Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
acrys only
| Term | Definition |
|---|---|
| ACL | Access Control List — firewall/router rules that permit or deny traffic based on source IP, destination IP, and port |
| ARO | Annualized Rate of Occurrence — how many times a threat is expected to happen per year; used in risk calculations |
| ARP | Address Resolution Protocol — maps IP addresses to MAC addresses on a local network; can be poisoned by attackers to intercept traffic |
| BEC | Business Email Compromise — attacker spoofs an executive's display name to request gift cards or wire transfers; no malicious link involved |
| CIA | Confidentiality, Integrity, Availability — the three core pillars of information security; NOT a scoring system |
| CRL | Certificate Revocation List — a published list of digital certificates that have been revoked; must be updated when a private key is stolen |
| CVE | Common Vulnerabilities and Exposures — a standardized list that names and IDs known vulnerabilities; does NOT score severity |
| CVSS | Common Vulnerability Scoring System — scores vulnerabilities from 0 to 10 based on severity; used to prioritize patching |
| DLP | Data Loss Prevention — tools that detect and block unauthorized data transfers out of the organization |
| DRM | Digital Rights Management — technology controlling how digital content is used, copied, or distributed |
| DRP | Disaster Recovery Plan — document detailing the order to bring critical systems back online after a major outage |
| ECC | Elliptic Curve Cryptography — asymmetric encryption using elliptic curves; preferred when computing resources are limited; smaller keys same security as RSA |
| EDR | Endpoint Detection and Response — detects and responds to malware threats on individual endpoints; NOT for lost device management |
| FDE | Full Device Encryption — encrypts everything on a device so it is unreadable without the key; protects data if device is lost or stolen |
| FIM | File Integrity Monitoring — monitors files for unauthorized changes; server-side tool; NOT for mobile app management |
| HSM | Hardware Security Module — a physical device that manages and protects cryptographic keys; more secure than software key storage |
| IaC | Infrastructure as Code — deploying cloud resources through config files like Terraform; enables fast consistent deployments |
| IaaS | Infrastructure as a Service — cloud model where provider manages hardware only; YOU manage OS, apps, and database security |
| IDS | Intrusion Detection System — monitors network traffic and alerts on suspicious activity; detects but does not block |
| IMTTR | Mean Time to Repair — average time to fix a system after failure; used alongside RTO to measure recovery speed |
| IoC | Indicator of Compromise — evidence that a breach occurred such as unusual IP addresses or changed file hashes; gathered during Analysis phase |
| IPSec | Internet Protocol Security — encrypts and authenticates IP traffic at the network layer; best for securing private cloud communications |
| MDM | Mobile Device Management — platform for remotely managing mobile devices; enables remote wipe, screen lock, app allowlists |
| MTBF | Mean Time Between Failures — average operating time before a system fails; used to assess reliability for insurance decisions |
| NGFW | Next-Generation Firewall — advanced firewall with deep packet inspection; filters traffic at the network perimeter |
| OCSP | Online Certificate Status Protocol — real-time check of whether a specific certificate has been revoked; faster than downloading a full CRL |
| PaaS | Platform as a Service — cloud model where vendor manages hardware and OS/runtime; YOU patch your application |
| RCA | Root Cause Analysis — identifies the underlying WHY of an incident; happens during Lessons Learned; purpose is to prevent recurrence |
| RBAC | Role-Based Access Control — grants permissions based on a user's assigned role; not time-dependent |
| RPO | Recovery Point Objective — maximum acceptable data loss measured in time; shorter RPO requires more frequent backups |
| RSA | Asymmetric encryption algorithm using public/private key pairs — used for key exchange and digital signatures; NOT for bulk data encryption |
| RTO | Recovery Time Objective — maximum acceptable time to restore a system after disruption; shorter RTO requires faster infrastructure |
| SaaS | Software as a Service — cloud model where vendor manages EVERYTHING including the app; you only manage data and user access |
| SCADA | Supervisory Control and Data Acquisition — industrial control system for power grids and utilities; designed to be STABLE, never constantly changing |
| SIEM | Security Information and Event Management — aggregates and analyzes logs across the environment to detect anomalies and generate alerts |
| SHA-1 | Secure Hash Algorithm 1 — a hashing algorithm that produces a fixed-length hash; now considered weak and outdated; NOT encryption |
| SOAR | Security Orchestration Automation and Response — automates incident response workflows; NOT a vulnerability scoring tool |
| SSH | Secure Shell — encrypted protocol for remote system access; SSH tunneling wraps unencrypted traffic inside it as a compensating control |
| TGT | Ticket Granting Ticket — a Kerberos token issued after login; used to request service access without re-entering credentials |
| TPM | Trusted Platform Module — hardware chip on a motherboard that stores cryptographic keys; works with FDE to protect data at rest |
| VDI | Virtual Desktop Infrastructure — hosts desktops on company servers; user only sees a screen; data NEVER leaves company hardware |
| VPC | Virtual Private Cloud — a cloud networking construct for isolating cloud resources; NOT a remote access solution |
| VPN | Virtual Private Network — encrypts traffic between remote user and corporate network; standard answer for secure remote access without interception |
| WAF | Web Application Firewall — filters HTTP traffic to protect web apps; blocks SQL injection and XSS attempts |
| XSS | Cross-Site Scripting — malicious scripts injected into web pages through unsanitized inputs; prevented by input validation |
| MFA | MULTI FACTOR AUTHENTICATOR |
Created by:
anisa-13