Key terms, unit by unit

A risk strategy: a deliberate decision to live with the residual risk, because absolute security is unattainable.

Unit 2

The ordered set of rules a firewall uses to permit or deny inbound and outbound traffic; the first matching rule is executed.

Unit 3

A small entry space with two doors that lets one authorized person through at a time, so nobody can be admitted with them.

Unit 2

The protocol that finds the media access control (MAC) address belonging to an internet protocol (IP) address on the same local area network (LAN), and stores the pair in an ARP table.

NetworkingUnit 3

A person or group trying to compromise a system. College Board says adversary, not "hacker".

Unit 1Unit 2

When responders get used to false positives and take alerts less seriously, assuming they are false before investigating.

Unit 3

Detection that compares data to a baseline of normal activity and alerts on data outside a tolerance range; catches new attacks but costs more and has more false positives.

Unit 3

Sending falsified address resolution protocol (ARP) packets so a device's ARP table pairs the target's internet protocol (IP) address with the adversary's media access control (MAC) address.

NetworkingUnit 3

Computer systems that perform tasks such as generating text, recognizing patterns or sorting events, used by both adversaries and defenders.

Unit 1

Anything valuable: financial resources, intellectual property, data, digital infrastructure, physical property or reputation.

Unit 2

A social engineering tactic: impersonating someone with power over the target, or relaying "their" instructions.

Unit 2

A security principle: data and services are accessible to authorized people when needed. Without it: unexpected downtime.

Unit 2

A risk strategy: stop the activity that creates the risk; impossible if the activity is critical to the mission.

Unit 2

A frame a wireless access point broadcasts several times a second to announce its service set identifier (SSID) and wireless encryption protocols.

NetworkingUnit 3

A short, sturdy post that stops vehicles from reaching a building entrance or area.

Unit 2

The highest address of a network, such as 192.168.1.255; a packet sent to it is delivered to every device on that network.

NetworkingUnit 3

A physical attack where the adversary copies an authorized user's access card to gain everything that user can access.

Unit 2

Personal questions a website uses to verify identity, such as a pet's name or a birthdate.

Unit 1

A way for adversaries to send commands to a compromised device and receive its output.

Unit 2

A security principle: only authorized people, systems or processes can access data. Without it: data theft or destruction.

Unit 2

A social engineering tactic that creates social pressure by making the target believe everyone else is already doing it.

Unit 2

A security control function that fixes problems and restores systems, such as patching, repairing a card reader or an intrusion prevention system (IPS).

Unit 2

A control that costs less to install and maintain than the expected loss from the attack it prevents.

Unit 2

Collecting real usernames and passwords through a fake login site.

NetworkingUnit 1Unit 3

An adversary motivated by politics or beliefs who disrupts entire communities, regions or nations, such as a power grid or water plant.

Unit 2

Data moving across a network, as opposed to data at rest, which is stored on a drive.

NetworkingUnit 3

The address of the router on a host's own network, to which the host sends every packet addressed to another network.

NetworkingUnit 3

A strategy that uses multiple types of security controls in layers, so if one is bypassed another still protects the asset.

Unit 2

An attack that makes a system or resource unavailable to authorized users.

Unit 1Unit 3

A rule an automated detection system uses to flag likely malicious activity, which AI can suggest and a detection engineer should review.

Unit 1

A security control function that identifies attacks as they happen, such as cameras, intrusion detection systems (IDSs) and security information and event management (SIEM) systems.

Unit 2

An AI-made copy of a person's voice or image, built from existing samples, used to impersonate them on calls or video.

Unit 1

A denial of service attack in which many devices attack the same target at the same time.

Unit 3

Planting a fake domain name system (DNS) record on a DNS server so users are redirected, typically to a malicious website.

NetworkingUnit 3

The system that translates domain names into internet protocol (IP) addresses, using DNS servers, authoritative name servers and DNS records.

NetworkingUnit 3

A physical attack where the adversary searches a target's trash for information that helps them reach their goal.

Unit 2

Capturing data in transit in order to read, record or copy it.

NetworkingUnit 3

Getting a target to reveal sensitive information through conversation or messages, a goal of social engineering.

Unit 1

To reach accounts with more permissions, the goal of the lateral movement phase.

Unit 2

An adversary's access point that copies or imitates a legitimate network's service set identifier (SSID) so users join it by mistake.

NetworkingUnit 1Unit 3

To send stolen data out of an organization, part of the taking action phase.

Unit 2

A framework that lets users authenticate to a wireless network through an approved authentication server, required by many wireless security policies.

Unit 3

When an adversary bypasses a detection system, so a real attack raises no alert.

Unit 3

An alert for activity that is actually harmless; high rates waste time and cause alert fatigue.

Unit 3

A social engineering tactic: pretending to be, or to know, someone close to the target to build trust.

Unit 2

Software that allows or denies network traffic in or out of a network using a set of rules called an access control list (ACL); it runs on its own device or inside another one, such as a router.

