Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

10
votes
2answers
5k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
41
votes
3answers
6k views

What is the meaning of Triage in Cybersec world?

I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? ...
5
votes
1answer
119 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
1
vote
1answer
67 views

How do I interpret output that produces gpg listing keys?

Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
1
vote
2answers
265 views

SIEM and Security Analytics

I've encountered the two terms 'SIEM' and 'Security Analytics' a lot in the past few weeks, unfortunately I still don't understand the difference. According to some research I've done about these ...
-1
votes
1answer
327 views

What's the difference between “Organization normative framework” and “Application normative framework”?

I'm studying for the CCSP exam and I'm confused with some of the terminologies between Organization normative framework and application normative framework. The training material defines them as: ...
2
votes
3answers
86 views

Confusing terminologies: Incident, alert, event, ticket [duplicate]

I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused. We are currently following the workflow like: some security events ...
2
votes
2answers
45 views

Definition of information in ISO 2700x

I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at ...
3
votes
4answers
3k views

What is the difference between a backdoor and a rootkit?

I was reading the "What is a rootkit ?" post and I'm confused about the difference between a rootkit and a backdoor. As I understood it, both : Are a piece of code written by the attacker and ...
4
votes
2answers
156 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
2
votes
1answer
62 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
1
vote
1answer
78 views

What is the difference between full end-to-end encryption and end-to-end encryption?

What is the difference between full end-to-end encryption and end-to-end encryption? Are there any differences between these two terms?
0
votes
1answer
193 views

What is a “security bod”?

This is a term I ran across in a blog post by Troy Hunt (which was linked from an answer on this site): I heard a perfect example of this just the other day when speaking to a security bod in a ...
17
votes
4answers
3k views

Where does authenticity fit into the CIA Triad?

Consider a chat application where an attacker is able to send messages in any user's name. This obviously violates the message's authenticity. But what aspect of CIA would be violated? Integrity ...
1
vote
1answer
1k views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA deprecated, like SHA1? Are they the ...
0
votes
1answer
51 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
1
vote
0answers
17 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
-1
votes
2answers
314 views

What is difference between cracking and ethical hacking?

Today I read about ethical hacking and cracking. I read that ethical hacking is legal but cracking is illegal. The confusion came in my mind when I think that both are same. So how can we identify ...
6
votes
4answers
9k views

Difference between a security analyst and a security engineer?

Looking out for jobs/internships, I see these two designations used almost interchangeably at times and at other times they mean different things. So as someone who have no experience in security, ...
33
votes
3answers
7k views

What does “in-house hash function” mean?

In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete ...
4
votes
2answers
554 views

What is the etymology of “Salt” in relation to password storage?

Simple question: When talking about appending a random string to a password before hashing in order to defend against dictionary attacks, we call it a salt. Why do we call it a salt?
1
vote
5answers
174 views

What does “hacked” actually mean? [duplicate]

In the context of a) information security and b) an operating system such as Windows 10 or OS X, what actually constitutes a "hack"? Most non-technical end-users associate the term "hack" with the ...
3
votes
3answers
141 views

Difference between white-box testing and secure code review

As far as I know, penetration testing can be divided into black-box, gray-box, and white-box testing. But then what about secure code review? Is it part of white-box testing or is it separate?
5
votes
1answer
5k views

What is TTP hunting?

What is "TTP hunting" in terms of network security research? I came across this term, but do not know what this is . Tried to google it, but TTP seem to stand for many different things, but none of ...
4
votes
1answer
552 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
2
votes
2answers
217 views

Unambiguous terminology for different kinds of malware?

I noticed in the literatures that there are no exact boundaries for numerous information security terms such as malware, virus, etc. Some people say malware in the umbrella under which viruses, worms, ...
6
votes
3answers
2k views

What is the difference between misuse and abuse cases in security?

I know that misuse cases are use cases which help identify security requirements as they highlight the user's goal in misusing the system, but what exactly is abuse cases and what is the difference or ...
3
votes
1answer
144 views

What does Frank Abagnale mean by “Level 4 security” in his talk at Google?

