Domain 5 Acronyms Security +

Only the Acronyms i believe are needed not all of them.

Domain 5

RPO

Recovery Point Objective (RPO) measures how much data loss you can tolerate.

RTO

Recovery Time Objective (RTO) measures how long your systems can stay offline

MTTR

Mean time to repair
Average time required to fix an issue

MTBF

Mean time between failures
Estimated time that the system will run before the next outage

Reconnaissance

Allows the pentester to gather all the information they need before the attack

Passive Reconaissance

Learn as much as you can from open sources
. Social Media
. Social engineering
. Websites

Active Reconnaissance

More direct to gathering information.
. Visible on networks

. Pings Scans, port scans

. DNS Queries

AUP

Acceptable use policies , is what users are able to do with the technology that was provided to them.

can protect the network in case of legal problems.

SDLC

Software Development Life lifecycle. Is getting an app from the idea face all the way to its running state
2 common sdlcs is agile and waterfall

SLA

Service Level Agreedmant. Contract between 2 parties that specifies.
defines specific performance standards, response times, and remediation commitments that a security vendor or internal IT team must meet

SLE

Single Loss Expectancy (SLE) is a cybersecurity risk management metric that calculates the total monetary loss every time a single specific asset is compromised.

ALE

Annualized Loss Expectancy (ALE) in cybersecurity is the expected monetary loss from a specific threat over a one-year period, calculated using the formula: ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)

Data Controller

data controller decides why and how personal data is processed

Data Processor

data processor is an external entity or third-party service that handles, stores, or processes data on behalf of a data controller.

Data Subject

The actual person or indiviual who provided their data initially. To the controller

Data Custodian

Manages the security of an organizations data

Rule of engagement

A file the pen tester uses that include testing windows, what time,what devices , are we testing everything or only somethings

Domain 3

DMZ

• Definition: A physical or logical subnetwork that contains an organization's external-facing services (like web servers) to separate them from the untrusted internet and the private internal network.

• Example: Placing the company's public web server in a DMZ so that if a hacker compromises the website, they still can't access the internal accounting database.

(Demilitarized Zone)

802.1X

• Definition: A port-based network access control (PNAC) protocol that provides secure authentication for devices trying to connect to a LAN or WLAN.

• Example: When you plug a laptop into a corporate wall jack, a window pops up demanding your domain username and password before it routes any internet traffic.

IaaS

• Definition: A cloud computing model where the provider supplies raw computing infrastructure—like virtual servers, storage, and networking—and the customer manages the operating system and data.

• Example: Renting a blank virtual machine from Amazon Web Services (AWS) or Microsoft Azure to install your own custom Linux operating system.

(Infrastructure as a Service)

PaaS

• Definition: A cloud model where the provider handles the hardware, network, and operating system, leaving the customer to deploy only their code or applications.

• Example: A software developer using Google App Engine to upload their app code without ever worrying about patching server operating systems.

(Platform as a Service)

SaaS

• Definition: A cloud model where the vendor hosts and manages the entire application, and users connect to it directly via a web browser.

• Example: Using Microsoft 365, Google Workspace, or Salesforce for daily business operations.

(Software as a Service)

RAID

• Definition: A hardware technology that mirrors or stripes data across multiple physical hard drives to protect against data loss if a drive fails.

• Example: Implementing RAID 5 on a database server so that if one hard drive completely breaks, the server stays online and no files are lost.

(Redundant Array of Independent Disks)

APIs

Application Programming Interfaces. The glue to microservices

VLANs

Virtual Local Area Network
Turns one router into 2 or more

GDPR

General data protection regulation EU Data must stay there

COOP

Continuity of operations Planning

SD-WAN

Software Defined Networking in a Wide Area Network. Fixed some issues we had commuting to the cloud.

