Flashcards: SYO-501 Acronym flashcards

Authentication, Authorization, Accounting1. Authentication has 2 components: Identification (Username or email address) and the authentication factor (Something you know, Something you have, Something you are, Somewhere you are or are not, Something you do) 2. Authorization: the rights and privileges assigned to a user to be able to perform their job. 3. Accounting or Auditing: Accounting is the process of recording system activities and resource access. Auditing is part of accounting where an administrator examines logs of what was recorded.

After-Action Report

Attribute-based Access Control: Access control based on different attributes: group membership, OS being used, IP address, the presence of up-to-date patches and anti-malware, geographic location. Typically used in an SDN (Software Defined Network).

Access Control List: A list of objects and what subjects can access them. Example; A user access a directory but only has read access to the documents inside.Routers and firewalls both employ ACLs, either allowing or denying access to different parts of the network.

Active Directory

Advanced Encryption Standard: A symmetric block cipher. Three different key sizes; 128, 192, & 256 bit.

Authentication Header: An IPSec protocol that provides authentication as well as integrity & protection from replay attacks. Uses protocol # 51.

Annual Loss Expectancy: The amount of money an organization would lose over the course of a year. The formula is the SLE (Single Loss Expectancy) times the ARO (Annual Rate of Occurrence). SLE x ARO = ALE.

Access Point: Sometimes referred to as a WAP (Wireless Access Point). An AP is a bridge between wireless and wired networks.

Application Programming Interface:

Advanced Persistent Threat: An attack that uses multiple attack vectors, attempt to remain hidden as to maintain a connection to compromised systems. You can normally tie this to nation-states.

Annual Rate of Occurrence: The number times a year that a particular loss occurs.

Address Resolution Protocol: Matches the MAC address to a known IP address. Easily spoofed, used in MITM (Man-in-the-Middle) attack.

Acceptable Use Policy

Asset Value: Asset Value is half of the formula for a one-time loss or SLE (Single Loss Expectancy). AV x EF (Exposure Factor) = SLE /Antivirus

Business Continuity Planning: Need to identify critical business systems, which systems need to be protected the most, and have resources available to help recover them

Business Impact Analysis: Identify resources that are critical to an organization's ability to sustain operations against threats to those resources. It also assesses the possibility that each threat will occur and the impact those occurrences will have on the organization.

Basic Input/Output System: The firmware that sends instructions to the hardware so the system can boot.

Business Partners Agreement: The agreement between two entities, what is expected with respect to finances, services, and security.

Bring Your Own Device: The model where the organization allows a user to use their personal device for business needs also covers allowing the end user to use the company's Internet with their personal electronic devices.

Certificate Authority: Sometimes referred to as PKI (Public Key Infrastructure). Issues and signs certificates, and maintains the public / private key pair.

Change Advisory Board

Common Access Card: Considered a smart card or digital certificate. Typically issued to military personnel and contractors that need access to DoD (Department of Defense) systems and facilities.

Completely Automated Public TuringTest to Tell Computers and HumansApart

Cloud Access Security Broker

Cipher Block Chaining: A mode of operation for DES, which uses an IV (Initialization Vector) for the first plaintext block and then combines with the next plaintext block using XOR (Exclusive OR). There is a delay using this process. With this method, no plain-text block produces the same ciphertext.

Common Criteria

Cipher Block Chaining MessageAuthentication Code Protocol

Closed-circuit Television

Cross-over Error Rate: A metric for biometric technologies are rated. The CER is the point where the FRR (False Rejection Rate) and FAR (False Acceptance Rate) meet. The lowest possible CER is most desirable. /Certificate: Format that encodes the certificate in binary format may also include PEM (Privacy-enhanced Electronic Mail) on a Windows system.

Computer Emergency Response Team

Cipher Feedback: This DES mode of operation is the streaming cipher version of CBC. It uses an IV and chaining. The IV is first encrypted and then the result is XORed with the previous plain-text block.

Challenge Handshake Authentication Protocol: An encrypted authentication protocol normally used for remote access.