During his talk at Google, Frank Abagnale mentioned the following: ...we will be doing away with passwords in the next 24 months. Passwords will leave the world, there will be no more passwords. ...
0
votes
3answers
2k views

Port sweep vs port scan

I was asked this question in an interview: "What is a port sweep?" When I replied with port scan he said that my answer was not a scan, it was a port sweep. I googled and found "tcp sweep: but not "...
12
votes
4answers
4k views

Eavesdropping vs. sniffing

I'm taking a coursera course, and they take pains when talking about network security to distinguish between eavesdropping and sniffing. According to their definitions, sniffing involves reading or ...
0
votes
2answers
40 views

What is the correct terminology for enforcing access control by means of cryptography, or on a privileged list?

I have a server that enforces access control by means of cryptography, by not giving up data, or by a combination thereof. By the former (cryptography), I mean: If a user requests some data, the ...
6
votes
2answers
361 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
1
vote
3answers
11k views

What's the difference between “Due Care” and “Due Diligence”?

Can someone please explain the difference between "due care" and "due diligence"? They seem very similar to one another and after researching more and more, I'm getting confused. One tech book ...
163
votes
4answers
33k views

What does it mean to “burn a zero-day”?

I noticed a comment on this answer where another user said ...but it requires risking burning a 0day, which people are not always all that willing to do. I did an Internet Search for the phrase "...
79
votes
4answers
18k views

What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?

I reached out to an old friend of mine who was a terrific programmer back in my school days and he invited me to attend one of the CTF events with his university group. This group seems very beginner ...
3
votes
2answers
556 views

Difference between “weakness” and “vulnerability”?

What is the difference between the terms "vulnerability" and "weakness" when it comes to security? I was looking at the CWE page and it mentions that a weakness leads to a security vulnerability. I ...
0
votes
1answer
60 views

Benign, Malicious Domains and Definitions

I am working on a research project where we segregate domains used for malicious purpose from benign domains. However, my guide does not want the term malicious domain and benign domain in the paper....
3
votes
2answers
164 views

Why are Protection Rings called rings?

Protection rings are different privilege levels granted to software, with the kernel being the most privileged, applications the least privileged, and drivers somewhere in between. My question is why ...
7
votes
1answer
649 views

In IPSec what is the definition & purpose of SAD and SPD?

What is a Security Application Database & Security Policy Database? What is their role in processing models for OUTBOUND and INBOUND packets?
1
vote
1answer
172 views

What is this phishing technique called using subdomains

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
3
votes
2answers
613 views

Is server public key and Diffie Hellman public are the same?

I am trying to understand the working of TLS. I understand that there are various way to generate the master secret used to encrypting the data. Such as DH (Ephemeral DHE) and RSA. I understand that, ...
4
votes
2answers
154 views

Way of categorising and organising types of security issues and areas

I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
3
votes
3answers
2k views

What's the difference between privacy and anonymity? [closed]

In the previous topic I was talking about VPN and TOR browser, and someone mentioned privacy VS anonymity. What's the actual difference between them?
3
votes
2answers
270 views

Is there a difference between “risk tolerance” and “risk appetite”?

I'm studying for the CCSP exam and I'm a little confused on the difference between "Risk Appetite" and "Risk Tolerance". Is there a clear and discernible difference? Can the terms be used ...
2
votes
1answer
61 views

Is it reasonable to consider logs as a “technical control”?

I'm studying for the CCSP exam and one of the examples of technical controls (referenced in the course training material) confuse me: Technical controls, also referred to as logical controls, are ...
2
votes
1answer
145 views

Is there a difference between “Maximum Tolerable Downtime” and “Maximum Allowed Downtime”?

I'm studying for the CCSP exam and one of the BC/DR terms that is referenced in my study material is "Maximum Allowable Downtime". The definition for it is: MAD (Maxium Allowable Downtime) How ...
1
vote
1answer
26 views

Is this description of the term “event” accurate within the context of Business Continuity and Disaster recovery?

I'm studying for the CCSP exam and I came across this description: An event is any unscheduled adverse impact to the operating environment. An event is distinguished from a disaster by the ...
4
votes
2answers
3k views

Cyber Security vs. Digital Security

What is the difference between Cyber Security and Digital Security? They sound very similar (same) to me, But I have read that current techniques of Machine Learning can provide Digital Security, ...
0
votes
1answer
62 views

What's the difference between “directory services” and “identity repositories”?

I'm studying for the CCSP exam and the study material references two different terms which seems very similar: Directory Services A system for managing identities and attributes. These allow the ...
7
votes
3answers
327 views

When did we start to call malicious software “malware”?

I'm looking into the history of malware. When was malicious software fist called malware? I think that malicious software is called "computer virus".