C|CT key terms

A layered security strategy in which controls at network, host, application, and data levels each provide protection, so that failure of a single control does not expose the whole environment. Candidates should map which layer a given control addresses.

Dividing a network into zones separated by firewalls or routing policy so that traffic between zones is restricted. Limits lateral movement after compromise and is commonly applied to separate user, server, and management networks.

A buffer subnet holding internet-facing services such as web or mail servers, isolated from the internal network by filtering devices. Compromise of a DMZ host should not grant direct internal access.

A firewall technique that records the state of active connections and permits return traffic only for sessions it initiated. It examines connection context rather than judging each packet in isolation.

A firewall that adds application awareness, user identity, intrusion prevention, and threat intelligence to traditional port and protocol filtering. It can allow or block specific applications regardless of port.

An ordered set of permit and deny rules applied to interfaces, files, or services. Rules are evaluated in sequence, and an implicit deny at the end is common practice; misordering is a frequent configuration error.

Traffic moving between systems inside the same data center or network rather than entering from outside. Because it bypasses perimeter controls, it drives demand for internal segmentation and host-based monitoring.

A design principle that grants no implicit trust based on network location and instead verifies identity and device posture for every request. Access decisions are continuous and least-privilege rather than perimeter-based.

Granting users, services, and processes only the permissions required to perform their assigned tasks, for no longer than needed. Reduces the blast radius of compromised accounts and accidental misuse.

A documented minimum configuration standard for systems, such as required patch levels, disabled services, and password policy. Auditors compare live systems against the baseline to identify drift.

The gradual divergence of a system's actual settings from its approved baseline through ad hoc changes, updates, or manual fixes. Detected by configuration comparison and reduced by automated configuration management.

Reducing a system's attack surface by removing unnecessary software, disabling unused services, and tightening permissions and defaults. Usually performed from a published benchmark before a host is placed in production.

The information-gathering phase of an attack or test, covering passive collection such as public records and DNS data, and active probing such as port scans. Findings feed later exploitation steps.

Open-source intelligence: information lawfully gathered from public sources such as websites, social media, registries, and job postings. Used to map an organization's people, technology, and exposed assets.

Probing TCP or UDP ports to determine which services are listening and often which versions are running. Results guide targeted vulnerability checks; scanning must stay within authorized scope.

A written agreement defining the scope, targets, timing, permitted techniques, escalation contacts, and stop conditions of a penetration test. It provides legal authorization and protects both tester and client.

Code or a technique that takes advantage of a specific weakness to alter a system's behavior, such as achieving code execution or bypassing authentication. Effectiveness depends on the target version and defenses present.

Gaining rights beyond those initially held, either vertically to administrative levels or horizontally to another user's resources. Common paths include misconfigured permissions, unpatched services, and credential reuse.

Moving from one compromised host to others within a network using stolen credentials, remote services, or trust relationships. Detection focuses on unusual authentication patterns and internal connection attempts.

A minimal, controlled demonstration that a vulnerability is real and exploitable, produced without causing harm. It documents impact for remediation while avoiding unnecessary data access or service disruption.

The documented, unbroken record of who handled evidence, when, where, and for what purpose, from seizure through presentation. Gaps or undocumented transfers can render evidence inadmissible or unreliable.

The principle of collecting the most perishable evidence first, such as memory and network connections, before persistent storage and archived logs. Prevents loss of data that disappears on shutdown or timeout.

A bit-for-bit copy of a storage device or partition, including slack and unallocated space, created with a write-blocking method. Analysis is performed on the copy, never the original evidence.

Computing a cryptographic digest such as SHA-256 over evidence before and after acquisition or analysis to prove it is unchanged. Matching values support authentication of the copy in testimony.

Analyzing a captured RAM image to recover running processes, network connections, loaded modules, and injected code that never touch disk. Requires acquisition while the system is still powered on.

Recovering files from unallocated space or damaged media by locating known headers, footers, and structure rather than relying on file system metadata. Useful when directory entries are overwritten.

Any trace left by user or system activity that has forensic value, such as registry keys, prefetch files, shellbags, event logs, or browser history. Interpretation requires understanding how the artifact is created.

Ordering events from multiple sources by timestamp to reconstruct what happened and in what sequence. Analysts must account for clock skew, time zone handling, and timestamps altered by attackers.

Observable evidence suggesting intrusion, such as malicious file hashes, domains, IP addresses, or registry keys. IOCs support detection but age quickly as attackers change infrastructure.

The behavioral patterns of an adversary: high-level goals, the methods used to achieve them, and the specific implementation details. More durable than IOCs for detection and threat-informed defense.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform and phase. Used to map detections, prioritize gaps, and describe incidents consistently.

Security information and event management: a platform that centralizes logs, correlates events, and generates alerts against detection rules. Its value depends on log coverage, parsing quality, and tuned rules.

Parsing logs from diverse sources into a common field schema so they can be searched and correlated consistently. Poor normalization causes missed detections and unreliable dashboards.

Rapidly assessing each alert to decide whether it is a true positive, benign, or a duplicate, and assigning priority. Involves enrichment with asset criticality, threat intelligence, and recent activity.

An alert raised for activity that is actually benign. High rates erode analyst trust and cause real incidents to be ignored, so tuning balances sensitivity against operational noise.

A documented set of roles, phases, communication paths, and decision criteria for handling security incidents, typically following preparation, detection, containment, eradication, recovery, and lessons learned. Tested through exercises.

The response phase that limits an incident's spread and impact, for example by isolating a host, disabling an account, or blocking infrastructure. Chosen to preserve evidence where possible while stopping damage.

The discipline of designing, testing, deploying, and maintaining detection logic with measurable coverage and false-positive rates. Rules are treated as code with versioning, review, and validation against known adversary behavior.

A documented detection scenario stating what behavior is being found, which data sources are required, the logic applied, and the expected response. Provides traceability from threat to rule to test.

Contextual information about adversaries, their infrastructure, and their methods, used to prioritize defenses and enrich alerts. Ranges from strategic reporting to machine-readable feeds of technical indicators.