Definitions and pro-tips for the CS0-003 certification.
Address Space Layout Randomization (ASLR) is a security technique that randomly arranges the address space positions of key data areas of a process. This makes it difficult for an attacker to predict the memory address of specific functions or libraries. It effectively mitigates the reliability of memory-based exploits.
Agent-based Scanning is a vulnerability management approach where software agents are installed locally on endpoints to perform security assessments. This method provides deeper visibility into the system and eliminates the need for open network ports or credential management required by remote scanners.
Air Gapping is a security measure that ensures a computer or network is physically isolated from all other networks, including the public internet. This creates a physical barrier that prevents remote hacking attempts and unauthorized data exfiltration.
Attack Surface refers to the total sum of all possible points, or vectors, where an unauthorized user can try to enter data to or extract data from an environment. Reducing the attack surface involves disabling unnecessary services and closing unused ports.
Attribute-Based Access Control (ABAC) is a flexible access control model that grants access based on attributes of the user, the resource, and the environment. It uses policies that combine these attributes to make fine-grained authorization decisions in real-time.
A Baseline is a documented set of performance and configuration metrics that represent the normal state of a system or network. Analysts use baselines to identify anomalies, which may indicate a security breach, misconfiguration, or system failure.
A Business Impact Analysis (BIA) is a systematic process used to determine the potential effects of an interruption to critical business operations. It identifies the Maximum Tolerable Downtime (MTD) and helps prioritize the recovery of essential systems.
A Canary Token is a digital 'tripwire' designed to alert security teams when a sensitive file or resource is accessed. It consists of a unique identifier that triggers a notification to the administrator upon interaction. This helps detect unauthorized access or lateral movement within a network.
Chain of Custody is the chronological documentation that records the sequence of custody, control, transfer, and analysis of physical or electronic evidence. This rigorous tracking ensures that evidence remains untampered and is admissible in a court of law during legal proceedings.
A Cloud Access Security Broker (CASB) is a software tool or service that sits between cloud service consumers and cloud service providers. It enforces security, compliance, and governance policies for cloud-based resources, providing visibility into 'shadow IT' and data movement.
Common Attack Pattern Enumeration and Classification (CAPEC) is a comprehensive dictionary of known patterns of attack used by adversaries to exploit software vulnerabilities. It provides a way to categorize attack vectors and helps security analysts understand how a vulnerability might be exploited.
Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. It provides a standardized way to identify specific versions of operating systems and applications across different vendors. This allows vulnerability scanners to precisely match discovered software to known vulnerabilities.
Common Vulnerabilities and Exposures (CVE) is a list of publicly disclosed cybersecurity vulnerabilities. Each entry is assigned a unique identifier to help IT professionals coordinate their efforts to fix vulnerabilities and ensure consistent naming across different security tools and databases.
Common Weakness Enumeration (CWE) is a community-developed list of common software and hardware weakness types. Unlike CVEs, which identify specific instances of vulnerabilities in specific products, CWEs categorize the underlying types of flaws that lead to those vulnerabilities.
Containment is the phase of the incident response process focused on limiting the scope and magnitude of a security incident. The goal is to prevent the threat from spreading to other systems while preserving evidence for later forensic analysis.
Credentialed Scanning is a vulnerability scan performed using valid user credentials to access the internal file system and registry of a target host. This provides a deeper, more accurate view of vulnerabilities than non-credentialed, external scans.
Cross-Site Scripting (XSS) is a vulnerability where an attacker injects malicious scripts into content delivered to other users. This allows the attacker to bypass same-origin policies, steal session cookies, or deface websites by executing scripts in the victim's browser.
Crossover Error Rate (CER) is the point where the False Acceptance Rate (FAR) and the False Rejection Rate (FRR) are equal. It is used as a primary metric to determine the overall accuracy and effectiveness of a biometric system.
CVSS (Common Vulnerability Scoring System) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. It provides a numerical score reflecting the severity of a vulnerability, allowing organizations to prioritize remediation efforts based on risk.
The Cyber Kill Chain is a framework developed by Lockheed Martin that outlines the stages of a cyberattack from reconnaissance to the final objective. It helps analysts identify the point at which an attack can be disrupted to prevent a successful breach.
Data Leak Prevention (DLP) is a set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users. It monitors data in motion, data at rest, and data in use to prevent exfiltration.
