Questions tagged [terminology]
For questions about names of attacks, vulnerabilities, concepts, etc.
251
questions
-1
votes
1
answer
48
views
What are symmetric and asymmetric encryption and what would be a good example from daily life? [duplicate]
I understand that to "encrypt" something means to "code" it, to make it understandable for two parties, giver and receiver and generally only for them, but I don't know what it ...
- 5
0
votes
0
answers
24
views
Is it that a pair of a locking device and an opening device is asymmetric, and a single device which can both lock and open is symmetric? [closed]
I understand that a pair of a locking device and an opening device is asymmetric, and a single device which can both lock and open is symmetric.
Is that correct?
- 5
1
vote
0
answers
11
views
MITRE ATT&CK framework concept doubts between tactics
I am studying the MITRE ATT&CK framework and I am confused with the following tactics: Reconnaissance, Discovery, and Resource Development.
What are the differences between these 3 tactics? ...
- 11
0
votes
1
answer
69
views
What is it called when you only use a user account for a specific task in your OS?
I've noticed that people don't use a user account for a specific task;
I keep thinking the concept is called a "service account"
But it causes a lot of issues surrounding security; for ...
- 1,237
3
votes
1
answer
453
views
should I treated the let's encrypt fullchain.pem as a public key
I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
- 133
0
votes
0
answers
70
views
Values inserted with the JavaScript "value" property are ineffective
Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
- 1
0
votes
1
answer
182
views
What are the ways to browse the web without exposing a a manually operated computer's IP address?
I figure these as the ways to browse the web without exposing a manually operated computer's IP address:
Proxy (such as "download from us" proxy)
VPN
TOR
Using a remote GUI operating system ...
-1
votes
1
answer
100
views
Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]
I believe it would violate all the three aspects due to following reasons:
Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
- 3
0
votes
1
answer
105
views
Is there a term for a non-brute-force version of a fuzzer?
Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target ...
- 1,290
0
votes
1
answer
115
views
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
This leads me to further ask, have there been attempts to reform the terminology from "...
1
vote
2
answers
149
views
Is there a term for one specific step at beginning of reconnaissance?
If the hacker decides to attack the system, the first step is reconnaissance.
But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or ...
- 190
15
votes
6
answers
3k
views
Does phishing include ransomware?
Does the definition of phishing also include tricking the victim into executing malware, such as ransomware, that's not used to retrieve the victim's information?
As I see it, Wikipedia's definition ...
- 429
0
votes
1
answer
685
views
Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?
I apologize for the weird wording of the question title, I was hitting the character count.
I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
2
votes
1
answer
91
views
Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?
I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
- 188
0
votes
0
answers
394
views
What is cybersecurity landscape?
What does "cybersecurity landscape" mean?
Is it a cyber threat trend?
1
vote
0
answers
118
views
Is using URL parameters together with body parameters in a POST request a defined security anti-pattern?
It is technically allowed by many programming languages to supply parameters in POST requests as part of the URL, similar to a GET request. You can do this in addition to supplying parameters in the ...
- 7,194
3
votes
0
answers
127
views
Threat / Adversary / Trust / Security model, what is the difference?
In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
- 269
0
votes
0
answers
98
views
What's the term for a hash sent early and plain text revealed later?
I think there is a known pattern where you post the hash of a document, e.g. on Twitter, in order to have its time registered. You could then later publish the document and have it accredited for the ...
- 3,054
3
votes
1
answer
474
views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
0
votes
1
answer
157
views
Anti virus vs Anti malware? [duplicate]
What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
- 71
1
vote
1
answer
749
views
Is this considered DOM-XSS or self-XSS or both?
SCENARIO:
A web page shows an error login page using these javascript lines
<script>
let queryParams = new URLSearchParams(window.location.search);
document.getElementById("message")....
- 477
3
votes
2
answers
167
views
Why is the term "nation state" used to refer to a government-sponsored effort in infosec, and is it accurate? [closed]
I work in infosec and as such, have read many whitepapers and been to many conference talks. I hear all the time, especially in conversation and literature about malware, the term "nation state" used ...
- 891
0
votes
0
answers
83
views
What is securing an application platform called?
I'm searching for the right terminology for this element of cyber security.
If I want to secure something like a PaaS for other applications to use, how is this usually called? It's not application ...
- 1
1
vote
1
answer
168
views
Difference between Process and Practice in Information Security
I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean.
While these two terms are quite easy to distinguish:
policy is what to do to secure ...
- 51
1
vote
1
answer
115
views
What does "hijack" mean in networking security?
How should I understand the word "hijack" in network security?
In Cloudflare's page about the Mirai botnet, there is a sentence:
The Mirai botnet employed a hundred thousand hijacked IoT devices ...
