test for later (accounting systems)

access attack

An attack in which hackers attempt to gain unauthorized access to a network and its information by exploiting vulnerabilities discovered during reconnaissance.

botnet

A number of computers infected with malware that function like robots. The ___s are programmed to do whatever attackers want, such as flooding a specific host with repetitive requests to consume the target system’s capacity.

brute-force attack

An attack in which attackers force access to a network by attempting many passwords or phrases until they find the correct one.

cyber-kill chain

The life cycle of a cyberattack from early stages of information gathering through final steps of damaging the network. The ___ has three steps: (1) gathering information about the network, (2) accessing the network, and (3) disrupting the network.

cybersecurity

The measures a company takes to protect a computer or system—including those on the internet—against unauthorized access or attacks.

denial-of-service (DoS) attack

An attack that prohibits users from using resources such as computers, websites, servers, or an entire network. ___ deny users access to resources they have a legitimate need to use. To accomplish this, attackers continuously send fake requests to the business to consume the system’s capacity, resulting in loss of availability for real users. The resources become temporarily or even indefinitely unavailable.

dictionary attack

An attack in which attackers use lists of commonly used words and combinations of words and letters to guess passwords.

distributed denial-of-service (DDoS) attack

A large-scale DoS attack that uses multiple machines or IP addresses to force a target to shut down. Since the hacker uses multiple originating points of attack, it’s more difficult for a company to stop such attacks, as it must identify each source. This also makes it difficult for a company to differentiate between an attack and legitimate business traffic.

Dumpster diving

An attack that involves looking through someone else’s physical trash. In the corporate world, criminals look for discarded sensitive information like passwords or network diagrams.

eavesdropping

The unauthorized interception of communications. It includes listening to phone calls and intercepting emails, text messages, and other forms of communication. Also known as sniffing.

email phishing

A deceptive request designed to trick victims into sharing private information. ___ often involves a fraudulent email that appears to be from a reputable source, such as an employer or a company. This email may ask victims to respond with sensitive information or may contain a link that takes victims to a fake website, where they input the sensitive information.

encryption

The process of using an algorithm to encode a plaintext message, like readable text, and to convert the plaintext to something that is seemingly meaningless, called ciphertext. ___ helps ensure confidentiality.

File Transfer Protocol (FTP)

A standard network protocol that allows users to transfer files between a company network and outside parties.

IP address

A string of characters that a device uses to communicate over a network.

IP spoofing

An attack in which an attacker creates IP packets with modified source addresses to disguise their identify and impersonate a legitimate computer on the network.

logic bomb

A piece of malicious code that is programmed into a system and remains dormant until certain conditions are met. Cyber attackers program ___s to be dormant until the time is right, and then the malicious code is released into the system. The conditions that trigger a ___ vary based on the creativity of the cyber attacker. These attacks are difficult to detect or prevent until they have been activated.

logical access attack

An attack in which the attackers seek unauthorized access to a system or application by either exploiting a network vulnerability unveiled during reconnaissance attacks or attempting to use force to get through network security.

logical attack

An attack that occurs on a fully digital spectrum and requires no human interaction other than the attacker instigating the attack.

logical reconnaissance attack

A digital attack on a network vulnerability that could eventually allow the hacker to get into the system. This type of attack does not require a human target.

malicious code

Code that is written to cause harm and attack a target system.

malware

Software specifically designed to damage, disrupt, or gain unauthorized access to systems. Short for “malicious software.”

National Institute of Standards and Technology (NIST)

A U.S. Department of Commerce agency that promotes innovation in science, standards, and technology to improve the quality of life in the United States.

network port

A location in a network where communication packets are sent and received.

normal packet

A packet in which the source address is the IP address of the packet sender.

on-path attack

An attack in which the attacker attempts to gain access between two endpoints during an ongoing communication and can impersonate either of the parties. In an ___, the hacker can intercept or modify the communication. Also known as a man-in-the-middle attack.

packet

A small portion of a full message sent over a network.

patch

A software update, released by the software’s providers, that may include upgrades, fixes, or improvements. Failure to ___ software can open a network to hackers.

penetration test

A test that a company performs on its own network (or that a third party performs on the company’s network) to identify network vulnerabilities. ___ is often performed as part of IT audits or technology consulting engagements. Also called a pen test.

