IDS (Intrusion Detection System)

focuses on detecting threats and generating alerts without taking automatic action.

IPS (Intrusion Prevention System)

automatically takes action to stop or block threats when detected.

IDS vs IPS

IDS detects and alerts while IPS prevents and responds automatically.

Man-in-the-Middle Attack

an attacker intercepts and possibly alters communication between two parties.

Replay Attack

an attacker captures and retransmits valid data to gain unauthorized access.

Denial of Service (DoS)

an attack that overwhelms a system or network to make it unavailable.

Buffer Overflow

an attack that exploits memory by exceeding buffer limits to execute malicious code.

Slack Space

unused space in storage that may contain residual or hidden data.

Signature-Based Detection

identifies threats by matching known attack patterns or signatures.

Anomaly-Based Detection

detects threats by identifying deviations from normal behavior.

Behavior-Based Detection

monitors actions or behavior patterns to identify suspicious activity.

False Positive

a normal event incorrectly flagged as malicious.

False Negative

a malicious event incorrectly identified as normal.

Alert Fatigue

when excessive alerts cause security teams to ignore or miss important warnings.

SIEM (Security Information and Event Management)

aggregates logs and supports analysis and correlation across a network.

SOAR (Security Orchestration, Automation and Response

automates security responses using predefined workflows and reduces manual work

EDR (Endpoint Detection and Response)

monitors and protects endpoints like laptops

XDR (Extended Detection and Response)

integrates and analyzes data across multiple security layers beyond endpoints.

UBA (User Behavior Analytics)

focuses on analyzing user activity to detect abnormal behavior.

UEBA (User and Entity Behavior Analytics)

analyzes behavior of users and other entities like systems and devices.

APT (Advanced Persistent Threat)

a targeted and long-term attack where attackers remain in a system for surveillance

Packet Mirroring

copying network traffic to another system for monitoring or analysis.

SQL (Structured Query Language)

a language used to manage and query databases.

SQL Injection

an attack that inserts malicious SQL code to manipulate or access a database.

XSS (Cross-Site Scripting)

an attack that injects malicious scripts into web content affecting users’ browsers.

IDPS (Intrusion Detection and Prevention System)

combines detection and prevention capabilities into one system.

SOC (Security Operations Center)

a centralized team or facility responsible for monitoring and responding to security incidents.

VPN (Virtual Private Network)

provides secure communication using tunneling

Site-to-Site VPN

connects entire networks to each other securely.

Remote Access VPN

allows individual users to securely connect to a network remotely.

Host-to-Host VPN

secures communication between two specific devices.

Tunnel Mode (VPN)

encrypts and protects the entire original IP packet.

Transport Mode (VPN)

encrypts only the payload of the original packet.

HTTP (Hypertext Transfer Protocol)

a protocol used for transferring web data.

FTP (File Transfer Protocol)

a protocol used for transferring files between systems.

IPSec (Internet Protocol Security)

a suite of protocols that secures IP communications.

SMTP (Simple Mail Transfer Protocol)

a protocol used for sending email.

IKE (Internet Key Exchange)

negotiates security settings and establishes secure IPSec connections.

ESP (Encapsulating Security Payload)

provides encryption and integrity protection for IPSec traffic.

Asymmetric Encryption

uses a public key for encryption and a private key for decryption.

Hashing

converts data into a fixed-length value for integrity verification and is one-way.

Split Tunneling

allows some traffic through the VPN while other traffic bypasses it.

Default Deny

blocks all traffic unless explicitly allowed by rules.

Rule Ordering

determines how firewall or security rules are evaluated based on their sequence.