CompTIA CySA+ complete index with explanation

application programming interface (API) integration

The applications on either end of the API are synchronized and protecting the integrity of the information that passes through the API. It also enables proper updating and versioning required in many environments.

application wrapping

Technique to protect mobile devices and the data they contain. Application wrappers (implemented as policies) enable administrators to set policies that allow employees with mobile devices to safely download an app, typically from an internal store.

Arachni

A Ruby framework for assessing the security of a web application.

asset criticality

A measure of how essential an asset is to the organization’s business.

asset tagging

Process of placing physical identification numbers of some sort on all assets.

asset value (AV)

Value of an asset. Multiplied by the exposure factor (EF) to calculate single loss expectancy (SLE).

asymmetric algorithms

Algorithms that use both a public key and a private or secret key. The public key is known by all parties, and the private key is known only by its owner.

atomic execution

A set of instructions either execute in order and in entirety or the changes they make are rolled back or prevented Atomic operations in concurrent programming are program operations that run independently of any other processes (threads). Making the operation atomic consists of using synchronization mechanisms in order to make sure that the operation is seen, from any other thread, as a single, atomic operation. This increases security by preventing one thread from viewing the state of the data when the first thread is still in the middle of the operation.

Attack Complexity (AC)

CVSS base metric that describes the difficulty of exploiting the vulnerability.

attack frameworks

Frameworks and methodologies that include security program development standards, enterprise and security architect development frameworks, security control development methods, corporate governance methods, and process management methods.

attack vector

A segment of the communication path that an attack uses to access a vulnerability.

Attack Vector (AV)

CVSS base metric that describes how the attacker would exploit the vulnerability.

attestation

Process in which the software and platform components have been identified, or “measured,” using cryptographic techniques.

attribute-based access control (ABAC)

Authentication system that grants or denies user requests based on arbitrary attributes of the user and arbitrary attributes of the object, and environment conditions that may be globally recognized.

Authentication Header (AH)

IPsec component that provides data integrity, data origin authentication, and protection from replay attacks.

authentication period

How long a user can remain logged in.

authentication server

In the 802.1X framework, the centralized device that performs authentication.

authenticator

In the 802.1X framework, the device through which the supplicant is attempting to access the network.

automated malware signature creation

A method of identifying malware in which the AV software monitors incoming unknown files for the presence of malware and analyzes the file based on both classifiers of file behavior and classifiers of file content.

Availability (A)

CVSS base metric that describes the disruption that might occur if the vulnerability is exploited.