AP® Cybersecurity · 35 terms so far

Glossary

Every term is defined in the words the CED uses, with the codes where it appears in the course and a link to the lesson that teaches it.

A

Address resolution protocol (ARP): The protocol that finds the media access control (MAC) address belonging to an internet protocol (IP) address on the same local area network (LAN), and stores the pair in an ARP table.
ARP poisoning: Sending falsified address resolution protocol (ARP) packets so a device's ARP table pairs the target's internet protocol (IP) address with the adversary's media access control (MAC) address.

Beacon frame: A frame a wireless access point broadcasts several times a second to announce its service set identifier (SSID) and wireless encryption protocols.
Broadcast address: The highest address of a network, such as 192.168.1.255; a packet sent to it is delivered to every device on that network.

Credential harvesting: Collecting real usernames and passwords through a fake login site.

Data in transit: Data moving across a network, as opposed to data at rest, which is stored on a drive.
Default gateway: The address of the router on a host's own network, to which the host sends every packet addressed to another network.
Denial of service (DoS): An attack that makes a system or resource unavailable to authorized users.
Distributed denial of service (DDoS): A denial of service attack in which many devices attack the same target at the same time.
DNS poisoning: Planting a fake domain name system (DNS) record on a DNS server so users are redirected, typically to a malicious website.
Domain name system (DNS): The system that translates domain names into internet protocol (IP) addresses, using DNS servers, authoritative name servers and DNS records.

Eavesdropping: Capturing data in transit in order to read, record or copy it.
Evil twin: An adversary's access point that copies or imitates a legitimate network's service set identifier (SSID) so users join it by mistake.

Firewall: Software that allows or denies network traffic in or out of a network using a set of rules called an access control list (ACL); it runs on its own device or inside another one, such as a router.
Frame: A unit that wraps a packet for one link, with the media access control (MAC) addresses of the two devices on that link.

Host: A device that sends or receives data on a network, such as a laptop, phone, printer or server.

Internet control message protocol (ICMP): A protocol for short test and error messages between devices, used by ping; it has no port numbers.
IP address: A numerical identifier assigned to a device's connection by the network it joins, made of a network portion and a host portion.

Jamming: Broadcasting radio noise so wireless devices cannot communicate: an attack on availability.

Lateral movement: Using access to one compromised device to compromise other devices on the same local area network (LAN).
Local area network (LAN): A network that covers one building or site and is controlled by one organization or household.

MAC address: A 48-bit identifier of a network interface card, written in hexadecimal and used to deliver frames on one local link.
MAC flooding: Sending a switch many frames with different fake media access control (MAC) addresses so its table fills and it broadcasts frames out of every port.
MAC spoofing: Making a device send a media access control (MAC) address other than its own.

Network data port: A socket in a wall that is cabled to a switch port; plugging a device into it connects that device to the local area network (LAN).

On-path attack: An attack in which the adversary secretly sits between two parties, capturing and possibly altering the data they exchange.

Packet: A small unit of data sent across a network, made of headers (addresses and control information) and a payload (the data).

Rogue access point: An unauthorized wireless access point connected to an organization's network, often through an open data port.
Router: A device that joins networks and forwards packets between them by reading internet protocol (IP) addresses.

Service set identifier (SSID): The name of a wireless network, announced in beacon frames.
Smurf attack: A denial-of-service attack: internet control message protocol (ICMP) requests sent to a broadcast address with the victim's address forged as the source, so all replies flood the victim.
Switch: A device that joins hosts within a local area network (LAN) and forwards each frame only to the port where the destination media access control (MAC) address was seen.

Triangulation: Locating a signal's source by measuring its strength from several positions.

Vulnerability scanner: An automated tool that checks networks, devices and applications for known vulnerabilities and reports what it finds.

Wireless access point (WAP): A device that connects wireless devices to a wired local area network (LAN) by radio and announces the network in beacon frames.