NetworkingUnit 1Unit 2Unit 3

A first point of access on a target's computer, gained during the initial access phase.

Unit 2

A unit that wraps a packet for one link, with the media access control (MAC) addresses of the two devices on that link.

NetworkingUnit 3

An adversary who compromises computers and networks to support a social, political or personal cause, believing the goal justifies illegal methods.

Unit 2

A device that sends or receives data on a network, such as a laptop, phone, printer or server.

NetworkingUnit 3

Detection that combines signature-based and anomaly-based methods; the most expensive option and it generates more alerts.

Unit 3

A managerial control that sets out the steps an organization follows when an attack happens.

Unit 2

Evidence in data or traffic that a system may be under attack, such as connections to known malicious addresses or mismatched port and application traffic.

Unit 3

An adversary who already has legitimate credentials and access to systems and data, sometimes recruited by outsiders, often motivated by greed or revenge.

Unit 2

A security principle: data are accurate and trustworthy. Without it: data manipulation.

Unit 2

A protocol for short test and error messages between devices, used by ping; it has no port numbers.

NetworkingUnit 3

A social engineering tactic where the adversary threatens negative consequences if the target does not comply.

Unit 1Unit 2

A numerical identifier assigned to a device's connection by the network it joins, made of a network portion and a host portion.

NetworkingUnit 3

Broadcasting radio noise so wireless devices cannot communicate: an attack on availability.

NetworkingUnit 1Unit 3

A device or program that records every key a user types, which can capture passwords and messages.

Unit 2

A generative AI model trained on huge text data sets that writes human-like text, and can leak or repeat what it learned.

Unit 1

Using access to one compromised device to compromise other devices on the same local area network (LAN).

Unit 2Unit 3

The two factors of a risk assessment: how probable an attack is, and how bad the damage would be.

Unit 2

A network that covers one building or site and is controlled by one organization or household.

NetworkingUnit 3

Low-skilled adversaries use malicious tools made by others against known vulnerabilities; high-skilled adversaries build or adapt tools and find zero days.

Unit 1

A 48-bit identifier of a network interface card, written in hexadecimal and used to deliver frames on one local link.

NetworkingUnit 3

Allowing only devices with approved media access control (MAC) addresses to join a network or use a switch port.

Unit 3

Sending a switch many frames with different fake media access control (MAC) addresses so its table fills and it broadcasts frames out of every port.

NetworkingUnit 3

Making a device send a media access control (MAC) address other than its own.

NetworkingUnit 3

Software designed to harm a device or its user, such as by stealing data, spying or giving an adversary control.

Unit 1Unit 2

A security control type made of rules, guidelines, policies and procedures, such as password policies, access reviews and incident response plans.

Unit 2Unit 3

A risk strategy: add security controls to reduce the likelihood or impact of a risk.

Unit 2

A detective control that alerts security to movement, best placed where traffic is unexpected and paired with cameras.

Unit 2

A login that requires extra proof of identity, such as a one-time code, in addition to a password.

Unit 1

A socket in a wall that is cabled to a switch port; plugging a device into it connects that device to the local area network (LAN).

NetworkingUnit 3

An automated tool that analyzes network data to determine if malicious activity is happening and generates an alert.

Unit 2Unit 3

An automated tool that detects malicious network activity like an IDS and can also halt it by closing ports, blocking addresses or rejecting protocols.

Unit 2Unit 3

Dividing a network into smaller, isolated segments or subnets so attacks are contained and each segment can have its own security level.

Unit 3

A firewall with stateless and stateful filtering plus advanced features such as intrusion prevention, deep packet inspection and filtering by application type.

Unit 3

An attack in which the adversary secretly sits between two parties, capturing and possibly altering the data they exchange.

NetworkingUnit 3

A code that works for a single login or a short time, often sent by text or an authenticator app as a second factor.

Unit 1

An attack where an adversary tries to log in to a device or service using common passwords, common patterns or stolen passwords.

Unit 1

Freely available information, such as social media, websites and public records, used during reconnaissance.

Unit 2

A small unit of data sent across a network, made of headers (addresses and control information) and a payload (the data).

NetworkingUnit 3

A long password made of several words, easier to remember than random characters and hard to guess when the words are unrelated.

Unit 1

A list of likely passwords built from personal information about a target, submitted by an automated tool.

Unit 1

A tool that generates and stores long, random, unique passwords so each account can have its own.

Unit 1

The attack phase where adversaries keep access without breaking in again, often with command and control through a RAT or rootkit.

Unit 2

A social engineering message, usually an email or text, that pretends to be trustworthy to get the target to reveal information, click a link or open a file.

Unit 1Unit 2

A security control type for the physical space, such as locks, fences, cameras, bollards and guards.

Unit 2

A physical attack where the adversary uses social engineering to get an authorized person to let them into a restricted area.

Unit 2

A switch feature that limits how many media access control (MAC) addresses can be assigned to a single switch port.

