Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
48 views

What are symmetric and asymmetric encryption and what would be a good example from daily life? [duplicate]

I understand that to "encrypt" something means to "code" it, to make it understandable for two parties, giver and receiver and generally only for them, but I don't know what it ...
user avatar
  • 5
0 votes
0 answers
24 views

Is it that a pair of a locking device and an opening device is asymmetric, and a single device which can both lock and open is symmetric? [closed]

I understand that a pair of a locking device and an opening device is asymmetric, and a single device which can both lock and open is symmetric. Is that correct?
user avatar
  • 5
1 vote
0 answers
11 views

MITRE ATT&CK framework concept doubts between tactics

I am studying the MITRE ATT&CK framework and I am confused with the following tactics: Reconnaissance, Discovery, and Resource Development. What are the differences between these 3 tactics? ...
user avatar
0 votes
1 answer
69 views

What is it called when you only use a user account for a specific task in your OS?

I've noticed that people don't use a user account for a specific task; I keep thinking the concept is called a "service account" But it causes a lot of issues surrounding security; for ...
user avatar
  • 1,237
3 votes
1 answer
453 views

should I treated the let's encrypt fullchain.pem as a public key

I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
user avatar
  • 133
0 votes
0 answers
70 views

Values inserted with the JavaScript "value" property are ineffective

Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
user avatar
0 votes
1 answer
182 views

What are the ways to browse the web without exposing a a manually operated computer's IP address?

I figure these as the ways to browse the web without exposing a manually operated computer's IP address: Proxy (such as "download from us" proxy) VPN TOR Using a remote GUI operating system ...
user avatar
-1 votes
1 answer
100 views

Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]

I believe it would violate all the three aspects due to following reasons: Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
user avatar
0 votes
1 answer
105 views

Is there a term for a non-brute-force version of a fuzzer?

Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target ...
user avatar
  • 1,290
0 votes
1 answer
115 views

From a modular development standpoint, should a "firewall" do anything else than filtering ports?

From a modular development standpoint, should a "firewall" do anything else than filtering ports? This leads me to further ask, have there been attempts to reform the terminology from "...
user avatar
1 vote
2 answers
149 views

Is there a term for one specific step at beginning of reconnaissance?

If the hacker decides to attack the system, the first step is reconnaissance. But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or ...
user avatar
  • 190
15 votes
6 answers
3k views

Does phishing include ransomware?

Does the definition of phishing also include tricking the victim into executing malware, such as ransomware, that's not used to retrieve the victim's information? As I see it, Wikipedia's definition ...
user avatar
0 votes
1 answer
685 views

Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?

I apologize for the weird wording of the question title, I was hitting the character count. I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
user avatar
2 votes
1 answer
91 views

Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?

I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
user avatar
  • 188
0 votes
0 answers
394 views

What is cybersecurity landscape?

What does "cybersecurity landscape" mean? Is it a cyber threat trend?
user avatar
1 vote
0 answers
118 views

Is using URL parameters together with body parameters in a POST request a defined security anti-pattern?

It is technically allowed by many programming languages to supply parameters in POST requests as part of the URL, similar to a GET request. You can do this in addition to supplying parameters in the ...
user avatar
  • 7,194
3 votes
0 answers
127 views

Threat / Adversary / Trust / Security model, what is the difference?

In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
user avatar
  • 269
0 votes
0 answers
98 views

What's the term for a hash sent early and plain text revealed later?

I think there is a known pattern where you post the hash of a document, e.g. on Twitter, in order to have its time registered. You could then later publish the document and have it accredited for the ...
user avatar
3 votes
1 answer
474 views

MSTG-ARCH-7: All security controls have a centralized implementation

In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation". Now I'm struggling a bit by what ...
user avatar
0 votes
1 answer
157 views

Anti virus vs Anti malware? [duplicate]

What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
user avatar
1 vote
1 answer
749 views

Is this considered DOM-XSS or self-XSS or both?

SCENARIO: A web page shows an error login page using these javascript lines <script> let queryParams = new URLSearchParams(window.location.search); document.getElementById("message")....
user avatar
  • 477
3 votes
2 answers
167 views

Why is the term "nation state" used to refer to a government-sponsored effort in infosec, and is it accurate? [closed]

I work in infosec and as such, have read many whitepapers and been to many conference talks. I hear all the time, especially in conversation and literature about malware, the term "nation state" used ...
user avatar
0 votes
0 answers
83 views

What is securing an application platform called?

I'm searching for the right terminology for this element of cyber security. If I want to secure something like a PaaS for other applications to use, how is this usually called? It's not application ...
user avatar
1 vote
1 answer
168 views

Difference between Process and Practice in Information Security

I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean. While these two terms are quite easy to distinguish: policy is what to do to secure ...
user avatar
1 vote
1 answer
115 views

What does "hijack" mean in networking security?