physical access attack

An attack that results in access to either hardware or people. That access can be gained with the assistance of an unknowing victim or through force.

physical attack

An attack in which the attacker threatens elements a network administrator has no control over, such as physical security, hardware, and people.

physical reconnaissance attack

An attack that uses human interaction—on the part of the target, the attacker, or both—to generate information about a network.

ping sweep

An attack that involves identifying which hosts are active in a network by sending a communication to each IP address to see if there is a response packet. The hacker pings, or calls, each network IP address, one at a time, and waits for the response packet. By performing a ___, a hacker can create a list of active IP addresses. Also called an IP probe.

port scan

A method hackers use to narrow their results by finding which ports are open and sending or receiving data on a network. Attackers use ___s to identify the types of communication occurring on a network.

ransomware

Malware that is used to hold a system hostage in exchange for a demand, like monetary payment.

reconnaissance attack

A knowledge-gathering attack that helps an attacker identify targets and plan operations. In this type of attack, cybercriminals look for vulnerabilities in the network, through either a person who exposes valuable information or a technical weak point in the network.

social engineering

A physical reconnaissance attack in which an attacker persuades another human to perform an act that would allow the hacker access to confidential information. ___ can be used for reconnaissance, access, and to cause damage.

spoofed packet

A packet that has a forged source address. A hacker sends a ___ to a system, and the system responds to a real user who is the target of the attack.

Trojan horse

Malware that is disguised as benign software but carries malicious code that may be activated via a logic bomb. ___s are commonly used to obtain back-door access to a target system. The result is unauthorized access that allows attackers to destroy data.

virus

A type of malware that replicates itself in a system and spreads quickly, causing corruption to systems and data. Attackers create ___s that cause a variety of problems. For example, ___s can steal usernames and passwords, spam email inboxes, corrupt files, or lock users out of systems.

vulnerability scan

A control activity whose goal is to detect and classify security loopholes in the infrastructure.

worm

Malware that replicates without the assistance of human interaction. ___s arrive attached to email in the form of links or a file to download. Once a ___ is installed on a machine, it infects every system it can reach.

access control vestibule

A pair of doors in which only one of the doors can be open at any one time. It increases security by allowing only one person to be in the middle of the two sets of doors at a time. Also called a mantrap.

administrator role

The highest role in the role-based access control hierarchy, which has permissions for all objects. In other words, people in this role have unlimited access themselves and are also the ones who assign access roles to the other users. This role is assigned to very few people. There may, for example, be only two people with this level of access: the primary administrator and the backup person.

backup cycle

A schedule that determines when data backup occurs—that is, the frequency with which data is backed up. A common ___ is the grandfather-father-son cycle.

backup site

A physical location where company personnel will go to recover systems and data after a disaster. A ___ is a re-creation of a data center and provides the company with a place of operations in the event that the data center is impacted during a disaster.

backup strategy

A plan that determines which data is being stored during a data backup. There are three basic types of backup strategies: full, differential, and incremental.

business continuity planning (BCP)

A set of procedures that a business undertakes to protect employees, other stakeholders, and assets in the event of a disruptive event (for example, flood, tornado, cyberattack, political disturbance, or pandemic). ___ ensures that a business and all its processes continue running.

change management

A standardized process that decreases risk by controlling the identification and implementation of required changes to a system.

change management process

A process that consists of three stages that changes to a system’s code must pass through. These stages occur in isolated environments that enforce segregation of duties for each of the three steps of the process: (1) creating changes in the test environment, (2) evaluating accuracy of changes in the model environment, and (3) implementing changes in the production environment.

