Military Cyber Test key terms

Actions that disrupt, deny, degrade, or destroy information resident in computers and networks, or the systems themselves. Distinct from exploitation and defense, it produces effects rather than merely gathering data.

Operations that enable collection of information from adversary networks and systems, generally while leaving them functioning. The goal is intelligence gain and persistent access rather than disruption.

Defensive actions taken inside a defended network, such as host hardening, patching, and hunting for intruders. Contrasted with response actions that operate outside the boundary.

Defensive activity conducted outside a defended network to defeat or disrupt an adversary, such as hunting on a compromised host upstream. Requires careful legal and command authorization.

The observable outcomes produced by cyber operations, ranging from temporary degradation to physical destruction. Planners specify effects and their duration rather than the technical method used to create them.

Missions that project power in cyberspace to achieve military objectives, including access development, exploitation, and attack. They are planned like other fires, with authorities, deconfliction, and effects assessment.

The systematic process of identifying, analyzing, and validating an adversary system or network as a potential target, including its function, dependencies, and defenses. It precedes weaponeering and execution.

Selecting the specific cyber tool, payload, and access path that will produce the desired effect on a validated target, weighing reliability, reversibility, and risk of unintended consequences.

A structured assessment of unintended consequences a cyber action may cause outside the target, such as effects on civilian networks, third-party systems, or the operation's own infrastructure.

Coordination that prevents friendly cyber forces from interfering with each other, with other operations, or with intelligence collection on the same network. It preserves access and avoids self-inflicted disruption.

The property of maintaining access to a compromised system or network across reboots, credential changes, and remediation attempts. It supports both long-term exploitation and reliable attack execution.

The infrastructure and channels an operator uses to task and control implanted tools in a target network. Detection and blocking of C2 traffic is a central defensive objective.

Regular, automated outbound contact from an implant to its controller, often at jittered intervals. Its periodic timing is a detectable pattern in network traffic analysis.

Randomized delay added to beacon intervals so that periodic callbacks do not form a predictable pattern. Defenders counter it by looking for consistent destination and size patterns rather than strict timing.

A phase model of an intrusion: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objective. It helps defenders choose interventions at each stage.

A curated knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform. Analysts map detections and threat reports to its technique identifiers.

The behavioral patterns of an adversary: why they act (tactics), how they act technically (techniques), and the specific step-by-step implementation (procedures). TTPs are more durable than infrastructure indicators.

Artifacts such as malicious hashes, domains, or registry keys that suggest a system is compromised. They are easy to share but perishable, since attackers change them frequently.

Analyzed information about adversaries, their capabilities, and intent that supports decision-making. Useful intelligence answers specific command questions rather than merely listing malware samples.

The judgment of which actor is responsible for a cyber operation, drawn from technical, intelligence, and geopolitical evidence. Confidence levels and political consequences shape whether it is publicly stated.

Deliberately planting evidence that points to a different actor, such as using another group's malware or infrastructure. It complicates attribution and is a reason to weigh multiple evidence sources.

Proactive, hypothesis-driven searching through networks and endpoints for adversaries that evaded automated detection. It relies on TTP-based hypotheses rather than waiting for alerts.

The ordered phases of handling an incident: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Skipping containment often lets an adversary re-enter during recovery.

Short-term action to stop an intrusion from spreading, such as isolating hosts, blocking routes, or disabling accounts. It balances stopping damage against destroying evidence or tipping off the adversary.

Removing the adversary's access and malicious artifacts from the environment, including implants, persistence mechanisms, and compromised credentials. It follows containment and precedes recovery.

A documented set of roles, authorities, communication paths, and procedures activated when an incident occurs. Exercising it through tabletop drills reveals gaps before a real crisis.

Layering independent security controls so that failure of one does not expose the whole system. Examples include segmentation, endpoint detection, least privilege, and monitoring at multiple points.

A security model that treats no network location as inherently trusted and verifies every request based on identity, device posture, and policy. It replaces perimeter-only assumptions with continuous authentication and least privilege.

Granting users and processes only the access needed for their current task, for no longer than necessary. It limits the blast radius of a compromised account or service.

Dividing a network into zones with controlled traffic between them, using firewalls, VLANs, or enclaves. Good segmentation slows lateral movement and limits what a single compromised host can reach.

Techniques an intruder uses to move from one compromised host to others, such as remote services, credential reuse, or trust relationships. Detection focuses on anomalous authentication and admin share access.

Gaining higher permissions than initially granted, either by exploiting a vulnerability or by abusing misconfiguration. It converts a low-value foothold into administrative control.

Authenticating with a captured password hash instead of the plaintext password, exploiting protocols that accept hash-based credentials. It shows why credential theft, not just password guessing, drives intrusions.

Requiring two or more independent credential types, such as a password plus a hardware token. It blocks simple password reuse attacks but can be defeated by real-time phishing proxies.

A sensor that inspects traffic or host activity and alerts on signatures or anomalies matching known malicious behavior. Placement determines what it can see; encrypted traffic limits its value.

An inline device that not only detects malicious traffic but can block it in real time. False positives can disrupt legitimate operations, so tuning and fail-open decisions matter.

A documented picture of normal traffic volumes, protocols, hosts, and connection patterns. Deviations from the baseline are what make beaconing and exfiltration visible to analysts.

Summarized metadata about network conversations, including source, destination, ports, byte counts, and timestamps, without payload content. It supports traffic analysis and retroactive hunting at scale.

Recording full packet contents on a network segment for later analysis. It provides definitive evidence but is storage-intensive and useless against traffic encrypted end to end.

A protocol that encrypts and authenticates data between client and server, protecting confidentiality and integrity in transit. Inspecting it defensively requires terminating or mirroring sessions with proper authority.

The policies, certificate authorities, and processes that issue and revoke digital certificates binding identities to public keys. It underpins authentication for TLS, VPNs, and smart card logon.

An encrypted tunnel that carries traffic between a remote host and a trusted network. Compromised VPN credentials are a common initial access route, so its logs are high-value evidence.

The adversary's first foothold in a target environment, gained through phishing, exposed services, valid credentials, or supply chain compromise. Defenders concentrate controls at these entry points.

Deceptive messages that trick recipients into revealing credentials, running malicious code, or approving access. Variants include spear phishing and business email compromise, both frequent military-network threats.

Manipulating people through trust, urgency, or authority to obtain access or information. Technical controls alone cannot stop it, so training and verification procedures are the main defenses.

Directives that specify when and how force, including cyber effects, may be used, including constraints, escalation thresholds, and approval authorities. Operators must know them before acting.

The legal principle that expected incidental harm from an attack must not be excessive relative to the anticipated military advantage. In cyberspace it requires assessing effects on civilian networks and data.

The requirement to differentiate military objectives from civilian objects and persons, directing operations only at the former. Dual-use networks make this judgment especially difficult in cyberspace.

The principle that states have authority over their territory and internal affairs, which bears on whether cyber operations violate another state's rights. Its application to cyberspace remains contested among states.

The expectation that a state not knowingly allow its territory to be used for acts harmful to other states. In cyberspace, applying it to infrastructure hosting malicious activity is debated and unevenly practiced.

The body of international law governing armed conflict, including necessity, distinction, proportionality, and humanity. It applies to cyber operations that occur during or amount to armed conflict.