DSST Cybersecurity flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

Parameterized query

A SQL statement where user input is bound as data rather than concatenated into the query text, so the database cannot interpret input as SQL code. Primary defense against SQL injection.

Stored XSS

A cross-site scripting attack where the malicious script is persisted on the server, such as in a comment or profile field, and served to every user who views the affected page.

DOM-based XSS

Cross-site scripting in which the vulnerability exists entirely in client-side JavaScript: a source such as the URL fragment flows into a dangerous sink like innerHTML without server involvement.

CSRF synchronizer token

A random, unpredictable value embedded in forms and validated server-side on submission, proving the request originated from the legitimate application page rather than a forged cross-site request.

IDOR

Insecure Direct Object Reference: an application exposes an internal identifier and fails to verify that the requesting user is authorized for that object, allowing access to other users' records.

ASLR

Address Space Layout Randomization. Randomizes the memory locations of stack, heap, and libraries at load time, making it harder for an attacker to reliably jump to injected code.

Stack canary

A random value placed before the return address on the stack; if a buffer overflow overwrites it, the program detects the change and terminates before returning, blocking classic stack smashing.

SAST versus DAST

SAST analyzes source or bytecode without running the application and finds flaws early; DAST tests a running application from outside and finds runtime and configuration issues.

TOCTOU

Time-of-check to time-of-use: a race condition where a resource's state changes between the authorization check and its use, letting an attacker substitute or alter the target.

Multifactor authentication

Authentication requiring two or more factors from different categories: knowledge, possession, and inherence. Two passwords or two biometrics do not constitute MFA.

Password salt

A unique random value stored with each password hash and combined before hashing, so identical passwords produce different hashes and precomputed rainbow tables become ineffective.

Kerberos TGT

Ticket-granting ticket issued by the KDC after initial authentication. The client presents it to request service tickets without resending credentials, until the ticket expires.

OpenID Connect

An identity layer built on OAuth 2.0 that adds authentication: the provider issues a signed ID token (a JWT) containing claims about the authenticated user.

SAML assertion

A digitally signed XML statement from an identity provider to a service provider describing an authentication event or authorization attributes for a subject.

RBAC

Role-Based Access Control: permissions are assigned to roles, and users receive permissions by being placed in roles. Simplifies administration and supports least privilege and separation of duties.

MAC mandatory access control

Access decisions are made by the system based on security labels assigned to subjects and objects, not by owner discretion. Used in multilevel security such as Bell-LaPadula.

Session fixation

An attack where the attacker sets or knows a victim's session identifier before login; defense is to issue a fresh session ID upon successful authentication.

TACACS+ versus RADIUS

Both are AAA protocols. TACACS+ encrypts the entire payload and separates authentication, authorization, and accounting; RADIUS encrypts only the password field.

PCI DSS scope

The set of systems that store, process, or transmit cardholder data, plus connected systems that could affect their security. Scope reduction through segmentation lowers compliance burden.

GDPR breach notification

Controllers must notify the supervisory authority of a personal data breach likely to risk individuals' rights within 72 hours of becoming aware, unless the breach is unlikely to result in risk.

HIPAA safeguards

The Security Rule requires administrative, physical, and technical safeguards for electronic protected health information, covering access control, audit, integrity, and transmission security.

SOX Section 404

Requires management to assess and report on internal controls over financial reporting, with independent auditor attestation. IT general controls provide supporting evidence.

Chain of custody

Chronological documentation of evidence seizure, handling, and transfer, including who had it and when, used to prove the evidence was not altered or tampered with.

Data classification

Assigning labels such as public, internal, confidential, and restricted to information so that handling, storage, transmission, retention, and destruction rules follow consistently.

NIST CSF functions

Core framework functions: Identify, Protect, Detect, Respond, and Recover; CSF 2.0 adds Govern. Used to organize and communicate cybersecurity program activities.

ARP spoofing

A Layer 2 attack sending forged ARP replies to associate the attacker's MAC address with a legitimate IP, enabling man-in-the-middle interception on the local subnet. Dynamic ARP inspection mitigates it.

Stateful firewall

A firewall that maintains a connection table and permits return traffic for sessions initiated from inside, rather than evaluating each packet in isolation against static rules.

DMZ

A segmented network zone holding internet-facing services, placed between external and internal firewall boundaries so compromise of a public server does not directly expose the internal network.

802.1X

Port-based network access control using a supplicant, an authenticator switch, and a RADIUS authentication server; the port stays restricted until authentication succeeds.

Mantrap

A physical access control with two interlocking doors where the first must close before the second opens, preventing tailgating and trapping intruders between checkpoints.

Clean agent suppression

Fire suppression using gaseous agents such as FM-200 or inert gas that extinguish fire without water damage or residue, suitable for occupied data centers and equipment rooms.

Credentialed scan

A vulnerability scan that authenticates to the target host, allowing inspection of installed patches, registry, and configuration; yields more accurate results and fewer false positives than unauthenticated scans.

CVSS base score

A 0.0-10.0 severity rating derived from exploitability metrics (attack vector, complexity, privileges, user interaction) and impact metrics (confidentiality, integrity, availability).

False negative

A scan result that misses a vulnerability that actually exists on the target. Reduces apparent risk and is more dangerous than a false positive, which merely wastes remediation effort.

Virtual patching

Applying a compensating control such as a WAF or IPS signature that blocks exploitation of a known vulnerability while the vendor patch is unavailable or cannot yet be deployed.