The Rules That Govern Communications
Originally designed with no built-in sender authentication, this protocol sends email in cleartext.
What is SMTP?
This tool was most likely to have detected log4j, aggregating logs from across an organization's infrastructure, correlates events, and generates alerts.
What is SIEM?
This access control principle that grants users only the minimum permissions required to perform their job function.
What is least privilege?
This national vulnerability database is operated by the MITRE Corporation and assigns a unique identifier to each disclosed vulnerability.
What is the CVE database?
This type of attack is where malicious code is inserted into a vendor's legitimate software before it is distributed to customers.
What is a supply chain attack?
The three-protocol combination that retrofits authentication onto SMTP — one verifies which servers send email for a domain, the second adds a cryptographic signature, and the third tells recievers what to do if the first two fail.
What are SPF, DKIM, and DMARC?
A security control that prevents sensitive data from leaving the network, sitting at egress points to inspect outbound traffic.
What is DLP (Data Loss Prevention)?
These four steps of the IAA framework in order, from claiming an identity to recording the event.
What are Identification, Authentication, Authorization, and Accounting?
This scoring system rates vulnerabilities on a severity scale from 0.0 to 10.0, with 9.0-10.0 being classified as critical.
What is CVSS (Common Vulnerability Scoring System)?
This cybersecurity firm discovered the SolarWinds compromise while investigating suspicious activity on its own network.
Who is FireEye?
This DNS record type can hand an attacker a complete list of every hostname in a domain in a single request, if misconfigured to allow unrestricted access.
What is a zone transfer (AXFR record)?
The type of security scan that an attacker can use from outside the network without credentials, seeing only what is exposed to the internet.
What is an external uncredentialed scan?
The numeric permission value in Linux that grants the owner read/write/execute permissions, the group read/execute, and others no access.
What is 750?
This compliance framework protects payment card data and is mandated by the major credit card companies.
What is PCI DSS?
This term is the length of time an attacker remains undetected inside a compromised network.
What is dwell time?
This attack technique encodes data inside DNS queries to exfiltrate information or maintain C2 communication, bypassing firewalls that allow DNS traffic without inspection.
What is DNS tunneling?
The exploit where a log message contained a special prefix, causing the system to evaluate the string as a remote resource lookup rather than just writing it to a file.
What is the log4j exploit?
This Linux command is used to grant fine-grained permissions to a specific user on a file or directory without changing group ownership.
What is setfacl?
This vulnerability lifecycle step follows identification and determines which vulnerabilities to fix first, taking into account asset value, exploitability, and potential business impact.
What is prioritization / evaluation?
The process of cryptographically verifying that a software package was built by its claimed author.
What is code signing?
Beyond simply keeping clocks synchronized, this reason is why NTP (Network Time Protocol) is considered security-critical.
What is certificate validation (and Kerberos authentication / log correlation during incident response)?
This reason caused the log4j vulnerability to be so widespread despite affecting just a single library.
What is transitive dependency?
This IAA step was successfully bypassed by the Twitter 2020 attackers by impersonating IT staff over the phone.
What is Authentication?
This tool would not detect an SQL injection vulnerability because it is a network and host scanner, not a web application scanner.
What is Nessus?
This document lists every component, library, and dependency in a piece of software — now increasingly required by compliance frameworks as a direct response to SolarWinds.
What is an SBOM (Software Bill of Materials)?