Questions tagged [terminology]
For questions about names of attacks, vulnerabilities, concepts, etc.
261
questions
2
votes
1
answer
41
views
Is it wrong to refer to ptrace process injection as process hollowing
ATT&CK defines process injection sub-technique 012 Process Hollowing different from sub-technique 008 Ptrace system calls.
With this in mind, if I write some fancy shellcode into the .text segment ...
- 209
0
votes
1
answer
42
views
Term for a access control model based on users sharing resources with each other?
A very simple access model: I have users and resources. Each resource has an owner. Owners can can grant other users read and write permissions to resources they own (and transfer ownership). So ...
- 563
1
vote
1
answer
124
views
MSTG-ARCH-3 What means?
In the OWASP Mobile Application Security Checklist there is a requirement called MSTG-ARCH-3 which describes:
"A high-level architecture for the mobile app and all connected remote
services has ...
- 13
0
votes
1
answer
66
views
Is there a difference between text described as a cipher or ciphertext?
I've noticed both "cipher" and "ciphertext" being used to describe text encrypted with a cipher.
Here are some definitions from Merriam Webster:
cipher: a message in code
...
- 109
0
votes
1
answer
51
views
Is there a specific term for when an employee steals your card info when you make a payment?
There seems to be a term for nearly every specific type of hack or theft. Someone brought up the situation of an employee at a drive-thru window stealing credit card info when you make a payment and I ...
- 143
2
votes
2
answers
260
views
Does attaching malware or virus in an email count as Phishing attack
I know that Phishing attacks try to gain access or sensitive information from the user or victim. This attack comes under the Social Engineering attack, where personal confidential data such as login ...
2
votes
2
answers
173
views
What is the name for printed 2FA codes on a wallet card?
What is the correct name for the 2FA device that is printed codes on a wallet card?
These codes are sequentially numbered from 001 to 224. The log in screen displays 2 numbers in that range and the ...
- 943
0
votes
0
answers
49
views
In STIX, what are the differences between tools, infrastructure, and malware
I am starting to learn STIX, and the exact meaning of some of the SDOs is not really clear to me.
In particular, can someone give precise guidelines or examples of the differences between the tool, ...
- 101
1
vote
1
answer
97
views
Does black hat always equal illegal? [closed]
I often hear of black-hat hacking discussed as if it was synonymous with illegal hacking. In other words, an act of hacking is black-hat iff it is illegal. Our own tag wiki for black-hat defines it as ...
- 119
0
votes
2
answers
49
views
What is using timing and cryptotext length for deanonymization called?
Alice and Bob are communicating frequently via an encrypted overlay network. Eve can observe the timing and length of Alice's and Bob's incoming and outgoing ip traffic, but cannot read their ...
- 105
-1
votes
1
answer
808
views
What is the relation between change management, patch management and configuration management?
How are:
change management
patch management
configuration management
related to each other and what is the security team's role in them?
-1
votes
1
answer
115
views
What are symmetric and asymmetric encryption and what would be a good example from daily life? [duplicate]
I understand that to "encrypt" something means to "code" it, to make it understandable for two parties, giver and receiver and generally only for them, but I don't know what it ...
- 5
2
votes
2
answers
347
views
What is dynamic code analysis? Is it the same as DAST?
I'm confused a bit between the terms. What I know is that there is SAST and DAST. SAST is scanning code statically for possible vulnerabilities, equivalent to static code analysis. This is usually ...
1
vote
0
answers
108
views
MITRE ATT&CK framework concept doubts between tactics
I am studying the MITRE ATT&CK framework and I am confused with the following tactics: Reconnaissance, Discovery, and Resource Development.
What are the differences between these 3 tactics? ...
- 11
0
votes
1
answer
83
views
What is it called when you only use a user account for a specific task in your OS?
I've noticed that people don't use a user account for a specific task;
I keep thinking the concept is called a "service account"
But it causes a lot of issues surrounding security; for ...
- 1,387
2
votes
1
answer
1k
views
should I treated the let's encrypt fullchain.pem as a public key
I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
- 123
0
votes
0
answers
80
views
Values inserted with the JavaScript "value" property are ineffective
Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
- 1
0
votes
1
answer
193
views
What are the ways to browse the web without exposing a a manually operated computer's IP address?
I figure these as the ways to browse the web without exposing a manually operated computer's IP address:
Proxy (such as "download from us" proxy)
VPN
TOR
Using a remote GUI operating system ...
-1
votes
1
answer
124
views
Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]
I believe it would violate all the three aspects due to following reasons:
Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
- 3
0
votes
1
answer
114
views
Is there a term for a non-brute-force version of a fuzzer?
Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target ...
- 1,300
0
votes
1
answer
118
views
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
This leads me to further ask, have there been attempts to reform the terminology from "...
1
vote
3
answers
178
views
Is there a term for one specific step at beginning of reconnaissance?
If the hacker decides to attack the system, the first step is reconnaissance.
But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or ...
- 187
15
votes
6
answers
3k
views
Does phishing include ransomware?
Does the definition of phishing also include tricking the victim into executing malware, such as ransomware, that's not used to retrieve the victim's information?
