450 - 525 reminders

multipath

• A technology that creates multiple physical connections (paths) between a server and a storage device, such as a SAN (Storage Area Network) or backup storage system.

• Provides fault tolerance: if one physical path (like a cable, HBA, or switch) fails, traffic automatically reroutes through the remaining available path(s) without interrupting access to the storage.

• Provides load balancing: I/O traffic can be distributed across multiple active paths simultaneously, improving overall throughput and performance rather than relying on a single connection.

• Commonly used in enterprise storage environments (like Fibre Channel or iSCSI SANs) where high availability and performance for critical data connections are essential.

Attack framework alignment

• The process of mapping the details of an actual security incident (like the attacker's actions, tools, and techniques observed) to a recognized, standardized threat framework, such as MITRE ATT&CK or the Cyber Kill Chain.

• Helps security teams understand and categorize an incident in a consistent, industry-standard way, making it easier to compare against known adversary behavior patterns, share findings with other organizations, and identify gaps in detection or defense.

• Useful for post-incident analysis, allowing analysts to see which specific tactics and techniques (e.g., initial access, privilege escalation, lateral movement) were used during the attack, and cross-reference them against a broader knowledge base of known adversary behavior.

• Different from the lessons learned phase, which focuses specifically on identifying process improvements and preventive changes after root cause is known, attack framework alignment is more about classifying and contextualizing the incident's technical details within an established reference model.

MITRE ATT&CK

• A globally accessible knowledge base and framework that catalogs known adversary tactics, techniques, and procedures (TTPs), based on real-world observed cyberattacks.

• Organized into "tactics" (the adversary's overall goals, like initial access, persistence, privilege escalation, exfiltration) and "techniques" (the specific methods used to achieve each tactic, like phishing for initial access or credential dumping for privilege escalation).

• Widely used by security teams, threat intelligence analysts, and red/blue teams to understand attacker behavior, map detected activity to known patterns, identify security gaps, and improve defensive strategies.

• Maintained and regularly updated by the MITRE Corporation, covering various platforms including enterprise IT, mobile, and industrial control systems (ICS).

• Different from the MITRE CVE database, which catalogs known vulnerabilities, ATT&CK specifically focuses on cataloging adversary behavior and techniques, not specific software flaws.

• Commonly used as the framework of choice when performing "attack framework alignment," since it provides a detailed, standardized vocabulary for describing exactly how an attacker operated during an incident.

Pretexting

• A social engineering technique where an attacker creates a fabricated scenario or false identity (a "pretext") to manipulate a victim into divulging sensitive information or performing an action they normally wouldn't.

• Relies on the attacker establishing a believable, often authoritative or urgent, story to build trust or create pressure, examples include posing as IT support needing a password reset, a bank representative verifying account details, or an executive requesting an urgent wire transfer.

• Often involves research beforehand to make the pretext more convincing (like knowing internal company details, names of coworkers, or specific processes), making the deception more believable to the target.

• Differs from general phishing in that it typically relies more heavily on a constructed narrative/backstory and often involves direct interaction (phone calls, in-person conversations) rather than just a deceptive email or link.

• Frequently used as a foundation for other social engineering attacks, an attacker might use pretexting as the "story" behind a vishing call, an impersonation attempt, or information elicitation effort, essentially the believable cover story that makes the rest of the deception work.

pcap reassembly

• The process of taking captured network packets (stored in a .pcap file, typically captured via tools like tcpdump or Wireshark) and reconstructing them back into their original data stream or file format.

• Useful for reconstructing files, documents, or payloads that were transmitted in plaintext over the network, allowing an analyst to recover the actual content that was sent.

• Limited effectiveness against encrypted traffic (like HTTPS), since the packet contents are encrypted, reassembly would only produce unreadable ciphertext without the corresponding decryption keys, making it ineffective for recovering an HTTPS-delivered payload without additional access to session keys.

SSD snapshot

• A point-in-time copy of the data stored on a solid-state drive (or any storage device), capturing the state of the disk's contents at that moment.

• Used in forensics to preserve and analyze what's stored on a device's persistent storage, files, deleted data remnants, system configurations, and more.

• Only useful for recovering data that has actually been written to disk, it provides no visibility into data or code that exists purely in volatile memory (RAM) and was never saved to persistent storage.

Image volatile memory

• The process of capturing a complete copy (a memory dump) of a system's RAM contents at a specific point in time.

• Captures everything currently active in memory, including running processes, open network connections, encryption keys in use, and any malicious code executing purely in memory (like fileless malware).

• The only way to recover evidence of malware that never touches the disk, since once the system loses power or the process terminates, that in-memory data is permanently lost, timing is critical, the image must be captured while the malware is still actively running in memory.

Pseudo-anonymization

• A data protection technique that replaces personally identifiable information (PII) — such as names, employee IDs, Social Security numbers, or account numbers — with artificial identifiers or pseudonyms.

• Unlike full anonymization, the transformation is reversible: a separate, securely stored key or mapping table allows the original identity to be restored if legitimately needed later.

