Acceptable use policy (AUP) - ANSWER A policy that governs employees' use of
company equipment and Internet services. Isps may also apply aups to their customers.
Access badge - ANSWER An authentication mechanism that allows a user to present a
smart card to operate an entry system.
Access control list (ACL) - ANSWER The collection of access control entries (aces) that
determines which subjects (user accounts, host IP addresses, and so on) are allowed or
denied access to the object and the privileges given (read-only, read/write, and so on).
Access control vestibule - ANSWER A secure entry system with two gateways, only one
of which is open at any one time.
Think Airlock
Access point (AP) - ANSWER A device that provides a connection between wireless
devices and can connect to wired networks, implementing an infrastructure mode WLAN.
Account lockout - ANSWER Policy that prevents access to an account under certain
conditions, such as an excessive number of failed authentication attempts.
Account policies - ANSWER A set of rules governing user security information, such as
password expiration and uniqueness, which can be set globally.
1
,Accounting - ANSWER Tracking authorized usage of a resource or use of rights by a
subject and alerting when unauthorized use is detected or attempted.
Acquisition/procurement - ANSWER Policies and processes that ensure asset and
service purchases and contracts are fully managed, secure, use authorized
suppliers/vendors, and meet business goals.
Active reconnaissance - ANSWER Penetration testing techniques that interact with
target systems directly.
Active security control - ANSWER Detective and preventive security controls that use
an agent or network configuration to monitor hosts. This allows for more accurate
credentialed scanning, but consumes some host resources and is detectable by threat
actors.
Ad hoc network - ANSWER A type of wireless network where connected devices
communicate directly with each other instead of over an established medium.
Address resolution protocol (ARP) - ANSWER Broadcast mechanism by which the
hardware MAC address of an interface is matched to an IP address on a local network
segment.
Advanced persistent threat (APT) - ANSWER An attacker's ability to obtain, maintain,
and diversify access to network systems using exploits and malware.
Adware - ANSWER Software that records information about a PC and its user. Adware
is used to describe software that the user has acknowledged can record information about
their habits.
AES Galois Counter Mode Protocol (GCMP) - ANSWER A high performance mode of
operation for symmetric encryption. Provides a special characteristic called authenticated
encryption with associated data, or AEAD.
2
,Air-gapped - ANSWER A type of network isolation that physically separates a host
from other hosts or a network from all other networks.
Alert tuning - ANSWER The process of adjusting detection and correlation rules to
reduce incidence of false positives and low-priority alerts.
Algorithm - ANSWER Operations that transform a plaintext into a ciphertext with
cryptographic properties, also called a cipher. There are symmetric, asymmetric, and hash
cipher types.
Allow listing - ANSWER A security configuration where access is denied to any entity
(software process, IP/domain, and so on) unless the entity appears on an allow list.
Amplification attack - ANSWER A network-based attack where the attacker
dramatically increases the bandwidth sent to a victim during a ddos attack by implementing
an amplification factor.
Analysis - ANSWER An incident response process in which indicators are assessed to
determine validity, impact, and category.
Annualized loss expectancy (ALE) - ANSWER The total cost of a risk to an organization
on an annual basis. This is determined by multiplying the SLE by the annual rate of
occurrence (ARO).
Annualized rate of occurrence (ARO) - ANSWER In risk calculation, an expression of
the probability/likelihood of a risk as the number of times per year a particular loss is
expected to occur.
Anomalous behavior recognition - ANSWER Systems that automatically detect users,
hosts, and services that deviate from what is expected, or systems and training that
encourage reporting of this by employees.
3
, Antivirus - ANSWER Inspecting traffic to locate and block viruses.
Antivirus scan (A-V) - ANSWER Software capable of detecting and removing virus
infections and (in most cases) other types of malware, such as worms, Trojans, rootkits,
adware, spyware, password crackers, network mappers, dos tools, and so on.
Anything as a service - ANSWER The concept that most types of IT requirements can
be deployed as a cloud service model.
Appliance firewall - ANSWER A standalone hardware device that performs only the
function of a firewall, which is embedded into the appliance's firmware.
Application programming interface - ANSWER Methods exposed by a script or
program that allow other scripts or programs to use it. For example, an API enables software
developers to access functions of the TCP/IP network stack under a particular operating
system.
Application virtualization - ANSWER A software delivery model where the code runs
on a server and is streamed to a client.
Arbitrary code execution - ANSWER A vulnerability that allows an attacker to run their
own code or a module that exploits such a vulnerability.
ARP Poisening - ANSWER A network-based attack where an attacker with access to the
target local network segment redirects an IP address to the MAC address of a computer that
is not the intended recipient. This can be used to perform a variety of attacks, including dos,
spoofing, and on-path (previously known as man-in-the-middle).
Artificial intelligence - ANSWER The science of creating machines with the ability to
develop problem-solving and analysis strategies without significant human direction or
intervention.