Computer Incident Response Team

Center for Internet Security

Content Management System: SaaS (Software as a Services)

Continuity of Operations Plan: Designing operations and systems to be as little affected by an incident and to have resources to recover from them.

Corporate Owned, Personally Enabled: Company owns and supplies the device. The employee may use the device for web browsing, personal email, and personal social media sites.

Cyclical Redundancy Check: Error-detecting code used to detect errors in the packet during transmission.

Certificate Revocation List: A list of certificates that were revoked before they were configured to expire

Computer Security Incident Response Team:

Cloud Service Provider:

Cryptographic Service Provider

Certificate Signing Request: When a subject wants a certificate, it completes a CSR and submits it to a CA (Certificate Authority)

Cross-site Request Forgery: Attacker passes an HTTP request to the victim's browser in an attempt to gain the user's password and username. The output of the attack could include keywords such as "Buy" or "Purchase"

Counter-Mode: An encryption mode that uses a constantly changing IV, also functions similar to a stream cipher.

Counter: Same as CTM

Choose Your Own Device: A mobile deployment model where the company gives the employees a list of approved mobile devices they can use on the corporate network. This helps keep the devices with more current models.

Discretionary Access Control: Access control is set by the data owner, or possibly the administrator. The permissions can be applied to a group or an individual.

Domain Controller

Distributed Denial of Service: Many devices attacking a single device. The devices can be PCs' laptops, DVRs, Webcams, etc. This type of attack is carried out via a botnet, and the devices are known as drones or zombies.

Data Execution Prevention: A feature that prevents malicious code from executing in memory. This feature is programmed into Windows, AMD CPU's, & Intel CPU's. If you were looking at a log output, you might see one of the columns as "DEP". In the column, if it says "Yes", good chance the malware did not execute from that area. If it says no, that might be where the attack originated.

Distinguished Encoding Rules: Is used to create a binary representation of the information on the certificate. DER-encoded binary file can be represented as ASCII characters using Base64 Privacy-enhanced Electronic Mail (PEM) encoding. File extensions .cer and .crt contain either binary DER or ASCII PEM data.

Digital Encryption Standard: A symmetric block cipher that encrypts in blocks of 64 bits and uses a 56-bit key. This method is deprecated and the easiest upgrade is 3DES (Triple DES)

Dynamic Host Configuration Protocol: A protocol that provides an automated process of assigning IP addresses. Can also issue optional parameters such as DNS address, DNS suffix, Default Gateway, and subnet mask. Uses Ports 67 & 68 UDP

Diffie-Hellman Ephemeral: A protocol for the secure exchange of encryption keys. The Ephemeral provides PFS (Perfect Forward Secrecy)

Dynamic Link Library: Is a binary package used to implement functionality, such as cryptography or establishing a network connection

Data Loss Prevention: A hardware or software solution that prevents a certain type of information from being ex-filtrated from a device or network. Data like PII (Personally Identifiable Information), credit card numbers, Social Security numbers, data that is sensitive using keywords. USB blocking is a form of DLP. Preventing this type of information from being printed is another protection.

Demilitarized Zone: This is where you place your public facing web servers. DMZ's are configured as one of the connections or legs on a firewall.

Destination Network Address Translation: Also called "Port Forwarding", the router accepts requests from the Internet for an application, and then sends the request to a designated host and port within the DMZ.

Domain Name Service (Server): A service that maps / resolves hosts names to an IP address. Use Port 53 UDP for DNS queries, uses Port 53 TCP for Zone Transfers

Denial of Service: Is an attack that is one to one. Anything that can keep a device or user from accessing a service or information is a denial of service. One user flooding other users accounts with email attachments until the email box is full, cutting the network cable or power are just a few examples.

