Questions tagged [terminology]
For questions about names of attacks, vulnerabilities, concepts, etc.
267
questions
1
vote
0
answers
66
views
How should you pronounce ed25519? [closed]
Not strictly a security question, but one that everyone using SSH will need at some point... This has been annoying me for some time, and I wondered if there is an official line on how "ed25519&...
- 737
1
vote
0
answers
99
views
Attack against MFA: attacker triggering MFA prompt at the same time user is doing a legitimate transaction requiring MFA
Is there a name for this kind of attack against Multi-Factor Authentication:
Attacker is in possession of a user login and password, and is able to trigger a transaction or login which requires MFA ...
- 220
4
votes
1
answer
1k
views
Why are JWT claims called claims?
In authentication, the term 'claim' is used to describe elements like user identity that has not yet been challenged and verified. My understanding is that a 'claim' typically refers to something that ...
- 43
1
vote
0
answers
112
views
What is a term for ineffective security measures that don't prevent any realistic attack? [closed]
Is there a term for when you a particular system design might prove to have some advantages, but doesn't actually qualitatively change the potential attacks on the system and thus ends up as redundant,...
- 417
0
votes
1
answer
154
views
Difference between "circumstance" and "event" in the definitions of threat
On the Wikipedia page of threat (in textbooks too) various definitions are given where almost all agree in defining a threat as a "circumstance or event".
I'm having trouble understanding ...
- 117
0
votes
1
answer
94
views
Authentication via User Interaction (Game play, using ML)
Something you know (password), something you are (biometrics), something you have (key card/security key) are the typical authentication factors.
Several years ago I've seen a paper in which the users ...
- 3,942
2
votes
1
answer
180
views
Is it wrong to refer to ptrace process injection as process hollowing
ATT&CK defines process injection sub-technique 012 Process Hollowing different from sub-technique 008 Ptrace system calls.
With this in mind, if I write some fancy shellcode into the .text segment ...
- 209
0
votes
1
answer
140
views
Covert channel definition conflicts regarding steganography
I'm under the impression that stegonographic manipulation of file names or packet timing would qualify as a storage covert channel and a timing covert channel respectively.
I came across this ...
- 1
0
votes
1
answer
89
views
Term for a access control model based on users sharing resources with each other?
A very simple access model: I have users and resources. Each resource has an owner. Owners can can grant other users read and write permissions to resources they own (and transfer ownership). So ...
- 563
2
votes
1
answer
237
views
MSTG-ARCH-3 What means?
In the OWASP Mobile Application Security Checklist there is a requirement called MSTG-ARCH-3 which describes:
"A high-level architecture for the mobile app and all connected remote
services has ...
- 23
0
votes
1
answer
244
views
Is there a difference between text described as a cipher or ciphertext?
I've noticed both "cipher" and "ciphertext" being used to describe text encrypted with a cipher.
Here are some definitions from Merriam Webster:
cipher: a message in code
...
- 109
0
votes
1
answer
105
views
Is there a specific term for when an employee steals your card info when you make a payment?
There seems to be a term for nearly every specific type of hack or theft. Someone brought up the situation of an employee at a drive-thru window stealing credit card info when you make a payment and I ...
- 143
2
votes
2
answers
316
views
Does attaching malware or virus in an email count as Phishing attack
I know that Phishing attacks try to gain access or sensitive information from the user or victim. This attack comes under the Social Engineering attack, where personal confidential data such as login ...
2
votes
2
answers
228
views
What is the name for printed 2FA codes on a wallet card?
What is the correct name for the 2FA device that is printed codes on a wallet card?
These codes are sequentially numbered from 001 to 224. The log in screen displays 2 numbers in that range and the ...
- 953
0
votes
0
answers
121
views
In STIX, what are the differences between tools, infrastructure, and malware
I am starting to learn STIX, and the exact meaning of some of the SDOs is not really clear to me.
In particular, can someone give precise guidelines or examples of the differences between the tool, ...
- 101
1
vote
1
answer
146
views
Does black hat always equal illegal? [closed]
I often hear of black-hat hacking discussed as if it was synonymous with illegal hacking. In other words, an act of hacking is black-hat iff it is illegal. Our own tag wiki for black-hat defines it as ...
- 119
0
votes
2
answers
102
views
What is using timing and cryptotext length for deanonymization called?
Alice and Bob are communicating frequently via an encrypted overlay network. Eve can observe the timing and length of Alice's and Bob's incoming and outgoing ip traffic, but cannot read their ...
- 105
-1
votes
1
answer
2k
views
What is the relation between change management, patch management and configuration management?
How are:
change management
patch management
configuration management
related to each other and what is the security team's role in them?
-1
votes
1
answer
257
views
What are symmetric and asymmetric encryption and what would be a good example from daily life? [duplicate]
I understand that to "encrypt" something means to "code" it, to make it understandable for two parties, giver and receiver and generally only for them, but I don't know what it ...
- 5
2
votes
2
answers
898
views
What is dynamic code analysis? Is it the same as DAST?
I'm confused a bit between the terms. What I know is that there is SAST and DAST. SAST is scanning code statically for possible vulnerabilities, equivalent to static code analysis. This is usually ...
1
vote
0
answers
276
views
MITRE ATT&CK framework concept doubts between tactics
I am studying the MITRE ATT&CK framework and I am confused with the following tactics: Reconnaissance, Discovery, and Resource Development.
