# Reference: cybersecurity terms Cybersecurity terms, principles, and history [https://cybersecurityguide.org/resources/cybersecurity-101/](https://cybersecurityguide.org/resources/cybersecurity-101/) Basic terminology - To understand the vast world of cybersecurity or any technical field for that matter, the learner must master the words and phrases unique to that specialty. - These terms and expressions will often have a related, but not entirely accurate meaning in general non-technical use. - Without a clear understanding of how security professionals use certain words and phrases, learning about this specialty can be very confusing. - Many words routinely used in security have such obscure origins that it is difficult to use them correctly without an understanding of their history. As an example, the term pwn, or pwned, is commonly used by hackers. To understand how threat actors use pwn, it is helpful to know that this word likely comes from a common mistyping of “own” as a result of the proximity of the letter P to the letter O on a keyboard. So if a hacker claims to have pwned a person or organization, they are laying claim to owning or conquering them. The following definitions explain some of the terms, abbreviations, and acronyms commonly used in the security field. - Attack surface:  The attack surface of a software-based system is the sum of the different locations (logical or physical) where a threat actor can try to enter or extract data. Reducing the attack surface as small as possible is a primary security measure.
How does this compare to our analogy of a burglar invading a house?
- AV:  Antivirus is a type of security software that scans for, detects, blocks, and eliminates malware. AV programs will run in the background, scanning for known malware signatures and behavior patterns that may indicate the presence of malware.
How is AI changing this?
- Brute-force attack:  A brute-force attack is an attempt to decipher a username-password combination by trial and error. It is performed with software designed to try large samples of known username-password combinations. This method is an old attack method, but it’s still useful and popular with hackers.
How does this relate to our password lab? What are the 3 main mistakes people make about their passwords?
- Cryptoworm:   A form of malware that spreads like a worm and encrypts victims’ data.
How is this different from a spearphishing attack?
- Data breach:  A data breach refers to a security event where unauthorized users steal sensitive information from an organization’s IT systems. Often, stolen data is personally identifiable information (PII) or financial information, both of which are valuable on the dark web.
Refer to the three L's: which of these is relevant?
- EDR:  Endpoint detection and response is a type of security tool that focuses on detecting and mitigating suspicious activity on devices and hosts. The value of EDR is the ability to detect advanced threats that may not have a recorded behavioral pattern or malware signature.
Look this up: compare centralized EDR to local EDR
- Firewall:  A firewall is a network security system that monitors and controls the network traffic based on specific security rules. A firewall usually establishes a barrier between a trusted internal network and an untrusted external network, such as the Internet.
Compare your local firewall to the one you created with the routers-what is similar or different?
- Honeypot:  A honeypot is a piece of software code designed to detect, deflect, and counteract attempts at unauthorized use of information systems. A honeypot consists of data appearing to be a legitimate part of the site but is isolated and monitored. The data seems to contain information, or a resource of value, to attackers, who are then blocked.
Look up "The cuckoo's egg" and explain how that worked
- IPS:  An intrusion prevention system (IPS) is a form of network security that works to detect and prevent identified threats. Intrusion prevention systems continuously monitor a network, looking for possible malicious incidents, then capturing and reporting information about them.
Do we have one of these at HPA? At the elab?
- Malware:  Malware is malicious software that propagates via an email attachment or a link to a malicious website. It infects the endpoints when a user opens the attachment or clicks on the link.
Compare static malware to dynamic malware
- NIST:  The [National Institute of Standards and Technology (NIST)](https://cybersecurityguide.org/resources/nist-small-business-community/) is a non-regulatory entity under the umbrella of the United States Department of Commerce. NIST Publication Series 800 provides a comprehensive listing of information security measures and controls based on extensive research.
NIST also provides time synchronized sites for SSL-why would your computer not be able to access websites if the clock is wrong?
- Phishing/Spearphishing:  A malicious email that tricks users into surrendering their user credentials. The email may appear legitimate as if coming from a bank and ask the user to reset their password. Phishing attacks take advantage of mass email programs. In a spearphishing attack, an individually crafted email targets a specific key executive or decision-maker.
Who is most likely to be vulnerable to these, and how can we protect organizations? Give an example at HPA.
- Ransomware:  Ransomware is a class of malicious software that prevents the end-user from accessing a system or data. The most common form is crypto-ransomware. This type of ransomware makes data or files unreadable through encryption and requires a decryption key to restore access. Another form, locker ransomware, locks access rather than encrypting data. Attackers typically request a payment, often in the form of bitcoins, to decrypt files or restore access.
Again, come back to the three L's: who is most likely to be a victim and why?
- Ransomware attack:  During a ransomware campaign, hackers often use phishing and social engineering to get a computer user to click on an attachment or a link to a malicious website. Some types of ransomware attacks, however, don’t require user action because they exploit site or computer vulnerabilities to deliver the payload. Once a system is infected, the attacker will launch an on-screen notification with the ransom demand.
Why are autonomous attacks (no user action needed) harder to prevent?
- Risk management framework:  A Risk Management Framework provides a disciplined and structured process that integrates information security and risk management tasks into the system development life cycle. Essential components of an RMF include identification, measurement and assessment, mitigation, reporting and monitoring, and governance.
Why would companies NOT report attacks?
- Security misconfigurations:  Security misconfigurations result from the improper implementation of security controls on devices, networks, cloud applications, firewalls, and other systems. They can lead to data breaches, unauthorized access, and other security incidents. Misconfigurations can include anything from default admin credentials, open ports, and unpatched software, to unused web pages and unprotected files.
Where have you seen this with the routers you setup?
- SOC:  A security operations center (SOC) is a central location where cybersecurity personnel carry out threat detection and incident response processes. They employ security technologies that make up an organization’s security operations.
You are running a small office-can you afford to have an SOC? What are your options?
- SQL injection: An SQL injection is a technique that inserts structured query language (SQL) code into a web application database. Web applications use SQL to communicate with their databases. Attackers can use SQL injections to perform actions such as retrieving or manipulating database data, spoofing user identity, and executing remote commands.
Make a diagram of a website: "front end", "back end", data stream, and explain how an SQL injection attack works
- Tor: Tor is free and open-source software used to enable anonymous communication. Its name is derived from an acronym for the original software project name, “The Onion Router” and is sometimes referred to as such. Tor directs Internet traffic through a free, worldwide, overlay network consisting of more than seven thousand relays. It conceals a user’s location and usage from anyone conducting network surveillance or traffic analysis.
How is TOR different from a VPN?
- VA:  Vulnerability assessment is the process of identifying, classifying, and prioritizing vulnerabilities in digital business systems. Assessments can focus on internal, external, or host-based vulnerabilities.
Could you make money doing one of these for a company or office?
•VM:  Vulnerability management solutions identify, track, and prioritize internal and external cybersecurity vulnerabilities. They optimize cyberattack prevention activities such as patching, upgrades, and configuration fixes. Who does this at HPA? At your house?
--- Migrated from Apple Server Wiki. Original page ID: 31h2v00