Network + Section 4

Data at rest

Data that is stored on a device, such as a hard drive or database, and not actively moving across a network.

Data in transit

Data that is actively moving across a network from one location to another.

Data in use

Data that is actively being processed or accessed in a system's memory.

Digital certificate

An electronic document that uses a digital signature to bind a public key with an identity, verifying authenticity.

Certificate authority (CA)

A trusted entity that issues and manages digital certificates, validating the identity of certificate holders.

PKI (Public Key Infrastructure)

The framework of hardware, software, policies, and procedures used to create, manage, and validate digital certificates.

IAM (Identity and Access Management)

The framework of policies and technologies used to ensure the right individuals have appropriate access to resources.

Least privilege

A security principle stating users and systems should only have the minimum access necessary to perform their function.

Zero trust

A security model that assumes no implicit trust and requires continuous verification of every user and device, regardless of location.

Authentication

The process of verifying the identity of a user or device attempting to access a system.

Authorization

The process of granting or denying a verified user access to specific resources or actions.

Accounting (AAA)

The process of tracking and logging user activity for auditing purposes, part of the AAA framework.

SSO (Single Sign-On)

An authentication method allowing a user to log in once and gain access to multiple independent systems.

RADIUS (Remote Authentication Dial-In User Service)

An AAA protocol commonly used to centralize authentication for network access, encrypting only the password.

TACACS+ (Terminal Access Controller Access-Control System Plus)

A Cisco-developed AAA protocol that encrypts the entire authentication session and separates authentication, authorization, and accounting.

LDAP (Lightweight Directory Access Protocol)

A protocol used to access and maintain distributed directory information, commonly used for centralized user authentication.

SAML (Security Assertion Markup Language)

An XML-based standard used to exchange authentication and authorization data, commonly used for SSO between web services.

EAP (Extensible Authentication Protocol)

A framework that supports multiple methods of authentication, commonly used in wireless and network access control.

802.1X

A port-based network access control standard that requires authentication before allowing a device onto the network.

Honeypot

A decoy system designed to attract and detect attackers, diverting them from real production systems.

Honeynet

A network of honeypots designed to simulate an entire decoy network environment for attacker deception and study.

Risk

The potential for loss or damage when a threat exploits a vulnerability.

Vulnerability

A weakness in a system, process, or design that could be exploited by a threat.

Exploit

A method or piece of code used to take advantage of a vulnerability.

Threat

Any potential danger that could exploit a vulnerability to cause harm.

CIA triad

The security model of Confidentiality, Integrity, and Availability, representing core goals of information security.

Confidentiality

Ensuring that information is only accessible to authorized individuals.

Integrity

Ensuring that data has not been altered or tampered with in an unauthorized way.

Availability

Ensuring that systems and data are accessible to authorized users when needed.

Data localization

Legal or regulatory requirements that data be stored and processed within a specific geographic region.

GDPR (General Data Protection Regulation)

A European Union regulation governing data protection and privacy for individuals within the EU.

PCI DSS (Payment Card Industry Data Security Standard)

A set of security standards designed to protect cardholder data for organizations that handle credit card transactions.

IoT (Internet of Things) segmentation

The practice of isolating IoT devices onto separate network segments to limit their exposure and potential attack surface.

SCADA (Supervisory Control and Data Acquisition)

A system used to monitor and control industrial processes and infrastructure.

Operational technology (OT)

Hardware and software used to monitor and control physical devices and industrial processes, as opposed to traditional IT.

Guest network

A separate, restricted network segment provided for visitors, isolated from internal production resources.

BYOD (Bring Your Own Device)

A policy allowing employees to use personal devices to access organizational resources and networks.

Denial of Service (DoS)

An attack that attempts to make a system or network resource unavailable by overwhelming it with traffic or requests.

DDoS (Distributed Denial of Service)

A DoS attack launched from multiple distributed sources simultaneously, often using a botnet.

DoS amplification

An attack technique that uses a small request to generate a much larger response directed at a victim, magnifying attack traffic.

VLAN hopping

An attack technique used to gain unauthorized access to traffic on a different VLAN than the attacker is assigned to.

Switch spoofing

A VLAN hopping technique where an attacker's device mimics a trunking switch to gain access to multiple VLANs.

Double tagging

A VLAN hopping technique that exploits native VLAN handling by embedding two VLAN tags in a single frame.

MAC flooding

An attack that overwhelms a switch's MAC address table, causing it to flood traffic to all ports like a hub.

ARP poisoning

An attack that sends falsified ARP messages to associate an attacker's MAC address with another device's IP address, enabling traffic interception.

DNS poisoning

An attack that corrupts DNS resolution data to redirect users to malicious sites.

On-path attack

An attack (formerly "man-in-the-middle") where an attacker intercepts and potentially alters communication between two parties.

Rogue DHCP server

An unauthorized DHCP server on a network that can hand out incorrect or malicious configuration information to clients.

Rogue access point

An unauthorized wireless access point connected to a network, potentially creating a security vulnerability.

Evil twin

A rogue access point that mimics a legitimate SSID to trick users into connecting to it.

Phishing

A social engineering attack that uses deceptive communications (often email) to trick users into revealing sensitive information.

Shoulder surfing

Observing someone's screen or keyboard input to gain unauthorized information, such as passwords.

Tailgating

Following an authorized person through a secured entry point without proper credentials.

Piggybacking

Gaining unauthorized physical access by convincing an authorized individual to allow entry, often with their knowledge.

Dumpster diving

Searching through discarded materials to find sensitive information that was not properly destroyed.

Malware

Malicious software designed to damage, disrupt, or gain unauthorized access to systems.

Ransomware

Malware that encrypts a victim's data and demands payment in exchange for restoring access.

Device hardening

The process of securing a device by disabling unnecessary services, changing default settings, and applying security controls.

Disabling unused ports

A security practice of turning off physical or logical ports that are not actively needed, reducing the attack surface.

Default credentials

Factory-set usernames and passwords on a device that should be changed immediately to prevent unauthorized access.

MAC filtering

A security control that allows or denies network access based on a device's MAC address.

Access control list (ACL)

A set of rules used to permit or deny traffic based on criteria such as source/destination IP, port, or protocol.

Firewall rule

A configured rule that determines whether to allow or block specific traffic passing through a firewall.

Content filtering

The practice of blocking or restricting access to certain types of content, often based on category or keyword.

Screened subnet (DMZ)

A network segment that sits between an internal network and the internet, hosting public-facing services while isolating them from the internal network.

Security zone

A logical grouping of network segments with a common security policy or trust level.