Disaster Recovery Plan: A step by step procedure to restore the organization to full functionality. This can be a failed web server, firewall, or some other critical component. The cause can be weather related, man-made either intentional or accidental. Some items needed:1. Inventory list of hardware and software2. Contact info for DRP team members3. Contact info for employees, suppliers, vendors, customers4. Alternate site5. Backups

Digital Signature Algorithm: Public key encryption used for digital signatures. This is an asymmetric encryption method

Extensible Authentication Protocol: EAP allows different authentication methods, most of using a digital certificate on the server and/or the client

Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling: Replaces LEAP, a certificate is optional on the server

Extensible Authentication Protocol (EAP) over LAN

Extensible Authentication Protocol-Transport Layer Security: Requires a certificate on the server and the clients

Extensible Authentication Protocol - Tunneled Transport Layer Security: Requires a certificate on the server only

Electronic Code Book: Not recommended for use, uses the same key for every packet, break one key, you have the entire message

Elliptic Curve Cryptography: Asymmetric encryption, used with wireless and mobile devices due to both have less processing power

Elliptic Curve Diffie-Hellman Ephemeral: A secure method of exchanging shared keys using PFS (Perfect Forward Secrecy)

Elliptic Curve Digital Signature Algorithm: Uses ElGamal with an elliptical curve to implement a digital signature.

Encrypted File System:  A NTFS public key encryption. On a Windows system, you have the ability to encrypt a single file or the folder based on the user's credentials.

Electromagnetic Interference: An adjacent electrical circuit creates a magnetic field that interferes with the signal, from sources like a high voltage motor, fluorescent lights, and power cables.

Electro Magnetic Pulse: Very powerful but short duration wave with the potential to destroy any type of electronic equipment.

Electronic Serial Number: is a unique identification number embedded by manufacturers on a microchip in wireless phones.

End-of-Life: When systems or applications are no longer supported by the manufacturer or developer.

Electronically Stored Information

Encapsulated Security Payload: An IPSec protocol that does the same as AH (Authentication Header), but also encrypts/encapsulates the entire payload/packet. Uses protocol # 50.

Exposure Factor: The percentage of the asset’s value that would be lost. The EF x AV (Asset Value) = the SLE (Single Loss Expectancy).

File System Access Control List: The file access control lists (FACLs) or simply ACLs are the list of additional user/groups and their permission to the file, on a Unix or Linux system.

False Acceptance Rate: A Type II error. The ratio of when a biometric system authenticates an unauthorized user as an authorized user.

Full Disk Encryption: Means that the entire contents of the drive (or volume), including system files and folders, are encrypted. Two methods are BitLocker and PGP Whole Disk Encryption. This is a software-based or an operating system encryption method. These methods are more CPU intensive processes.

File Integrity Monitoring

False Rejection Rate: Type I error. The ratio in which a biometric system rejects an authorized user.

File Transfer Protocol:Uploads and downloads large files to and from an FTP server. FTP transmits data in plaintext. FTP active mode uses TCP port 21 for control and TCP port 20 for data transfer. FTP passive mode (PASV) also uses TCP port 21 for control signals, but it uses a random TCP port for data.If the user can connect to the FTP but not upload or download, disable PASV (passive mode)

File Transfer Protocol over SSL: Ports 989 & 990 TCP, transfer in plain text or encrypted via "Explicit" mode, forced to use encryption is "Implicit" mode

Galois Counter Mode: Provides confidentiality and authenticity of the data. This mode is used for authenticated encryption. GCM mode uses an IV (Initialization Vector) and that the IV is a nonce (number used once).

Gnu Privacy Guard: GPG is a free implementation of PGP (Pretty Good Privacy). GPG allows the user to encrypt and digitally sign your emails or data.

Group Policy Object: Group Policy Object is a component of Group Policy (in Microsoft Active Directory) that can be used in Microsoft operating systems to control user accounts and user activity.

Global Positioning System: GPS is a way of determining a device's position (its latitude and longitude) based on information received from GPS satellites. The device must have line-of-sight to the GPS satellites. GPS provides another means of locating the device.

Graphic Processing Unit

Generic Routing Encapsulation: GRE is a tunneling protocol that encapsulates over an IP network. GRE uses protocol number 47. Used with PPTP and IPSec.

High Availability: The key premise is that systems are resilient and redundant. HA is the percentage of uptime a system is able to maintain over the period a year. For example, 99% would equal being down 3.65 per year of 14 minutes per day. The five 9's, 99.999%, would equal being down 5.25 minutes per year or .86 seconds per day.

