AP®︎ Cybersecurity: Topic 2.1 Flashcards

Using psychological tactics to manipulate a target into taking an action desired by an adversary

Creating a believable reason or invented situation for contacting a target and making a request seem legitimate

Impersonating someone with power over a target or claiming to relay that person's instructions

Stating or implying that a target will suffer negative consequences for refusing to comply

Creating social pressure by claiming that other people are already performing or approving an action

Pressuring a target to act by claiming that an opportunity, product, reward, or resource has limited availability

Pretending to be or know someone close to a target in order to establish trust

Imposing a deadline that pressures a target to act quickly, often to avoid a negative consequence

A person or organization that seeks to compromise devices, networks, applications, data, or supporting systems

A low-skilled adversary who uses tools created by others without understanding how they work, often for greed or recognition

An adversary who illegally compromises systems to promote a social, political, or personal cause

A malicious person who uses legitimate organizational credentials or authorized access, often from greed, revenge, or outside recruitment

An ideologically motivated adversary seeking broad fear, harm, or disruption to populations or civil infrastructure

An organized, profit-seeking adversary operating across national boundaries, commonly through ransomware or intellectual-property theft

Reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection; attacks may omit, repeat, or revisit phases

The attack phase in which an adversary gathers information about a target and possible routes of attack

Information gathered from freely available public sources, often during reconnaissance

The attack phase in which an adversary establishes a first foothold on a target system, often through social engineering or weak credentials

The attack phase in which an adversary establishes a way to maintain access without repeating the initial compromise

Communication through which an adversary sends commands to a compromised device and receives output or collected information

Malware that enables unauthorized remote control of a device and can help an adversary maintain access

Malware designed to provide privileged access while helping conceal malicious activity

The attack phase in which an adversary accesses additional systems or accounts, often seeking elevated permissions and more valuable resources

The attack phase in which an adversary carries out objectives such as collecting or exfiltrating data, disrupting services, or destroying data

The unauthorized transfer of data out of a target environment

The attack phase in which an adversary conceals evidence by editing logs, deleting malware, or removing other planted files

Anything valuable, including money, intellectual property, data, infrastructure, physical property, or reputation

A weakness or flaw associated with an asset that could allow compromise

A potential source capable of exploiting a vulnerability and compromising an asset

The action taken to exploit a vulnerability and compromise an asset

The possibility of loss or harm when a threat can exploit a vulnerability to compromise an asset

Evaluating a specific risk by considering the likelihood that a vulnerability will be exploited and the severity of the resulting damage

The probability or practical chance that a specific vulnerability will be exploited, based on target value, exploit difficulty, and likely adversaries

The projected damage if an attack succeeds, including financial, operational, reputational, and other consequences

A risk assessment that assigns descriptive ratings such as low, medium, high, or severe

A risk assessment that assigns a numerical score or quantifiable impact, such as a monetary estimate

For each risk, record the asset and value, threat, vulnerability and exploit path, likelihood, impact, and final rating

Choosing how to handle an assessed risk through avoidance, transference, mitigation, or acceptance

Stopping the activity that generates a risk

Placing some burden or consequences of a risk on another entity, such as an insurer or contractor

Implementing security controls to reduce the likelihood or impact of a risk

The risk remaining after avoidance, transference, and mitigation have been applied where appropriate

Acknowledging and choosing to live with a remaining level of risk because absolute security is unattainable

A solution that costs less to install and maintain than the expected loss from the attack it addresses

A safeguard intended to prevent, detect, or correct a security problem

The three core security objectives: confidentiality, integrity, and availability

Ensuring that only authorized individuals, systems, or processes can access data

Ensuring that data are accurate, trustworthy, and protected from unauthorized alteration

Ensuring that data and services are accessible to authorized users when needed

A control that provides security in physical space, such as a lock, fence, camera, bollard, or guard

A control that provides security in the digital space, such as a firewall, anti-malware software, or encryption

A rule, guideline, policy, or procedure specifying required security, such as a password policy or incident response plan

A control intended to address a vulnerability and stop an adversary from successfully attacking

A control intended to identify an attack when it occurs or provide evidence that it occurred

A control intended to fix a problem and help restore a system to an operational state

Using overlapping controls across multiple layers so different threats are addressed and one failed control does not cause complete compromise