• The non-identifying parts of the data (e.g., salary figures, transaction amounts, medical test results) remain intact and usable for analysis, since only the identifying fields are swapped out.

• Commonly used when organizations need to share or analyze sensitive datasets while reducing the risk of directly exposing individuals' identities.

• Helps organizations comply with privacy regulations like GDPR, which formally recognizes pseudonymization as a risk-reduction measure (though pseudonymized data is still considered personal data under GDPR because it's re-identifiable).

• Differs from tokenization in that pseudo-anonymization typically applies to identity/PII fields specifically and focuses on protecting who the data belongs to, while tokenization can apply to any sensitive data element (including the sensitive values themselves) and substitutes it with a non-meaningful token via a tokenization system.

• Differs from full/true anonymization in that anonymization is meant to be irreversible — once data is truly anonymized, there's no key or method to trace it back to the original individual, whereas pseudo-anonymized data always retains a path back to the original identity.

• Real-world examples: replacing "John Smith, SSN 123-45-6789" with "Employee_4471" in a dataset, or substituting patient names in medical research data with coded IDs while a hospital keeps the name-to-ID mapping in a separate secured system.

• Weakness/risk: if the mapping key or re-identification method is compromised or if enough contextual data points are combined (a "linkage attack"), individuals can potentially be re-identified even without the key.

Tainted training data

• A form of data poisoning attack where the dataset used to train a machine learning or AI model is deliberately or maliciously altered/corrupted before or during the training process.

• Causes the AI to "learn" incorrect patterns, biases, or behaviors, resulting in inaccurate predictions, flawed decision-making, or unpredictable outcomes once deployed.

• Especially dangerous in supply chain contexts, where an organization relies on third-party or externally sourced data — if a supplier is compromised, attackers can inject malicious or misleading data upstream before it ever reaches the organization's own systems.

• Difficult to detect because the AI system may appear to be functioning normally on the surface while quietly producing skewed or manipulated outputs.

Credential Stuffing

• An attack technique in which threat actors take username/password pairs that were leaked or stolen from a data breach on one website/service and systematically attempt to use those exact same credentials to log into other, unrelated websites or services.

• Relies entirely on the widespread practice of password reuse — many users use the same password (or a small set of passwords) across multiple accounts, so a credential pair exposed in one breach often works elsewhere too.

• Unlike brute force or dictionary attacks, credential stuffing does not involve guessing passwords; the attacker already possesses a valid, real username/password combination obtained from a prior breach or leak (often purchased or found on the dark web/breach dump sites).

• Typically automated using bots or scripts (sometimes called "credential stuffing tools") that can test thousands or millions of stolen credential pairs against login portals in rapid succession.

• Because the attacker is using legitimate, previously valid login credentials, this type of attack can be harder to detect with traditional failed-login alerting, since a successful stuffing attempt looks like a normal, valid login (though it often originates from an unusual location/IP, unusual device, or an abnormal login time — key detection indicators).

• Defenses/mitigations include: enforcing multi-factor authentication (MFA) so a stolen password alone isn't sufficient, prohibiting password reuse, monitoring for breached credentials (e.g., "have I been pwned"-style checks), implementing account lockout or rate-limiting after suspicious login patterns, and using CAPTCHA or bot-detection mechanisms to slow down automated login attempts.

• Distinct from password spraying (which tries a few common passwords across many accounts) and brute force/dictionary attacks (which guess passwords systematically) — credential stuffing specifically leverages already-known, breached, valid credential pairs.

pruple team

• A collaborative security exercise or function that combines the efforts of a red team (offensive/attack simulation) and a blue team (defensive/detection and response) working together, rather than in isolation or opposition.

• The goal is to improve an organization's overall security posture by having the red team actively simulate real-world attacks while the blue team simultaneously works to detect, respond to, and mitigate those simulated attacks, with both sides sharing information and insights in real time.

• Unlike a traditional red team engagement (where the blue team may not know an attack is occurring, testing detection capabilities in isolation), a purple team exercise emphasizes open communication and knowledge transfer between both teams throughout the exercise.

• Helps identify gaps in detection and response capabilities, validates whether existing security controls and monitoring tools are effective against specific attack techniques, and allows the blue team to learn directly from the red team's methods and tactics.

• Often used to test and refine incident response procedures, fine-tune SIEM alerting/correlation rules, and improve the overall maturity of an organization's security operations center (SOC).

• Can be run as a dedicated ongoing function within an organization (a "purple team" as a permanent role) or as a time-boxed collaborative exercise/engagement.

• The term "purple" reflects the blending of red (offense) and blue (defense) — the collaboration itself, rather than a separate independent team performing a third distinct function.

• Contrasts with:

  • Red team: offense-only, simulates attackers without collaborating with defenders during the exercise.

  • Blue team: defense-only, focused on detecting and responding to threats (real or simulated) without necessarily interacting with an active attack simulation team.

  • White team: often acts as referees/observers who oversee and set the rules for red vs. blue exercises, without directly participating in attack or defense.