Key terms, unit by unit

A managerial control describing what users may, may not and must do on organization devices.

Unit 4

A risk strategy: a deliberate decision to live with the residual risk, because absolute security is unattainable.

Unit 2

The ordered set of rules a firewall uses to permit or deny inbound and outbound traffic; the first matching rule is executed.

Unit 3Unit 4

A method for deciding which subjects (users or applications) can perform which operations on which objects (files or applications).

Unit 5

A small entry space with two doors that lets one authorized person through at a time, so nobody can be admitted with them.

Unit 2

A login setting that locks an account after a set number of invalid attempts, often 3 to 5.

Unit 4

The process of recording and monitoring user activities, such as when data are accessed and by whom.

Unit 5

The protocol that finds the media access control (MAC) address belonging to an internet protocol (IP) address on the same local area network (LAN), and stores the pair in an ARP table.

NetworkingUnit 3

The most common symmetric encryption algorithm: a block cipher using 128-bit (16-byte) blocks and keys of varying lengths.

Unit 5

A person or group trying to compromise a system. College Board says adversary, not "hacker".

Unit 1Unit 2

When responders get used to false positives and take alerts less seriously, assuming they are false before investigating.

Unit 3

Detection that compares data to a baseline of normal activity and alerts on data outside a tolerance range; catches new attacks but costs more and has more false positives.

Unit 3

Software that scans files against a database of malware signatures and quarantines and removes matches.

Unit 4

A program that runs instructions on a computer: executable data. Some run locally, others (web applications) run on a server reached over a network.

Unit 5

Sending falsified address resolution protocol (ARP) packets so a device's ARP table pairs the target's internet protocol (IP) address with the adversary's media access control (MAC) address.

NetworkingUnit 3

Computer systems that perform tasks such as generating text, recognizing patterns or sorting events, used by both adversaries and defenders.

Unit 1

Anything valuable: financial resources, intellectual property, data, digital infrastructure, physical property or reputation.

Unit 2

Encryption that uses two different keys, one to encrypt and the other to decrypt.

Unit 5

A piece of proof of identity: knowledge (know), possession (have), biometric (are) or location (where).

Unit 4

A log that records every attempted login on a system, including the user, time, source and result.

Unit 4

A social engineering tactic: impersonating someone with power over the target, or relaying "their" instructions.

Unit 2

Granting an entity permission to have a certain type of access to a resource.

Unit 5

A setting that runs content from an inserted external drive automatically; adversaries use it to launch malware.

Unit 4

A security principle: data and services are accessible to authorized people when needed. Without it: unexpected downtime.

Unit 2

A risk strategy: stop the activity that creates the risk; impossible if the activity is critical to the mission.

Unit 2

A frame a wireless access point broadcasts several times a second to announce its service set identifier (SSID) and wireless encryption protocols.

NetworkingUnit 3

An indicator of compromise found in authentication and access logs, such as many failed logins or attempts to elevate privileges.

Unit 4

A mandatory access control model: subjects may not read objects above their level (Simple Security Property) or write to objects below it (* Security Property).

Unit 5

A password on the basic input output system (BIOS) or unified extensible firmware interface (UEFI) that stops adversaries booting another operating system or a privileged mode.

Unit 4

Encryption that handles information in fixed-size chunks called blocks, producing an output block for each input block.

Unit 5

A short, sturdy post that stops vehicles from reaching a building entrance or area.

Unit 2

The highest address of a network, such as 192.168.1.255; a packet sent to it is delivered to every device on that network.

NetworkingUnit 3

An offline attack that uses an automated tool to test every possible password against a captured hash.

Unit 4

An attack that feeds more data into a fixed-size buffer in memory than was allotted, overwriting nearby memory to crash the system or run unauthorized code.

Unit 5

A physical attack where the adversary copies an authorized user's access card to gain everything that user can access.

Unit 2

Personal questions a website uses to verify identity, such as a pet's name or a birthdate.

Unit 1

The Linux command that changes file permissions, using the numeric method (chmod 640 file) or the symbolic method (chmod g+w file).

Unit 5

The unreadable output of an encryption algorithm; only the right key turns it back into plaintext.

Unit 5

When two different inputs produce the same hash; if collisions can be forced efficiently, the hash function is deprecated.

Unit 4

A way for adversaries to send commands to a compromised device and receive its output.

Unit 2

A security principle: only authorized people, systems or processes can access data. Without it: data theft or destruction.

Unit 2

A social engineering tactic that creates social pressure by making the target believe everyone else is already doing it.

Unit 2

Characters an application uses to encase user input, including the single quote, the double quote and the semicolon.

