ECSS flashcards
ECSS · Build recall with a focused review session.
31 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA triad
- Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely authorized access. Controls are classified by the property they primarily protect.
- Defense in depth
- Layering independent controls across physical, network, host, application, and data levels so that failure of one control does not expose the asset. Overlapping controls are deliberate, not redundant waste.
- Implicit deny
- A firewall or ACL behavior where traffic matching no explicit rule is dropped. Because rules are evaluated top-down first-match, specific permits must precede broad denies.
- Stateful inspection
- A firewall maintains a connection table keyed on the five-tuple and state, allowing return traffic automatically. Stateless ACLs instead require explicit rules for both directions and ephemeral ports.
- IDS versus IPS
- An IDS monitors passively out-of-band and alerts; an IPS sits inline and can block. Signature detection matches known patterns, while anomaly detection baselines normal behavior and flags deviation.
- Private IP ranges
- Non-routable address space: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The 169.254.0.0/16 range is link-local APIPA, assigned when DHCP fails.
- IPsec AH and ESP
- AH provides integrity and authentication but no encryption. ESP provides confidentiality plus integrity. IKE negotiates security associations in two phases before data protection begins.
- AAA framework
- Authentication verifies identity, authorization determines permitted actions, and accounting records activity. RADIUS is common for network access; TACACS+ encrypts the entire payload and separates the functions.
- Risk formula
- Risk equals likelihood multiplied by impact. Residual risk remains after controls are applied. Treatment options are mitigate, transfer, avoid, and accept.
- Reconnaissance phases
- Passive reconnaissance gathers OSINT without touching the target, such as WHOIS and certificate transparency. Active reconnaissance sends traffic directly, such as DNS zone transfer attempts and banner grabbing.
- TCP SYN scan
- A half-open scan sending SYN and interpreting SYN-ACK as open and RST as closed. It never completes the handshake, so it is stealthier but requires raw-socket privilege.
- Nmap port states
- Open means a service responded. Closed means RST was received. Filtered means no reply or an ICMP unreachable. Unfiltered means the port is reachable but open/closed could not be determined.
- Enumeration targets
- Extracting identifiers rather than just open ports: SMB shares and users, SNMP community strings and MIB walks, LDAP directories, DNS records, NetBIOS names, and NTP information.
- Rainbow table attack
- Precomputed hash-to-plaintext lookup tables that trade storage for cracking time. Salting each password with unique random data before hashing defeats precomputation, as does key stretching.
- SQL injection basics
- Occurs when untrusted input is concatenated into queries. Indicators include quote-triggered errors and boolean or UNION logic changes. Parameterized queries and input validation are the primary defenses.
- XSS variants
- Reflected XSS echoes payload through a request; stored XSS persists in the application; DOM-based XSS executes via client-side script. Output encoding and Content Security Policy mitigate.
- CSRF attack
- A forged request sent with the victim's ambient authenticated session, causing unintended state changes. Anti-CSRF tokens and SameSite cookie attributes are standard defenses.
- Vertical privilege escalation
- Gaining higher privilege than assigned, such as user to administrator. Horizontal escalation instead reaches another account at the same privilege level. Misconfigured sudo, SUID binaries, and unpatched kernels are common vectors.
- Penetration test report
- Documents scope, dates, methodology, findings with evidence and severity, business impact, and remediation guidance. Live credentials and excess exfiltrated data must never appear in it.
- Order of volatility
- Collection priority from most to least volatile: CPU registers and cache, RAM and swap, network state, running processes, temporary files, disk, remote logs, archival backups.
- Forensic image hashing
- Computing MD5 or SHA-256 of the source and the acquired image to prove bit-for-bit integrity. Hashes are recorded in chain-of-custody documentation and re-verified before analysis.
- Write blocker
- A hardware or software device that prevents write operations to evidence media during acquisition, ensuring the original is not altered and remains admissible.
- Physical versus logical acquisition
- Physical acquisition copies the entire device including unallocated space and slack. Logical acquisition copies a partition or selected files, capturing less deleted data.
- NTFS $MFT
- The Master File Table stores a record for every file and directory, including timestamps, attributes, and data run locations. It is central to proving file existence and deletion.
- NTFS alternate data streams
- Additional named data streams attached to a file, hidden from ordinary directory listings. They can conceal data and are examined with tools that enumerate all streams.
- File carving
- Recovering file content by scanning raw data for known header and footer signatures, independent of file system metadata. It works when directory entries are gone but clusters are not overwritten.
- MACB timestamps
- Modified (content), Accessed (read), Changed (MFT entry metadata), and Born (creation). Analysts normalize time zones and document clock skew before building timelines.
- Timestomping
- Deliberately altering file timestamps to mislead investigators. Indicators include sub-second precision anomalies, timestamps preceding volume creation, and mismatches between $MFT and $LogFile.
- Windows logon event IDs
- Security log 4624 records successful logon, 4625 failed logon, and 4688 process creation. These support authentication analysis and execution timeline reconstruction.
- Memory forensics
- Analysis of captured RAM to recover process lists, network connections, loaded modules, injected code, and encryption keys. RAM is highly volatile and must be captured early.
- Chain of custody
- A documented, unbroken record of who handled evidence, when, where, and how. Gaps or undocumented transfers can render evidence inadmissible or unreliable in proceedings.