Dead-box Forensics is the analysis of a digital device that has been powered off. This process involves creating a bit-for-bit image of the non-volatile storage, like a hard drive, and analyzing the copy to preserve the original evidence.
Defense in Depth is a security strategy that employs multiple layers of redundant defensive measures to protect an organization's assets. If one security control fails, other layers—such as firewalls, MFA, and endpoint security—remain in place to stop the attacker.
The Diamond Model of Intrusion Analysis is a framework used to map cyber attacks by connecting four core features: adversary, capability, infrastructure, and victim. This allows analysts to identify patterns and pivot between these elements to uncover more about a threat.
A Digital Signature is a mathematical scheme used to verify the authenticity and integrity of a digital message or document. It uses asymmetric cryptography to link a sender's private key to the data, ensuring the content has not been altered. It provides non-repudiation for the signer.
Discretionary Access Control (DAC) is an access control model where the owner of a resource determines who is granted access and what permissions they have. It is highly flexible but less secure than MAC or RBAC because users can pass permissions to others.
DNS Tunneling is a method of bypassing network security controls by encoding data from other protocols within DNS queries and responses. This allows attackers to establish a covert command-and-control channel or exfiltrate data through a protocol usually left open.
Dynamic Application Security Testing (DAST) is a black-box security testing methodology that examines an application while it is running. It identifies vulnerabilities by simulating external attacks on the running application to find flaws like injection points or configuration errors in real-time.
EDR (Endpoint Detection and Response) is an integrated endpoint security solution that combines real-time continuous monitoring and data collection with analysis and response. It focuses on detecting advanced threats that bypass traditional antivirus by monitoring system behaviors and process executions.
Egress Filtering is the practice of monitoring and restricting outbound traffic leaving a network based on specific security rules. It prevents compromised internal systems from communicating with command-and-control (C2) servers or exfiltrating sensitive data. It ensures only authorized traffic exits the perimeter.
Eradication is the phase of the incident response process focused on completely removing the threat from the environment. This involves deleting malware, disabling breached user accounts, and closing the vulnerabilities that allowed the initial compromise to occur.
Event Correlation is the process of associating different events from multiple sources to identify a pattern that indicates a security incident. It allows security analysts to connect seemingly unrelated logs into a single, meaningful security event for faster analysis.
False Acceptance Rate (FAR) is a biometric security metric that measures the probability that the system incorrectly identifies an unauthorized user as an authorized one. A high FAR indicates a security weakness where intruders are more likely to gain access.
A False Negative is a security failure where a malicious attack occurs, but the security tool fails to detect it and generates no alert. This is the most dangerous scenario for an organization as the attacker remains undetected within the environment.
A False Positive is a security alert that incorrectly indicates that a security threat is present when there is no actual danger. These can lead to 'alert fatigue,' where analysts begin ignoring critical warnings due to the high volume of noise.
False Rejection Rate (FRR) is a biometric security metric that measures the probability that the system incorrectly rejects an authorized user. A high FRR leads to user frustration and decreased productivity as legitimate users are denied access.
File Integrity Monitoring (FIM) is a technology that monitors and alerts on unauthorized changes to critical system files, configuration files, and application binaries. It typically uses cryptographic hashing to detect when a file has been altered, deleted, or created by an unauthorized entity.
Fuzzing, or fuzz testing, is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The goal is to trigger crashes, memory leaks, or failed assertions to uncover previously unknown vulnerabilities.
A Golden Image is a standardized, pre-configured template of an operating system and application stack used for deploying new virtual machines or workstations. It ensures consistency, security baselines, and rapid scalability across an organization. It reduces the risk of configuration drift.
A Honeypot is a decoy system designed to lure attackers away from critical production systems and trick them into revealing their tactics. By monitoring interactions with the honeypot, analysts can gather intelligence on attacker behavior without risking real data.
An Incident Response Playbook is a documented, step-by-step set of instructions used by security analysts to respond to specific types of security incidents. These standardized workflows ensure consistency, reduce response times, and minimize human error. These documents often include decision trees and communication plans to ensure all stakeholders are notified promptly.
Indicator of Attack (IOA) is a piece of evidence that indicates an active attempt to compromise a system, focusing on the 'how' and 'why' of an attack. Unlike indicators of compromise, IOAs focus on behavioral patterns and intent rather than static artifacts like file hashes.
An Indicator of Compromise (IoC) is an artifact observed on a network or operating system that with high confidence indicates a computer intrusion. Examples include specific file hashes, malicious IP addresses, or unusual registry keys that signal a breach.