What are the differences between these 3 tactics? ...
- 11
0
votes
1
answer
129
views
What is it called when you only use a user account for a specific task in your OS?
I've noticed that people don't use a user account for a specific task;
I keep thinking the concept is called a "service account"
But it causes a lot of issues surrounding security; for ...
- 1,441
2
votes
1
answer
2k
views
should I treated the let's encrypt fullchain.pem as a public key
I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
- 135
0
votes
0
answers
114
views
Values inserted with the JavaScript "value" property are ineffective
Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
- 1
0
votes
1
answer
233
views
What are the ways to browse the web without exposing a a manually operated computer's IP address?
I figure these as the ways to browse the web without exposing a manually operated computer's IP address:
Proxy (such as "download from us" proxy)
VPN
TOR
Using a remote GUI operating system ...
-1
votes
1
answer
217
views
Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]
I believe it would violate all the three aspects due to following reasons:
Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
- 3
0
votes
1
answer
148
views
Is there a term for a non-brute-force version of a fuzzer?
Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target ...
- 1,310
0
votes
1
answer
152
views
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
This leads me to further ask, have there been attempts to reform the terminology from "...
1
vote
3
answers
215
views
Is there a term for one specific step at beginning of reconnaissance?
If the hacker decides to attack the system, the first step is reconnaissance.
But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or ...
- 185
15
votes
6
answers
3k
views
Does phishing include ransomware?
Does the definition of phishing also include tricking the victim into executing malware, such as ransomware, that's not used to retrieve the victim's information?
As I see it, Wikipedia's definition ...
- 509
0
votes
1
answer
2k
views
Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?
I apologize for the weird wording of the question title, I was hitting the character count.
I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
2
votes
1
answer
127
views
Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?
I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
- 200
1
vote
0
answers
3k
views
Is using URL parameters together with body parameters in a POST request a defined security anti-pattern?
It is technically allowed by many programming languages to supply parameters in POST requests as part of the URL, similar to a GET request. You can do this in addition to supplying parameters in the ...
- 7,545
3
votes
0
answers
299
views
Threat / Adversary / Trust / Security model, what is the difference?
In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
- 259
4
votes
2
answers
969
views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
0
votes
1
answer
285
views
Anti virus vs Anti malware? [duplicate]
What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
- 51
2
votes
1
answer
1k
views
Is this considered DOM-XSS or self-XSS or both?
SCENARIO:
A web page shows an error login page using these javascript lines
<script>
let queryParams = new URLSearchParams(window.location.search);
document.getElementById("message")....
- 567
3
votes
2
answers
237
views
Why is the term "nation state" used to refer to a government-sponsored effort in infosec, and is it accurate? [closed]
I work in infosec and as such, have read many whitepapers and been to many conference talks. I hear all the time, especially in conversation and literature about malware, the term "nation state" used ...
- 1,199
0
votes
0
answers
118
views
What is securing an application platform called?
I'm searching for the right terminology for this element of cyber security.
If I want to secure something like a PaaS for other applications to use, how is this usually called? It's not application ...
- 1
1
vote
1
answer
289
views
Difference between Process and Practice in Information Security
I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean.
While these two terms are quite easy to distinguish:
policy is what to do to secure ...
- 51
1
vote
1
answer
156
views
What does "hijack" mean in networking security?
How should I understand the word "hijack" in network security?
In Cloudflare's page about the Mirai botnet, there is a sentence:
The Mirai botnet employed a hundred thousand hijacked IoT devices ...
- 935
1
vote
0
answers
22
views
Name of 'smart brute force' attack against sequential cipher lock [duplicate]
I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
- 223
-1
votes
1
answer
609
views
Is there really such a thing as "script kiddies"? [duplicate]
All my life, well, at least since the late 1990s, I've heard of this concept of "script kiddies". Allegedly, it's a term to refer to young kids or teenagers who, apparently, are somehow able to find "...
4
votes
2
answers
579
views
Why is the root in an Online CA model not a Single Point of Failure?
My textbook for CompTIA Security+ has the following practice question:
In which one of following PKI Trust Models is the root NOT a single point of failure?
Single CA
Hierarchical CA
...
- 2,430
4
votes
1
answer
7k
views
What is the difference between "cipher" and "encryption"?
It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
- 51
0
votes
0
answers
151
views
Risk, threat, vulnerability with an example
Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate:
Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
- 79
24
votes
4
answers
11k
views
Why define CIA in security like this?
As we know CIA of the demand for security means:
Confidentiality
Integrity
Availability
I don't understand why define the "Integrity" and "Availability`,
If we make a plaintext Confidentiality, the ...
- 935
-4
votes
1
answer
189
views
Should we consider Deepfakes and fakenews as disinformation or misinformation? [closed]
Cognitive hacking some say is a new type of hacking field and some say it is something that been there for many years. Exploring the chapters of WIKI and using projects like MisinfoSec, got me ...
- 1,294
1
vote
0
answers
41
views
Name of security measure that shows user a personal word / phrase / drawing [duplicate]
I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
- 2,058
1
vote
0
answers
111
views
Facial Recognition Attack Nomenclature
Is there a generally acknowledged term for spoofing facial recognition with a photo of the target face (Samsung smartphone facial recognition, not Apple FaceID (depth measurement)).
- 1,531