Cybersecurity Unit 8 Vocab

risk assesment

• figuring out the possible attacks

• how bad the attacks are

• how likely it is

threat

• anything that might cause harm to systems or data

vulnerability

a weakness that could cause a threat to harm systems

impact

• how much damage occurs after threat uses the vulnerability

qualititative

• you asses based on the category high, low

quantitative

• you asses based on numbers like costs, numbers, and percetnages

hybrid risk assessment

• you asses using quantititative and qualititative

risk mitigation

• reducing how bad the risk is

risk acceptance

• choosing to live the risk bc its too small or expensive

risk transference

• passing the risk to someone else

risk avoidance

• completely getting rid of the risk

risk register

• A list or table of all known risks, their impacts, and what’s being done about them.

compensating control

• a backup method used when the main security control isn’t possible

incident response

• the actions taken when a threat occurs

incident response plan

• a step by step guide of the actions taken when a threat occurs

what are the 5 incident response steps?

• Preparation

• Identification

• Containment

• Eradication

• Recovery

prom is continously evaporating sanity and reviving drama

preparation

• gretting ready before the threat occurs w tools etc

identification

• realizaing an event is occuring

containment

• stopping the problem from spreading

eradication

• completely removing the problem

recovery

• bringing everything back to normal

post-incident review

• going over what happened to improve overtime

forensics

• studying what happened to gather facts

chain of custody

• keep track of who handled evidence so it can be trusted in court

indicators of compromise

• clues that an attack has happened

Security Information and Event Management (SIEM)

• security software that gives organizations a bird's-eye-view of activity across their entire network so they can respond to threats faster—before business is disrupted

malware incident

• when a system gets infected w malicious software

network intrusion

• someone sneaking into a network w/o permission

business continuity plan

• a plan to keep a business running during a crisis

disaster recovery plan

• a plan to recover tech and data after a disaster

recovery time objective

• how fast you need systems to be back online

failover

• automatically switching to a backup if main systems fail

tabletop excercise

• a group talks through a fake incident plan to test the plan

red team

• offensice team that acts like hackers to test defenses

blue team

• defensive team that responds to attacks and protects the sytem

purple team

• combo of red and blue to work improve security

penetration testing

• ethical finding holes in a system before real hackers do

Recovery Point Objective (RPO)

• how much data you can afford to lose time-wise