Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
4 votes
1 answer
1k views

Why are JWT claims called claims?

In authentication, the term 'claim' is used to describe elements like user identity that has not yet been challenged and verified. My understanding is that a 'claim' typically refers to something that ...
user6026299's user avatar
1 vote
0 answers
93 views

What is a term for ineffective security measures that don't prevent any realistic attack? [closed]

Is there a term for when you a particular system design might prove to have some advantages, but doesn't actually qualitatively change the potential attacks on the system and thus ends up as redundant,...
tau's user avatar
  • 417
0 votes
1 answer
107 views

Difference between "circumstance" and "event" in the definitions of threat

On the Wikipedia page of threat (in textbooks too) various definitions are given where almost all agree in defining a threat as a "circumstance or event". I'm having trouble understanding ...
gomd's user avatar
  • 117
0 votes
1 answer
87 views

Authentication via User Interaction (Game play, using ML)

Something you know (password), something you are (biometrics), something you have (key card/security key) are the typical authentication factors. Several years ago I've seen a paper in which the users ...
Martin Thoma's user avatar
  • 3,932
2 votes
1 answer
155 views

Is it wrong to refer to ptrace process injection as process hollowing

ATT&CK defines process injection sub-technique 012 Process Hollowing different from sub-technique 008 Ptrace system calls. With this in mind, if I write some fancy shellcode into the .text segment ...
R-Rothrock's user avatar
0 votes
1 answer
117 views

Covert channel definition conflicts regarding steganography

I'm under the impression that stegonographic manipulation of file names or packet timing would qualify as a storage covert channel and a timing covert channel respectively. I came across this ...
P Malak's user avatar
0 votes
1 answer
84 views

Term for a access control model based on users sharing resources with each other?

A very simple access model: I have users and resources. Each resource has an owner. Owners can can grant other users read and write permissions to resources they own (and transfer ownership). So ...
Andrey's user avatar
  • 563
2 votes
1 answer
202 views

MSTG-ARCH-3 What means?

In the OWASP Mobile Application Security Checklist there is a requirement called MSTG-ARCH-3 which describes: "A high-level architecture for the mobile app and all connected remote services has ...
Luiz Filipe's user avatar
0 votes
1 answer
207 views

Is there a difference between text described as a cipher or ciphertext?

I've noticed both "cipher" and "ciphertext" being used to describe text encrypted with a cipher. Here are some definitions from Merriam Webster: cipher: a message in code ...
Nick McCurdy's user avatar
0 votes
1 answer
97 views

Is there a specific term for when an employee steals your card info when you make a payment?

There seems to be a term for nearly every specific type of hack or theft. Someone brought up the situation of an employee at a drive-thru window stealing credit card info when you make a payment and I ...
deltaray's user avatar
  • 143
2 votes
2 answers
305 views

Does attaching malware or virus in an email count as Phishing attack

I know that Phishing attacks try to gain access or sensitive information from the user or victim. This attack comes under the Social Engineering attack, where personal confidential data such as login ...
test test's user avatar
2 votes
2 answers
221 views

What is the name for printed 2FA codes on a wallet card?

What is the correct name for the 2FA device that is printed codes on a wallet card? These codes are sequentially numbered from 001 to 224. The log in screen displays 2 numbers in that range and the ...
H2ONaCl's user avatar
  • 953
0 votes
0 answers
102 views

In STIX, what are the differences between tools, infrastructure, and malware

I am starting to learn STIX, and the exact meaning of some of the SDOs is not really clear to me. In particular, can someone give precise guidelines or examples of the differences between the tool, ...
David Goldfarb's user avatar
1 vote
1 answer
139 views

Does black hat always equal illegal? [closed]

I often hear of black-hat hacking discussed as if it was synonymous with illegal hacking. In other words, an act of hacking is black-hat iff it is illegal. Our own tag wiki for black-hat defines it as ...
Robert Columbia's user avatar
0 votes
2 answers
94 views

What is using timing and cryptotext length for deanonymization called?

