The tag has no wiki summary.

learn more… | top users | synonyms (1)

3
votes
2answers
53 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the ...
4
votes
2answers
108 views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...
4
votes
1answer
113 views

Safe/Secured room?

I was involved in this project where development got outsourced to a consulting company, but to seal the deal the consulting company had to set up a room in their office with restricted access so that ...
1
vote
0answers
37 views

Data Security vs Information Security [closed]

Is Information Security field and Data Security field same? If not then, What is the basic difference between "Information" and "Data" in security field? Is Data Security a sub-category of ...
-1
votes
3answers
79 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
1
vote
2answers
48 views

What is the proper terminology for the various SMTP tunnel encryption solutions?

I'm writing up documentation and want to ensure that I'm using proper terminology. 1) What is the proper technical term for the SMTP tunnel encryption standard that typically starts on TCP/25, ...
4
votes
2answers
502 views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
2
votes
1answer
113 views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
4
votes
1answer
69 views

Do voting machines rely on “security through obscurity”?

There was an interesting paper in 2013 from the University of Pennsylvania called Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities. One ...
3
votes
1answer
961 views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing on my master thesis, I am wondering to which resource I ...
2
votes
2answers
160 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
1
vote
3answers
2k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
1
vote
1answer
385 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
4
votes
1answer
181 views

What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
4
votes
2answers
118 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
12
votes
6answers
3k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
13
votes
1answer
16k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
3
votes
1answer
330 views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
3
votes
3answers
1k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
7
votes
3answers
3k views

Terminology: authentication vs verification

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
7
votes
2answers
606 views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
14
votes
3answers
3k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
10
votes
6answers
3k views

What is the distinguishing point between a script kiddie and a hacker?

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker ...
1
vote
1answer
438 views

What is the origin of the three factors of authentication?

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
0
votes
6answers
349 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - ...
1
vote
2answers
138 views

Is there a term for a “Master + extension” style password scheme?

I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component. So for Gmail my password might be correcthorsebatterystaple + ...
-2
votes
1answer
526 views

What is a “cuckoo's egg”? [closed]

I remember that Clifford Stoll wrote a book called "The Cuckoo's Egg". In the book, the reader follows him as he pursues a hacker through networks across the world. I seem to recall that the title ...
2
votes
3answers
136 views

Are all vulnerabilities security related?

Are all vulnerabilities security related? When people talk about vulnerabilities and security vulnerabilities, are they the same concept? My understanding is that a vulnerability is the a weakness in ...
8
votes
2answers
2k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
5
votes
4answers
229 views

When should I use the word hacker, cracker, or black hat?

Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics. To others, it's the aggressor, bad-guy, cracker, or ...
0
votes
1answer
146 views

What terms should I use to define security assessment work? [duplicate]

Possible Duplicate: What is the difference between a penetration test and a vulnerability assessment? I am tasked with hiring a consultant to do an analysis of our infrastructure security ...
4
votes
1answer
323 views

What does colluded truncation attack mean?

I'm doing my final year engineering project. I went through some ieee papers and came across something called colluded truncation attack. Can someone explain what it is. I'm planning to do the project ...
6
votes
2answers
1k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
4
votes
1answer
51 views

Looking for a taxonomy of anonymization or re-identification properties

We are working with personally identifiable information that needs to be de-identified. Is there an existing hierarchy or taxonomy of different kinds of re-identification properties?
8
votes
3answers
1k views

Security fields: AppSec vs. InfoSec vs. NetSec, etc

When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within ...
8
votes
7answers
2k views

Definition of Software Security

I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article. Most of the books starts already assuming that the user knows what that is, and they're ...
10
votes
1answer
2k views

Oligomorphism vs polymorphism vs metamorphism in malware

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
8
votes
2answers
203 views

Vulnerability Assessments - Vulnerability Taxonomies?

All, First question on here so please be as gentle as you can :-) I've been looking around for any writings or papers on a standard for classifying vulnerabilities. Not from a severity/risk/impact ...
3
votes
3answers
393 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
6
votes
4answers
776 views

What is War Dialing?

The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?
19
votes
6answers
8k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
6
votes
3answers
512 views

Malware nomenclature

If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like? If one exists could someone explain it or ...