Cybersecurity: Module 9

An adverse event in which an attacker attempts to gain entry into an information system or disrupt its normal operations, almost always with the intent to do harm.

A system capable of automatically detecting an intrusion into an organization’s networks or host systems and notifying a designated authority.

The general term for a system that can both detect and modify its configuration and environment to prevent intrusions

An indication or notification that a system has just been attacked or is under attack.

A process of grouping almost identical alarms that occur nearly at the same time into a single higher-level alarm.

The process of classifying IDPS alerts so they can be more effectively managed.

The measure of an IDPS’s ability to correctly detect and identify certain types of attacks.

The process by which attackers change the format or timing of their activities to avoid being detected by an IDPS.

An event that triggers an alarm when no actual attack is in progress.

The failure of a technical control (such as an IDPS) to react to an actual attack event.

An alert or alarm that occurs in the absence of an actual attack.

accurate and noteworthy but do not pose significant threats to information security

The rules and configuration guidelines governing the implementation and operation of IDPSs within the organization.

An IDPS’s ability to dynamically modify its configuration in response to environmental activity.

An event that triggers an alarm and causes an IDPS to react as if a real attack is in progress.

The process of adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing false positives and false negatives.

A published weakness or fault in an information asset or its protective systems that may be exploited and result in loss.

An unknown or undisclosed vulnerability in an information asset or its protection systems that may be exploited and result in loss; once it is discovered, there are zero days to identify, mitigate, and resolve the vulnerability.

An IDPS that resides on a computer or appliance connected to a segment of an organization’s network and monitors traffic on that segment, looking for indications of ongoing or successful attacks.

A hardware and software component deployed on a remote computer or network segment and designed to monitor network or system traffic for suspicious activities and report back to the host application

A specially configured connection on a network device that can view all the traffic that moves through the device

A specially configured connection on a network device that can view all the traffic that moves through the device

A specially configured connection on a network device that can view all the traffic that moves through the device

The process of examining and verifying network traffic for invalid data packets—that is, packets that are malformed under the rules of the TCP/IP protocol.

The process of examining and verifying the higher-order protocols (HTTP, FTP, and Telnet) in network traffic for unexpected packet behavior or improper use.

An IDPS sensor setting in which the device simply monitors and analyzes observed network or system traffic.

An IDPS sensor intended for network perimeter use and deployed in close proximity to a perimeter firewall to detect incoming attacks that could overwhelm the firewall.

An IDPS that resides on a particular computer or server, known as the host, and monitors activity only on that system

The examination of system or network data in search of patterns that match known attack signatures

An IDPS detection method that compares current data and traffic patterns to an established baseline of normalcy

A predefined assessment level that triggers a predetermined response when surpassed. Typically, the response is to write the event to a log file, notify an administrator, or both.

The comparison of vendor-supplied profiles of protocol use and behavior against observed data and network patterns to detect misuse and attacks

An attack detection method that reviews log files generated by computer systems looking for patterns and signatures that may indicate an attack or intrusion is in process or has already occurred.

An information management system specifically tasked to collect and correlate events and other log data from a number of servers or other network devices for the purpose of interpreting, filtering, correlating, analyzing, storing, reporting, and acting on the resulting information.

A process used to develop knowledge that allows an organization to understand the actions and intentions of threat actors and develop methods to prevent or mitigate cyberattacks.

An IDPS implementation approach in which all control functions are managed in a central location.

An IDPS implementation approach in which all control functions are applied at the physical location of each IDPS component.

An IDPS implementation approach that combines the best aspects of the centralized and fully distributed strategies.

A value that sets the limit between normal and abnormal behavior.

A list of systems, users, files, or addresses that have been associated with malicious activity; it is commonly used to block those entities from systems or network access.

A list of systems, users, files, or addresses that are known to be benign; it is commonly used to expedite access to systems or networks.

An application that entices people who are illegally perusing the internal areas of a network by providing simulated rich content while the software notifies the administrator of the intrusion.

A monitored network or network segment that contains multiple honeypot systems.

Any system resource that is placed in a functional system but has no normal use in the system, and that instead serves as a decoy and alarm, similar to a honeypot.

A protected honeypot that cannot be easily compromised.

An application that combines the function of honeypots or honeynets with the capability to track the attacker back through the network.

An application that records information about outbound communications.

The process of illegally attempting to determine the source of an intrusion by tracing it and trying to gain access to the originating system.

The act of luring a person into committing a crime in order to get a conviction.

A logical sequence of steps or processes used by an attacker to launch an attack against a target system or network.

The organized research and investigation of Internet addresses owned or controlled by a target organization.

The systematic survey of a targeted organization’s Internet addresses collected during the footprinting phase to identify the network services offered by the hosts in that range.

A type of tool used both by attackers and defenders to identify or fingerprint active computers on a network, the active ports and services on those computers, the functions and roles of the machines, and other useful information.

The functions and features that a system exposes to unauthenticated users.

An application that scans networks to identify exposed usernames and groups, open network shares, configuration problems, and other vulnerabilities in servers.

A scanner that listens in on a network and identifies vulnerable versions of both server and client software.

Can provide a network administrator with valuable information for diagnosing and resolving networking issues