Hard Disk Drive

Host-based Intrusion Detection System

Health Insurance Portability and Accountability Act

Host-based Intrusion Prevention System

Hashed Message Authentication Code: Hashing method, provides integrity and authenticity of the message. Most often used with IPSec.

HMAC-based One-Time Password: Provides PFS (Perfect Forward Secrecy), the password uses an incrementing counter, the password is valid until used.

Hardware Security Module: Provides root of trust, stores cryptographic keys, can also work as an SSL accelerator

Hypertext Markup Language

Hypertext Transfer Protocol: Port 80 TCP, plaintext

Heating, Ventilation and Air Conditioning: Provides availability

Infrastructure as a Service: This type of service you have the least control. A payment portal such as PayPal is SaaS.

Identity and Access Management

Internet Control Message Protocol: Suite containing ping, tracert, and pathping

Industrial Control Systems

Identification: Username or email address.

International Data Encryption Algorithm: Symmetric block cipher, uses XOR

Intermediate Distribution Frame

Identity Provider: SAML uses an Identity Provider for the authentication assertion.

Intrusion Detection System: Out-of-band. If anomaly, heuristic, or behavioral-based, need to establish a baseline first. Detects attacks and sends an alert.

Institute of Electrical and Electronic Engineers

Internet Key Exchange

Internet Information System: Windows web server

Instant Messaging

Internet Message Access Protocol v4: Port 143 TCP, the emails are stored on the email server until deleted. The user is able to search by keywords, and store emails in named folders.

Indicators of Compromise

Internet of Things: IoT includes any connecting to the Internet that is not a PC, tablet, or laptop.

Internet Protocol

Intrusion Prevention System: IPS are in-band, either Signature-based or Anomaly-based.

Internet Protocol Security: IPSec is used to secure data-in-transit. Works at Layer 3 of the OSI, and has two modes: transport and tunneling. Transport mode, only the data is encrypted, not the header. Tunnel mode the packet and header are encrypted.

Incident Response

Internet Relay Chat

Incident Response Plan

Interconnection Security Agreement

International Organization for Standardization

Internet Service Provider

IT Contingency Plan

Initialization Vector

Key Distribution Center: Used with Kerberos.

Key Encryption Key: Encrypts the MEK (Media Encryption Key), which is generated from the user's password.

Layer 2 Tunneling Protocol: Port 1701 UDP, uses IPSec

Local Area Network

LAN Manager

Lightweight Directory Access Protocol: Port 389 TCP, plaintext

Lightweight Directory Access Protocol Secure: Port 636 TCP, requires PKI/CA, uses TLS

Lightweight Extensible Authentication Protocol: Does not require certificates, deprecated & replaced with EAP-FAST

Local Shared Object: Flash cookie.

Monitoring as a Service

Mandatory Access Control, or Media Access Control, or Message Authentication Code

Metropolitan Area Network

Master Boot Record

Microsoft Baseline Security Analyzer

Message Digest: Also called checksum.

Message Digest 5: Hashing algorithm, 128 bit, fastest, provides integrity check.

Main Distribution Frame

Mobile Device Management

Mission Essential Functions

Media Encryption Key: The SED uses the MEK to encrypt the data.

Multi-Factor Authentication: Two or more factors from the following:1. Something you know2. Something you have3. Something you are4. Something you do5. Somewhere you are or are not

Multi-function Device

Man-in-the-Browser

Man-in-the-Middle

Multimedia Message Service

Memorandum of Agreement

Memorandum of Understanding

Microsoft Challenge Handshake Authentication Protocol

Managed Service Provider

Mean Time Between Failures

Maximum Tolerable Downtime

Mean Time to Failure

Mean Time to Recover or Mean Time to Repair

Maximum Transmission Unit

Network Access Control

Network Address Port Translation

Network Address Translation: Many internal IP addresses mapped to one external IP address.

Non-disclosure Agreement

Near Field Communication

Next Generation Access Control

Network-based Intrusion Detection System: NIDS can also perform rogue system detection.