Alice and Bob are communicating frequently via an encrypted overlay network. Eve can observe the timing and length of Alice's and Bob's incoming and outgoing ip traffic, but cannot read their ...
Brent's user avatar
  • 105
-1 votes
1 answer
1k views

What is the relation between change management, patch management and configuration management?

How are: change management patch management configuration management related to each other and what is the security team's role in them?
Mohamed Talal Lamouchi's user avatar
-1 votes
1 answer
240 views

What are symmetric and asymmetric encryption and what would be a good example from daily life? [duplicate]

I understand that to "encrypt" something means to "code" it, to make it understandable for two parties, giver and receiver and generally only for them, but I don't know what it ...
opener's user avatar
  • 5
2 votes
2 answers
746 views

What is dynamic code analysis? Is it the same as DAST?

I'm confused a bit between the terms. What I know is that there is SAST and DAST. SAST is scanning code statically for possible vulnerabilities, equivalent to static code analysis. This is usually ...
ethicalhacker's user avatar
1 vote
0 answers
238 views

MITRE ATT&CK framework concept doubts between tactics

I am studying the MITRE ATT&CK framework and I am confused with the following tactics: Reconnaissance, Discovery, and Resource Development. What are the differences between these 3 tactics? ...
Jask_Skull's user avatar
0 votes
1 answer
122 views

What is it called when you only use a user account for a specific task in your OS?

I've noticed that people don't use a user account for a specific task; I keep thinking the concept is called a "service account" But it causes a lot of issues surrounding security; for ...
leeand00's user avatar
  • 1,441
2 votes
1 answer
2k views

should I treated the let's encrypt fullchain.pem as a public key

I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
Dolphin's user avatar
  • 135
0 votes
0 answers
111 views

Values inserted with the JavaScript "value" property are ineffective

Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
al-sayan's user avatar
0 votes
1 answer
227 views

What are the ways to browse the web without exposing a a manually operated computer's IP address?

I figure these as the ways to browse the web without exposing a manually operated computer's IP address: Proxy (such as "download from us" proxy) VPN TOR Using a remote GUI operating system ...
variableism's user avatar
-1 votes
1 answer
202 views

Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]

I believe it would violate all the three aspects due to following reasons: Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
LoneWolf's user avatar
0 votes
1 answer
143 views

Is there a term for a non-brute-force version of a fuzzer?

Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target ...
J.Todd's user avatar
  • 1,310
0 votes
1 answer
147 views

From a modular development standpoint, should a "firewall" do anything else than filtering ports?

From a modular development standpoint, should a "firewall" do anything else than filtering ports? This leads me to further ask, have there been attempts to reform the terminology from "...
puertoportopoio's user avatar
1 vote
3 answers
210 views

Is there a term for one specific step at beginning of reconnaissance?

If the hacker decides to attack the system, the first step is reconnaissance. But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or ...
TAbdiukov's user avatar
  • 186
15 votes
6 answers
3k views

Does phishing include ransomware?

Does the definition of phishing also include tricking the victim into executing malware, such as ransomware, that's not used to retrieve the victim's information? As I see it, Wikipedia's definition ...
Matthias Braun's user avatar
0 votes
1 answer
1k views

Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?

I apologize for the weird wording of the question title, I was hitting the character count. I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
desertpancake's user avatar
2 votes
1 answer
121 views

Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?

I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
Alex V's user avatar
  • 200
1 vote
0 answers
2k views

Is using URL parameters together with body parameters in a POST request a defined security anti-pattern?

It is technically allowed by many programming languages to supply parameters in POST requests as part of the URL, similar to a GET request. You can do this in addition to supplying parameters in the ...
Demento's user avatar
  • 7,455
3 votes
0 answers
286 views

Threat / Adversary / Trust / Security model, what is the difference?

