Network Security Baselines
What is a firewall
This network device filters traffic between network segments based on predefined rules.
What is EDR (Endpoint Detection and Response)?
This type of security software actively monitors endpoints for malicious activity and can automatically respond to threats.
What is HTTPS?
This secure protocol replaces HTTP by encrypting web traffic using TLS.
What is a SIEM system?
(Security Information and Event Management) This centralized system collects and correlates logs from multiple sources to detect security incidents.
What is session hijacking (or a replay attack)?
This attack technique involves an attacker capturing a valid authentication token or session ID and reusing it to impersonate a legitimate user, bypassing the need to know their password
What is network segmentation?
This practice involves dividing a network into smaller segments to limit the spread of an attack
What is full disk encryption (FDE)?
This security feature encrypts an entire hard drive, protecting data if a device is lost or stolen.
What is SSH?
This secure protocol replaces Telnet for encrypted remote command-line access to network devices.
What is a false positive?
This term describes a legitimate, benign event that is mistakenly flagged as malicious by a security tool.
What is a collision attack?
This cryptographic attack exploits the mathematical possibility that two different inputs produce the same hash output, undermining the integrity guarantee that hashing is supposed to provide.
What is Zero Trust?
This security architecture assumes no user or device should be trusted by default, even inside the network perimeter.
What is antivirus / anti-malware software?
This type of security software is designed specifically to detect, quarantine, and remove malicious software.
What is S/MIME?
(Secure/Multipurpose Internet Mail Extensions)- This secure email protocol encrypts and digitally signs email content using certificates.
What is baselining?
This process establishes a normal pattern of network or system activity so that deviations can be detected.
What is a permission/access (or entitlement) review — sometimes called addressing privilege creep?
This IAM concept refers to periodically reviewing and revoking a user's accumulated permissions from role changes over time, preventing excessive access from building up unnoticed.
What is a DMZ (demilitarized zone)?
This buffer network segment sits between an internal trusted network and an untrusted network like the internet, hosting public-facing services.
What is application allow listing (whitelisting)?
This technique allows only pre-approved applications to run on a system, blocking everything else by default.
What is DNSSEC?
Domain Name System Security Extensions- This protocol adds cryptographic signatures to DNS responses to prevent spoofing and cache poisoning.
What is threat hunting?
This proactive practice involves actively searching a network for threats that have evaded existing security controls.
What is SQL injection?
This type of vulnerability occurs when an attacker can inject and execute arbitrary SQL commands through unsanitized user input, potentially exposing an entire backend database.
What is hardening?
This secure configuration practice involves disabling unnecessary services, ports, and default accounts on a system before it is deployed.
What is Mobile Device Management (MDM) for BYOD?
This management strategy lets an organization enforce security policies, like remote wipe and encryption, on personal devices used for work.
What is SFTP?
Secure File Transfer Protocol- This secure protocol replaces standard FTP by encrypting file transfers over an SSH connection.
What is SOAR ?
(Security Orchestration, Automation, and Response)- This platform automates predefined response actions to security alerts, combining playbooks with minimal human intervention
What is Mean Time to Respond (MTTR) — specifically Mean Time to Acknowledge/Detect in some frameworks?
This monitoring metric measures the time between an alert firing and a security team acknowledging and beginning to act on it, and is a key indicator of SOC efficiency.