Unit 5

A security control function that fixes problems and restores systems, such as patching, repairing a card reader or an intrusion prevention system (IPS).

Unit 2

A control that costs less to install and maintain than the expected loss from the attack it prevents.

Unit 2

Collecting real usernames and passwords through a fake login site.

NetworkingUnit 1Unit 3

An attack that tries common default credentials or stolen username and password pairs on services or devices.

Unit 4

An attack that injects malicious code into a website so the user's browser runs it; Type I is reflected (in a link) and Type II is stored (posted on the site).

Unit 5

The practice of hiding information with algorithms that encrypt (hide) and decrypt (recover) it.

Unit 5

A managerial control describing an organization's acceptable encryption protocols and key parameters: approved algorithms, key lengths, key generation and key storage.

Unit 5

An adversary motivated by politics or beliefs who disrupts entire communities, regions or nations, such as a power grid or water plant.

Unit 2

Data stored on a drive; protect the physical drive from destruction or theft and encrypt the data so a thief cannot immediately read them.

Unit 5

Data moving across a network, as opposed to data at rest, which is stored on a drive.

NetworkingUnit 3

Data being processed by software or a person; they must be unencrypted to be used, so access controls limit who can view or edit them.

Unit 5

A third-party service that monitors users' data access, usage and transmission across an organization to detect suspicious activity.

Unit 5

Verifying that user input meets the expected criteria, such as digits for a quantity, before processing it, and rejecting anything outside the expected parameters.

Unit 5

The address of the router on a host's own network, to which the host sends every packet addressed to another network.

NetworkingUnit 3

A strategy that uses multiple types of security controls in layers, so if one is bypassed another still protects the asset.

Unit 2

An attack that makes a system or resource unavailable to authorized users.

Unit 1Unit 3

A rule an automated detection system uses to flag likely malicious activity, which AI can suggest and a detection engineer should review.

Unit 1

A security control function that identifies attacks as they happen, such as cameras, intrusion detection systems (IDSs) and security information and event management (SIEM) systems.

Unit 2

An offline attack that hashes a list of common passwords and compares them with a captured hash.

Unit 4

An AI-made copy of a person's voice or image, built from existing samples, used to impersonate them on calls or video.

Unit 1

An attack that edits uniform resource locators (URLs) and hypertext transfer protocol (HTTP) GET requests, usually with ../, to reach sensitive files outside a web application's folder.

Unit 5

An access control model where subjects set the access other subjects have to objects they own; administrators can override.

Unit 5

A denial of service attack in which many devices attack the same target at the same time.

Unit 3

Planting a fake domain name system (DNS) record on a DNS server so users are redirected, typically to a malicious website.

NetworkingUnit 3

The system that translates domain names into internet protocol (IP) addresses, using DNS servers, authoritative name servers and DNS records.

NetworkingUnit 3

A physical attack where the adversary searches a target's trash for information that helps them reach their goal.

Unit 2

Capturing data in transit in order to read, record or copy it.

NetworkingUnit 3

Getting a target to reveal sensitive information through conversation or messages, a goal of social engineering.

Unit 1

A common family of asymmetric encryption algorithms.

Unit 5

A computer that is part of a machine, with instructions for its specialized parts; usually slower, cheaper and with little storage.

Unit 4

A vendor service that monitors an organization's devices with a unified, centralized alert platform; expensive but holistic.

Unit 4

To reach accounts with more permissions, the goal of the lateral movement phase.

Unit 2

An adversary's access point that copies or imitates a legitimate network's service set identifier (SSID) so users join it by mistake.

NetworkingUnit 1Unit 3

To send stolen data out of an organization, part of the taking action phase.

Unit 2

A framework that lets users authenticate to a wireless network through an approved authentication server, required by many wireless security policies.

Unit 3

When an adversary bypasses a detection system, so a real attack raises no alert.

Unit 3

An alert for activity that is actually harmless; high rates waste time and cause alert fatigue.

Unit 3

A social engineering tactic: pretending to be, or to know, someone close to the target to build trust.

Unit 2

An indicator of compromise found in files, such as a hash matching known malware or a known malicious file name or path.

Unit 4

Malicious code that lives in random access memory (RAM) and uses legitimate programs already installed, instead of being stored as a file.

Unit 4

Software that allows or denies network traffic in or out of a network using a set of rules called an access control list (ACL); it runs on its own device or inside another one, such as a router.

NetworkingUnit 1Unit 2Unit 3

A first point of access on a target's computer, gained during the initial access phase.

Unit 2

A unit that wraps a packet for one link, with the media access control (MAC) addresses of the two devices on that link.