SASE

Secure Access Service Edge net generation VPN

TLS

Transport Layer Security

IPsec

internet protocol Security aka vpn

UTMs

Unified Threat Management are older firewalls. They do alot but dont have to many things on because they will run slower

WAF

Web Application FIrewall
Not like normal Firewalls instead they analyze input into websites like sql they can block it.
Credit cards use it

EAP

is what allows port security to work EAP AND 802.1x works together sometimes in conjunction with radius,ldap,tacacs+, kerberos  all authentication databases

SPAN

Switch Port Analyzer

UPS

Uninterruptible power supply

RTOS

Real Time Operating System
Like a Car Needing to break Instantly to stop the car

SCADA / ICS

Supervisory Control and Data Acquisition System
- Large-Scale, multi site ICS - industrial control systems 

IoT

Internet of Things

MitM

Man-in-the-Middle

IOC

• Definition: Forensic evidence or clues showing a system was breached.

• Example: Finding an unauthorized, unusual application running in system memory or a massive spike in outbound network traffic at 3:00 AM.

(Indicator of Compromise)

CSRF / XSRF

• Definition: An attack that forces an authenticated user's browser to send forged requests to a website that already trusts them.

• Example: While logged into your banking app in one tab, you click a malicious link in another tab that silently sends a command to your banking tab saying "Transfer $1,000 to Account X."

(Sea Surf)

APT

(Advanced Persistent Threat)

• Definition: State-sponsored, highly funded hackers focused on long-term stealth and data exfiltration.

• Example: A foreign military intelligence unit spends 6 months quietly mapping an electrical grid's network to steal blueprints without shutting anything down.

Non-Persistent Threat Actor

• Definition: An opportunistic attacker who strikes quickly and moves on, without attempting to maintain long-term, hidden network access.

• Example: A script kiddie runs an automated scanner against random websites to deface the homepages of any unpatched server they find.

Stored (Persistent) XSS

• Definition: Injecting malicious JavaScript permanently into a target server (like a comment section) that executes on any user's browser who views the page.

• Example: An attacker leaves a comment on a popular Facebook post containing hidden JavaScript code; every single user who scrolls past that comment automatically runs the script, stealing their active cookies.

Reflected (Non-persistent) XSS

• Definition: Bouncing a malicious script off a web server immediately via a customized, fraudulent web link.

• Example: An attacker sends a victim a link that reads http://bank.com<script>badcode</script>. When clicked, the bank's website repeats the search query on the screen, causing the browser to execute the script.

HIPS

• Definition: A software application installed on a single host (like a server or PC) that actively monitors system activity, logs alerts, and actively blocks malicious behavior or unauthorized system changes in real time.

• Example: A user accidentally clicks a malicious link that attempts to rewrite a critical Windows registry file. HIPS immediately intercepts the action, stops the file from being modified, and flags the event.

(Host Intrusion Prevention System)

Nmap

• Definition: A powerful command-line tool used by both defenders and attackers to scan networks, discover active hosts, and identify which ports are open, closed, or filtered.

• The Scan Trick: On the exam, if you see a prompt asking you to identify a command that looks like nmap -sV -p 1-1000 192.168.1.1, look for the -p flag. That stands for "ports" and tells Nmap exactly which port range to scan.

• Example: A security analyst runs an Nmap scan against a new web server and discovers that Port 23 (Telnet) is accidentally left wide open, allowing them to remediate it before an attacker exploits it.

Network Mapper

(802.1X)

• Definition: A port-based network access control protocol that forces a device to provide valid enterprise credentials (like a username/password or certificate) before the network switch or Wi-Fi router will allow any traffic to pass.

• Example: When you plug your laptop into a wall jack at a high-security bank, your computer pops up asking for your corporate domain login. If you don't have one, the wall port completely cuts you off from the internet.

Wireless Network Authentication

ACLs

• Definition: A text-based rule list used by routers and firewalls to permit or deny traffic based on attributes like source IP, destination IP, or port number.

• Example: A firewall rule that says: DENY all traffic coming from the internet on Port 80 going to the Internal Accounting Server

(Access Control Lists)