Security Operations

49 terms

Allowed Listing (software, identities, addresses)ISC2 · D7

These systems also alert designated IT security personnel if the attempt involves a resource not on a pre-approved list. Standalone security tools and integrated systems which provide these capabilities are now starting to incorporate anti-malware processes as part of their offerings; similarly, In this course, "blocked list" and "allowed list" replace "blacklist" and "whitelist." Anti-malware products have begun to incorporate these blocked listing /allowed listing management and use capabilities.

Alternate SiteISC2 · D7

A general term for a contingency or continuity of operations (COOP) site used to assume system or organizational operations in the event that the primary site is not usable for a period of time.

BackupISC2 · D7

A copy of files and programs made to facilitate recovery, if necessary.

BaselineISC2 · D7

The total inventory of all of a system's components, including hardware, software, data, administrative controls, documentation or user instructions. Types of baselines include: Enumerated baselines, which are inventory lists generated by systems cataloging, discovery and enumeration Build Security baselines associate the minimum acceptable set of security controls for each CI within a configuration baseline. Modification, update or patch baselines, which are subsets of a total system baseline. These would contain only those CIs which have been modified. or deployment baselines, which are configuration baselines for instances of a system being built for a specific purpose (such as security assessment) or environment (such as production or delivery to end users). tools. Configuration baselines, which have a revision or version identifier associated with each configuration item (CI).

BaseliningISC2 · D7

Creating a total inventory of a system, component by component, part by part.

Blocked Listing and Allowed Listing (software, identities, addresses)ISC2 · D7

Use of lists of blocked or allowed identities, whether as users, URLs, URIs, web addresses, IP addresses, geographic regions, hardware addresses, files or programs, as a means of controlling (prohibiting or permitting) their access, use or attempt to load and execute.

Change ManagementISC2 · D7

The formal process an organization uses to transition from the current state to a future state. This typically includes mechanisms to request, evaluate, approve, implement, verify and learn from the change.

Configuration ItemISC2 · D7

An aggregation of information system components that is designated for configuration management and treated as a single entity in the configuration management process. Item or aggregation of hardware, software, or both, which is designated for configuration management and treated as a single entity in the configuration management process.

Configuration Management (CM)ISC2 · D7

A collection of activities focused on establishing and maintaining the integrity of information technology products and information systems, through control of processes for initializing, changing and monitoring the configurations of those products and systems throughout the system development lifecycle.

Cyber ForensicsISC2 · D7

The practice of gathering, retaining and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

Disaster Recovery (DR)ISC2 · D7

The ability to provide IT services following an interruption, often at an alternate location.

DisruptionISC2 · D7

An unplanned event that causes an information system to be inoperable for a length of time (e.g., minor or extended power outage, extended unavailable network or equipment or facility damage or destruction).

Egress MonitoringISC2 · D7

Monitoring the flow of information out of an organization's control boundaries.

EntityISC2 · D7

Any form of user, such as a hardware device, software daemon, task, processing thread or human, which is attempting to use or access systems resources. Endpoint devices, for example, are entities that human (or nonhuman) users make use of in accessing a system. Should be subject to access control and accounting. See also User and Entity Behavior Analysis.

EradicationISC2 · D7

In incident response, the activities which remove the cause of the incident from the environment. This often requires the use of a formal root cause analysis process.

EventISC2 · D7

Any observable occurrence in a network or system.

False PositiveISC2 · D7

Incorrectly classifying a benign activity, system state or configuration as malicious or vulnerable

Forensics, Cyber ForensicsISC2 · D7

The examination of evidence related to suspected criminal activity. Cyber forensics refers to investigations of such activities involving information systems.

Full BackupISC2 · D7

Copies the entire system to backup media.

HackbackISC2 · D7

Actions taken by a victim of hacking to compromise the systems of the alleged attacker.

HardeningISC2 · D7

A reference to the process of applying secure configurations (to reduce the attack surface) and locking down various hardware, communications systems and software, including operating system, web server, application server, application. Hardening is normally performed based on industry guidelines and benchmarks such as those provided by the Center for Internet Security (CIS).

HeuristicsISC2 · D7

A method of machine learning, which identifies patterns of acceptable activity so that deviations from the patterns will be identified.

Honeypots/ HoneynetsISC2 · D7

Machines that exist on the network, but do not contain sensitive or valuable data; they are meant to distract and occupy malicious attackers or unauthorized intruders, as a means of delaying their attempts to access production data/assets. A number of machines of this kind, linked together a network or subnet, are referred to as a honeynet.

Hot SiteISC2 · D7

A fully operational offsite data processing facility equipped with hardware and software, to be used in the event of an information system disruption.

IncidentISC2 · D7

An event which actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits.

Incident ResponseISC2 · D7

The mitigation of violations of security policies and recommended practices.

IndicatorISC2 · D7

A technical artifact or observable occurrence that suggests an attack is imminent or is currently underway, or that a compromise may have already occurred.

Indicators of Compromise (IoC)ISC2 · D7

A signal that an intrusion, malware or other predefined hostile or hazardous set of events is occurring or has occurred.

Information Security Continuous Monitoring (ISCM)ISC2 · D7

Maintaining ongoing awareness of information security, vulnerabilities and threats to support organizational risk management decisions. [Note: The terms "continuous" and "ongoing" in this context mean that security controls and organizational risks are assessed and analyzed at a frequency to systems, networks and cyberspace, by assessing security control implementation and organizational security status in accordance with organizational risk tolerance, and within a reporting structure designed to make real-time, data-driven risk management decisions. sufficient to support risk-based security decisions to adequately protect organization information.] Ongoing monitoring sufficient to ensure and assure effectiveness of security controls related

Information Sharing and Analysis Center (ISAC)ISC2 · D7

Any entity or collaboration created or employed by public- or private-sector organizations, for purposes of gathering and analyzing critical cyber and related information in order to better understand security problems and interdependencies related to cyber systems, to ensure their availability, integrity and reliability.

IntrusionISC2 · D7

A security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system or system resource without having authorization to do so.

Intrusion Detection System (IDS)ISC2 · D7

A security service that monitors and analyzes network or system events for the purpose of finding and providing real time or near real-time warning of, attempts to access system resources in an unauthorized manner.

Intrusion Prevention Systems (IPS)ISC2 · D7

A security service that uses available information to determine if an attack is underway; it then sends alerts, but also blocks the attack from reaching its intended target.

LogISC2 · D7

A record of actions and events that have taken place on a computer system.

PatchISC2 · D7

A software component that, when installed, directly modifies files or device settings related to a different software component without changing the version number or release details for the related software component.

Patch ManagementISC2 · D7

The systematic notification, identification, deployment, installation and verification of operating system and application software code revisions. These revisions are known as patches, hot fixes and service packs.

Precursor(s)ISC2 · D7

Signals from events that suggest a possible change of conditions (internal or external to the organization) may alter the current threat landscape. An increase in tensions in the local political or social environment, or complaints or grievances by employees or customers going viral in social media, are examples of precursors.

ProvisioningISC2 · D7

Taking a particular configuration baseline, making additional or modified copies of it, then taking steps as necessary to properly place those copies into the environments they should belong in.

Ransom AttackISC2 · D7

Any form of attack, which threatens the destruction, denial or unauthorized public release or remarketing of private information assets. Usually involves encrypting these assets and withholding the decryption key until the ransom is paid by the victim.

RansomwareISC2 · D7

Malware used for the purpose of facilitating a ransom attack.