Interactive Application Security Testing (IAST) is a security testing method that combines elements of both SAST and DAST by analyzing code execution in real-time from within the application. It uses agents to monitor the application during runtime to identify vulnerabilities.
An Intrusion Detection System (IDS) is a monitoring tool that analyzes network traffic or system logs for signs of malicious activity or policy violations. It generates alerts for administrators but does not take active steps to block the detected traffic.
An Intrusion Prevention System (IPS) is a security appliance that monitors network traffic and actively blocks malicious activity in real-time. Unlike an IDS, an IPS can drop packets or reset connections to prevent an attack from reaching its target.
A Jump Server is a hardened server used to manage devices in a separate security zone, such as a DMZ or a production environment. It acts as a single, controlled entry point for administrators to access sensitive systems securely. This minimizes the attack surface by limiting direct access.
Lateral Movement refers to the techniques cyber attackers use to move deeper into a network after gaining an initial foothold. The goal is to navigate through the environment to find high-value assets or sensitive data while avoiding detection.
Live Response is the process of collecting forensic data from a powered-on system while it is still running. This allows analysts to capture volatile data, such as running processes and network connections, which would be lost if the system were shut down.
Log Aggregation is the process of collecting log data from multiple diverse sources—such as servers, firewalls, and applications—and consolidating them into a single centralized repository. This allows analysts to correlate events across the environment more efficiently.
Mean Time to Respond (MTTR) is a metric that calculates the average time taken to neutralize a threat once it has been detected. It encompasses the time spent on analysis, containment, and the final eradication of the threat from the environment.
Memory Forensics is the analysis of a computer's volatile memory (RAM) to uncover evidence of malicious activity that may not be written to the disk. It is critical for detecting fileless malware, rootkits, and active network connections that vanish upon reboot.
Microsegmentation is a security technique that divides a data center or cloud environment into small, isolated zones to limit lateral movement. By applying granular security policies to individual workloads, organizations can prevent an attacker from moving from one server to another.
Mitigation is the act of reducing the impact or likelihood of a vulnerability being exploited when a full fix is not immediately possible. This often involves implementing compensating controls, such as firewall rules or disabling a specific service, to protect the system.
The MITRE ATT&CK Framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a common taxonomy for describing how attackers behave, helping analysts map observed activity to known threat actor patterns.
NetFlow is a network protocol developed by Cisco for collecting IP network traffic as it enters or exits an interface. It provides a summary of traffic flows, including source/destination IP addresses and ports, rather than capturing the full packet payload.
A Network Tap is a hardware device inserted at a specific point in a network cable to provide a permanent copy of all traffic passing through that point. Unlike port mirroring, it is a physical layer device that does not rely on switch CPU resources. It ensures zero packet loss.
The NIST Cybersecurity Framework (CSF) is a set of guidelines and best practices designed to help organizations manage and reduce cybersecurity risk. It is organized around five core functions: Identify, Protect, Detect, Respond, and Recover. It provides a common language for internal and external communication regarding cybersecurity posture.
The NIST Incident Response Lifecycle is a four-step framework consisting of Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity. This standardized process ensures that organizations handle security incidents in a structured manner to minimize damage and recover efficiently.
Open Source Intelligence (OSINT) is the collection and analysis of data gathered from publicly available sources to produce actionable intelligence. This includes social media, public records, domain registration data, and technical forums to identify potential threats or leaked credentials.
Order of Volatility refers to the sequence in which digital evidence should be collected based on how quickly the data will disappear. Analysts prioritize capturing the most volatile data, such as CPU cache and RAM, before moving to persistent storage like hard drives.
OSINT (Open Source Intelligence) is the collection and analysis of data gathered from publicly available sources to produce actionable intelligence. This includes social media, public records, domain registrations, and forums to identify potential threats. Analysts use OSINT to map an organization's external footprint and identify potential entry points for attackers.
Packet Capture (PCAP) is the process of intercepting and logging network traffic as it flows across a digital network. These files allow security analysts to perform deep packet inspection to identify malicious patterns, protocol anomalies, and the exact nature of a security breach.
PCAP (Packet Capture) refers to the process of intercepting and logging all traffic passing over a digital network. These files contain the complete packet data, including headers and payloads, allowing analysts to perform deep packet inspection. Tools like Wireshark are commonly used to open and analyze these files during forensic investigations.