How should I understand the word "hijack" in network security? In Cloudflare's page about the Mirai botnet, there is a sentence: The Mirai botnet employed a hundred thousand hijacked IoT devices ...
user avatar
  • 915
1 vote
0 answers
21 views

Name of 'smart brute force' attack against sequential cipher lock [duplicate]

I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
user avatar
  • 211
-1 votes
1 answer
351 views

Is there really such a thing as "script kiddies"? [duplicate]

All my life, well, at least since the late 1990s, I've heard of this concept of "script kiddies". Allegedly, it's a term to refer to young kids or teenagers who, apparently, are somehow able to find "...
user avatar
4 votes
2 answers
415 views

Why is the root in an Online CA model not a Single Point of Failure?

My textbook for CompTIA Security+ has the following practice question: In which one of following PKI Trust Models is the root NOT a single point of failure? Single CA Hierarchical CA ...
user avatar
  • 2,432
3 votes
1 answer
3k views

What is the difference between "cipher" and "encryption"?

It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
user avatar
  • 41
0 votes
0 answers
79 views

Risk, threat, vulnerability with an example

Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate: Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
user avatar
24 votes
4 answers
11k views

Why define CIA in security like this?

As we know CIA of the demand for security means: Confidentiality Integrity Availability I don't understand why define the "Integrity" and "Availability`, If we make a plaintext Confidentiality, the ...
user avatar
  • 915
-5 votes
1 answer
155 views

Should we consider Deepfakes and fakenews as disinformation or misinformation? [closed]

Cognitive hacking some say is a new type of hacking field and some say it is something that been there for many years. Exploring the chapters of WIKI and using projects like MisinfoSec, got me ...
user avatar
  • 1,182
1 vote
0 answers
39 views

Name of security measure that shows user a personal word / phrase / drawing [duplicate]

I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
user avatar
  • 1,988
1 vote
0 answers
80 views

Facial Recognition Attack Nomenclature

Is there a generally acknowledged term for spoofing facial recognition with a photo of the target face (Samsung smartphone facial recognition, not Apple FaceID (depth measurement)).
user avatar
  • 1,541
0 votes
1 answer
189 views

What do i call this vulnerability Technically?

There is a site which hosts coding competitions for coding and placements. They issue certificates for winning the coding exam or at least get into the finale round. I did not participated in that ...
user avatar
1 vote
0 answers
206 views

Difference between IAG and IDM

What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)? Apologies for ...
user avatar
  • 73
2 votes
1 answer
7k views

What is the difference between data owner, data custodian and system owner?

I just started studying up for the CISSP and am having trouble understanding few concepts: Data owner Data custodian System owner Somewhere I read: The data owner (information owner) is usually a ...
user avatar
2 votes
1 answer
80 views

The use of "over" in cryptography (as in "a hash over the key")

This is the ultimate noob question. When reading discussions of cryptography, I often come across phrases like these: ...calculates a hash over the primary key... ...a key derivation function over a ...
user avatar
  • 1,043
0 votes
1 answer
99 views

SNMP - need help with terminology

In many resources, I see that community strings are also called default passwords. But in the Server Manager, I see "Community name" and it makes more sense. So why people often use the phrase "...
user avatar
  • 31
2 votes
2 answers
466 views

adaptive vs. non-adaptive adversaries; Is there a precise, unique and general definition? [closed]

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
user avatar
  • 1,217
3 votes
2 answers
2k views

What are client-side exploits

I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
user avatar
  • 51
2 votes
3 answers
224 views

Terminology for reduced brute-force attack?

Many security algorithms today have such a large key length, that there's just no use in trying to brute-force a key. For example to find one AES-256 key you would have to try 2^255 keys on average. ...
user avatar
2 votes
1 answer
123 views

What's the difference between OVAL definitions, objects, and tests?

I'm trying to become more familiar with OVAL tst def and obj references in joval xml definition files. For example, I'll see stuff like: <criterion comment="Foo" test_ref="oval:org.mitre.oval:...
user avatar
  • 3,286
8 votes
2 answers
5k views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TPM vs. HSM and TPM vs. SE)...
user avatar
  • 145
41 votes
3 answers
8k views

What is the meaning of Triage in Cybersec world?

I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? ...
user avatar
5 votes
1 answer
3k views

How do I interpret output that produces gpg listing keys?

Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
user avatar
  • 257
2 votes
3 answers
245 views

Confusing terminologies: Incident, alert, event, ticket [duplicate]

I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused. We are currently following the workflow like: some security events ...
user avatar
2 votes
2 answers
163 views

Definition of information in ISO 2700x

I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at ...
user avatar
2 votes
1 answer
1k views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
user avatar
  • 25
1 vote
1 answer
255 views

What is the difference between full end-to-end encryption and end-to-end encryption?

What is the difference between full end-to-end encryption and end-to-end encryption? Are there any differences between these two terms?
user avatar

1
2 3 4 5 6