Cyber Glossary

---

is an email authentication method that allows senders to associate a domain name with an

email message, thus vouching for its authenticity. A sender creates the DKIM by “signing” the email with a digital signature. This “signature” is located in the message's header.

is an email authentication protocol that uses Sender Policy Framework (SPF) and DKIM to determine the authenticity of an email message.

creates the DKIM by “signing” the email with a digital signature. This “signature” is located in the message's header.

is a form of zero-trust endpoint security. Instead of detecting or reacting to threats, it enforces controls that block and restrain harmful actions to prevent compromise. Application containment is used to block harmful file and memory actions to other apps and the endpoint. Application isolation is used to prevent other endpoint processes from altering or stealing from an isolated app or resources.

Authentic8 Silo; BitDefender™

Browser Isolation; CylancePROTECT; Menlo Security

Isolation Platform; Symantec Web Security Service

also known as endpoint threat detection and response, centrally collects and analyzes comprehensive endpoint data across your entire organization to provide a full picture of potential threats.

Carbon Black Cloud; Crowdstrike Falcon Insight; SentinelOne; Windows Defender Endpoint

are backup files that are fixed, unchangeable, and can be deployed to production servers immediately in case of ransomware attacks or other data loss.

is an electronic authentication method in which a computer user is granted access to a website or application only after successfully presenting two or more pieces of evidence to an authentication

mechanism: knowledge (e.g., password), possession (e.g., phone or key), and inherence (e.g., FaceID or hand print). MFA for remote email access can be enabled through most email providers.

Okta; Duo; LastPass; OneLogin; and Auth0.

software that uses predictive analytics driven by machine learning and artificial intelligence and combines with threat intelligence to detect and prevent malware and fileless non-malware attacks, identify malicious behavior, and respond to new and emerging threats that previously went undetected. For purposes of completing this application, NGAV refers to anti-virus protection that focuses on detecting and preventing malware on each individual endpoint. 

BitDefender™; Carbon Black; CrowdStrike Falcon Prevent; SentinelOne; Sophos;

Symantec

refers to a backup and recovery solution in which one copy of your organization's data is offline (i.e., disconnected) and cannot be accessed. If a file or system of files has no connection to the internet or a LAN, it can't be remotely hacked or corrupted.

is a cross-platform task automation and configuration management framework from Microsoft, consisting of a command-line shell and scripting language. It is used by IT departments to run tasks on multiple computers in an efficient manner. For example, Powershell can be used to install a new application across your organization.

is software that allows you to secure your privileged credentials in a

centralized, secure vault (i.e., a password safe). To qualify as PAM,

a product must allow administrators to create privileged access

accounts; offer a secure vault to store privileged credentials; and

monitor and log user actions while using privileged accounts.

 CyberArk and BeyondTrust.

refers to a service that provides Domain Name Service (DNS) protection (also known as DNS filtering) by blacklisting dangerous sites and filtering out unwanted content. It can also help to detect & prevent malware that uses DNS tunneling to communicate with a command and control server.

Zscaler; Quad9; OpenDNS; and

public sector PDNS.

is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a

network connection. The Microsoft RDP provides remote display

and input capabilities over network connections for Windows-based applications running on a server.

is a subsection within the field of computer security, wherein

software products and services combine security information

management and security event management. SIEM provides

real-time analysis of security alerts generated by applications and

network hardware.

is a centralized unit that deals with security issues on an organizational and technical level.

is an email authentication technique used to prevent spammers from sending messages on behalf of your domain. With SPF, your organization can publish authorized mail servers.

is a cloud service that gives you instantaneous, global visibility into where your IT systems might be vulnerable to the latest internet threats and how to protect against them. The tool is an ongoing process that includes proactive asset discovery, continuous monitoring, mitigation, remediation and defense tactics to protect your organization's modern IT attack surface from cyber threats.

Qualys; InsightVM by Rapid7; and Nessus® by Tenable™