The tag has no usage guidance.

learn more… | top users | synonyms (1)

1
vote
1answer
53 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
1
vote
1answer
82 views

difference between need to know, least privilege and confidential

I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing? In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
4
votes
1answer
68 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
6
votes
2answers
74 views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
3
votes
0answers
26 views

Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, what is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an ...
0
votes
1answer
41 views

Is there a 'key space' equivalent for encryption keys?

If a key space is the term given to the collection of all possible decryption keys for a given cryptosystem, then what is the collection of all possible encryption keys called?
0
votes
2answers
69 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
5
votes
1answer
76 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
0
votes
1answer
19 views

Technical term needed: Per default secured / blacklist vs whitelist

I'm currently working on a homework and missing a technical term / known best practice to describe what I have learned or what I feel that is better. It is about a publish / subscribe architecture, ...
0
votes
2answers
50 views

Confusing definitions of “parasitic virus” and “worm”

I was studying for CISSP certification when I came across the question "what type of virus attaches itself to an executable?" The answer was "parasitic". I find terms relating to viruses and malware ...
3
votes
3answers
73 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
1
vote
2answers
62 views

Is steganography a part of “cryptography”?

In preparing for a security exam, the prep book I'm reading states: In the field of cryptography, the topic of encryption gets by far the most attention ... ... Other techniques such as ...
6
votes
1answer
51 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
1
vote
1answer
52 views

Social engineering attacks terminology

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?
3
votes
2answers
46 views

What is the message called someone sends to verify a key?

Suppose Alice wants to check if Bob has a certain keypair. Alice could send some random payload to Bob and let Bob sign that payload with his private key. Alice is now able to check if the signature ...
1
vote
1answer
48 views

Terminology involving malware/virus/worm [duplicate]

What is the difference between "worms", "viruses", and "malware"? Some sources I've found said both viruses and worms infect files. But others say worms are stand alone programs, and are ...
1
vote
2answers
73 views

How do you call an attack vector that consists of filling the whole server ram using a single process?

I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That ...
0
votes
5answers
283 views

Is there a name for this flawed way of thinking about security? [closed]

I've recently encountered a developer who thinks that she can implement security on the client end of a web application. Breaking the security is as trivial as reading a few lines of Javascript and ...
3
votes
1answer
81 views

False Match vs False Acceptance

Studying up on biometric security terms, can someone clarify the difference between 'Match'/'Non-Match' and 'Rejection'/'Acceptance'?
0
votes
0answers
46 views

What is “Intentionally misleading Artificial Intelligence to create a misleading outcome” called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
4
votes
1answer
88 views

Terminology: What kind of security applies to industrial control systems, fire alarm systems, etc.?

I am wondering what you would call the kind of security that applies to systems such as industrial control (SCADA) systems, building automation systems, fire alarm systems, etc. These systems are ...
3
votes
2answers
139 views

What is the etymology of “Salt” in relation to password storage?

Simple question: When talking about appending a random string to a password before hashing in order to defend against dictionary attacks, we call it a salt. Why do we call it a salt?
0
votes
1answer
109 views

BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”

Note: Below are some information from searching around the Internet. To skip to my main question, go to the last line of this post. I've been searching around on how to change the Volume Master Key ...
3
votes
2answers
95 views

Registration or Enrollment?

When joining an authenticated network, I have seen the terms "Enrollment" and "Registration" used to describe the process of initially setting up your credentials on the network. "Authentication" ...
2
votes
1answer
53 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
1
vote
2answers
309 views

Difference between confidential, protected, and restricted data

I've been reading this article about Data Handling Security Measures, what's the difference between confidential, protected, and restricted data? Maybe I could understand it well with example of the ...
1
vote
1answer
56 views

What is the term for requiring a user to go through an additional activation/verification process on new devices only?

When I log onto my bank's website on a new device (be it a new phone or a web browser I haven't used before) it prompts me to send an activation code to my phone or email. I have to enter in this ...
0
votes
2answers
238 views

Is constantly downloading large amount of files from a web server considered DDoS?

For example, there's like a million files stored on a website (publicly, anyone with a link can get it), and I wrote a program to retrieve it one by one. Since obviously my program pings the server ...
3
votes
1answer
68 views

Who defined the term “fully homomorphic encryption”?

Rivest et al. proposed the concept of privacy homomorphisms, but did not distinguish between partial versus fully homomorphic encryption. Gentry seems to take for granted the idea that fully ...
2
votes
1answer
117 views

Protecting vs Securing

I encountered a question "true or false, replication is NOT a way to protect data". I answered true since I felt that protecting data meant securing the network and preventing unauthorized access to ...
3
votes
2answers
61 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the ...
6
votes
2answers
555 views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...
4
votes
1answer
196 views

Safe/Secured room?

I was involved in this project where development got outsourced to a consulting company, but to seal the deal the consulting company had to set up a room in their office with restricted access so that ...
1
vote
0answers
605 views

Data Security vs Information Security [closed]

Is Information Security field and Data Security field same? If not then, What is the basic difference between "Information" and "Data" in security field? Is Data Security a sub-category of ...
-1
votes
3answers
99 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
1
vote
2answers
85 views

What is the proper terminology for the various SMTP tunnel encryption solutions?

I'm writing up documentation and want to ensure that I'm using proper terminology. 1) What is the proper technical term for the SMTP tunnel encryption standard that typically starts on TCP/25, ...
9
votes
2answers
3k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
2
votes
1answer
612 views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
4
votes
1answer
85 views

Do voting machines rely on “security through obscurity”?

There was an interesting paper in 2013 from the University of Pennsylvania called Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities. One ...
5
votes
1answer
2k views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing on my master thesis, I am wondering to which resource I ...
3
votes
2answers
218 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
4
votes
3answers
8k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
1
vote
1answer
542 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
5
votes
1answer
246 views

What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
4
votes
2answers
138 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
15
votes
6answers
11k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
23
votes
3answers
44k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
3
votes
1answer
994 views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
3
votes
3answers
2k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
8
votes
3answers
10k views

Terminology: authentication vs verification

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...