- 915
1
vote
0
answers
21
views
Name of 'smart brute force' attack against sequential cipher lock [duplicate]
I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
- 211
-1
votes
1
answer
351
views
Is there really such a thing as "script kiddies"? [duplicate]
All my life, well, at least since the late 1990s, I've heard of this concept of "script kiddies". Allegedly, it's a term to refer to young kids or teenagers who, apparently, are somehow able to find "...
4
votes
2
answers
415
views
Why is the root in an Online CA model not a Single Point of Failure?
My textbook for CompTIA Security+ has the following practice question:
In which one of following PKI Trust Models is the root NOT a single point of failure?
Single CA
Hierarchical CA
...
- 2,432
3
votes
1
answer
3k
views
What is the difference between "cipher" and "encryption"?
It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
- 41
0
votes
0
answers
79
views
Risk, threat, vulnerability with an example
Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate:
Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
- 79
24
votes
4
answers
11k
views
Why define CIA in security like this?
As we know CIA of the demand for security means:
Confidentiality
Integrity
Availability
I don't understand why define the "Integrity" and "Availability`,
If we make a plaintext Confidentiality, the ...
- 915
-5
votes
1
answer
155
views
Should we consider Deepfakes and fakenews as disinformation or misinformation? [closed]
Cognitive hacking some say is a new type of hacking field and some say it is something that been there for many years. Exploring the chapters of WIKI and using projects like MisinfoSec, got me ...
- 1,182
1
vote
0
answers
39
views
Name of security measure that shows user a personal word / phrase / drawing [duplicate]
I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
- 1,988
1
vote
0
answers
80
views
Facial Recognition Attack Nomenclature
Is there a generally acknowledged term for spoofing facial recognition with a photo of the target face (Samsung smartphone facial recognition, not Apple FaceID (depth measurement)).
- 1,541
0
votes
1
answer
189
views
What do i call this vulnerability Technically?
There is a site which hosts coding competitions for coding and placements.
They issue certificates for winning the coding exam or at least get into the finale round.
I did not participated in that ...
- 107
1
vote
0
answers
206
views
Difference between IAG and IDM
What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)?
Apologies for ...
- 73
2
votes
1
answer
7k
views
What is the difference between data owner, data custodian and system owner?
I just started studying up for the CISSP and am having trouble understanding few concepts:
Data owner
Data custodian
System owner
Somewhere I read:
The data owner (information owner) is usually a ...
- 149
2
votes
1
answer
80
views
The use of "over" in cryptography (as in "a hash over the key")
This is the ultimate noob question.
When reading discussions of cryptography, I often come across phrases like these:
...calculates a hash over the primary key...
...a key derivation function over a ...
- 1,043
0
votes
1
answer
99
views
SNMP - need help with terminology
In many resources, I see that community strings are also called default passwords. But in the Server Manager, I see "Community name" and it makes more sense.
So why people often use the phrase "...
- 31
2
votes
2
answers
466
views
adaptive vs. non-adaptive adversaries; Is there a precise, unique and general definition? [closed]
In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
- 1,217
3
votes
2
answers
2k
views
What are client-side exploits
I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
- 51
2
votes
3
answers
224
views
Terminology for reduced brute-force attack?
Many security algorithms today have such a large key length, that there's just no use in trying to brute-force a key. For example to find one AES-256 key you would have to try 2^255 keys on average.
...
- 715
2
votes
1
answer
123
views
What's the difference between OVAL definitions, objects, and tests?
I'm trying to become more familiar with OVAL tst def and obj references in joval xml definition files.
For example, I'll see stuff like:
<criterion comment="Foo" test_ref="oval:org.mitre.oval:...
- 3,286
8
votes
2
answers
5k
views
What are the differences between HSM and SE?
What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably?
I came across various related question (TPM vs. HSM and TPM vs. SE)...
- 145
41
votes
3
answers
8k
views
What is the meaning of Triage in Cybersec world?
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? ...
- 503
5
votes
1
answer
3k
views
How do I interpret output that produces gpg listing keys?
Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
- 257
2
votes
3
answers
245
views
Confusing terminologies: Incident, alert, event, ticket [duplicate]
I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused.
We are currently following the workflow like: some security events ...
- 21
2
votes
2
answers
163
views
Definition of information in ISO 2700x
I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at ...
2
votes
1
answer
1k
views
What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?
I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like.
...
- 25
1
vote
1
answer
255
views
What is the difference between full end-to-end encryption and end-to-end encryption?
What is the difference between full end-to-end encryption and end-to-end encryption?
Are there any differences between these two terms?
- 303