0

In very layman's terms AFAIK security threats are classified into four broad categories namely

I could get few related definitions of all which can be navigated to via links above. It will be great if someone can provide basic definitions and fundamental differences between these for everyone to understand? This is my first question on this forum and I was looking for something like this but couldn't find it.

Improve this question
6
  • falsification is a very broad term. What exactly do you mean by falsification?
    – Limit
    Commented Dec 6, 2016 at 2:20
  • 1
    Also, repudiation attack that I just read on OWASP seems to be quite unrelated to the other terms that you used. Did you read about repudiation somewhere?
    – Limit
    Commented Dec 6, 2016 at 2:21
  • Is there a reason why you chose to divide security threats into exactly these four categories?
    – Arminius
    Commented Dec 6, 2016 at 4:51
  • @Arminius I shouldn't have said 4 categories but they are 4 most prominent problems as I was reading few things about security basics somewhere.
    – RBT
    Commented Dec 6, 2016 at 5:39
  • @Limit by falsification I mean this - Party A wants to send XYZ to party B. Over the wire an intruder X changed the content to ABC without anyone's knowledge. Party B receives ABC which is a false content.
    – RBT
    Commented Dec 6, 2016 at 5:41

1 Answer 1

Reset to default
4

Here is a rundown on the example of emails:

  • Interception or Snooping or Sniffing

An attacker intercepts the unencrypted traffic of an email server to record and modify the content of sent and received emails. (Your ISP, router or network administrator are all able to sniff/intercept the unencrypted traffic that they process.)

  • Spoofing

An attacker crafts an email with a forged sender address to appear as if it comes from your boss and asks you for a password. This is aptly called email spoofing.

  • Falsification and

Falsification refers to spoofing. In a spoofing attack you falsify ("forge") data.

  • Repudiation

An attacker gains access to your mail account and sends rude messages to your boss. You probably can't repudiate (deny) having sent these messages easily because the system doesn't keep track of the IPs that logged in to your account.

You might want to have a look at STRIDE, one of the most common models to classify security threats. It distinguishes Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. This classification might be a little more thorough than your proposed list.

Microsoft has a good overview on threats and countermeasures that includes STRIDE.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .