Acronyms 1
Methods used by adversaries in cyber
attacks
Tactics, Techniques, and Procedures (TTP)
Controls user access and tracks their activities
Authentication, Authorization, and Accounting (AAA)
Expected monetary loss from a single security incident
Single Loss Expectancy (SLE)
Attack that tricks users into performing actions they didn’t intend
Cross-Site Request Forgery (CSRF)
Protocol for authorization and delegated access
Open Authorization (OAUTH)
Prevents unauthorized data transfers and leaks
Data Loss Prevention (DLP)
Protects web applications by filtering and monitoring HTTP traffic.
Web Application Firewall (WAF)
Offers cloud computing services
Cloud Service Provider (CSP)
Maximum acceptable time to restore operations
Recovery Time Objective (RTO)
Advanced firewall with added security features
Next-generation Firewall (NGFW)
Monitors and analyzes activities on a
single host
Host-based Intrusion Detection System (HIDS)
Core principles of information security
Confidentiality, Integrity, Availability (CIA)
Detects and prevents identified threats
Intrusion Protection System (IPS)
System for analyzing security data and events
Security Information and Event Management (SIEM)
Cryptographic hash function for data integrity
Secure Hashing Algorithm (SHA)
Estimates yearly losses from specific risks
Annualized Loss Expectancy (ALE)
Monitors and responds to threats on
endpoints
Endpoint Detection and Response (EDR)
Monitors network or system activities for malicious
activities
Intrusion Detection System (IDS)
Develops standards and guidelines for security
National Institute of Standards & Technology (NIST)
Devices owned by the company but used personally
Corporate Owned, Personally Enabled (COPE)
Frequency of a risk event happening per
year
Annualized Rate of Occurrence (ARO)
A symmetric encryption algorithm used to
secure data.
Advanced Encryption Standard (AES)
Email authentication method to prevent phishing
Domain-based Message Authentication, Reporting, and Conformance (DMARC)
Manages and provisions computing infrastructure using
code
Infrastructure as Code (IaC)
Security standards for handling payment card information.
Payment Card Industry Data Security Standard (PCI-DSS)