issues a scoped access token to the third-party app so it can perform specific actions (like reading your profile or posting on your behalf) without ever seeing your credentials directly.

Containerization

is a method of packaging an application together with everything it needs to run (its code, libraries, dependencies, configuration) into a single, isolated unit called a container, without needing a full separate operating system for each one. Multiple containers can run on the same host OS while remaining isolated from each other, sharing the underlying OS kernel but keeping their own file systems, processes, and resources separate. This makes containers lightweight, fast to start, and portable across different environments (a container built on a developer's laptop will run the same way in production). In an enterprise security context, containerization is also used on mobile devices to separate personal and corporate data/apps into isolated profiles or "containers," so a company can manage and wipe corporate data without touching the user's personal information. Common container technologies include Docker and orchestration platforms like Kubernetes

VDI (Virtual Desktop Infrastructure)

is a technology that hosts full desktop operating systems as virtual machines on centralized servers, usually in a data center or the cloud, rather than running the OS locally on each individual employee's computer. Users connect to their assigned virtual desktop remotely, typically from a thin client (a stripped-down, low-power device with minimal local processing) or even an older PC, using a remote display protocol. Everything the user sees and interacts with, the desktop, applications, files, is actually running on the server; the local device is just displaying it and relaying keyboard/mouse input. This means all the heavy lifting (processing, storage, updates, patching) happens centrally, which is why VDI is so effective for centralized management, hardware longevity (old machines just need to render a remote display, not run full workloads), and consistency (every user gets an identical, standardized desktop environment regardless of what device they're physically using). Common VDI platforms include VMware Horizon, Citrix Virtual Apps and Desktops, and Microsoft Azure Virtual Desktop.

CASB (Cloud Access Security Broker)

is a security tool or service that sits between an organization's users and the cloud services they access (things like Microsoft 365, Salesforce, Google Workspace, AWS, etc.), acting as a control point for visibility, compliance, and security enforcement over cloud usage. It typically operates around four core pillars: visibility (discovering what cloud apps and services employees are actually using, including unauthorized "shadow IT"), compliance (ensuring cloud usage meets regulatory or organizational policy requirements), data security (enforcing data loss prevention policies, encryption, and access controls on data moving to/from the cloud), and threat protection (detecting malware, risky user behavior, and anomalous access patterns tied to cloud services). Essentially, a CASB extends an organization's security policies and monitoring into cloud environments that it doesn't directly control the underlying infrastructure for.

NG-SWG (Next-Generation Secure Web Gateway)

is an evolution of the traditional secure web gateway, which historically just did URL filtering and basic content blocking. The "next-generation" version adds deeper, more advanced capabilities: full content inspection (including encrypted/TLS traffic), malware and advanced threat detection, application-aware filtering (recognizing and controlling specific cloud apps and services rather than just URLs), data loss prevention, and often integrated threat intelligence feeds. It inspects and filters both general web traffic and cloud service traffic as it passes through, acting as an inline checkpoint that can detect and block malicious content, malware, and risky application usage in real time.