Military Cyber Test flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

DCO-IDM vs DCO-RA

DCO-IDM comprises internal defensive measures taken inside the defended network. DCO-RA comprises response actions outside the defended network, requiring separate authority because they may affect other systems.

Cyberspace attack definition

Actions that create denial, degradation, disruption, or destruction effects on computers and networks. Exploitation for intelligence gain is classified separately and is not itself an attack.

DODIN operations

Actions to design, build, configure, secure, operate, maintain, and sustain Department of Defense networks. They are steady-state and foundational, enabling both offensive and defensive cyberspace operations.

Joint targeting cycle

Six phases: commander's objectives and end state, target development and prioritization, capabilities analysis, commander's decision, mission planning and execution, and assessment. Each phase produces validated inputs for the next.

Measures of effectiveness

Criteria judging whether an operation achieved its intended behavioral or mission effect, as opposed to measures of performance, which only confirm that a payload or tool was delivered as planned.

Collateral effects estimation

Assessment of unintended damage to third-party or protected systems from a cyber operation, including propagation risk from self-replicating code and shared infrastructure, weighed against anticipated military advantage before approval.

Order of volatility

Evidence collection priority from most to least volatile: CPU registers and cache, RAM and swap, network state, running processes, disk storage, remote logs, archival media. Collect volatile data first.

Chain of custody

Documented, unbroken record of who handled evidence, when, and where, with hash values computed at acquisition. Breaks in custody can render evidence unusable in proceedings.

Pyramid of pain

A model ranking indicators by how much adversary cost they impose when blocked: TTPs highest, then tools, artifacts, domains and IPs, and hash values lowest.

Incident severity factors

Three factors drive severity scoring and escalation: functional impact on operations, information impact such as confidentiality or integrity loss, and recoverability of affected systems and data.

TCP three-way handshake

Connection setup via SYN, SYN-ACK, ACK. Half-open SYN floods exhaust the connection backlog, while scans often produce many SYNs followed by RST responses.

DNS tunneling indicators

High-entropy subdomains, unusually long labels, large TXT records, and frequent queries to a single domain suggest data exfiltration or command and control over DNS.

Beaconing analysis

Detection of command and control by measuring connection inter-arrival times: near-constant intervals with jitter, small consistent payloads, and repeated destinations indicate automated beaconing.

TLS SNI visibility

The Server Name Indication in the TLS ClientHello reveals the requested hostname in cleartext unless Encrypted Client Hello is used, enabling hostname-based monitoring without decryption.

Kerberoasting

An attack requesting Kerberos service tickets for service accounts, then cracking them offline. Detection relies on anomalous service ticket requests and weak service account passwords.

Living-off-the-land binaries

Signed system tools such as PowerShell, certutil, rundll32, and mshta abused for download, execution, or evasion. Monitor command-line content and parent-child process relationships, not process names alone.

Windows event ID 4688

Process creation event on Windows, logged only when audit policy enables it. It records the new process, its parent, and command line, making it central to endpoint detection.

Application allowlisting

A control permitting execution only of approved binaries. It blocks much commodity malware but is bypassed by allowed living-off-the-land binaries, so command-line monitoring remains necessary.

AES-GCM authenticated encryption

A mode providing confidentiality and integrity in one pass. Preferred over CBC, which requires a random IV and is vulnerable to padding-oracle attacks when used without authentication.

Digital signature purpose

A hash of a message signed with the sender's private key. Verification with the public key provides integrity, authentication, and non-repudiation, but not confidentiality.

Password hashing with KDFs

Passwords are stored using salted, deliberately slow key derivation functions such as bcrypt, scrypt, Argon2, or PBKDF2. Fast hashes like MD5 or SHA-1 are unsuitable.

Forward secrecy

Ephemeral Diffie-Hellman key exchange in TLS produces session keys that cannot be recovered from the server's long-term private key, limiting damage from later key compromise.

Post-quantum cryptography risk

Shor's algorithm breaks RSA and elliptic-curve key exchange and signatures. Grover's algorithm halves symmetric strength, so AES-256 remains adequate while migration planning is required.

Intelligence cycle

Six steps: requirements and planning, collection, processing, analysis and production, dissemination, and feedback. Requirements must be answerable and tied to a specific decision.

MITRE ATT&CK tactics

A structured list of adversary goals, including initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, and impact.

STIX and TAXII

STIX is a structured language for expressing threat intelligence; TAXII is the transport protocol for exchanging it. Indicators should carry confidence and expiry metadata to limit false positives.

Attribution confidence

Technical indicators such as infrastructure and tooling support attribution but rarely prove it alone. All-source intelligence is required, and conclusions should state explicit confidence levels.

Jus ad bellum

Law governing resort to force under the UN Charter: Article 2(4) prohibits force, Article 51 permits self-defense. Cyber operations with effects equivalent to kinetic force may qualify as use of force.

LOAC cyber principles

Distinction between military and civilian objects, proportionality of expected collateral damage to military advantage, and precautions in attack apply to cyber operations during armed conflict.

Tallinn Manual status

A scholarly study analyzing how existing international law applies to cyber operations. It is persuasive expert opinion, not a binding treaty or statute.

Title 10 versus Title 50

Title 10 covers traditional military operations; Title 50 covers covert action requiring a presidential finding. Misclassifying an operation affects legal authority and congressional notification.

Rules of engagement content

ROE specify authorized targets, prohibited effects, collateral thresholds, self-defense authority, and approval chains. Ambiguities must be resolved through the chain of command before execution.