AP®︎ Cybersecurity: Unit 2 Flashcards

Using psychological tactics to manipulate a target into taking an action desired by an adversary

Creating a believable reason or invented situation for contacting a target and making a request seem legitimate

Impersonating someone with power over a target or claiming to relay that person's instructions

Stating or implying that a target will suffer negative consequences for refusing to comply

Creating social pressure by claiming that other people are already performing or approving an action

Pressuring a target to act by claiming that an opportunity, product, reward, or resource has limited availability

Pretending to be or know someone close to a target in order to establish trust

Imposing a deadline that pressures a target to act quickly, often to avoid a negative consequence

A low-skilled adversary who uses tools created by others without understanding how they work, often for greed or recognition

An adversary who illegally compromises systems to promote a social, political, or personal cause

A malicious person who uses legitimate organizational credentials or authorized access, often from greed, revenge, or outside recruitment

An ideologically motivated adversary seeking broad fear, harm, or disruption to populations or civil infrastructure

An organized, profit-seeking adversary operating across national boundaries, commonly through ransomware or intellectual-property theft

Reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection; attacks may omit, repeat, or revisit phases

The attack phase in which an adversary gathers information about a target and possible routes of attack

Information gathered from freely available public sources, often during reconnaissance

The attack phase in which an adversary establishes a first foothold on a target system, often through social engineering or weak credentials

The attack phase in which an adversary establishes a way to maintain access without repeating the initial compromise

Communication through which an adversary sends commands to a compromised device and receives output or collected information

Malware that enables unauthorized remote control of a device and can help an adversary maintain access

Malware designed to provide privileged access while helping conceal malicious activity

The attack phase in which an adversary accesses additional systems or accounts, often seeking elevated permissions and more valuable resources

Gaining permissions beyond those originally available, often to access protected systems, accounts, or data

The attack phase in which an adversary carries out objectives such as collecting or exfiltrating data, disrupting services, or destroying data

The unauthorized transfer of data out of a target environment

The attack phase in which an adversary conceals evidence by editing logs, deleting malware, or removing other planted files

The possibility of loss or harm when a threat can exploit a vulnerability to compromise an asset

Anything valuable, including money, intellectual property, data, infrastructure, physical property, or reputation

A potential source capable of exploiting a vulnerability and compromising an asset

A weakness or flaw associated with an asset that could allow compromise

Evaluating a specific risk by considering the likelihood that a vulnerability will be exploited and the severity of the resulting damage

The probability or practical chance that a specific vulnerability will be exploited, based on target value, exploit difficulty, and likely adversaries

The projected damage if an attack succeeds, including financial, operational, reputational, and other consequences

A risk assessment that assigns a numerical score or quantifiable impact, such as a monetary estimate

A risk assessment that assigns descriptive ratings such as low, medium, high, or severe

Stopping the activity that generates a risk

Placing some burden or consequences of a risk on another entity, such as an insurer or contractor

Implementing security controls to reduce the likelihood or impact of a risk

Acknowledging and choosing to live with a remaining level of risk because absolute security is unattainable

The risk remaining after avoidance, transference, and mitigation have been applied where appropriate

A safeguard intended to prevent, detect, or correct a security problem whose installation and maintenance cost less than the expected loss it addresses

The three core security objectives: confidentiality, integrity, and availability

Ensuring that only authorized individuals, systems, or processes can access data

Ensuring that data are accurate, trustworthy, and protected from unauthorized alteration

Ensuring that data and services are accessible to authorized users when needed

A control that provides security in physical space, such as a lock, fence, camera, bollard, or guard

A control that provides security in the digital space, such as a firewall, anti-malware software, or encryption

A rule, guideline, policy, or procedure specifying required security, such as a password policy or incident response plan

A control intended to address a vulnerability and stop an adversary from successfully attacking

A control intended to identify an attack when it occurs or provide evidence that it occurred

A control intended to fix a problem and help restore a system to an operational state

A detective control that monitors network or system activity and alerts defenders when it identifies suspicious behavior

A preventative control that monitors network traffic and automatically blocks activity identified as malicious

A system that centrally collects, correlates, and analyzes security logs and events to detect suspicious activity and support investigation

Using overlapping controls across multiple layers so different threats are addressed and one failed control does not cause complete compromise

Using social engineering to manipulate an authorized person into granting access to a restricted area

Entering a restricted area by following close behind an authorized person without that person's awareness or knowledge

Watching or recording a user accessing sensitive information so it can be used later

Searching a target's physical trash for information that can help achieve an attack objective

Copying an authorized user's access card so the duplicate can access resources permitted to the original credential

Natural events such as fires, floods, earthquakes, and severe storms that can damage facilities, devices, data, or services

A loss, reduction, or surge of electrical power that can interrupt availability, damage equipment, or cause data loss

Direct access to a device that can enable theft, unauthorized data access, hardware tampering, or installation of malicious peripherals

A device attached to a computer that records a user’s keystrokes to capture credentials or other information

Risk in which sensitive information or critical systems are physically exposed without sufficiently restricted and controlled access

Risk in which an exposed noncritical or nonsensitive asset could provide a foothold for access to more valuable resources

Risk in which the vulnerable asset has low value, exploitation is unlikely, and the resulting harm would be limited

A managerial control that teaches employees to detect social engineering, avoid admitting others with their badges, and help prevent device theft

A managerial control specifying required protections for workplace devices, documents, and information, sometimes with stronger tiers for sensitive data

A requirement to remove or secure sensitive papers and exposed information when a workstation is unattended

A physical screen barrier that limits viewing from outside the intended position and mitigates shoulder surfing

A device that protects equipment from damaging voltage spikes but normally does not provide backup power

A limited backup power source that keeps devices operating briefly or allows an orderly shutdown when normal power fails

Fences and controlled gates that define a physical perimeter and deter, restrict, or regulate approaches to a protected area

A sturdy post that restricts vehicles from approaching entrances, equipment, or other protected areas

A restraint on a door, cabinet, or computer that helps prevent unauthorized entry, theft, or hardware access

An entry control that denies unauthorized badges and records which credential was used at a location and time

A controlled two-door passage in which the first door generally closes before the second opens, limiting entry on one authorization

A physical entrance control that limits how many people can pass for each authorization

Blocking or limiting USB device access to prevent external drives or malicious peripherals from compromising a computer

A larger-scale backup power source that can support a building or critical systems during an extended outage

A control that visually monitors a designated space and can preserve footage of people, movements, and actions

A control that detects movement in a monitored area and raises an alert without identifying the person or action

A person who monitors physical activity, interprets suspicious behavior, and can question individuals or begin an immediate response

Employees notice unauthorized people or suspicious behavior in their workspace and alert security for investigation

Position cameras for useful coverage and angles over likely actions and ingress or egress points while limiting blind spots, obstructions, and tampering

Place sensors in sensitive, low-traffic areas where movement is unexpected, ideally within camera coverage; avoid busy areas that generate false alarms

A guard who remains at one location to provide continuous protection, especially at entrances, traffic funnels, or high-value assets

A guard who moves through an area, providing broad, unpredictable coverage suited to perimeters and exterior spaces

Software that analyzes faces in camera footage and can alert defenders when an unauthorized individual enters a controlled area

Records showing the credential, door, and time of an access attempt along with how long the door remained open, which can reveal suspicious entry but not prove who carried the badge

An alert triggered by normal or harmless activity rather than an actual security incident