CyberOps Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality prevents unauthorized disclosure through encryption and access control; integrity proves data is unaltered via hashing and signatures; availability guarantees authorized access through redundancy, backups, and failover.

Risk calculation

Qualitative risk equals threat multiplied by vulnerability multiplied by impact. Risk is reduced by eliminating vulnerabilities or adding controls, and is treated by mitigating, transferring, avoiding, or accepting it.

Defense in depth

Layering multiple independent controls across network, host, application, data, and physical layers so that the failure or bypass of any single control does not expose the entire environment.

Zero-day vulnerability

A software flaw that has no vendor patch and no public signature when exploited. Signature-based antivirus and IDS usually cannot detect zero-day exploits reliably, so behavior-based monitoring is needed.

Asymmetric encryption

Uses a mathematically related key pair: the public key encrypts or verifies, while the private key decrypts or signs. It is slower than symmetric encryption, so it protects key exchange and digital signatures.

Hashing

A one-way function such as SHA-256 that reduces data of any size to a fixed-length digest. Any change to the input changes the digest, so hashes prove integrity but provide no confidentiality.

Multifactor authentication

Authentication using two or more different factor categories: something you know, something you have, or something you are. Two passwords are not multifactor because both fall in the same category.

SIEM

Security Information and Event Management platform that collects and normalizes logs from many sources, correlates events against detection rules, and produces prioritized alerts for security analysts to triage.

NetFlow

A flow-telemetry standard, with IPFIX as the IETF equivalent, that records session metadata such as the five-tuple, byte and packet counts, and timestamps without capturing any payload content.

Syslog

A logging protocol that forwards event messages to a collector. Traditional syslog uses UDP port 514, while syslog over TLS uses TCP port 6514 for encrypted and reliable delivery.

Event correlation

The process of linking multiple log events from different devices and different times to reveal a single incident that no individual event, viewed in isolation, would have exposed.

Baseline

A documented profile of normal behavior such as traffic volumes, protocol mix, and login times. Deviation from the baseline is an anomaly requiring investigation, but it is not automatically malicious.

False positive and false negative

A false positive is a benign event incorrectly flagged as an attack; a false negative is a real attack that was not detected. False negatives carry the greater risk to the organization.

Acceptable use policy

A document defining what employees may and may not do with organizational systems and data, including privacy expectations, prohibited activities, and the consequences of policy violations.

Policy vs standard vs procedure

A policy states mandatory management intent; a standard specifies required technical or process criteria; a procedure gives step-by-step instructions for performing a task. Guidelines are recommended but non-binding.

Data classification

Assigning data to tiers such as public, internal, confidential, and restricted so that handling, storage, transmission, encryption, and retention requirements match the data's sensitivity and value.

Separation of duties

Splitting a sensitive task among multiple people so no single individual can complete a fraudulent or damaging action alone. It is often combined with job rotation and least privilege.

Due care

Due care is the action an organization takes to protect its assets, such as implementing security controls. Due diligence is the ongoing verification that those controls actually work as intended.

PCI DSS

Payment Card Industry Data Security Standard, a contractual standard applying to any organization that stores, processes, or transmits cardholder data. Non-compliance can end the ability to accept card payments.

NIST incident response phases

NIST SP 800-61 defines four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. The phases are iterative and may overlap during a live incident.

Order of volatility

RFC 3227 guidance to collect the most perishable evidence first: CPU registers and cache, then memory, network state and ARP cache, running processes, disk storage, and finally backups and archives.

Chain of custody

A documented record of who collected, handled, and accessed evidence, when, and for what purpose. An unbroken record is required for the evidence to be credible in legal proceedings.

Containment

Limiting the scope and spread of an incident. Options include isolating a host by disabling its switch port, blocking traffic at a firewall, sinkholing DNS, or segmenting the affected network.

Post-incident activity

The final NIST phase covering the lessons-learned review, the written incident report, and control improvements. Effectiveness is measured with metrics such as mean time to detect and mean time to respond.

CSIRT

Computer Security Incident Response Team: the group that receives, triages, investigates, and coordinates response to incidents. Typical roles include handler, team lead, communications, legal, and management liaison.

TCP three-way handshake

Connection setup is SYN, then SYN-ACK, then ACK, with both sides agreeing on initial sequence numbers. Missing or incomplete handshakes in a capture suggest scanning, spoofing, or filtered paths.

SYN scan

A half-open port scan that sends SYN packets and never completes the handshake. Many SYNs to sequential ports from one source, answered with RST-ACK, is the classic signature.

Five-tuple

Source IP, source port, destination IP, destination port, and transport protocol. It uniquely identifies a single flow and is the key used by firewalls, NetFlow records, and session tables.

ARP spoofing

Sending forged ARP replies so victims map the gateway IP address to the attacker's MAC address, enabling man-in-the-middle interception. Detected by duplicate IP-to-MAC mappings or unsolicited gratuitous ARP.

DNS tunneling

Encoding data inside DNS queries and responses to bypass network controls. Indicators include many TXT or NULL queries to one domain, unusually long labels, and a high volume of NXDOMAIN replies.

Beaconing

Regular, repeating outbound connections from an internal host to the same external address, often at fixed intervals with small consistent payloads, which strongly indicates command-and-control malware activity.

Wireshark display filter

An analysis expression such as ip.addr==10.1.1.5 && tcp.port==443 applied to packets already captured. It differs from a BPF capture filter like host 10.1.1.5, which discards packets at capture time.