NetworkingUnit 3

An adversary who compromises computers and networks to support a social, political or personal cause, believing the goal justifies illegal methods.

Unit 2

The fixed-length output of a cryptographic hash function; repeatable, collision resistant and pre-image resistant.

Unit 4

A file that appears to hold valuable data but holds fake data; any access to it is an indicator of malicious activity.

Unit 5

A device that sends or receives data on a network, such as a laptop, phone, printer or server.

NetworkingUnit 3

Software on a single device that allows or denies traffic into or out of it using an ordered set of rules.

Unit 4

An indicator of compromise found in logs and configuration settings, such as unexpected processes or unauthorized setting changes.

Unit 4

Detection that combines signature-based and anomaly-based methods; the most expensive option and it generates more alerts.

Unit 3

A managerial control that sets out the steps an organization follows when an attack happens.

Unit 2

Evidence in data or traffic that a system may be under attack, such as connections to known malicious addresses or mismatched port and application traffic.

Unit 3Unit 4

An attack that inserts unexpected character strings into input fields to change a program's behavior.

Unit 5

Using a verification function to remove potentially malicious characters from user input, or reject it, before processing.

Unit 5

An adversary who already has legitimate credentials and access to systems and data, sometimes recruited by outsiders, often motivated by greed or revenge.

Unit 2

A security principle: data are accurate and trustworthy. Without it: data manipulation.

Unit 2

A protocol for short test and error messages between devices, used by ping; it has no port numbers.

NetworkingUnit 3

Everyday and industrial devices with embedded computers that connect to networks, from thermostats to water plant pumps.

Unit 4

A social engineering tactic where the adversary threatens negative consequences if the target does not comply.

Unit 1Unit 2

A numerical identifier assigned to a device's connection by the network it joins, made of a network portion and a host portion.

NetworkingUnit 3

Broadcasting radio noise so wireless devices cannot communicate: an attack on availability.

NetworkingUnit 1Unit 3

Two binary keys of equal length, generated together, that are mathematical inverses: what one encrypts, only the other decrypts.

Unit 5

A device or program that records every key a user types, which can capture passwords and messages.

Unit 2Unit 4

The number of possible keys an encryption algorithm can use; an n-bit key has a keyspace of 2^n.

Unit 5

A generative AI model trained on huge text data sets that writes human-like text, and can leak or repeat what it learned.

Unit 1

Using access to one compromised device to compromise other devices on the same local area network (LAN).

Unit 2Unit 3

The two factors of a risk assessment: how probable an attack is, and how bad the damage would be.

Unit 2

A network that covers one building or site and is controlled by one organization or household.

NetworkingUnit 3

Malware that triggers its effect only when set conditions are met, such as a date or a system version.

Unit 4

Low-skilled adversaries use malicious tools made by others against known vulnerabilities; high-skilled adversaries build or adapt tools and find zero days.

Unit 1

A 48-bit identifier of a network interface card, written in hexadecimal and used to deliver frames on one local link.

NetworkingUnit 3

Allowing only devices with approved media access control (MAC) addresses to join a network or use a switch port.

Unit 3

Sending a switch many frames with different fake media access control (MAC) addresses so its table fills and it broadcasts frames out of every port.

NetworkingUnit 3

Making a device send a media access control (MAC) address other than its own.

NetworkingUnit 3

Software designed to harm a device or its user, such as by stealing data, spying or giving an adversary control.

Unit 1Unit 2Unit 4

A security control type made of rules, guidelines, policies and procedures, such as password policies, access reviews and incident response plans.

Unit 2Unit 3

An access control model with strict rules for what each subject level may do to objects above, at or below its level; an external administrator assigns levels.

Unit 5

A risk strategy: add security controls to reduce the likelihood or impact of a risk.

Unit 2

A detective control that alerts security to movement, best placed where traffic is unexpected and paired with cameras.

Unit 2

A login that requires extra proof of identity, such as a one-time code, in addition to a password.

Unit 1Unit 4

A socket in a wall that is cabled to a switch port; plugging a device into it connects that device to the local area network (LAN).

NetworkingUnit 3

An automated tool that analyzes network data to determine if malicious activity is happening and generates an alert.

Unit 2Unit 3

An automated tool that detects malicious network activity like an IDS and can also halt it by closing ports, blocking addresses or rejecting protocols.

Unit 2Unit 3

Dividing a network into smaller, isolated segments or subnets so attacks are contained and each segment can have its own security level.

Unit 3

A firewall with stateless and stateful filtering plus advanced features such as intrusion prevention, deep packet inspection and filtering by application type.

Unit 3

Cracking a captured user:password hash database on the adversary's own computer; it bypasses lockout and cannot be detected.