COBIT 2019

The most widely used international standard for IT governance, which is designed to help companies meet regulatory compliance requirements, manage IT risks, and ensure that IT strategies are aligned with corporate goals.

cold backup site

A backup site that is an almost empty room with no servers or equipment ready. It has physical space, power, climate control, and physical security controls but is otherwise unequipped. A ___ is the cheapest option, but it is the type of site that takes the most time to begin using.

data backup

A copy of computer data that is stored in a separate location so it can be used to restore data to a system if the original data is lost.

data center

An area in a building—or even an entire building—that is dedicated to the physical storage of computer and telecommunication systems. ___s can be either onsite or offsite. Also known as a network operations center (NOC).

differential backup

A backup that involves copying only the new data created since the most recent full backup. ___s are the middle ground of backup strategies. They take a moderate amount of time and storage space.

disaster recovery (DR)

A subset of business continuity planning (BCP) that focuses on the restoration of a firm’s IT infrastructure and operations after a crisis. __ is a key part of a business continuity plan; it covers all the procedures related to backups for servers, systems, and data.

dormant access

A situation that exists when a user has not accessed a system for a significant period of time but still has an active role that grants them access.

full backup

A backup that involves copying all existing data in its entirety every time. This is the slowest of the backup strategies and requires a lot of storage, as it means creating a full copy of your data.

grandfather-father-son redundant backup

A common backup scheme that is based on three backup cycles: (1) grandfather cycle, which is a full backup, once a month; (2) father cycle, which is a full backup, once a week; and (3) son cycle, which is an incremental or differential backup, every day.

hot backup site

A backup site that runs and backs up continuously. Data is continuously backed up on a second-by-second or minute-by-minute basis, making the ___ a ready-to-go center of data operations. A ___ is typically offsite and contains an exact copy of the main server and live systems. Separating the backup site geographically provides the best protection against natural disasters that might destroy the building where operations take place.

incremental backup

A backup that involves copying only new or updated data with each backup. This is the cheapest backup strategy, and it uses the least amount of storage space.

information technology (IT)

The technology and processes involved in developing, maintaining, and using computer systems, hardware, software, and networks for the processing and distribution of data.

IT governance

The process that ensures effective and efficient use of IT so a company can achieve goals and provide value. ___ is a process, not a department or a static state of existing; it is an ongoing effort by different parts of an organization to monitor and make IT decisions that have an impact on business operations.

IT governance framework

A framework that defines the criteria a company can use to implement, manage, and monitor IT governance, including measurements for effectively leveraging IT resources. COBIT is an example of an ___.

model environment

A recent copy of a live system or application which is used to implement the code in an environment that mirrors the production environment of the system or application.

multifactor authentication

A type of user authentication in which a strong combination of identifiers is required when a user logs in. For example, two-factor authentication might require a username and password as well as a verification code sent in a text message or email.

permission

A listing of access rights, or privileges, a user has once assigned to a role.

piggybacking or tailgating

A method of circumventing physical access controls by closely following an authorized person through a secure entry point. The authorized person scans a badge or uses another access method, and the unauthorized individual passes through the door before it closes.

production environment

In systems development, an environment that is separate from the other environments and accessible only to production control employees. In the ___, code is implemented in the live business systems and released for use.

role-based access control (RBAC)

A type of authorization companies implement to address the need of each user requiring a specific level of access. ___ restricts network access by assigning individuals specific roles that have predefined criteria for what they can and cannot access in the system. ___ streamlines the logical access control process for IT personnel by eliminating the need to program access to every system for every employee. Instead, access is programmed for each employee only once, when that person is assigned a role.

test environment

An environment where developers can design and test their code without having any impact on the actual system. The ___ is not connected to the system the code belongs to, so nothing developers do in it will impact the system. Also called a sandbox.

user acceptance testing

A type of system testing in which a select group of end users get access to the system so they can use the system and verify that it meets their expectations. They are often provided scenarios to execute and then record their observations and any errors encountered.

user access de-provisioning

The formal process of changing a user’s access.

user access provisioning

The formal process of granting new users access to a system.

user access review

A review of all current users and their system roles. A ___ is an internal control that protects the data and security of a system by lowering a variety of inappropriate use risks.

user access role

A group with predefined permissions to which users are assigned, with each user assigned to only one role at a time.

user authentication

The process of associating the username of each authorized user with a unique identifier, such as something the user knows, has, or is. There are various kinds of identifiers, and they can be used individually or in combination for stronger control.

warm backup site

A backup site that is equipped with servers ready for systems to be installed and that contains only some of the equipment needed to ramp up operations. The data at a ___ site may only be updated at the end of each day instead of in real time. A __ provides less protection than a hot backup site, but it also costs significantly less to maintain.