Sec+ 701 Objective 3

Terms from objective 3

Cloud

Delivery of computing services over the Internet.

Responsibility Matrix

Defines security responsibilities between provider and customer.

Hybrid Considerations

Combines on-premises, private, and public cloud services.

Third-party Vendors

Companies providing cloud services to businesses.

Infrastructure as Code

Management of infrastructure through code in DevOps.

Serverless Computing

Build applications without managing server infrastructure.

Microservices

Application structure as independent services communicating via APIs.

Network Infrastructure

Resources enabling network connectivity and operations.

Physical Isolation

Separates sensitive systems from other networks.

Air-Gapped

Network isolated from unsecured networks to prevent access.

Logical Segmentation

Segments networks using protocols despite shared infrastructure.

Software-Defined Networking (SDN)

Manages network services through abstraction of functionality.

On-Premises

Infrastructure hosted within an organization's physical facilities.

Centralized Architecture

Processing occurs at a single central location.

Decentralized Architecture

Data distributed across multiple locations for resilience.

Containerization

Encapsulates applications with dependencies in containers.

Virtualization

Creates virtual versions of resources on a single machine.

Server Virtualization

Partitions a physical server into multiple virtual servers.

Desktop Virtualization

Runs multiple desktop environments on one machine.

IoT (Internet of Things)

Network of interconnected devices collecting and sharing data. Usually devices connected to the internet.

Industrial Control Systems (ICS)

Systems controlling industrial processes and operations.

Supervisory Control and Data Acquisition (SCADA)

Gathers real-time data to control remote equipment.

Real-Time Operating System (RTOS)

Processes data with strict timing constraints.

Embedded Systems

Specialized systems performing dedicated functions.

High Availability Considerations

Systems designed for continuous operation without failure.

Device Placement

Strategic positioning of devices for security and efficiency.

Security Zones

Network segments categorized by security needs.

DMZ (Demilitarized Zone)

Hosts public services isolated from internal networks.

Internal Network

Contains trusted devices like workstations and databases.

Guest Network

Separate zone for visitors, isolated from internal systems.

Connectivity

Communication pathways linking devices within an organization.

Redundancy

Multiple paths ensuring connectivity during failures.

Bandwidth and Latency

Adequate bandwidth and low-latency for real-time services.

Failure Modes

Describes system behavior during failures.

Fail-Open

System continues operation, allowing all traffic.

Fail-Closed

System blocks all traffic to ensure security.

Device Attributes

Specific roles or characteristics of network devices.

Active Devices

Devices that monitor or control network traffic.

Passive Devices

Devices observing traffic without interference.

Inline Devices

Devices actively controlling traffic in the data path.

Tap/Monitor Devices

Observe traffic without interfering, used for logging.

Network Appliances

Dedicated devices for specific network functions.

Jump Server

Secured intermediary for accessing isolated networks.

Proxy Server

Intermediary server for filtering and anonymity.

Intrusion Prevention System (IPS)

Blocks suspicious activity in real-time.

Intrusion Detection System (IDS)

Monitors traffic for potential malicious activities.

Load Balancer

A device that distributes traffic across multiple servers.

Sensors

Monitor and detect network traffic patterns.

Port Security

Controls access to network ports and devices.

802.1X

Network access control protocol for device authentication.

Extensible Authentication Protocol (EAP)

Framework for various network authentication methods.

Firewalls

Control incoming and outgoing network traffic.

Web Application Firewall (WAF)

Filters HTTP/HTTPS traffic for web application security.

Unified Threat Management (UTM)

Integrates multiple security features into one device.

Next-Generation Firewall (NGFW)

Advanced firewall with deep packet inspection capabilities.

Layer 4 (Transport Layer)

Filters traffic based on IP addresses and ports.

Layer 7 (Application Layer)

Inspects traffic at the application layer.

Secure Communication/Access

Ensures data confidentiality and integrity during transmission.

Virtual Private Network (VPN)

Creates secure, encrypted connections over public networks.

Remote Access

Access systems from outside physical locations.

Tunneling

Encapsulates data packets for secure transmission.

Transport Layer Security (TLS)

Cryptographic protocol securing communications over networks.

Internet Protocol Security (IPSec)

Secures IP communications through authentication and encryption.

Software-Defined Wide Area Network (SD-WAN)

Manages WAN traffic using software for performance.

Secure Access Service Edge (SASE)

Combines networking and security services in the cloud.

Selection of Effective Controls

Choosing security measures based on organizational needs.

Regulatory Compliance

Ensuring controls meet industry and legal standards.

Regulated Data

Data subject to legal and regulatory requirements.

Trade Secret

Confidential business information providing competitive advantage.

Intellectual Property

Legally protected creations of the mind.

Legal Information

Data related to laws, regulations, and contracts.

Financial Information

Data related to financial status and transactions.

Human-readable Data

Formatted data easily interpretable by people.

Non-human-readable Data

Encoded data not directly interpretable by humans.

Data Classifications

Categorizing data based on sensitivity and importance.

Sensitive Data

Data that could cause significant harm if disclosed.

Confidential Data

Data intended to be kept private within an organization.

Public Data

Information accessible to anyone without restrictions.

Restricted Data

Information limited to specific individuals or groups.

Private Data

Data pertaining to individuals requiring protection.

Critical Data

Essential data for organizational operation and survival.

Data at Rest

Stored data not actively processed or transmitted.

Data in Transit

Data being transmitted over a network or channel.

Data in Use

Data actively processed, most vulnerable to access.

Data Sovereignty

Data subject to local laws where stored.

Geolocation

Determining the physical location of a device.

Hashing

Converts data into a fixed-length string for security.

Data Masking

Obscuring data elements to protect sensitive information.

Tokenization

Replaces sensitive data with non-sensitive placeholders.

Obfuscation

Making data unintelligible while retaining usability.

Segmentation

Dividing networks to limit access to sensitive data.

Load Balancing

Distributing traffic across multiple servers for efficiency.

Clustering

Grouping servers for redundancy and higher availability.

Hot Site

Fully operational backup site mirroring primary site.

Cold Site

Backup site with only physical infrastructure available.

Warm Site

Partially equipped backup site needing additional resources.

Geographic Dispersion

Distributing services across multiple physical locations.

Platform Diversity

Using various technologies to avoid vendor dependence.

Multi-cloud Systems

Using multiple cloud providers for redundancy.

Continuity of Operations

Ensuring critical functions remain operational after disruptions.