CND key terms

A coordinated attack in which many compromised machines send traffic or service requests to one target so that its bandwidth, connection table, or processing capacity is exhausted and legitimate users can no longer be served.

An attack that sends forged Address Resolution Protocol replies tying an attacker's MAC address to another host's IP address, so traffic intended for the victim is silently redirected through the attacker on the local segment.

An attack that fills a switch's MAC address table with bogus source entries until the device can no longer map ports correctly and begins flooding frames out of every port for an attacker to capture.

An attack that inserts forged records into a resolver's cache so queries for a legitimate name return an attacker-controlled address, quietly sending users to malicious or impersonated sites.

An attack position in which an adversary sits between two communicating parties, relaying or altering their traffic while each side believes it is speaking directly to the other.

Layering multiple independent controls across network, host, application, and administrative layers so that if one safeguard fails or is bypassed, another still blocks or detects the intrusion.

Granting users, services, and processes only the access rights needed for their assigned work and nothing beyond that, which shrinks the damage an attacker can do with a stolen account.

A framework in which a subject's identity is verified, its permitted actions are checked against policy, and its activity is logged for audit, usually through a central server such as RADIUS or TACACS+.

A repeatable cycle of inventorying software, testing vendor updates, deploying them on a defined schedule, and verifying installation so known vulnerabilities are closed before attackers exploit them.

A segmented network hosting internet-facing services and separated from the internal LAN by firewalls, so a compromised public server cannot reach sensitive internal systems directly.

A firewall that records the state of active connections and permits return traffic only for sessions that were legitimately initiated, instead of judging every packet in isolation.

Sensors that match network traffic against signatures or behavioral baselines; an intrusion detection system only raises alerts, while an intrusion prevention system sits inline and can also drop or reset hostile traffic.

A deliberately exposed decoy system with no production role, used to attract attackers, consume their effort, and generate high-confidence alerts when someone probes or compromises it.

A control that authenticates devices and checks their health posture before admitting them to the network, quarantining unknown or non-compliant endpoints in a restricted remediation segment.

Agent software that continuously records endpoint process, file, and network behavior, applies analytics to spot malicious patterns, and lets responders isolate, query, or investigate a host remotely.

A control that permits only explicitly approved executables and scripts to run and blocks everything else, defeating many malware families that depend on unapproved binaries being launched.

A policy allowing staff to use personally owned laptops, tablets, and phones for work, requiring compensating controls such as containerization, compliance checks, and remote removal of corporate data.

Server software that enrolls and manages mobile devices, enforcing passcodes, encryption, app restrictions, and the ability to wipe business data while leaving personal content untouched.

An attack that slips crafted SQL fragments into input fields so the database treats them as code, letting an attacker read, change, or delete records the application never intended to expose.

An attack that plants malicious script in pages other users load, so the code executes in their browsers under the site's trust and can steal session cookies or act as the victim.

Labeling information by sensitivity, such as public, internal, confidential, or restricted, so that handling, storage, encryption, and retention rules can be applied consistently to each category.

A protocol that encrypts and integrity-protects data moving between client and server, and, when certificates are validated, also confirms the identity of the endpoint being contacted.

A protocol suite that encrypts and authenticates IP traffic between sites or remote users across an untrusted network, typically assembled from IKE for key exchange and ESP for protection.

An exploit in which code running inside a guest virtual machine breaks the hypervisor's isolation to reach the host or neighboring guests, turning one compromised workload into a platform-wide breach.

The split of security duties between a cloud provider and its customer: the provider protects the underlying infrastructure, while the customer protects its data, identities, configurations, and workloads.

An unauthorized wireless access point, whether installed by a careless employee or an attacker, that bypasses perimeter controls and can lure nearby clients onto a hostile network.

Centralized software that gathers logs and events from many sources, normalizes and correlates them against rules, and raises alerts, giving analysts one console for monitoring and investigation.

Summarized metadata about network conversations, including source, destination, ports, and byte counts, exported by routers and switches so analysts can spot anomalies without capturing full payloads.

A standard protocol and message format that lets devices and servers forward event records to a central collector, making logs from across the enterprise searchable and retainable.

Recording complete packet headers and payloads on a link in a standard capture file format, so analysts can replay and inspect exactly what crossed the wire during an event.

The repeatable phases used to handle security incidents, typically preparation, detection and analysis, containment, eradication, recovery, and lessons learned, giving responders a structured path from alert to closure.

Short-term actions that stop an incident from spreading or causing further damage, such as isolating a host, blocking an address, disabling an account, or segmenting part of the network.

Documented step-by-step procedures for a specific incident type, naming required roles, decision points, evidence steps, and escalation paths so responders act consistently under pressure.

A documented, unbroken record of who handled digital evidence, when, and for what purpose, from collection through storage and analysis, proving it has not been altered or substituted.

The rule that evidence should be collected from most fragile to most persistent, such as processor and memory contents before disk and backups, because volatile data vanishes when power is lost.

A bit-for-bit copy of a storage device or memory space, verified by cryptographic hash, which analysts examine instead of the original so the source evidence remains unmodified.

The maximum acceptable time a business process may stay unavailable after a disruption, setting the target for restoring systems and shaping which continuity strategies are worth funding.

The maximum tolerable data loss expressed as time, which determines how frequently backups or replication must run so that recovery does not lose more information than the business can accept.

A study that identifies critical business functions, their dependencies, and the operational and financial effect of their outage, producing the recovery targets that continuity plans are built around.

The process of inventorying assets and threats, estimating how likely each threat is to exploit a weakness and how severe the result would be, then ranking risks to prioritize spending on controls.