Questions tagged [terminology]
For questions about names of attacks, vulnerabilities, concepts, etc.
241
questions
15
votes
6answers
3k views
Does phishing include ransomware?
Does the definition of phishing also include tricking the victim into executing malware, such as ransomware, that's not used to retrieve the victim's information?
As I see it, Wikipedia's definition ...
0
votes
1answer
171 views
Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?
I apologize for the weird wording of the question title, I was hitting the character count.
I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
1
vote
1answer
49 views
Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?
I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
0
votes
0answers
89 views
What is cybersecurity landscape?
What does "cybersecurity landscape" mean?
Is it a cyber threat trend?
1
vote
0answers
51 views
Is using URL parameters together with body parameters in a POST request a defined security anti-pattern?
It is technically allowed by many programming languages to supply parameters in POST requests as part of the URL, similar to a GET request. You can do this in addition to supplying parameters in the ...
0
votes
0answers
52 views
Difference between Attack Pattern and Attack Vector
I am learning about InfoSec and I always found these two terms
Attack Pattern
an attack pattern is an abstraction mechanism for describing how a
type of observed attack is executed
Attack Vector
a ...
3
votes
0answers
39 views
Threat / Adversary / Trust / Security model, what is the difference?
In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
0
votes
0answers
56 views
What's the term for a hash sent early and plain text revealed later?
I think there is a known pattern where you post the hash of a document, e.g. on Twitter, in order to have its time registered. You could then later publish the document and have it accredited for the ...
3
votes
1answer
143 views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
0
votes
1answer
88 views
Anti virus vs Anti malware? [duplicate]
What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
1
vote
1answer
260 views
Is this considered DOM-XSS or self-XSS or both?
SCENARIO:
A web page shows an error login page using these javascript lines
<script>
let queryParams = new URLSearchParams(window.location.search);
document.getElementById("message")....
3
votes
2answers
115 views
Why is the term “nation state” used to refer to a government-sponsored effort in infosec, and is it accurate? [closed]
I work in infosec and as such, have read many whitepapers and been to many conference talks. I hear all the time, especially in conversation and literature about malware, the term "nation state" used ...
0
votes
0answers
49 views
What is securing an application platform called?
I'm searching for the right terminology for this element of cyber security.
If I want to secure something like a PaaS for other applications to use, how is this usually called? It's not application ...
1
vote
1answer
82 views
Difference between Process and Practice in Information Security
I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean.
While these two terms are quite easy to distinguish:
policy is what to do to secure ...
1
vote
1answer
76 views
What does “hijack” mean in networking security?
How should I understand the word "hijack" in network security?
In Cloudflare's page about the Mirai botnet, there is a sentence:
The Mirai botnet employed a hundred thousand hijacked IoT devices ...
1
vote
0answers
21 views
Name of 'smart brute force' attack against sequential cipher lock [duplicate]
I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
-1
votes
1answer
224 views
Is there really such a thing as “script kiddies”? [duplicate]
All my life, well, at least since the late 1990s, I've heard of this concept of "script kiddies". Allegedly, it's a term to refer to young kids or teenagers who, apparently, are somehow able to find "...
4
votes
2answers
259 views
Why is the root in an Online CA model not a Single Point of Failure?
My textbook for CompTIA Security+ has the following practice question:
In which one of following PKI Trust Models is the root NOT a single point of failure?
Single CA
Hierarchical CA
...
1
vote
1answer
538 views
What is the difference between “cipher” and “encryption”?
It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
0
votes
0answers
37 views
Risk, threat, vulnerability with an example
Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate:
Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
24
votes
4answers
11k views
Why define CIA in security like this?
As we know CIA of the demand for security means:
Confidentiality
Integrity
Availability
I don't understand why define the "Integrity" and "Availability`,
If we make a plaintext Confidentiality, the ...
-5
votes
1answer
116 views
Should we consider Deepfakes and fakenews as disinformation or misinformation? [closed]
Cognitive hacking some say is a new type of hacking field and some say it is something that been there for many years. Exploring the chapters of WIKI and using projects like MisinfoSec, got me ...
1
vote
0answers
39 views
Name of security measure that shows user a personal word / phrase / drawing [duplicate]
I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
1
vote
0answers
46 views
Facial Recognition Attack Nomenclature
Is there a generally acknowledged term for spoofing facial recognition with a photo of the target face (Samsung smartphone facial recognition, not Apple FaceID (depth measurement)).
