Cisco 300-220 CBRTHD key terms

The three core goals of information security: confidentiality keeps data from unauthorized readers, integrity keeps it unaltered and trustworthy, and availability keeps it accessible to authorized users when needed.

The likelihood that a threat will exploit a vulnerability and cause harm, usually weighed against the business impact of that harm. Security decisions compare risk against cost of controls.

A weakness in software, configuration, or process that an attacker could use to violate security policy. Vulnerabilities are identified by scanning, advisories, and penetration testing, then remediated or mitigated.

Code or a technique that takes advantage of a specific vulnerability to achieve an attacker's goal, such as remote code execution. Exploits are often packaged in kits and frameworks.

A person or group with the intent and capability to attack a system, ranging from opportunistic criminals to state-sponsored groups. Actor type guides detection priorities and response urgency.

Layering independent controls across network, host, application, and identity so that one failure does not expose everything. Detection at multiple layers also gives analysts corroborating evidence.

A model that treats no network location as inherently trusted, verifying identity and device posture for every request. It replaces perimeter-only assumptions with continuous authentication and least privilege.

Granting users, services, and processes only the permissions needed for their function. It limits blast radius when credentials are stolen and makes anomalous privilege use easier to spot.

The sum of points where an attacker can interact with a system: exposed services, open ports, user input fields, APIs, endpoints, and identities. Reducing it lowers exposure.

Dividing a network into zones with controlled traffic between them, enforced by firewalls or ACLs. It constrains lateral movement and makes east-west traffic visible for monitoring.

A standardized 0-10 severity rating for a vulnerability based on exploitability and impact metrics. Scores help prioritize patching, but context such as exposure and asset value still matters.

The process of tracking, testing, and deploying software updates that fix known flaws. Unpatched systems are a leading initial-access path, so patch status is a frequent investigation question.

A platform that collects logs from many sources, normalizes them, correlates events, and triggers alerts. Analysts use it for search, dashboards, and case investigation across the estate.

Parsing raw log formats into a common schema so fields such as source IP, user, and action can be compared across vendors. Without it, correlation and search across sources break down.

Logic in a monitoring platform that links multiple events or conditions within a time window to raise a higher-confidence alert. Tuning these rules controls false positive volume.

The first-pass review of an alert to decide whether it is benign, a true positive, or needs escalation. Triage uses context such as asset criticality, user history, and related events.

An alert that fires when no malicious activity actually occurred. High false positive rates cause alert fatigue, so rules are tuned and enriched with context.

A recorded picture of normal behavior for a host, user, or network segment, used as a comparison point. Deviations from baseline are what make anomalies meaningful during analysis.

Spotting activity that differs from established normal patterns, such as unusual login times or data volumes. It can catch unknown threats but needs baselines to avoid noise.

A standard protocol and message format for sending log events from devices to a central collector, typically over UDP 514 or TCP 514/6514 with TLS. Severity and facility codes are part of the format.

A summary record of network conversations that captures metadata such as source and destination IP, ports, protocol, byte counts, and timestamps, without full packet content. Useful for traffic profiling and exfiltration spotting.

Storing complete packet payloads for later analysis, giving definitive evidence of what was sent. It is storage-intensive, so retention is usually short and targeted.

Proactive, hypothesis-driven searching through telemetry for attacker activity that existing alerts missed. Findings feed new detections and tuning back into monitoring.

An observable artifact suggesting intrusion, such as a malicious hash, domain, IP, or registry key. IOCs are easy to share but decay quickly as attackers change infrastructure.

The behavioral patterns of an adversary: their goals, how they achieve them, and their specific operational habits. TTPs are more durable detection targets than static indicators.

A public knowledge base of adversary tactics and techniques organized by phase of attack, used to map detections and find coverage gaps. It is descriptive, not a scanning or blocking tool.

A phased model of an intrusion, from reconnaissance through exploitation, installation, command and control, and actions on objective. It helps analysts place an event in the attack timeline.

Software on an endpoint that watches processes, files, and system calls for malicious or policy-violating behavior. It provides deep local visibility that network sensors cannot see.

An agent-based platform that continuously records endpoint telemetry such as process trees, network connections, and file writes, and supports query and containment. It is central to modern host investigations.

A Microsoft Sysmon driver and service that logs detailed Windows events such as process creation with parent and command line, network connections, and image loads to the event log. Widely forwarded to SIEMs.

