The tag has no wiki summary.

learn more… | top users | synonyms (1)

2
votes
1answer
27 views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
3
votes
1answer
55 views

Do voting machines rely on “security through obscurity”?

There was an interesting paper in 2013 from the University of Pennsylvania called Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities. One ...
3
votes
1answer
598 views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing on my master thesis, I am wondering to which resource I ...
2
votes
2answers
151 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
1
vote
3answers
839 views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
1
vote
1answer
346 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
4
votes
1answer
161 views

What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
4
votes
2answers
107 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
10
votes
6answers
1k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
11
votes
1answer
8k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
3
votes
1answer
220 views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
2
votes
3answers
669 views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
6
votes
3answers
1k views

Terminology: authentication vs verification

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
7
votes
2answers
417 views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
14
votes
3answers
2k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
8
votes
5answers
2k views

What is the distinguishing point between a script kiddie and a hacker?

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker ...
1
vote
1answer
378 views

What is the origin of the three factors of authentication?

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
0
votes
6answers
339 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - ...
1
vote
2answers
119 views

Is there a term for a “Master + extension” style password scheme?

I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component. So for Gmail my password might be correcthorsebatterystaple + ...
-2
votes
1answer
394 views

What is a “cuckoo's egg”? [closed]

I remember that Clifford Stoll wrote a book called "The Cuckoo's Egg". In the book, the reader follows him as he pursues a hacker through networks across the world. I seem to recall that the title ...
2
votes
3answers
132 views

Are all vulnerabilities security related?

Are all vulnerabilities security related? When people talk about vulnerabilities and security vulnerabilities, are they the same concept? My understanding is that a vulnerability is the a weakness in ...
7
votes
2answers
1k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
5
votes
4answers
216 views

When should I use the word hacker, cracker, or black hat?

Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics. To others, it's the aggressor, bad-guy, cracker, or ...
0
votes
1answer
131 views

What terms should I use to define security assessment work? [duplicate]

Possible Duplicate: What is the difference between a penetration test and a vulnerability assessment? I am tasked with hiring a consultant to do an analysis of our infrastructure security ...
4
votes
1answer
278 views

What does colluded truncation attack mean?

I'm doing my final year engineering project. I went through some ieee papers and came across something called colluded truncation attack. Can someone explain what it is. I'm planning to do the project ...
6
votes
2answers
963 views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
4
votes
1answer
50 views

Looking for a taxonomy of anonymization or re-identification properties

We are working with personally identifiable information that needs to be de-identified. Is there an existing hierarchy or taxonomy of different kinds of re-identification properties?
7
votes
3answers
881 views

Security fields: AppSec vs. InfoSec vs. NetSec, etc

When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within ...
8
votes
7answers
1k views

Definition of Software Security

I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article. Most of the books starts already assuming that the user knows what that is, and they're ...
10
votes
1answer
2k views

Oligomorphism vs polymorphism vs metamorphism in malware

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
8
votes
2answers
190 views

Vulnerability Assessments - Vulnerability Taxonomies?

All, First question on here so please be as gentle as you can :-) I've been looking around for any writings or papers on a standard for classifying vulnerabilities. Not from a severity/risk/impact ...
3
votes
3answers
338 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
5
votes
4answers
661 views

What is War Dialing?

The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?
17
votes
6answers
6k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
6
votes
3answers
442 views

Malware nomenclature

If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like? If one exists could someone explain it or ...