Ports
80
HTTP
Software that encrypts files and demands payment for the key
ransomware
Playbook with set of procedures that an organization follows to respond and recover from cybersecurity incidents
Incident Response Plan
Monitors, detects, and responds to threats on endpoints such as laptops, desktops, and servers
Endpoint Detection and Response EDR
SOC
Security Operations Center
443
HTTPS
Fraudulent emails that pretend to be from trusted sources to steal credentials
phishing
First step in an IRP plan
Preparation
Monitors, detects, and responds to suspicious or malicious activity across an organization’s network.
Network Detection and Response NDR
IOT
Internet of Things
53
DNS
Overwhelming a site with traffic to make it unavailable
DDoS
The final phase where teams analyze what went well or wrong
lessons learned
Controls incoming and outgoing traffic based on rules
Firewall
RDP
Remote Desktop Protocol
22
SSH
Trying many password combinations to guess credentials
brute-force
Cyberattack scenario to test and improve organization's incident response plan
Tabletop Exercise
Scans systems, networks, or applications to find weaknesses or misconfigurations
Vulnerability Scanner
RAT
Remote Access Trojan
25
SMTP
Inserting malicious script into webpage
cross-site scripting
The person who coordinates the response, ensures tasks are executed, and communicates with stakeholder
Incident Commander/Manger
Aggregates and analyzes security data from across an organization's infrastructure
SIEM
LDAP
Lightweight Directory Access Protocol