Unit 4

An attack in which the adversary secretly sits between two parties, capturing and possibly altering the data they exchange.

NetworkingUnit 3

A code that works for a single login or a short time, often sent by text or an authenticator app as a second factor.

Unit 1

An attack where an adversary tries to log in to a device or service using common passwords, common patterns or stolen passwords.

Unit 1Unit 4

Freely available information, such as social media, websites and public records, used during reconnaissance.

Unit 2

A command line tool for encrypting and decrypting with symmetric (openssl enc) and asymmetric (openssl genrsa, pkeyutl) algorithms.

Unit 5

A small unit of data sent across a network, made of headers (addresses and control information) and a payload (the data).

NetworkingUnit 3

A long password made of several words, easier to remember than random characters and hard to guess when the words are unrelated.

Unit 1

A list of likely passwords built from personal information about a target, submitted by an automated tool.

Unit 1

A tool that generates and stores long, random, unique passwords so each account can have its own.

Unit 1

A managerial control setting password requirements: length, age, reuse, construction rules and password managers.

Unit 4

An online attack that tries one common password against many different accounts.

Unit 4

A small software update from a vendor that fixes a known vulnerability.

Unit 4

Data collected to process card payments: name, account number, expiration date, address and card verification value (CVV) code.

Unit 5

The attack phase where adversaries keep access without breaking in again, often with command and control through a RAT or rootkit.

Unit 2

Any data that allow someone to be identified, such as name, signature, phone number, address, biometric data, social security number, date of birth or email address.

Unit 5

A social engineering message, usually an email or text, that pretends to be trustworthy to get the target to reveal information, click a link or open a file.

Unit 1Unit 2

A security control type for the physical space, such as locks, fences, cameras, bollards and guards.

Unit 2

A physical attack where the adversary uses social engineering to get an authorized person to let them into a restricted area.

Unit 2

The readable information that goes into an encryption algorithm.

Unit 5

A switch feature that limits how many media access control (MAC) addresses can be assigned to a single switch port.

Unit 3

A social engineering tactic where the adversary creates a believable reason to contact the target.

Unit 2

A security control function that stops an attack before it happens, such as locks and encryption.

Unit 2

The idea that entities should get exactly as much access as they need to perform their function, and no more.

Unit 5

The key in a pair that the owner stores securely and uses to decrypt; if compromised, the key pair must be deleted and replaced.

Unit 5

Any data about an individual's health, treatment or payment for healthcare, such as test results, hospital records and doctor visit notes.

Unit 5

The key in a pair that is published for anyone to use; senders encrypt with the receiver's public key.

Unit 5

Two kinds of risk result: quantitative gives a number or money value; qualitative gives a descriptive label.

Unit 2

A precomputed table of potential passwords and their hashes, sorted by hash, searched for a captured hash.

Unit 4

Malware that encrypts a device's files and demands payment for a decryption key within a deadline.

Unit 4

The first phase of a cyberattack, gathering as much information about a target as possible, often from open source intelligence.

Unit 1Unit 2

Malware that keeps an adversary's access to a device; a RAT gives remote control, a rootkit hides deep in the system.

Unit 2Unit 4

The risk that remains after an organization has avoided, transferred and mitigated what it can; the level it chooses to accept.

Unit 2

The chance that a threat exploits a vulnerability to compromise an asset, assessed by likelihood and severity.

Unit 2

An unauthorized wireless access point connected to an organization's network, often through an open data port.

NetworkingUnit 3

An access control model that assigns every subject to a role and defines which roles have which access to which objects.

Unit 5

Sophisticated malware that gets into a computer's operating system, controls nearly every part of it, and can hide itself from detection.

Unit 2Unit 4

A device that joins networks and forwards packets between them by reading internet protocol (IP) addresses.

NetworkingUnit 3

A managerial control that sets the minimum configuration standard for routers, such as banning local accounts, disabling unnecessary services and requiring a firewall.

Unit 3

A common asymmetric encryption algorithm, also used in digital signatures and digital certificates.

Unit 5

An access control model that checks a set of rules to allow or deny access, usually layered on top of another model.

Unit 5

A unique random value hashed with each user's password so identical passwords produce different hashes.

Unit 4

A social engineering tactic that creates a sense of limited availability: limited supply, not limited time.

Unit 2

A network segment, created with firewall zones and rules, between the internet and the internal network that holds public-facing resources; a lower security zone.

Unit 3

A low-skilled adversary who uses tools developed by others without understanding how they work, often for money or recognition.

Unit 2

The idea that security features of software and devices are enabled by default, so products are secure out of the box.

