Terminology is the study of terms and their use.

learn more… | top users | synonyms (1)

25
votes
6answers
14k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
23
votes
3answers
47k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
17
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
16
votes
3answers
10k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
15
votes
6answers
12k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
13
votes
2answers
3k views

Is the injection in a NoSQL database architecture also called SQL injection?

Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection? For example an injection in code that communicates ...
13
votes
1answer
3k views

Oligomorphism vs polymorphism vs metamorphism in malware

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data appending/...
12
votes
6answers
9k views

What is the distinguishing point between a script kiddie and a hacker?

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker (...
10
votes
3answers
3k views

Security fields: AppSec vs. InfoSec vs. NetSec, etc

When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within ...
9
votes
2answers
3k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
9
votes
2answers
4k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
8
votes
7answers
3k views

Definition of Software Security

I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article. Most of the books starts already assuming that the user knows what that is, and they're ...
8
votes
3answers
11k views

Terminology: authentication vs verification

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
8
votes
2answers
276 views

Vulnerability Assessments - Vulnerability Taxonomies?

All, First question on here so please be as gentle as you can :-) I've been looking around for any writings or papers on a standard for classifying vulnerabilities. Not from a severity/risk/impact ...
7
votes
4answers
1k views

What is War Dialing?

The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?
7
votes
2answers
699 views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...
7
votes
2answers
2k views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
6
votes
2answers
1k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
6
votes
3answers
831 views

Malware nomenclature

If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like? If one exists could someone explain it or ...
6
votes
1answer
121 views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
6
votes
1answer
52 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
5
votes
1answer
2k views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing on my master thesis, I am wondering to which resource I ...
5
votes
4answers
260 views

When should I use the word hacker, cracker, or black hat?

Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics. To others, it's the aggressor, bad-guy, cracker, or ...
5
votes
1answer
79 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
5
votes
1answer
249 views

What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
4
votes
2answers
139 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
4
votes
3answers
8k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
4
votes
1answer
212 views

Safe/Secured room?

I was involved in this project where development got outsourced to a consulting company, but to seal the deal the consulting company had to set up a room in their office with restricted access so that ...
4
votes
1answer
78 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
4
votes
1answer
89 views

Terminology: What kind of security applies to industrial control systems, fire alarm systems, etc.?

I am wondering what you would call the kind of security that applies to systems such as industrial control (SCADA) systems, building automation systems, fire alarm systems, etc. These systems are ...
4
votes
1answer
499 views

What does colluded truncation attack mean?

I'm doing my final year engineering project. I went through some ieee papers and came across something called colluded truncation attack. Can someone explain what it is. I'm planning to do the project ...
4
votes
1answer
86 views

Do voting machines rely on “security through obscurity”?

There was an interesting paper in 2013 from the University of Pennsylvania called Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities. One ...
4
votes
1answer
89 views

Looking for a taxonomy of anonymization or re-identification properties

We are working with personally identifiable information that needs to be de-identified. Is there an existing hierarchy or taxonomy of different kinds of re-identification properties?
3
votes
3answers
2k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
3
votes
3answers
627 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
3
votes
3answers
343 views
+50

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
3
votes
1answer
1k views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
3
votes
2answers
48 views

What is the message called someone sends to verify a key?

Suppose Alice wants to check if Bob has a certain keypair. Alice could send some random payload to Bob and let Bob sign that payload with his private key. Alice is now able to check if the signature ...
3
votes
2answers
151 views

What is the etymology of “Salt” in relation to password storage?

Simple question: When talking about appending a random string to a password before hashing in order to defend against dictionary attacks, we call it a salt. Why do we call it a salt?
3
votes
2answers
227 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
3
votes
2answers
61 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the voice-...
3
votes
1answer
72 views

Who defined the term “fully homomorphic encryption”?

Rivest et al. proposed the concept of privacy homomorphisms, but did not distinguish between partial versus fully homomorphic encryption. Gentry seems to take for granted the idea that fully ...
3
votes
3answers
77 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
3
votes
1answer
100 views

False Match vs False Acceptance

Studying up on biometric security terms, can someone clarify the difference between 'Match'/'Non-Match' and 'Rejection'/'Acceptance'?
3
votes
2answers
106 views

Registration or Enrollment?

When joining an authenticated network, I have seen the terms "Enrollment" and "Registration" used to describe the process of initially setting up your credentials on the network. "Authentication" ...
3
votes
0answers
26 views

Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, what is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an AuthenticationToken....
2
votes
2answers
47 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
2
votes
1answer
119 views

Protecting vs Securing

I encountered a question "true or false, replication is NOT a way to protect data". I answered true since I felt that protecting data meant securing the network and preventing unauthorized access to ...
2
votes
1answer
102 views

Incident response terminology

Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few ...
2
votes
1answer
54 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...