In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
Lavender's user avatar
  • 259
4 votes
2 answers
928 views

MSTG-ARCH-7: All security controls have a centralized implementation

In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation". Now I'm struggling a bit by what ...
A security researcher's user avatar
0 votes
1 answer
274 views

Anti virus vs Anti malware? [duplicate]

What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
Bluesandbox's user avatar
2 votes
1 answer
1k views

Is this considered DOM-XSS or self-XSS or both?

SCENARIO: A web page shows an error login page using these javascript lines <script> let queryParams = new URLSearchParams(window.location.search); document.getElementById("message")....
Maicake's user avatar
  • 567
3 votes
2 answers
221 views

Why is the term "nation state" used to refer to a government-sponsored effort in infosec, and is it accurate? [closed]

I work in infosec and as such, have read many whitepapers and been to many conference talks. I hear all the time, especially in conversation and literature about malware, the term "nation state" used ...
the_endian's user avatar
  • 1,179
0 votes
0 answers
113 views

What is securing an application platform called?

I'm searching for the right terminology for this element of cyber security. If I want to secure something like a PaaS for other applications to use, how is this usually called? It's not application ...
PiusXIII's user avatar
1 vote
1 answer
269 views

Difference between Process and Practice in Information Security

I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean. While these two terms are quite easy to distinguish: policy is what to do to secure ...
GreenPenguin's user avatar
1 vote
1 answer
150 views

What does "hijack" mean in networking security?

How should I understand the word "hijack" in network security? In Cloudflare's page about the Mirai botnet, there is a sentence: The Mirai botnet employed a hundred thousand hijacked IoT devices ...
244boy's user avatar
  • 925
1 vote
0 answers
22 views

Name of 'smart brute force' attack against sequential cipher lock [duplicate]

I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
SF.'s user avatar
  • 223
-2 votes
1 answer
586 views

Is there really such a thing as "script kiddies"? [duplicate]

All my life, well, at least since the late 1990s, I've heard of this concept of "script kiddies". Allegedly, it's a term to refer to young kids or teenagers who, apparently, are somehow able to find "...
Laven Damgaard's user avatar
4 votes
2 answers
563 views

Why is the root in an Online CA model not a Single Point of Failure?

My textbook for CompTIA Security+ has the following practice question: In which one of following PKI Trust Models is the root NOT a single point of failure? Single CA Hierarchical CA ...
Fire Quacker's user avatar
  • 2,432
4 votes
1 answer
6k views

What is the difference between "cipher" and "encryption"?

It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
Dariell's user avatar
  • 51
0 votes
0 answers
147 views

Risk, threat, vulnerability with an example

Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate: Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
user211245's user avatar
24 votes
4 answers
11k views

Why define CIA in security like this?

As we know CIA of the demand for security means: Confidentiality Integrity Availability I don't understand why define the "Integrity" and "Availability`, If we make a plaintext Confidentiality, the ...
244boy's user avatar
  • 925
-4 votes
1 answer
186 views

Should we consider Deepfakes and fakenews as disinformation or misinformation? [closed]

Cognitive hacking some say is a new type of hacking field and some say it is something that been there for many years. Exploring the chapters of WIKI and using projects like MisinfoSec, got me ...
Filipon's user avatar
  • 1,294
1 vote
0 answers
41 views

Name of security measure that shows user a personal word / phrase / drawing [duplicate]

I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
Ram Rachum's user avatar
  • 2,058
1 vote
0 answers
108 views

Facial Recognition Attack Nomenclature

Is there a generally acknowledged term for spoofing facial recognition with a photo of the target face (Samsung smartphone facial recognition, not Apple FaceID (depth measurement)).
gatorback's user avatar
  • 1,521
0 votes
1 answer
222 views

What do i call this vulnerability Technically?

There is a site which hosts coding competitions for coding and placements. They issue certificates for winning the coding exam or at least get into the finale round. I did not participated in that ...
Vishwa Ratna's user avatar
1 vote
0 answers
293 views

Difference between IAG and IDM

What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)? Apologies for ...
aquaman's user avatar
  • 93

1
2 3 4 5 6