Unit 3

A social engineering tactic where the adversary creates a believable reason to contact the target.

Unit 2

A security control function that stops an attack before it happens, such as locks and encryption.

Unit 2

Two kinds of risk result: quantitative gives a number or money value; qualitative gives a descriptive label.

Unit 2

The first phase of a cyberattack, gathering as much information about a target as possible, often from open source intelligence.

Unit 1Unit 2

Malware that keeps an adversary's access to a device; a RAT gives remote control, a rootkit hides deep in the system.

Unit 2

The risk that remains after an organization has avoided, transferred and mitigated what it can; the level it chooses to accept.

Unit 2

The chance that a threat exploits a vulnerability to compromise an asset, assessed by likelihood and severity.

Unit 2

An unauthorized wireless access point connected to an organization's network, often through an open data port.

NetworkingUnit 3

A device that joins networks and forwards packets between them by reading internet protocol (IP) addresses.

NetworkingUnit 3

A managerial control that sets the minimum configuration standard for routers, such as banning local accounts, disabling unnecessary services and requiring a firewall.

Unit 3

A social engineering tactic that creates a sense of limited availability: limited supply, not limited time.

Unit 2

A network segment, created with firewall zones and rules, between the internet and the internal network that holds public-facing resources; a lower security zone.

Unit 3

A low-skilled adversary who uses tools developed by others without understanding how they work, often for money or recognition.

Unit 2

Training that teaches employees to detect social engineering, avoid badging others in and prevent device theft.

Unit 2

A safeguard that protects confidentiality, integrity or availability, classified by type (physical, technical, managerial) and function (preventative, detective, corrective).

Unit 2

A system that collects and analyzes data from many sources to detect attack patterns and alert analysts, who resolve or escalate the alert.

Unit 2Unit 3

The name of a wireless network, announced in beacon frames.

NetworkingUnit 1Unit 3

A word or phrase known only to two people, used to verify each other's identity in high-stakes situations.

Unit 1

A physical attack where the adversary watches, or records with a camera, someone accessing sensitive information to use it later.

Unit 2

Detection that compares data to a database of known indicators of compromise; fast, almost no false positives, but cannot detect new attacks.

Unit 3

A denial-of-service attack: internet control message protocol (ICMP) requests sent to a broadcast address with the victim's address forged as the source, so all replies flood the victim.

NetworkingUnit 3

An attack that uses psychological tactics to manipulate people into revealing sensitive information, downloading a malicious file or clicking a malicious link.

Unit 1Unit 2

A virtual private network (VPN) setup where some traffic goes through the VPN and some goes directly to the internet at the same time; VPN policies often prohibit it.

Unit 3

A firewall that tracks the state of connections passing through it and filters by connection-related rules as well as header information.

Unit 3

A firewall that filters each packet using header information such as internet protocol (IP) addresses, ports and protocols.

Unit 3

Creating separate subnets based on internet protocol (IP) addressing so a compromised device exposes fewer others.

Unit 3

A device that joins hosts within a local area network (LAN) and forwards each frame only to the port where the destination media access control (MAC) address was seen.

NetworkingUnit 3

A physical attack where the adversary follows close behind an authorized person into a restricted area without that person noticing.

Unit 2

A security control type for the digital space, such as firewalls, anti-malware software and encryption.

Unit 2

Anything that could exploit a vulnerability to cause harm, including human adversaries and natural disasters.

Unit 2

A risk strategy: move the burden of the risk to another entity, such as an insurer, a government or consumers.

Unit 2

An adversary group that seeks money, mainly through ransomware and stealing intellectual property to sell.

Unit 2

Locating a signal's source by measuring its strength from several positions.

NetworkingUnit 3

A battery backup that keeps a device running during a power outage; generators provide power at larger scale.

Unit 2

A social engineering tactic where the adversary creates a reason or deadline for the target to act quickly.

Unit 1Unit 2

A logical network created on switches that separates devices physically connected to the same central switches.

Unit 3

A service that encrypts all your traffic to the VPN operator's system, hiding it from the local network and service provider but not from the VPN provider.

Unit 1

A weakness or flaw that could allow an asset to be compromised.

Unit 2

An automated tool that checks networks, devices and applications for known vulnerabilities and reports what it finds.

Unit 3

Detecting a target's wireless network beacons while driving or walking around it, to learn the network type and where the signal leaks outside.

Unit 1

A device that connects wireless devices to a wired local area network (LAN) by radio and announces the network in beacon frames.

NetworkingUnit 3

A policy that sets the measures for protecting a physical workplace, such as locking devices, clearing sensitive papers, privacy screens and power protection.

Unit 2

Wi-Fi Protected Access 3, currently the strongest wireless encryption protocol; Wired Equivalent Privacy (WEP), Wi-Fi Protected Setup (WPS) and the original Wi-Fi Protected Access (WPA) have known vulnerabilities.

Unit 3

An undocumented vulnerability that defenders do not know about yet, discovered and used by high-skilled adversaries.

Unit 1