As I see it, Wikipedia's definition ...
- 485
0
votes
1
answer
1k
views
Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?
I apologize for the weird wording of the question title, I was hitting the character count.
I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
2
votes
1
answer
96
views
Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?
I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
- 190
0
votes
0
answers
426
views
What is cybersecurity landscape?
What does "cybersecurity landscape" mean?
Is it a cyber threat trend?
1
vote
0
answers
2k
views
Is using URL parameters together with body parameters in a POST request a defined security anti-pattern?
It is technically allowed by many programming languages to supply parameters in POST requests as part of the URL, similar to a GET request. You can do this in addition to supplying parameters in the ...
- 7,409
3
votes
0
answers
216
views
Threat / Adversary / Trust / Security model, what is the difference?
In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
- 259
4
votes
2
answers
851
views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
0
votes
1
answer
199
views
Anti virus vs Anti malware? [duplicate]
What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
- 51
2
votes
1
answer
1k
views
Is this considered DOM-XSS or self-XSS or both?
SCENARIO:
A web page shows an error login page using these javascript lines
<script>
let queryParams = new URLSearchParams(window.location.search);
document.getElementById("message")....
- 567
3
votes
2
answers
186
views
Why is the term "nation state" used to refer to a government-sponsored effort in infosec, and is it accurate? [closed]
I work in infosec and as such, have read many whitepapers and been to many conference talks. I hear all the time, especially in conversation and literature about malware, the term "nation state" used ...
- 1,139
0
votes
0
answers
89
views
What is securing an application platform called?
I'm searching for the right terminology for this element of cyber security.
If I want to secure something like a PaaS for other applications to use, how is this usually called? It's not application ...
- 1
1
vote
1
answer
204
views
Difference between Process and Practice in Information Security
I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean.
While these two terms are quite easy to distinguish:
policy is what to do to secure ...
- 51
1
vote
1
answer
124
views
What does "hijack" mean in networking security?
How should I understand the word "hijack" in network security?
In Cloudflare's page about the Mirai botnet, there is a sentence:
The Mirai botnet employed a hundred thousand hijacked IoT devices ...
- 935
1
vote
0
answers
22
views
Name of 'smart brute force' attack against sequential cipher lock [duplicate]
I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
- 223
-2
votes
1
answer
477
views
Is there really such a thing as "script kiddies"? [duplicate]
All my life, well, at least since the late 1990s, I've heard of this concept of "script kiddies". Allegedly, it's a term to refer to young kids or teenagers who, apparently, are somehow able to find "...
4
votes
2
answers
506
views
Why is the root in an Online CA model not a Single Point of Failure?
My textbook for CompTIA Security+ has the following practice question:
In which one of following PKI Trust Models is the root NOT a single point of failure?
Single CA
Hierarchical CA
...
- 2,442
4
votes
1
answer
5k
views
What is the difference between "cipher" and "encryption"?
It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
- 51
0
votes
0
answers
124
views
Risk, threat, vulnerability with an example
Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate:
Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
- 79
24
votes
4
answers
11k
views
Why define CIA in security like this?
As we know CIA of the demand for security means:
Confidentiality
Integrity
Availability
I don't understand why define the "Integrity" and "Availability`,
If we make a plaintext Confidentiality, the ...
- 935
-4
votes
1
answer
162
views
Should we consider Deepfakes and fakenews as disinformation or misinformation? [closed]
Cognitive hacking some say is a new type of hacking field and some say it is something that been there for many years. Exploring the chapters of WIKI and using projects like MisinfoSec, got me ...
- 1,254
1
vote
0
answers
39
views
Name of security measure that shows user a personal word / phrase / drawing [duplicate]
I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
- 2,018
1
vote
0
answers
84
views
Facial Recognition Attack Nomenclature
Is there a generally acknowledged term for spoofing facial recognition with a photo of the target face (Samsung smartphone facial recognition, not Apple FaceID (depth measurement)).
- 1,541
0
votes
1
answer
198
views
What do i call this vulnerability Technically?
There is a site which hosts coding competitions for coding and placements.
They issue certificates for winning the coding exam or at least get into the finale round.
I did not participated in that ...
- 107
1
vote
0
answers
255
views
Difference between IAG and IDM
What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)?
Apologies for ...
- 93
2
votes
1
answer
9k
views
What is the difference between data owner, data custodian and system owner?
I just started studying up for the CISSP and am having trouble understanding few concepts:
Data owner
Data custodian
System owner
Somewhere I read:
The data owner (information owner) is usually a ...
- 159
2
votes
1
answer
84
views
The use of "over" in cryptography (as in "a hash over the key")
This is the ultimate noob question.
When reading discussions of cryptography, I often come across phrases like these:
...calculates a hash over the primary key...
...a key derivation function over a ...
- 1,053
0
votes
1
answer
103
views
SNMP - need help with terminology
In many resources, I see that community strings are also called default passwords. But in the Server Manager, I see "Community name" and it makes more sense.
So why people often use the phrase "...
- 31
3
votes
2
answers
791
views
adaptive vs. non-adaptive adversaries; Is there a precise, unique and general definition? [closed]
In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
- 1,317