AP Cybersecurity: Unit 2 (Securing Spaces) Vocabulary Guide

Comprehensive vocabulary flashcards covering Unit 2: Securing Spaces, including social engineering tactics, adversary types, attack phases, malware categories, risk management, and physical and technical security controls.

Social Engineering

The use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.

Urgency

Creating time pressure so that the target acts before thinking carefully.

Authority

Impersonating someone with power to compel compliance.

Familiarity

Pretending to know or be close to a target to gain trust.

Consensus

Making a target believe everyone else is already complying.

Scarcity

Creating a sense of limited availability to prompt fast action.

Intimidation

Using threats or fear of negative consequences to force action.

Pretexting

Creating a fabricated scenario and identity to extract information; involves researching the victim/target to make the story convincing.

Hacktivist

A specific group of hackers who are motivated by their ideological views.

Cyberterrorists

Hackers who have political motivations with the intent to harm, typically resulting in violence.

Script Kiddie

A low-skilled adversary who uses hacking tools created by others without understanding how they work.

Insider Adversary

A current or former employee, contractor, or business partner who uses their legitimate access to systems to cause harm.

Transnational Criminal Organization

A sophisticated criminal group that operates across national borders and conducts cyberattacks primarily for financial gain.

Reconnaissance (Recon)

The phase where an attacker gathers information about a target before attempting to break in, functioning as research where no systems are harmed.

Passive Reconnaissance

Gathering information without directly interacting with the target's systems.

Active Reconnaissance

Collecting information by directly probing systems, networks, or devices (e.g., port scanning, OS fingerprinting).

Port

A numbered communication channel that allows specific types of network traffic into and out of a device.

OSINT

Open Source Intelligence; information gathered from publicly available sources (such as websites, LinkedIn profiles, job postings, DNS records) without directly interacting with a target system.

Attack Surface

The total number of possible entry points an attacker could use to access a system or network.

Initial Access

The phase when an attacker first enters a target system or network (the "breaking in" moment).

Persistence

Techniques an attacker uses to maintain long-term access to a system even after it is rebooted, passwords are changed, or the original vulnerability is patched.

Lateral Movement

The process by which an attacker moves from one device or account to another within the same network, expanding their reach after initial compromise.

Privilege Escalation

The act of gaining higher-level permissions or accounts beyond what was originally obtained (e.g., standard user to administrator).

C2 Systems

Command and Control infrastructure consisting of external servers an attacker uses to send instructions to malware on a compromised machine and receive stolen data.

Taking Action

The attack sequence phase where the attacker achieves their objective (exfiltrating data, encrypting files, disrupting services) and covers their tracks by deleting logs and clearing forensic evidence.

Ransomware

A type of cyber attack that threatens to publish the victim's data or block access to it unless a ransom is paid.

Malware

Any type of software that is designed to intentionally harm or damage a computer or network.

Virus

A type of malware that attaches itself onto a host program, such as a document, and can cause serious damage to files or an entire device.

Spyware

Software that, once downloaded onto a user's computer, secretly gathers information about a person or organization and sends it to the attacker.

Trojan

Software designed to disrupt, damage, or gain unauthorized access to a computer system while masquerading as legitimate software.

Worm

Malware that self-propagates across networks without requiring user action.

Rootkit

Malware that hides deep inside the operating system to avoid detection.

Remote Access Trojan (RAT)

Malware that gives an attacker remote control of a compromised device.

Penetration Test

When a company hires a white hat hacker to assess the security of a system by finding and exploiting vulnerabilities.

System Log

An automatic record of events on a computer or server such as logins, file access, and account changes.

Exfiltration

The unauthorized transfer of data out of a network or system.

Log Tampering

The deliberate modification or deletion of system logs to conceal attacker activity.

Staging

Breaking large data transfers into smaller chunks to avoid detection during exfiltration.

Risk Assessment

The process of identifying, assessing, and prioritizing potential risks for an organization or company.

Vulnerability Scan

A tool or procedure designed and used to assess computers, networks, or applications for known weaknesses.

Packet Sniffing

The practice of gathering, collecting, and logging some or all packets that pass through a computer network.

Avoidance

Stopping or removing the activity that creates the risk; not possible when the activity is critical to the organization's mission.

Transference

Shifting the burden or responsibility of a risk to another entity, such as an insurance company, a government, or consumers.

Mitigation

Implementing security controls and taking steps to reduce the likelihood or minimize the impact of a risk.

Acceptance

Acknowledging the risk that remains and deciding to live with it as is, since absolute security is unattainable.

Residual Risk

The risk that remains after avoidance, transference, and mitigation security controls have been applied.

Risk Tolerance

How much residual risk an organization is willing to accept.

Cost-Effective Control

A control that costs less to install and maintain than the expected loss from an attack.

Single Loss Expectancy (SLE)

The expected financial loss from a single occurrence of a threat.

Annualized Rate of Occurrence (ARO)

The expected number of times a threat occurs in a year.

Annualized Loss Expectancy (ALE)

The expected yearly loss, calculated as $\text{ALE} = \text{SLE} \times \text{ARO}$.

Physical Control

A security measure that uses tangible objects or personnel to restrict access to physical spaces and hardware (e.g., locks, security cameras, fences).

Technical Control

A security measure implemented through software, hardware, or network configurations to protect digital systems (e.g., firewalls, encryption, anti-malware).

Managerial Control

A security measure consisting of policies, rules, and procedures that govern expected security behaviors (e.g., password policies, access reviews, incident response plans).

Preventative Control

A control designed to stop a security incident before it occurs.

Detective Control

A control designed to identify a security incident while it is occurring or shortly after.

Corrective Control

A control designed to restore systems or limit damage after a security incident has occurred.

Defense in Depth

A security strategy that uses multiple layers of controls so that if one layer fails, other layers can still protect the asset; includes human, physical, network, device, application, and data layers.

Intrusion Prevention System (IPS)

A technical security control that monitors network traffic and automatically blocks or restricts activity as malicious; classified as both detective and corrective.

CIA Triad

Core security principles consisting of Confidentiality (protection from unauthorized viewing), Integrity (protection from unauthorized alteration), and Availability (assurance systems/data are accessible when needed).

Vulnerability

A flaw or weakness in a system or device that could allow an asset to be compromised.

Threat

A source of potential harm or potential for a cybercriminal/natural disaster to exploit a vulnerability.

Risk

The potential for loss when an attack happens.

Likelihood

The probability of observing the evidence assuming the prior belief is true.

Asset

Anything valuable that an organization needs to protect, including financial resources, intellectual property, data, digital infrastructure, physical property, and reputation.

Severity

The potential damage caused if a threat successfully exploits a vulnerability, measured in financial, operational, reputational, or safety terms.

Security Control

A safeguard or countermeasure designed to protect an asset, reduce a threat, or close a vulnerability.

Piggybacking

Using social engineering to convince an authorized person to grant access to a restricted area.

Tailgating

Following closely behind an authorized person through a secured entrance without their knowledge.

Shoulder Surfing

Watching a user access sensitive information, sometimes with a camera, to use it later.

Dumpster Diving

Searching a target's physical trash for useful information.

Card Cloning

Copying an authorized user's access card to gain the access that card grants.

Hardware Keylogger

A physical device placed between a keyboard and a computer that records keystrokes and is not detectable by antivirus software.

Power Disruption

Cutting or disrupting power by damaging fuses, breakers, wiring, substations, or transformers to make devices and services unavailable.

Disruption of Services

A compromise type in which systems or the services they provide become unavailable.