InfoSec - ANSWER Combination of people, process, and technology
CIA - ANSWER Confidentiality, Integrity, Availability
Threat - ANSWER malicious or accidental action that compromises
confidentiality, integrity, or availability.
Vulnerability - ANSWER a weakness or bug in software that allows an
attacker to compromise a target. Often rated by CVSS score or severity
Exploit - ANSWER weaponized malicious code designed to exercise a
particular vulnerability to compromise a target
Risk - ANSWER the likelihood that a given threat will successfully exploit a
vulnerability, accounts for the outcome's severity
Vulnerability Management - ANSWER scanning assets to find vulnerabilities,
prioritizing them by risk. Aka "scanners" Ex: InsightVM, Tenable, Nessus &
Security Center, Qualys
Patch Management - ANSWER programs that push out the changes that
remediate (fix) vulnerabilities. Typically install updates. Ex: BigFix SCCM
AppSec - ANSWER web application security, scanning for problems in
custom made websites. Built using SDLC. Ex: SQL injection, XSS on a bank's
custom built website
Penetration Testing - ANSWER outside or internal team that ethically hacks
an org to report on weaknesses and recommend changes
Malware - ANSWER overarching term that includes all malicious code,
usually relies on exploiting a vulnerability
, Social Engineering - ANSWER manipulating humans using deception as part
of an attack Ex: phishing, pretext calling
Control - ANSWER tool (hardware/software) or process that prevents, detects,
or responds to security events Ex: firewall, anti-virus, background checks,
keycards, vuln scanner
Defense in depth - ANSWER concept of layered overlapping and redundant
controls. If one fails, another one still stops the attack
Blue Team - ANSWER InfoSec practitioners who defend their org on a day to
day basis (defense)
Red Team - ANSWER InfoSec practitioners who hack their own org to find
weaknesses (offensive)
Perimeter - ANSWER the part of their network that is accessible from the
internet, measured as number of IP addresses
CIO - ANSWER sign off on large deals, medium sized ones at smaller orgs
CISO - ANSWER Chief Information Security Officer. Defines high level
policy, program direction, hiring plans. Not many named accounts have this
position
Director of Security or IT - ANSWER often has budget authority. Defines
policies, not aware of day to day tool details or pain.
Manager - ANSWER implement policies, sometimes define them. Rarely have
budget authority
Security Analyst - ANSWER manages tools day to day, no budget power,
make the technical recommendation. Know pain and needs
DevOps and developers - ANSWER AppSpider tool user, treat the same
Analyst
IT teams - ANSWER patch systems. Not very useful, join meetings sometimes
CIA - ANSWER Confidentiality, Integrity, Availability
Threat - ANSWER malicious or accidental action that compromises
confidentiality, integrity, or availability.
Vulnerability - ANSWER a weakness or bug in software that allows an
attacker to compromise a target. Often rated by CVSS score or severity
Exploit - ANSWER weaponized malicious code designed to exercise a
particular vulnerability to compromise a target
Risk - ANSWER the likelihood that a given threat will successfully exploit a
vulnerability, accounts for the outcome's severity
Vulnerability Management - ANSWER scanning assets to find vulnerabilities,
prioritizing them by risk. Aka "scanners" Ex: InsightVM, Tenable, Nessus &
Security Center, Qualys
Patch Management - ANSWER programs that push out the changes that
remediate (fix) vulnerabilities. Typically install updates. Ex: BigFix SCCM
AppSec - ANSWER web application security, scanning for problems in
custom made websites. Built using SDLC. Ex: SQL injection, XSS on a bank's
custom built website
Penetration Testing - ANSWER outside or internal team that ethically hacks
an org to report on weaknesses and recommend changes
Malware - ANSWER overarching term that includes all malicious code,
usually relies on exploiting a vulnerability
, Social Engineering - ANSWER manipulating humans using deception as part
of an attack Ex: phishing, pretext calling
Control - ANSWER tool (hardware/software) or process that prevents, detects,
or responds to security events Ex: firewall, anti-virus, background checks,
keycards, vuln scanner
Defense in depth - ANSWER concept of layered overlapping and redundant
controls. If one fails, another one still stops the attack
Blue Team - ANSWER InfoSec practitioners who defend their org on a day to
day basis (defense)
Red Team - ANSWER InfoSec practitioners who hack their own org to find
weaknesses (offensive)
Perimeter - ANSWER the part of their network that is accessible from the
internet, measured as number of IP addresses
CIO - ANSWER sign off on large deals, medium sized ones at smaller orgs
CISO - ANSWER Chief Information Security Officer. Defines high level
policy, program direction, hiring plans. Not many named accounts have this
position
Director of Security or IT - ANSWER often has budget authority. Defines
policies, not aware of day to day tool details or pain.
Manager - ANSWER implement policies, sometimes define them. Rarely have
budget authority
Security Analyst - ANSWER manages tools day to day, no budget power,
make the technical recommendation. Know pain and needs
DevOps and developers - ANSWER AppSpider tool user, treat the same
Analyst
IT teams - ANSWER patch systems. Not very useful, join meetings sometimes
