HTB CJCA key terms

A model describing three core goals of information security: confidentiality keeps data from unauthorized readers, integrity keeps it accurate and unaltered, and availability keeps it reachable when legitimate users need it.

The principle that every user, process, or service should receive only the permissions required to do its job, and nothing more, limiting the damage any single compromised account can cause.

Layering independent controls such as firewalls, endpoint protection, authentication, and monitoring so that failure of one safeguard does not expose the whole environment to an attacker.

A property ensuring a party cannot credibly deny having performed an action, typically achieved with digital signatures or tamper-evident audit logs that bind an identity to an event.

A one-way function that converts input into a fixed-length value so changes to the data are detectable; it is used for integrity checks and password storage, not for encryption or secrecy.

A cryptographic value created with a private key over a message hash, letting anyone with the matching public key verify the signer's identity and confirm the content was not altered.

A four-layer description of network communication covering link, internet, transport, and application concerns, explaining how data is encapsulated and routed from one host to another across networks.

A seven-layer reference framework (physical through application) used to describe and troubleshoot where network functions occur and where failures or attacks take place in a communication path.

The TCP connection setup sequence of SYN, SYN-ACK, and ACK that synchronizes sequence numbers between client and server before data transfer begins.

A compact way to express an IP network and its size, such as 10.0.0.0/24, where the suffix counts network bits and determines how many host addresses remain available.

Dividing a larger IP network into smaller logical ranges so traffic can be grouped by function, trust level, or location and routed or filtered between those ranges.

Splitting a network into zones separated by routing or filtering controls, so a compromise in one area, such as guest Wi-Fi, cannot freely reach sensitive systems elsewhere.

Network Address Translation rewrites source or destination addresses as packets cross a boundary, commonly letting many internal hosts share one public address and hiding internal addressing from outside observers.

A device or software rule engine that permits or blocks traffic based on attributes such as addresses, ports, protocol, or application state, enforcing a boundary between network zones.

A running instance of a program with its own memory space, identifiers, and privileges; examining its parent, command line, and user context is central to endpoint investigations.

The parent-child relationships among running processes, which reveal how a program was launched and help analysts spot unusual chains such as a word processor spawning a command shell.

A hierarchical database storing operating system and application configuration, including autostart entries and security settings that attackers often modify to gain persistence.

Using legitimate built-in tools such as PowerShell, certutil, or wmic to carry out attacker actions, which blends activity into normal administration and evades signature-based detection.

Any mechanism an attacker establishes to regain access after reboot or credential loss, such as scheduled tasks, startup registry keys, services, or added accounts.

The disciplined process of tracking, testing, and deploying software updates so known flaws are fixed before attackers exploit them, prioritized by exposure and severity.

Requiring two or more independent evidence types, such as a password plus a hardware token, so a stolen password alone is not enough to access an account.

Assigning permissions to job roles rather than individuals, so users inherit the access their role needs and changes are managed consistently as staff move between positions.

An attack that requests service tickets for accounts with service principal names and cracks them offline to recover weak service account passwords, often yielding privileged access.

Trying username and password pairs leaked from one breach against other services, exploiting password reuse; it produces many failed logins across accounts from few sources.

Attempting one or a few common passwords against many accounts to avoid lockout thresholds, generating low-and-slow authentication failures spread across the directory.

Bombarding a user with repeated push notifications until they approve one out of annoyance or confusion, turning a strong control into a weak point through human behavior.

Gaining higher permissions than originally granted, either by exploiting a flaw on the same system or by moving to an account or host with broader rights.

A weakness in software, configuration, or process that an attacker could use to affect confidentiality, integrity, or availability; it becomes a real risk only when reachable and exploitable.

Code or a technique that takes advantage of a specific vulnerability to achieve an outcome such as code execution, data disclosure, or denial of service.

Deceiving a target with a fraudulent message that impersonates a trusted party to steal credentials, deliver malware, or trigger a harmful action such as a payment.

Manipulating people through authority, urgency, or trust to disclose information or perform actions, bypassing technical controls by targeting human decision-making instead.

A denial-of-service attack that sends many connection requests without completing the handshake, exhausting a server's pending-connection table so legitimate clients cannot connect.

The staged process of preparation, detection and analysis, containment, eradication, recovery, and lessons learned that structures how an organization handles a security incident.

The incident response step that limits spread and damage, for example by isolating a host, disabling an account, or blocking a domain before eradication begins.

A documented record of who collected, handled, and stored evidence and when, preserving its integrity so findings remain defensible in an investigation or legal proceeding.

A time-ordered record of system or application events, including who did what and when, used for detection, troubleshooting, and demonstrating compliance after the fact.

A platform that centrally collects logs from many sources, normalizes them, and applies correlation rules so analysts can detect patterns and investigate across the environment.

An alert raised for activity that turns out to be benign; excessive false positives erode analyst trust and cause real detections to be overlooked.

Adjusting detection rules, thresholds, and exclusions over time so alerts match the environment, reducing noise while keeping coverage for genuine malicious behavior.

Identifying assets and threats, then estimating likelihood and impact to rank risks, so limited security resources go to the exposures that matter most to the business.

A published set of controls and requirements, such as ISO 27001 or PCI DSS, that organizations map their practices against to demonstrate adequate safeguards to customers and regulators.