CyberOps Associate key terms

A model that describes information security through three goals: confidentiality, keeping data from unauthorized readers; integrity, keeping data complete and unaltered; and availability, keeping systems usable when legitimate users need them.

A person or group capable of causing harm to systems or data, such as opportunistic criminals, malicious insiders, hacktivists, or state-sponsored groups, each with different motives, skills, and resources.

A weakness in software, configuration, hardware, or process that could be used to break security. It is separate from the threat, which is whoever or whatever might take advantage of it.

Code, a command sequence, or a technique that abuses a specific vulnerability to gain access, run code, escalate privileges, or disrupt a target system.

The chance and impact of harm when a threat takes advantage of a vulnerability in an asset; combining likelihood with business consequence helps prioritize which controls matter most.

Giving users, services, and processes only the access they need for their assigned tasks, and only while needed, to limit damage from mistakes or stolen credentials.

A public catalog of adversary tactics and techniques observed in real attacks, organized by attacker goal and used to describe intrusions, build detections, and test defensive coverage.

A stage model of an intrusion-reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives-that shows where defenders can interrupt an attack.

Security information and event management: a platform that collects and normalizes logs from many sources, correlates events, and raises alerts so analysts can detect and investigate suspicious activity.

A summary record of a network conversation-source and destination addresses and ports, protocol, byte and packet counts, timestamps-that lets analysts profile traffic without storing full payloads.

An intrusion detection system passively inspects network or host activity, matches it against signatures or baselines, and alerts on suspicious patterns without blocking the traffic itself.

An intrusion prevention system sits inline with traffic and can drop or reset malicious sessions; it blocks attacks actively but risks disruption if a rule fires incorrectly.

Host-based intrusion detection watches one endpoint's files, processes, logs, and configuration for signs of compromise, giving visibility into activity that network sensors cannot see.

Endpoint detection and response software records process, file, and network telemetry on hosts, supports threat hunting, and can isolate or remediate a machine that appears compromised.

An alert triggered by legitimate activity rather than an attack; frequent false positives waste analyst time and can train staff to ignore real detections, so rules need tuning.

A recorded picture of normal behavior-typical hosts, ports, traffic volumes, or processes-that analysts compare against current activity to spot meaningful deviations.

A management-approved statement of the security rules an organization requires, assigning responsibilities and setting direction that standards, procedures, and guidelines then carry out.

A mandatory, specific requirement that supports a policy, such as an approved encryption algorithm or minimum password length, leaving little room for individual interpretation.

Detailed step-by-step instructions for completing a task the same way every time, naming who acts, in what order, and with which tools.

Assigning labels such as public, internal, confidential, or restricted based on sensitivity and business value, so handling, storage, and sharing rules can be applied consistently.

Rules stating how employees may use company systems, networks, and data, including prohibitions and the organization's right to monitor activity; staff usually acknowledge it at onboarding.

A discussion-based drill in which stakeholders walk through a simulated incident against the response plan, exposing gaps in roles, communication, and decisions without touching production systems.

A document defining roles, phases, contacts, and communication paths that guide the organization from detecting an incident through containment, recovery, and later improvement.

A computer security incident response team: the designated group with the skills, authority, and contacts to triage, investigate, contain, and coordinate the response to security incidents.

The rule that evidence should be collected from most to least perishable-processor registers and memory before disk, then remote logs and archives-because volatile data disappears quickly.

An unbroken, documented record of who collected, handled, transferred, and stored evidence, and when, so it stays trustworthy for legal, HR, or audit purposes.

Short-term action that stops an incident from spreading-isolating hosts, blocking traffic, disabling accounts-while keeping enough evidence intact for the investigation.

Removing the cause of an incident: deleting malware, patching the exploited flaw, rebuilding compromised systems, and resetting affected credentials before normal operations resume.

A review after an incident that examines what happened, what worked, and what failed, producing tracked actions that improve detection, process, and controls.

A predefined, repeatable sequence of investigation and response steps for a specific incident type, such as phishing or ransomware, that shortens decisions under pressure.

Packet capture: a file holding recorded network packets, commonly in .pcap format, that analysts replay in tools to rebuild sessions and confirm what actually happened.

The five values-source IP, source port, destination IP, destination port, and protocol-that identify a network flow and are used in firewall, flow-record, and packet analysis.

Probing a host across many ports to discover which services are listening; a burst of connection attempts or SYN packets to closed ports often marks reconnaissance.

A denial-of-service technique that sends many TCP SYN packets without finishing the handshake, exhausting a server's connection table so real clients cannot connect.

Carrying data or command traffic inside DNS queries and responses to slip past filters; telltale signs include unusually long names or frequent queries to one domain.

Regular, automated outbound connections from an infected host to attacker infrastructure; the predictable timing and repeated destination reveal command-and-control activity.

The channel an attacker uses to send instructions to compromised hosts and receive results, often riding allowed protocols such as HTTPS or DNS to blend with normal traffic.

Moving from one compromised machine to others inside the network using stolen credentials or remote-access tools, seeking higher privileges and more valuable data.

Unauthorized removal of data from the network, which may appear as large uploads, transfers at odd hours, or data hidden inside permitted protocols.