The native Windows logging system with channels such as Security, System, and Application. Security events include logons (4624), failed logons (4625), and process creation (4688).

The hierarchy of a process and its parent and children, showing what launched what. Unusual parents, such as a word processor spawning a shell, are strong host compromise signals.

A relationship where a process is started by an unexpected parent, indicating injection or abuse. Examples include Office applications spawning PowerShell or services launching cmd.exe.

Using legitimate built-in tools such as PowerShell, WMI, certutil, or rundll32 to perform attacker actions, blending in with normal administration. Detection relies on command-line context, not file signatures.

Malicious activity that runs in memory or abuses trusted system components rather than dropping an executable on disk. It defeats hash-based detection and requires behavioral telemetry.

Windows features that record PowerShell commands and script blocks, including module logging, script block logging, and transcription. They expose obfuscated or encoded malicious commands.

Tracking changes to critical files and directories by comparing hashes or attributes against a known-good state. Unexpected changes to system binaries suggest tampering or persistence.

Any mechanism an attacker uses to keep access after reboot or credential change, such as scheduled tasks, services, run keys, or startup scripts. Investigators enumerate these during host analysis.

Gaining higher permissions than granted, by exploiting a flaw or abusing misconfiguration. On hosts it often appears as a low-privileged process obtaining administrator or SYSTEM rights.

Moving from one compromised host to others, often via remote services, stolen credentials, or administrative shares. It shows up as unusual east-west authentication and SMB traffic.

Probing a range of TCP or UDP ports to learn which services are listening. Scans produce many short connection attempts from one source and often precede exploitation.

The pre-attack phase of gathering information about targets, such as host discovery, DNS enumeration, and banner grabbing. Early detection here can preempt later stages.

Intrusion detection systems passively inspect traffic and alert on suspicious patterns; intrusion prevention systems sit inline and can block. Signature and anomaly modes are both used.

A pattern, such as byte sequences or protocol anomalies, used by detection tools to identify known malicious traffic. Signatures are fast but blind to novel or heavily obfuscated attacks.

Regular, periodic outbound connections from an infected host to attacker infrastructure, typical of command-and-control channels. Consistent intervals and small repeated payloads are telltale signs.

The channel attackers use to issue instructions to compromised hosts and receive results. It may use HTTP, DNS, or custom protocols, often disguised as normal traffic.

Unauthorized transfer of data out of an environment, over the network or removable media. Clues include large or unusual uploads, off-hours transfers, and DNS tunneling.

Encoding data inside DNS queries and responses to bypass controls or establish covert channels. Long, high-entropy subdomains and unusual query volume are key indicators.

Authenticating with a captured password hash instead of the plaintext, exploiting protocols that accept hash-based credentials. It appears as successful logons with unusual source hosts.

A Windows field describing how a logon occurred, such as interactive at the console, network over SMB, or remote desktop. Type 3 and type 10 events are common in lateral movement analysis.

Examining captured packets to reconstruct sessions, extract files, and confirm exactly what happened on the wire. It provides ground truth that flow records cannot.

The structured process of preparing for, detecting, containing, eradicating, recovering from, and learning from a security incident. Clear roles and evidence handling are essential.

Documented, unbroken record of who handled evidence, when, and how, from collection through storage and analysis. Gaps can make evidence inadmissible or unusable.

Creating a bit-for-bit copy of a disk or memory for analysis while preserving the original. Working from a verified copy protects evidence integrity.

Information that disappears on shutdown, such as running processes, network connections, and memory contents. It must be collected first during live response.

A documented, repeatable procedure for handling a specific incident type, with steps, owners, and escalation paths. It reduces decision time and inconsistency under pressure.

Detailed operational instructions for executing a technical task, such as isolating a host or resetting credentials. Runbooks complement higher-level playbooks with exact commands and checks.

Rules defining how employees may use organizational systems and data, including prohibitions and monitoring notice. It sets expectations that support enforcement and investigations.

Labeling information by sensitivity, such as public, internal, confidential, and restricted, so handling and protection requirements are clear. Labels drive access and monitoring controls.

Software designed to harm or gain unauthorized access, including viruses, worms, trojans, ransomware, and spyware. Analysis focuses on behavior, persistence, and network communications.