A Playbook is a documented, step-by-step set of instructions used by security analysts to respond to a specific type of security incident. Playbooks ensure consistency in response and are often the basis for automation within a SOAR platform.
Port Mirroring, often implemented as a Switched Port Analyzer (SPAN) port, is a method of sending a copy of network packets seen on one switch port to a monitoring connection. This allows an IDS or packet analyzer to inspect traffic without interrupting flow. It provides visibility into network activity.
Post-incident activity, often called a Lessons Learned meeting, is the process of reviewing an incident to improve future security posture. The goal is to document what happened, how the team responded, and what changes are needed to prevent recurrence.
Privilege Escalation is the act of exploiting a bug, design flaw, or configuration error in an operating system or application to gain elevated access to resources. This can be vertical, gaining admin rights, or horizontal, gaining access to another user's account.
Privileged Access Management (PAM) is a framework of technologies and policies used to secure, manage, and monitor high-level permissions. It focuses on protecting accounts with administrative rights, often utilizing 'just-in-time' access to reduce the attack surface of a network.
The Pyramid of Pain is a conceptual model that ranks indicators of compromise based on how difficult they are for an adversary to change. It ranges from Hash Values (trivial) at the bottom to TTPs (tough) at the top of the pyramid.
Recovery is the final active phase of incident response where affected systems are restored to normal operation and validated for security. This includes restoring data from clean backups, changing passwords, and monitoring the environment to ensure the threat does not return.
Remediation is the process of fully resolving a vulnerability by eliminating the root cause, typically through patching or configuration changes. This is the most effective way to handle a security weakness, as it removes the possibility of the vulnerability being exploited.
Risk acceptance is a formal decision by management to acknowledge a security risk and choose not to take any action to mitigate or remediate it. This occurs when the cost of the fix outweighs the potential loss from a security incident.
Role-Based Access Control (RBAC) is an access control mechanism that restricts system access to authorized users based on their role within an organization. Permissions are assigned to specific roles, and users are then assigned to those roles to simplify administration.
Root Cause Analysis (RCA) is a systematic process used during the post-incident phase to identify the underlying cause of a security failure. Rather than addressing the immediate symptom, RCA seeks to find the fundamental flaw to prevent the incident from recurring.
Sandboxing is a security mechanism that runs untrusted code or files in an isolated virtual environment to observe their behavior without risking the host system. It is primarily used to analyze malware and detect zero-day exploits by monitoring system calls.
Secure Access Service Edge (SASE) is a cloud architecture model that converges network security functions, such as FWaaS and CASB, with wide-area networking (SD-WAN). It delivers security services directly to the user at the edge, rather than routing traffic back to a central data center.
Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider. It enables Single Sign-On (SSO), allowing users to access multiple applications with one set of credentials.
Security Content Automation Protocol (SCAP) is a suite of specifications for standardizing the way software flaws and security configurations are communicated. It integrates several standards, including CVE and CVSS, to automate vulnerability management and compliance checking. It enables consistent security reporting across diverse systems.
Security Information and Event Management (SIEM) is a security management system that provides real-time analysis of security alerts generated by applications and network hardware. It combines security information management (SIM) and security event management (SEM) to provide a holistic view of an organization's security posture through log aggregation and correlation.
A Security Operations Center (SOC) is a centralized unit that deals with security issues on an organizational and technical level. It employs a team of security analysts, engineers, and managers to monitor, detect, analyze, and respond to cybersecurity incidents in real-time.
Security Orchestration, Automation, and Response (SOAR) is a stack of compatible software programs that allows an organization to collect data about security threats and respond to low-level security events without human assistance. It integrates SIEM and other tools to automate incident response workflows through digital playbooks.
Server-Side Request Forgery (SSRF) is a vulnerability where an attacker induces a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This is often used to attack internal systems that are not reachable from the external network.
SIEM (Security Information and Event Management) is a security solution that provides real-time analysis of security alerts generated by applications and network hardware. It aggregates log data from multiple sources, correlates events to identify patterns, and provides a centralized dashboard for monitoring.
SOAR (Security Orchestration, Automation, and Response) is a stack of compatible software programs that allows an organization to collect data about security threats and respond to low-level security events without human assistance. It integrates SIEM and other tools to execute automated playbooks.
SQL Injection (SQLi) is a vulnerability that allows an attacker to interfere with the queries that an application makes to its database. By inserting malicious SQL code into input fields, attackers can view, modify, or delete sensitive data from the database.
