Word Notes

An authentication process that requires two different factors before granting access.

CyberWire Glossary link: https://thecyberwire.com/glossary/two-factor-authentication

Learn more about your ad choices. Visit megaphone.fm/adchoices

From the intrusion kill chain model, the delivery of a “lure” to a potential victim by pretending to be some trustworthy person or organization in order to trick the victim into revealing sensitive information. According to Knowbe4, the word “phishing” first appeared in a Usenet newsgroup called AOHell in 1996 and some of the very first phishing attacks used AOL Instant Messenger to deliver fake messages purportedly from AOL employees in the early 2000s. The word is part of l33tspeak that started in the early days of the internet (1980s) as a shorthand to let readers know the author was part of the hacker community. In this case, the letters “ph” replace the letter “f” in the word fishing, as in “I fish, with an ‘f,’ for bass in the lake.” In hacking, “I Phish, with a ‘ph,’ for login credentials from key employees at my target’s organization.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A cloud based sensitive information management system that allows users access across multiple devices.

CyberWire Glossary link: https://thecyberwire.com/glossary/icloud-keychain

Audio reference link: Ellen’s Tips For iOS, 2022. How To Master iCloud Keychain to Keep Your Passwords Safe and Secure [Video]. YouTube. https://www.youtube.com/watch?v=Tl3E29iUvgE 

Learn more about your ad choices. Visit megaphone.fm/adchoices

A subset of the internet where communications between two parties or client-server transactions are obscured from search engines and surveillance systems by layers of encryption. The U.S. Navy designed the original Darknet by developing The Onion Router network, or TOR, back in the 1990s. Roger Dingledine and Nick Mathewson deployed the first alpha implementation in 2002 with some initial funding by the Electronic Frontier Foundation (EFF.) The TOR Project became a non-profit in 2006 and is funded by the U.S, Sweden, different NGOs, and individual sponsors.

Learn more about your ad choices. Visit megaphone.fm/adchoices

1. A wireless access point installed by employees in an office or data center environment as a convenience to connectivity without the consent or the knowledge of the network manager. 2. A wireless access point, sometimes called an Evil Twin, installed by a cyber adversary in or near an office or data center environment designed to bypass security controls, gain access, and/or surveil the network traffic of the victim’s network. Both kinds, the employee installed and the adversary installed rogue access points, increase the attack surface of the organization. The employee installed device, because of its electronic footprint range, might make it easier for hackers and mischief makers outside of the organization’s network to bypass the corporate security controls and gain access without permission. The adversary installed device is designed specifically to bypass the security controls of the target network.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A network mapping tool that pings IP addresses looking for a response and can discover host names, open communications ports, operating system names and versions. Written and maintained by Gordon Lyon, a.k.a. Fyodor, it is a free and open source software application used by both system admins and hackers alike and has been a staple in the security community for well over two decades.

CyberWire Glossary link: https://thecyberwire.com/glossary/nmap

Learn more about your ad choices. Visit megaphone.fm/adchoices

A cyber threat intelligence analysis model that defines relationship pairs between four core components in the shape of a diamond of adversary playbook activity across the intrusion kill chain: the adversary, their capability, the infrastructure used or attacked, and the victim.

CyberWire Glossary link: https://thecyberwire.com/glossary/diamond-model

Audio reference link: “Diamond Presentation v2 0: Diamond Model for Intrusion Analysis – Applied to Star Wars’ Battles,” Andy Pendergrast and Wade Baker, ThreatConnect, YouTube, 4 February 2020.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unsolicited, unwanted, and sometimes malicious electronic messages indiscriminately transmitted to a large number of people.

CyberWire Glossary link: https://thecyberwire.com/glossary/spam

Audio reference link: zumpzump, 2007. Monty Python - Spam [Video]. YouTube. URL https://www.youtube.com/watch?v=anwy2MPT5RE.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A US Department of Homeland Security agency tasked with supporting cyber and physical security for US critical infrastructure.

CyberWire Glossary link: https://thecyberwire.com/glossary/cybersecurity-and-infrastructure-security-agency

Audio reference link: CISA, 2021. CISA Director Jen Easterly’s Keynote at Black Hat USA 2021 [Video]. YouTube. URL https://www.youtube.com/watch?v=q7bu-L-m4K4.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The act of searching through an organization's trash for discarded sensitive material. 

CyberWire Glossary link: https://thecyberwire.com/glossary/dumpster-diving

Audio reference link: “Better Call Saul jimmy digs in the Sandpiper trash scene,” uploaded by Robert Bowersock, 18 September 2022.

Learn more about your ad choices. Visit megaphone.fm/adchoices