0
votes
1answer
151 views
What do i call this vulnerability Technically?
There is a site which hosts coding competitions for coding and placements.
They issue certificates for winning the coding exam or at least get into the finale round.
I did not participated in that ...
1
vote
0answers
123 views
Difference between IAG and IDM
What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)?
Apologies for ...
2
votes
1answer
4k views
What is the difference between data owner, data custodian and system owner?
I just started studying up for the CISSP and am having trouble understanding few concepts:
Data owner
Data custodian
System owner
Somewhere I read:
The data owner (information owner) is usually a ...
2
votes
1answer
46 views
The use of “over” in cryptography (as in “a hash over the key”)
This is the ultimate noob question.
When reading discussions of cryptography, I often come across phrases like these:
...calculates a hash over the primary key...
...a key derivation function over a ...
0
votes
1answer
65 views
SNMP - need help with terminology
In many resources, I see that community strings are also called default passwords. But in the Server Manager, I see "Community name" and it makes more sense.
So why people often use the phrase "...
2
votes
2answers
201 views
adaptive vs. non-adaptive adversaries; Is there a precise, unique and general definition?
In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
3
votes
2answers
2k views
What are client-side exploits
I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
2
votes
3answers
163 views
Terminology for reduced brute-force attack?
Many security algorithms today have such a large key length, that there's just no use in trying to brute-force a key. For example to find one AES-256 key you would have to try 2^255 keys on average.
...
2
votes
1answer
69 views
What's the difference between OVAL definitions, objects, and tests?
I'm trying to become more familiar with OVAL tst def and obj references in joval xml definition files.
For example, I'll see stuff like:
<criterion comment="Foo" test_ref="oval:org.mitre.oval:...
7
votes
2answers
3k views
What are the differences between HSM and SE?
What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably?
I came across various related question (TPM vs. HSM and TPM vs. SE)...
41
votes
3answers
7k views
What is the meaning of Triage in Cybersec world?
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? ...
4
votes
1answer
2k views
How do I interpret output that produces gpg listing keys?
Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
2
votes
3answers
150 views
Confusing terminologies: Incident, alert, event, ticket [duplicate]
I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused.
We are currently following the workflow like: some security events ...
2
votes
2answers
115 views
Definition of information in ISO 2700x
I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at ...
2
votes
1answer
409 views
What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?
I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like.
...
1
vote
1answer
145 views
What is the difference between full end-to-end encryption and end-to-end encryption?
What is the difference between full end-to-end encryption and end-to-end encryption?
Are there any differences between these two terms?
0
votes
1answer
323 views
What is a “security bod”?
This is a term I ran across in a blog post by Troy Hunt (which was linked from an answer on this site):
I heard a perfect example of this just the other day when speaking to a security bod in a ...
0
votes
1answer
302 views
What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?
I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
2
votes
1answer
45 views
Vocabulary matters: link between faults and weaknesses
I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
-1
votes
2answers
1k views
What is difference between cracking and ethical hacking?
Today I read about ethical hacking and cracking. I read that ethical hacking is legal but cracking is illegal. The confusion came in my mind when I think that both are same.
So how can we identify ...
33
votes
3answers
7k views
What does “in-house hash function” mean?
In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete ...
1
vote
5answers
196 views
What does “hacked” actually mean? [duplicate]
In the context of a) information security and b) an operating system such as Windows 10 or OS X, what actually constitutes a "hack"? Most non-technical end-users associate the term "hack" with the ...
3
votes
3answers
723 views
Difference between white-box testing and secure code review
As far as I know, penetration testing can be divided into black-box, gray-box, and white-box testing. But then what about secure code review? Is it part of white-box testing or is it separate?
4
votes
2answers
201 views
How are ciphers related to cryptographic algorithms like DES or AES?
It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael).
...
3
votes
1answer
344 views
What does Frank Abagnale mean by “Level 4 security” in his talk at Google?
During his talk at Google, Frank Abagnale mentioned the following:
...we will be doing away with passwords in the next 24 months. Passwords will leave the world, there will be no more passwords. ...
12
votes
4answers
6k views
Eavesdropping vs. sniffing
I'm taking a coursera course, and they take pains when talking about network security to distinguish between eavesdropping and sniffing.
According to their definitions, sniffing involves reading or ...
