PAPA flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Prompt injection

An attack in which untrusted text causes a model to follow attacker instructions instead of the operator's. Direct injection arrives in user input; indirect injection hides in retrieved documents, tool output, or web content the model reads.

Indirect prompt injection

Malicious instructions embedded in content the model ingests, such as a web page, email, or retrieved document, rather than typed by the user. It is dangerous because the victim never sees the payload and tools may act on it.

Training data poisoning

Corrupting the data used to train or fine-tune a model so it learns attacker-chosen behavior, such as biased outputs or a hidden trigger. Detection is hard because overall accuracy on clean validation data can remain normal.

Backdoor trigger

A rare input pattern inserted during poisoning that causes a model to produce an attacker-chosen output only when present. The model behaves normally otherwise, so standard accuracy testing does not reveal it.

Model extraction attack

An adversary queries a model API many times and trains a substitute model on the input-output pairs, stealing functionality and possibly enabling cheaper follow-on attacks. Rate limiting and watermarking raise the cost.

Membership inference

A privacy attack that determines whether a specific record was part of a model's training set by exploiting differences in confidence or behavior. Differential privacy and limited confidence-score exposure reduce the leakage.

Adversarial example

An input deliberately perturbed so a model misclassifies it while a human sees little difference. Perturbations often transfer between models, so an attack crafted on a surrogate can fool the target.

Excessive agency

A failure mode where an AI system holds permissions, tools, or autonomy beyond its task, so a bad output becomes a real action. Least-privilege tool scopes and human approval for irreversible actions mitigate it.

Insecure output handling

Accepting model output into downstream systems without validation, so generated text becomes executable code, markup, or queries. It maps to classic injection sinks such as XSS, SQL injection, and SSRF.

SYN flood

A denial-of-service attack that sends many TCP SYNs without completing the handshake, exhausting the server's connection backlog. SYN cookies avoid allocating state until the final ACK arrives.

TLS 1.3 forward secrecy

TLS 1.3 mandates ephemeral key exchange, so compromise of a server's long-term private key cannot decrypt previously recorded sessions. TLS 1.2 with static RSA key exchange lacks this property.

IPsec ESP versus AH

ESP encrypts and authenticates the payload, providing confidentiality plus integrity. AH provides integrity and authentication only, with no encryption, so it protects against tampering but not eavesdropping.

IPsec tunnel mode

A mode that encapsulates the entire original IP packet inside a new packet with new headers, hiding internal addressing. It is the standard choice for site-to-site VPNs between gateways.

IDS versus IPS

An IDS monitors a copy of traffic and alerts without blocking. An IPS sits inline and can drop malicious traffic, but a false positive directly disrupts legitimate communication.

ARP spoofing

An attacker sends forged ARP replies to bind their MAC address to another host's IP on the local network, enabling interception or man-in-the-middle. Dynamic ARP inspection and DHCP snooping are the usual defenses.

Network segmentation

Dividing a network into zones with enforced default-deny policy between them, so compromise of one zone does not grant reachability to others. A DMZ isolates internet-facing services from internal systems.

DNSSEC

A set of extensions that cryptographically signs DNS records so resolvers can verify origin and integrity. It prevents cache poisoning but does not encrypt queries or hide them from observers.

NAT security misconception

NAT translates addresses and ports but is not a security control. It breaks end-to-end reachability, complicates protocols carrying IP addresses, and is easily bypassed by outbound-initiated connections.

Incident response phases

NIST SP 800-61 orders activities as preparation; detection and analysis; containment, eradication, and recovery; then post-incident activity. Containment comes before eradication, and evidence needs constrain containment choices.

Order of volatility

The sequence for collecting evidence from most to least perishable: CPU registers and cache, RAM, swap, network state, disk, remote logs, archival media. Volatile data is captured first because it disappears on shutdown.

Chain of custody

Documentation recording who handled evidence, when, and for what purpose at every transfer. A hash computed at acquisition, such as SHA-256, later proves the evidence was not altered.

MITRE ATT&CK tactics

The adversary's goals, such as Initial Access, Persistence, Privilege Escalation, Lateral Movement, and Exfiltration. Techniques are the specific methods used to achieve a tactic and carry identifiers like T1059.

Benign true positive

An alert that correctly detected the activity it was written for, but the activity is authorized or expected. Classifying it separately from false positives prevents analysts from disabling working detections.

MTTD and MTTR

Mean time to detect and mean time to respond, the core security operations metrics. Lowering MTTD usually requires broader telemetry coverage and better correlation rather than simply adding analysts.

Host isolation in containment

Removing a compromised host from the network while leaving it powered on, preserving memory for forensics. Powering the machine off destroys volatile evidence such as running processes and encryption keys.

Clock synchronization for logs

Normalizing timestamps to UTC using NTP across sources. Skewed clocks break event correlation and timeline reconstruction, and can undermine the reliability of log evidence in an investigation.

Cloud shared responsibility

The provider secures facilities, hardware, and the managed service internals; the customer secures identity, data, configuration, and deployed workloads. The split shifts with IaaS, PaaS, and SaaS models.

Cloud identity as perimeter

In cloud environments, permissions determine reachability more than network location does. Least privilege, short-lived federated credentials, and MFA on privileged accounts are the primary controls.

Security group versus NACL

A security group is stateful and attached to instances, so return traffic is automatically allowed. A network ACL is stateless and subnet-level, requiring explicit rules for both directions of a flow.

Customer-managed keys

Encryption keys the customer controls in a key management service rather than the provider. They allow revocation and separation of duties, but key policy mistakes can lock out data or weaken protection.

Cloud public storage exposure

A bucket or blob becomes public through policy, ACLs, or account-level settings, and any one can override intent. Auditors must check all layers plus public-access block settings together.