Unit 5

An initiative to include security in all phases of product development, including design; companies own customer security outcomes, are radically transparent and build security-first leadership.

Unit 5

Training that teaches employees to detect social engineering, avoid badging others in and prevent device theft.

Unit 2

A safeguard that protects confidentiality, integrity or availability, classified by type (physical, technical, managerial) and function (preventative, detective, corrective).

Unit 2

A system that collects and analyzes data from many sources to detect attack patterns and alert analysts, who resolve or escalate the alert.

Unit 2Unit 3

The name of a wireless network, announced in beacon frames.

NetworkingUnit 1Unit 3

A word or phrase known only to two people, used to verify each other's identity in high-stakes situations.

Unit 1

A physical attack where the adversary watches, or records with a camera, someone accessing sensitive information to use it later.

Unit 2

An indicator in malware that makes it detectable; anti-malware and signature-based tools match against databases of them.

Unit 3Unit 4

Detection that compares data to a database of known indicators of compromise; fast, almost no false positives, but cannot detect new attacks.

Unit 3

A denial-of-service attack: internet control message protocol (ICMP) requests sent to a broadcast address with the victim's address forged as the source, so all replies flood the victim.

NetworkingUnit 3

An attack that uses psychological tactics to manipulate people into revealing sensitive information, downloading a malicious file or clicking a malicious link.

Unit 1Unit 2

A managerial control stating what software users may install, with an approved list and a request process.

Unit 4

A virtual private network (VPN) setup where some traffic goes through the VPN and some goes directly to the internet at the same time; VPN policies often prohibit it.

Unit 3

Malware that tracks a user's actions and sends the information back to an adversary.

Unit 4

An attack that places structured query language (SQL) commands and control characters into an input field, so the application returns too much data or changes and deletes data.

Unit 5

A firewall that tracks the state of connections passing through it and filters by connection-related rules as well as header information.

Unit 3

A firewall that filters each packet using header information such as internet protocol (IP) addresses, ports and protocols.

Unit 3

Encryption that handles input continuously, producing output one element at a time.

Unit 5

Creating separate subnets based on internet protocol (IP) addressing so a compromised device exposes fewer others.

Unit 3

A device that joins hosts within a local area network (LAN) and forwards each frame only to the port where the destination media access control (MAC) address was seen.

NetworkingUnit 3

Encryption that uses the same key to encrypt and decrypt information.

Unit 5

A physical attack where the adversary follows close behind an authorized person into a restricted area without that person noticing.

Unit 2

A security control type for the digital space, such as firewalls, anti-malware software and encryption.

Unit 2

Anything that could exploit a vulnerability to cause harm, including human adversaries and natural disasters.

Unit 2

A risk strategy: move the burden of the risk to another entity, such as an insurer, a government or consumers.

Unit 2

An adversary group that seeks money, mainly through ransomware and stealing intellectual property to sell.

Unit 2

Locating a signal's source by measuring its strength from several positions.

NetworkingUnit 3

Malware hidden inside software that seems harmless; a remote access trojan (RAT) gives remote access.

Unit 4

A battery backup that keeps a device running during a power outage; generators provide power at larger scale.

Unit 2

A social engineering tactic where the adversary creates a reason or deadline for the target to act quickly.

Unit 1Unit 2

A logical network created on switches that separates devices physically connected to the same central switches.

Unit 3

A service that encrypts all your traffic to the VPN operator's system, hiding it from the local network and service provider but not from the VPN provider.

Unit 1

Malware that activates only when a user runs or opens a file.

Unit 4

A weakness or flaw that could allow an asset to be compromised.

Unit 2

An automated tool that checks networks, devices and applications for known vulnerabilities and reports what it finds.

Unit 3

Detecting a target's wireless network beacons while driving or walking around it, to learn the network type and where the signal leaks outside.

Unit 1

A managerial control setting when web applications are assessed, how assessments are done, and timelines for fixing vulnerabilities by risk level.

Unit 5

A device that connects wireless devices to a wired local area network (LAN) by radio and announces the network in beacon frames.

NetworkingUnit 3

A policy that sets the measures for protecting a physical workplace, such as locking devices, clearing sensitive papers, privacy screens and power protection.

Unit 2

Malware that spreads from one computer to another without human interaction.

Unit 4

Wi-Fi Protected Access 3, currently the strongest wireless encryption protocol; Wired Equivalent Privacy (WEP), Wi-Fi Protected Setup (WPS) and the original Wi-Fi Protected Access (WPA) have known vulnerabilities.

Unit 3

An undocumented vulnerability that defenders do not know about yet, discovered and used by high-skilled adversaries.

Unit 1