STIX (Structured Threat Information Expression) is a standardized language used to describe cyber threat information so it can be shared consistently across organizations. It enables the machine-readable exchange of data regarding threat actors, campaigns, and indicators of compromise to improve collective defense.
Strategic Threat Intelligence provides a high-level overview of the threat landscape, focusing on long-term trends and motivations of threat actors. It is typically intended for executive leadership to inform risk management and budget decisions. It focuses on the 'who' and 'why' rather than the 'how.'
Structured Threat Information Expression (STIX) is a standardized language used to describe cyber threat intelligence. It allows organizations to share information about threat actors, campaigns, and indicators in a consistent, machine-readable format to improve collective defense and automation.
A tabletop exercise is a simulation-based discussion where stakeholders walk through their response to a hypothetical security scenario in a low-stress environment. It is used to validate incident response plans, identify gaps in communication, and improve coordination among team members.
Tactical Threat Intelligence focuses on the immediate technical indicators of a threat, such as IP addresses, file hashes, and malicious domains. This information is used by security analysts to update blocklists and detect active intrusions in real-time. It is highly volatile and changes frequently.
Tactics, Techniques, and Procedures (TTPs) describe the behavior of a threat actor. Tactics are the high-level goals, techniques are the specific methods used to achieve those goals, and procedures are the detailed step-by-step sequences of actions taken during an attack.
TAXII (Trusted Automated Exchange of Intelligence Information) is the application protocol used to exchange cyber threat intelligence via STIX. It defines the mechanisms for how threat data is transmitted over the network, facilitating automated sharing between security tools and organizations.
A threat actor is an individual or group that performs malicious actions against a target system or network. These actors can range from script kiddies and hacktivists to organized crime syndicates and state-sponsored advanced persistent threats (APTs) with varying levels of sophistication.
A Threat Intelligence Platform (TIP) is a software solution that collects, aggregates, and organizes threat data from multiple sources into a single location. It allows security analysts to analyze the data, identify trends, and share intelligence with other organizations or security tools.
A threat vector is the specific path or method an attacker uses to gain unauthorized access to a network or device. Common examples include phishing emails, unpatched software vulnerabilities, compromised credentials, and insecure wireless access points used to deliver a malicious payload.
A True Negative is a security state where a security tool correctly identifies that no malicious activity is occurring and does not trigger an alert. This represents the ideal state of a system where benign traffic is correctly identified as safe.
A True Positive is a security alert that correctly identifies an actual security threat or malicious activity. This occurs when the security tool triggers an alarm and the event is confirmed by an analyst to be a genuine attack or policy violation.
Trusted Automated Exchange of Intelligence Information (TAXII) is an application-layer protocol used to exchange cyber threat intelligence. It defines the mechanism for how STIX-formatted data is shared between threat intelligence platforms and security tools via a hub-and-spoke or peer-to-peer model.
User and Entity Behavior Analytics (UEBA) is a security process that uses machine learning and data science to establish a baseline of normal behavior for users and devices. It flags anomalies that may indicate insider threats, compromised accounts, or advanced persistent threats.
A vulnerability assessment is a systematic review of security weaknesses in an information system. It identifies, quantifies, and prioritizes vulnerabilities to determine the risk level, allowing organizations to implement the most critical patches or configuration changes first to reduce the attack surface.
The Vulnerability Management Life Cycle is a continuous process of identifying, classifying, remediating, and mitigating security weaknesses in an organization's assets. It typically consists of stages: discovery, prioritization, remediation, and verification to ensure risks are minimized.
A Web Application Firewall (WAF) is a specialized security filter that monitors, filters, and blocks HTTP traffic to and from a web application. It operates at Layer 7 of the OSI model to protect against attacks like SQL injection and cross-site scripting.
YARA rules are a tool used to identify and classify malware samples based on textual or binary patterns. They allow security analysts to create descriptions of malware families by defining specific strings or conditions that must be present in a file or process.
Zero Trust Architecture (ZTA) is a security model based on the principle of 'never trust, always verify,' regardless of whether the user is inside or outside the network perimeter. It requires strict identity verification and least-privilege access for every request.
We're adding new exams every week. Let us know what you're studying for, and we'll bump it up our priority list! (Typical turnaround: 2-3 days)
Your feedback has been submitted successfully. We appreciate your help in making Cert Sensei better!