Network-based Intrusion Prevention System

Network Operating System

New Technology File System

New Technology LAN Manager: Prone to pass-the-hash attack, disable or upgrade to NTLMv2

Network Time Protocol: Port 123 UDP, provides time synchronization.

Open Authorization

Online Certificate Status Protocol: Real-time certificate validation, checks on only one certificate and returns responses such as good, revoked or unknown.

Object Identifier

Operating System

Open-Source Intelligence: Passive reconnaissance

Over The Air

One Time Password: Provides PFS: Perfect Forward Secrecy

Organizational Unique Identifier: First 6 hexadecimal characters in a MAC address

Open Vulnerability Assessment Language

Open Web Application Security Project

PKCS #12: Certificate encoded in Base64 format, can contain the private key.

Peer to Peer: Block using an URL filter.

Platform as a Service

Proxy Auto Configuration

Pluggable Authentication Module

Password Authentication Protocol: Username and password sent in plaintext

Port Address Translation: One external IP address, multiple internal IP addresses

Password-based Key Derivation Function 2: Key stretching, salt, thwart rainbow table attacks and brute force

Private Branch Exchange: Phone system, either traditional or VoIP.

Packet Capture

Protected Extensible Authentication Protocol: Uses TLS tunnel to encapsulate EAP. The certificate required only on the server

Personal Electronic Device

Privacy-enhanced Electronic Mail

Perfect Forward Secrecy: Uses a one-time-password via a session key

Personal Exchange Format: Microsoft extension, contains both the public and private key

Pretty Good Privacy: An alternative to PKI/CA. Email certificate can be used to sign(digital signature) and encrypt email messages. Establishes a web of trust.

Personal Health Information

Personally Identifiable Information

Personal Identity Verification: HSPD-12: Homeland Security Presidential Directive-12

Public Key Infrastructure

Port-based Network Access Control

Padding Oracle on Downgrade Legacy Encryption: Downgrade attack, MiTM - Man-in-The-Middle Attack, disable SSL 3.0 with CBC

Post Office Protocol: Port 110 TCP

Plain Old Telephone Service

Point-to-Point Protocol: Uses PAP or CHAP for authentication

Point-to-Point Tunneling Protocol: Port 1723 TCP, GRE ID Protocol 47

Pseudo Random Number Generator

Pre-shared Key: Prone to a brute force attack

Pass-the-Hash

Recovery Agent: Recovers the private key / Registration Authority

Rapid Application Development

Remote Authentication Dial-in User Server: Used with WPA2 Enterprise, requires a PKI/CA and a valid certificate, tie to 802.1x

Redundant Array of Independent Disks

Redundant Array of Independent Disks 0: 2 disks minimum, striped disks, no redundancy, if one drive fails you lose all data, performance only

Redundant Array of Independent Disks 1: 2 disks only, mirrored drives, lose one drive, all data is on the other drive

Redundant Array of Independent Disks 5: 3 disks minimum, striping with parity, lose the equivalent of one disk to parity, can afford the loss of one disk

Redundant Array of Independent Disks 6: 4 disks minimum, striping with dual parity, lose the equivalent of two disks to parity, can afford the loss of two disks

Remote Access Server

Remote Access Trojan: Function as a backdoor application, can be downloaded via freeware, sometimes detected through netstat by looking for established connections.

Role-based Access Control:Based on your job function. Rule-Based Access Control:Time of day restriction or some other rule

Rivest Cipher version 4: Stream cipher, symmetric encryption, the following are built on RC4: WEP, WPA-TKIP, TLS

Remote Desktop Protocol: Port 3389 TCP

Request for Comments

Radio Frequency Identifier: Used for inventory and asset management. Used in conjunction with geofencing.

RACE Integrity Primitives Evaluation Message Digest: Hashing algorithm

Return on Investment

Risk Management Framework

Random Number Generation

Recovery Point Objective: The maximum amount of data an organization is willing to lose due to an event, measured in time.

Round Robin DNS

Rivest, Shamir, & Adleman

Remotely Triggered Black Hole

Recovery Time Objective: Time it takes to restore a system after a disaster.

