The terminology tag has no wiki summary.
1
vote
0answers
21 views
What is the exactly mean of these CPE file fields?
I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml
My ...
3
votes
1answer
54 views
Do voting machines rely on “security through obscurity”?
There was an interesting paper in 2013 from the University of Pennsylvania called Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities. One ...
3
votes
1answer
580 views
Who is the creator of the CIA triad?
The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad.
As I am writing on my master thesis, I am wondering to which resource I ...
2
votes
2answers
150 views
Trust vs Reputation
There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
1
vote
3answers
793 views
What are the main differences between the network-level and the application-level regarding information security?
I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you.
What are the main differences between the network-level and the application-level regarding information ...
1
vote
1answer
343 views
What is this QR code authentication scheme called?
What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more
A user is authenticated within webapp ...
4
votes
1answer
161 views
What are covert channel algorithms?
Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be.
Has anyone heard of this term ...
4
votes
2answers
106 views
Is there a pre-existing taxonomy of attackers?
When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as:
Passive ...
10
votes
6answers
1k views
Difference between Privilege and Permission
I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
11
votes
1answer
8k views
Secure Configuration of Ciphers/MACs/Kex available in SSH
Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals:
Disable any 96-bit HMAC ...
3
votes
1answer
212 views
Auditing, accounting, logging, and accountability… What's the difference?
Let's first look at the book Microsoft Windows Security Essentials:
... the three As (AAA) of security: authentication, authorization, and accounting
... they combine to contribute to reliable ...
2
votes
3answers
648 views
Why is the Samy Worm considered XSS?
Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
5
votes
3answers
1k views
Terminology: authentication vs verification
The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
7
votes
2answers
409 views
Does the md5 (or any hash for that matter) of a string include the null terminator?
Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
14
votes
3answers
2k views
What is the difference between Exploit and Payload?
In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
8
votes
5answers
2k views
What is the distinguishing point between a script kiddie and a hacker?
When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker ...
1
vote
1answer
377 views
What is the origin of the three factors of authentication?
The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
0
votes
6answers
339 views
What sort of security method is this called (if it has a name)?
I have thought of a way of securing access to an application interacting with another application.
Using this method
Application 1 - "What is the sum of 1+1?"
Application 2 - "3"
Application 1 - ...
1
vote
2answers
119 views
Is there a term for a “Master + extension” style password scheme?
I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component.
So for Gmail my password might be correcthorsebatterystaple + ...
-2
votes
1answer
388 views
What is a “cuckoo's egg”? [closed]
I remember that Clifford Stoll wrote a book called "The Cuckoo's Egg".
In the book, the reader follows him as he pursues a hacker through networks across the world. I seem to recall that the title ...
2
votes
3answers
132 views
Are all vulnerabilities security related?
Are all vulnerabilities security related? When people talk about vulnerabilities and security vulnerabilities, are they the same concept? My understanding is that a vulnerability is the a weakness in ...
7
votes
2answers
1k views
Taxonomy of Ciphers/MACs/Kex available in SSH?
SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
5
votes
4answers
216 views
When should I use the word hacker, cracker, or black hat?
Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics.
To others, it's the aggressor, bad-guy, cracker, or ...
0
votes
1answer
130 views
What terms should I use to define security assessment work? [duplicate]
Possible Duplicate:
What is the difference between a penetration test and a vulnerability assessment?
I am tasked with hiring a consultant to do an analysis of our infrastructure security ...
4
votes
1answer
274 views
What does colluded truncation attack mean?
I'm doing my final year engineering project. I went through some ieee papers and came across something called colluded truncation attack. Can someone explain what it is. I'm planning to do the project ...
6
votes
2answers
960 views
What is SQL injection?
What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
4
votes
1answer
50 views
Looking for a taxonomy of anonymization or re-identification properties
We are working with personally identifiable information that needs to be de-identified. Is there an existing hierarchy or taxonomy of different kinds of re-identification properties?
7
votes
3answers
879 views
Security fields: AppSec vs. InfoSec vs. NetSec, etc
When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within ...
8
votes
7answers
1k views
Definition of Software Security
I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article.
Most of the books starts already assuming that the user knows what that is, and they're ...
10
votes
1answer
2k views
Oligomorphism vs polymorphism vs metamorphism in malware
What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
8
votes
2answers
190 views
Vulnerability Assessments - Vulnerability Taxonomies?
All,
First question on here so please be as gentle as you can :-)
I've been looking around for any writings or papers on a standard for classifying vulnerabilities. Not from a severity/risk/impact ...
3
votes
3answers
335 views
How do I clearly distinguish between groups of formal and informal models?
I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
5
votes
4answers
660 views
What is War Dialing?
The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?
17
votes
6answers
6k views
What is the difference between a penetration test and a vulnerability assessment?
What is the difference between a penetration test and a vulnerability assessment?
Why would you choose one over the other?
What deliverables would you expect to receive and how would you rate the ...
6
votes
3answers
437 views
Malware nomenclature
If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like?
If one exists could someone explain it or ...
