Terminology is the study of terms and their use.

learn more… | top users | synonyms (1)

3
votes
2answers
155 views
+50

Is array injection a vulnerability and what is the proper term for it?

When penetration testing I sometimes notice an undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk I ...
2
votes
0answers
21 views

Is FAR (False Accept Rate) a property of algorithm or a property of the system?

As known in biometrics: https://en.wikipedia.org/wiki/Biometrics#Performance False match rate (FMR, also called FAR = False Accept Rate): the probability that the system incorrectly matches the ...
13
votes
2answers
2k views

Is the injection in a NoSQL database architecture also called SQL injection?

Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection? For example an injection in code that communicates ...
1
vote
2answers
68 views

Do we still refer to a threat as a threat once it has been realised?

A threat is defined as something that might do harm but once a threat happens do we still refer to it as a threat? For instance, if malware infects our computer, do we still refer to the malware as a ...
2
votes
1answer
100 views

Incident response terminology

Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few ...
0
votes
2answers
49 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
1
vote
1answer
53 views

What is the difference between vulnerability identification and exploitation?

Are strings like AND '1' = '2 and <script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits? If so, when black-box testing a house made web application, ...
-4
votes
1answer
34 views

What is the difference between data and information when it comes to Data Security? [closed]

I'm currently enrolled for Data Security program and for our assignment the question is to differentiate data and information. What is the difference between those two?
17
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
2
votes
1answer
101 views

Who defined the term “end-to-end encryption”?

I am trying to find the origin of the term "end-to-end encryption", but have been unsuccessful until now.
1
vote
1answer
30 views

Terminology - DMZ

The term DMZ is used to describe a separation area between a trusted zone and an untrusted zone. Ex: internal network vs internet. Can it be used to refer to a separation area between a trusted zone ...
0
votes
1answer
37 views

Terminology - entry point, data source, sink

In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
0
votes
0answers
41 views

What's is a security vulnerability that lets you inject server-side code called?

What is the name for a security vulnerability, that lets you inject server-side code into one of their server-sides pages (say PHP or ASPX)? I have googled 'Code Injection' though I'm not sure this is ...
1
vote
0answers
62 views

What is “Intentionally misleading Artificial Intelligence to create a misleading outcome” called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
1
vote
1answer
35 views

Does this case fit the definition of a replay attack?

I read the definition of a replay attack on Wikipedia. However I don't know if the following case fits the description: An attacker captures a HTTP request sent to a web server, modifies the request ...
3
votes
1answer
72 views

Who defined the term “fully homomorphic encryption”?

Rivest et al. proposed the concept of privacy homomorphisms, but did not distinguish between partial versus fully homomorphic encryption. Gentry seems to take for granted the idea that fully ...
1
vote
1answer
59 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
23
votes
3answers
47k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
1
vote
1answer
199 views

difference between need to know, least privilege and confidential

I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing? In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
4
votes
1answer
77 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
6
votes
1answer
117 views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
3
votes
0answers
26 views

Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, what is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an AuthenticationToken....
0
votes
1answer
49 views

Is there a 'key space' equivalent for encryption keys?

If a key space is the term given to the collection of all possible decryption keys for a given cryptosystem, then what is the collection of all possible encryption keys called?
0
votes
2answers
98 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
5
votes
1answer
79 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
0
votes
1answer
19 views

Technical term needed: Per default secured / blacklist vs whitelist

I'm currently working on a homework and missing a technical term / known best practice to describe what I have learned or what I feel that is better. It is about a publish / subscribe architecture, ...
0
votes
2answers
58 views

Confusing definitions of “parasitic virus” and “worm”

I was studying for CISSP certification when I came across the question "what type of virus attaches itself to an executable?" The answer was "parasitic". I find terms relating to viruses and malware ...
3
votes
2answers
151 views

What is the etymology of “Salt” in relation to password storage?

Simple question: When talking about appending a random string to a password before hashing in order to defend against dictionary attacks, we call it a salt. Why do we call it a salt?
3
votes
3answers
2k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
3
votes
3answers
77 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
1
vote
2answers
70 views

Is steganography a part of “cryptography”?

In preparing for a security exam, the prep book I'm reading states: In the field of cryptography, the topic of encryption gets by far the most attention ... ... Other techniques such as ...
4
votes
3answers
8k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
6
votes
1answer
52 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
1
vote
1answer
55 views

Social engineering attacks terminology

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?
3
votes
2answers
48 views

What is the message called someone sends to verify a key?

Suppose Alice wants to check if Bob has a certain keypair. Alice could send some random payload to Bob and let Bob sign that payload with his private key. Alice is now able to check if the signature ...
1
vote
1answer
49 views

Terminology involving malware/virus/worm [duplicate]

What is the difference between "worms", "viruses", and "malware"? Some sources I've found said both viruses and worms infect files. But others say worms are stand alone programs, and are ...
3
votes
1answer
100 views

False Match vs False Acceptance

Studying up on biometric security terms, can someone clarify the difference between 'Match'/'Non-Match' and 'Rejection'/'Acceptance'?
1
vote
2answers
73 views

How do you call an attack vector that consists of filling the whole server ram using a single process?

I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That ...
0
votes
5answers
283 views

Is there a name for this flawed way of thinking about security? [closed]

I've recently encountered a developer who thinks that she can implement security on the client end of a web application. Breaking the security is as trivial as reading a few lines of Javascript and ...
4
votes
1answer
89 views

Terminology: What kind of security applies to industrial control systems, fire alarm systems, etc.?

I am wondering what you would call the kind of security that applies to systems such as industrial control (SCADA) systems, building automation systems, fire alarm systems, etc. These systems are ...
0
votes
1answer
125 views

BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”

Note: Below are some information from searching around the Internet. To skip to my main question, go to the last line of this post. I've been searching around on how to change the Volume Master Key (...
3
votes
2answers
104 views

Registration or Enrollment?

When joining an authenticated network, I have seen the terms "Enrollment" and "Registration" used to describe the process of initially setting up your credentials on the network. "Authentication" ...
2
votes
1answer
54 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
1
vote
2answers
462 views

Difference between confidential, protected, and restricted data

I've been reading this article about Data Handling Security Measures, what's the difference between confidential, protected, and restricted data? Maybe I could understand it well with example of the ...
1
vote
1answer
58 views

What is the term for requiring a user to go through an additional activation/verification process on new devices only?

When I log onto my bank's website on a new device (be it a new phone or a web browser I haven't used before) it prompts me to send an activation code to my phone or email. I have to enter in this one-...
0
votes
2answers
252 views

Is constantly downloading large amount of files from a web server considered DDoS?

For example, there's like a million files stored on a website (publicly, anyone with a link can get it), and I wrote a program to retrieve it one by one. Since obviously my program pings the server ...
2
votes
1answer
119 views

Protecting vs Securing

I encountered a question "true or false, replication is NOT a way to protect data". I answered true since I felt that protecting data meant securing the network and preventing unauthorized access to ...
3
votes
2answers
61 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the voice-...
12
votes
6answers
9k views

What is the distinguishing point between a script kiddie and a hacker?

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker (...
7
votes
2answers
689 views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...