Real-time Operating System: Embedded systems for time-sensitive tasks.

Real-time Transport Protocol: Used with streaming media, VoIP being the main one.

Remote Terminal Unit

Secure/Multipurpose Internet Mail Extensions: Provides email encryption with digital signatures.

Software as a Service

Sherwood Applied Business Security Architecture

Security Assertions Markup Language

Storage Area Network:Block level storage, can use jumbo frames.   / Subject Alternative Name: Protects multiple domain names, also be used if it has to match the hostname.

Satellite Communications

System Control and Data Acquisition

Security Content Automation Protocol

Simple Certificate Enrollment Protocol

Secure Copy Protocol: Port 22 TCP

Small Computer System Interface

Software Development Kit

Software Development Life Cycle

Software Development Life Cycle Methodology

Software Defined Network

Security as a Service

Self-Encrypting Drive: Fixes the performances issues that are inherent in FDE (Full Disk Encryption). FDE encrypts using the operating system, the SED uses the drive controller. Encrypts the data with the MEK (Media Encryption Key). The MEK is protecting by encrypting it with the KEK (Key Encryption Key)

Structured Exception Handler

Secure File Transfer Protocol: or File Transfer Protocol over SSH: Port 22 TCP

Secure Hashing Algorithm: 160 bit

Security Identifier

Security Information and Event Management

Session Initiation Protocol

Session Initiation Protocol Secure

Security Incident Response Team

Service Level Agreement

Single Loss Expectancy: AV x EF = SLE

Server Message Block: Port 445 TCP, Microsoft file sharing port, worms spread through this port

Simple Mail Transfer Protocol: Port 25 TCP

Simple Mail Transfer Protocol Secure: Port 465 TCP

Simple Network Management Protocol: Port 161 UDP, version 3 is the only secure version

Simple Object Access Protocol

System on Chip

Standard Operating Procedure

Sender Policy Framework

Spam over Internet Messaging

Single Point of Failure

Structured Query Language

Secure Real-Time Protocol: Encryption for streaming audio, video, and VoIP.

Solid State Drive

Secure Shell: Port 22 TCP

Service Set Identifier

Secure Sockets Layer

Single Sign-on

Secure Socket Tunneling Protocol

Spanning Tree Protocol: prevents switching loops

Terminal Access Controller Access Control System Plus: Port 49 TCP

Transmission Control Protocol/Internet Protocol

Trivial File Transfer Protocol: Port 69 UDP

Ticket Granting Service

Ticket Granting Ticket: Used with Kerberos

Temporal Key Integrity Protocol: Prone to brute force attacks, built on RC4, a different key for each packet

Transport Layer Security

Trusted Operating System

Time-based One-Time Password

Trusted Platform Module

True Random Number Generator

Transaction Signature

User Account Control

User Acceptance Testing

Unmanned Aerial Vehicle

Unified Communications

User Datagram Protocol

Unified Extensible Firmware Interface

Uninterruptable Power Supply

Uniform Resource Identifier

Universal Resource Locator

Universal Serial Bus

USB On The Go

Unified Threat Management

Unshielded Twisted Pair

Virtual Desktop Environment

Virtual Desktop Infrastructure

Virtual IP

Virtual Local Area Network

Variable Length Subnet Masking

Virtual Machine

Voice over IP

Virtual Private Network

Video Teleconferencing

Web Application Firewall: Works at Layer 7 of the OSI, protects against XSS & XSRF attacks, also works as a load balancer

Wireless Access Point

Wired Equivalent Privacy: Prone to IV attacks, built on RC4, replaced with WPA.

Wireless Intrusion Detection System

Wireless Intrusion Prevention System

Write Once Read Many

WiFi Protected Access: Prone to a brute force attack, built on RC4

WiFi Protected Access 2: Built on AES

WiFi Protected Setup: Attack keywords: 8 digit PIN, Reaver (program to crack WPS), can be cracked in 11,000 attempts or less

Work Recovery Time

Extensible Markup Language

Exclusive Or: Security through obscurity

Cross-site Request Forgery: Keywords in logs: "Buy" or "Purchase"

Cross-site Scripting