4
company equipment and Internet services. Isps may also apply aups to their customers.
Access badge - ANSWER An authentication mechanism that allows a user to present a
smart card to operate an entry system.
Access control list (ACL) - ANSWER The collection of access control entries (aces) that
determines which subjects (user accounts, host IP addresses, and so on) are allowed or
denied access to the object and the privileges given (read-only, read/write, and so on).
Access control vestibule - ANSWER A secure entry system with two gateways, only one
of which is open at any one time.
Think Airlock
Access point (AP) - ANSWER A device that provides a connection between wireless
devices and can connect to wired networks, implementing an infrastructure mode WLAN.
Account lockout - ANSWER Policy that prevents access to an account under certain
conditions, such as an excessive number of failed authentication attempts.
Account policies - ANSWER A set of rules governing user security information, such as
password expiration and uniqueness, which can be set globally.
1
,Accounting - ANSWER Tracking authorized usage of a resource or use of rights by a
subject and alerting when unauthorized use is detected or attempted.
Acquisition/procurement - ANSWER Policies and processes that ensure asset and
service purchases and contracts are fully managed, secure, use authorized
suppliers/vendors, and meet business goals.
Active reconnaissance - ANSWER Penetration testing techniques that interact with
target systems directly.
Active security control - ANSWER Detective and preventive security controls that use
an agent or network configuration to monitor hosts. This allows for more accurate
credentialed scanning, but consumes some host resources and is detectable by threat
actors.
Ad hoc network - ANSWER A type of wireless network where connected devices
communicate directly with each other instead of over an established medium.
Address resolution protocol (ARP) - ANSWER Broadcast mechanism by which the
hardware MAC address of an interface is matched to an IP address on a local network
segment.
Advanced persistent threat (APT) - ANSWER An attacker's ability to obtain, maintain,
and diversify access to network systems using exploits and malware.
Adware - ANSWER Software that records information about a PC and its user. Adware
is used to describe software that the user has acknowledged can record information about
their habits.
AES Galois Counter Mode Protocol (GCMP) - ANSWER A high performance mode of
operation for symmetric encryption. Provides a special characteristic called authenticated
encryption with associated data, or AEAD.
2
,Air-gapped - ANSWER A type of network isolation that physically separates a host
from other hosts or a network from all other networks.
Alert tuning - ANSWER The process of adjusting detection and correlation rules to
reduce incidence of false positives and low-priority alerts.
Algorithm - ANSWER Operations that transform a plaintext into a ciphertext with
cryptographic properties, also called a cipher. There are symmetric, asymmetric, and hash
cipher types.
Allow listing - ANSWER A security configuration where access is denied to any entity
(software process, IP/domain, and so on) unless the entity appears on an allow list.
Amplification attack - ANSWER A network-based attack where the attacker
dramatically increases the bandwidth sent to a victim during a ddos attack by implementing
an amplification factor.
Analysis - ANSWER An incident response process in which indicators are assessed to
determine validity, impact, and category.
Annualized loss expectancy (ALE) - ANSWER The total cost of a risk to an organization
on an annual basis. This is determined by multiplying the SLE by the annual rate of
occurrence (ARO).
Annualized rate of occurrence (ARO) - ANSWER In risk calculation, an expression of
the probability/likelihood of a risk as the number of times per year a particular loss is
expected to occur.
Anomalous behavior recognition - ANSWER Systems that automatically detect users,
hosts, and services that deviate from what is expected, or systems and training that
encourage reporting of this by employees.
3
, Antivirus - ANSWER Inspecting traffic to locate and block viruses.
Antivirus scan (A-V) - ANSWER Software capable of detecting and removing virus
infections and (in most cases) other types of malware, such as worms, Trojans, rootkits,
adware, spyware, password crackers, network mappers, dos tools, and so on.
Anything as a service - ANSWER The concept that most types of IT requirements can
be deployed as a cloud service model.
Appliance firewall - ANSWER A standalone hardware device that performs only the
function of a firewall, which is embedded into the appliance's firmware.
Application programming interface - ANSWER Methods exposed by a script or
program that allow other scripts or programs to use it. For example, an API enables software
developers to access functions of the TCP/IP network stack under a particular operating
system.
Application virtualization - ANSWER A software delivery model where the code runs
on a server and is streamed to a client.
Arbitrary code execution - ANSWER A vulnerability that allows an attacker to run their
own code or a module that exploits such a vulnerability.
ARP Poisening - ANSWER A network-based attack where an attacker with access to the
target local network segment redirects an IP address to the MAC address of a computer that
is not the intended recipient. This can be used to perform a variety of attacks, including dos,
spoofing, and on-path (previously known as man-in-the-middle).
Artificial intelligence - ANSWER The science of creating machines with the ability to
develop problem-solving and analysis strategies without significant human direction or
intervention.
4
