Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
12
votes
2answers
3k views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...
28
votes
6answers
19k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
11
votes
2answers
2k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
2
votes
2answers
236 views

Unambiguous terminology for different kinds of malware?

I noticed in the literatures that there are no exact boundaries for numerous information security terms such as malware, virus, etc. Some people say malware in the umbrella under which viruses, worms, ...
25
votes
3answers
1k views

What is a rootkit?

As a followup to "Tripwire - Is It Security Theater", I'm looking to get a better idea of what a rootkit is. To be more clear: What is a kernel module? What at high-level is the flow for how it's ...
163
votes
4answers
33k views

What does it mean to “burn a zero-day”?

I noticed a comment on this answer where another user said ...but it requires risking burning a 0day, which people are not always all that willing to do. I did an Internet Search for the phrase "...
7
votes
4answers
9k views

Difference between a security analyst and a security engineer?

Looking out for jobs/internships, I see these two designations used almost interchangeably at times and at other times they mean different things. So as someone who have no experience in security, ...
3
votes
3answers
4k views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
24
votes
3answers
31k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
19
votes
3answers
6k views

What is the difference between “Incident”, “Attack” and “event”?

In the Computer and network security incident taxonomy what are the differences between "Incident", "Attack" and "event"? Where does "threat" fit with them?
24
votes
6answers
31k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
14
votes
4answers
28k views

Terminology: authentication vs verification

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
4
votes
4answers
7k views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
12
votes
1answer
5k views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing my master thesis, I am wondering to which resource I ...
8
votes
1answer
3k views

What's the difference between escaping, filtering, validating and sanitizing?

An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and ...
7
votes
3answers
3k views

What are the accepted naming convention for the terms “public/private keys” and “certificates”?

Is there an accepted naming convention for referring to PKI artifacts? There seems to be a lot of confusion with the naming of artifacts. For example, it seems that some people refer to: public ...
10
votes
2answers
5k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
9
votes
2answers
6k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
12
votes
2answers
268 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS request ...
6
votes
4answers
324 views

When should I use the word hacker, cracker, or black hat?

Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics. To others, it's the aggressor, bad-guy, cracker, or ...
6
votes
3answers
2k views

What is the difference between misuse and abuse cases in security?

I know that misuse cases are use cases which help identify security requirements as they highlight the user's goal in misusing the system, but what exactly is abuse cases and what is the difference or ...
3
votes
2answers
920 views

Difference between “weakness” and “vulnerability”?

What is the difference between the terms "vulnerability" and "weakness" when it comes to security? I was looking at the CWE page and it mentions that a weakness leads to a security vulnerability. I ...
2
votes
1answer
756 views

What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?

I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and ...
2
votes
3answers
200 views

Is Information Security a Cybersecurity area or the opposite?

I'm reading about Cybersecurity and Information Security and I have questions: Is Information Security part of Cybersecurity? Is Cybersecurity part of Information Security? Both have just common ...
1
vote
2answers
1k views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”?

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy"? I had an argument about this with my management and whilst some think that its basically the same thing,...
1
vote
1answer
101 views

Terminology involving malware/virus/worm [duplicate]

What is the difference between "worms", "viruses", and "malware"? Some sources I've found said both viruses and worms infect files. But others say worms are stand alone programs, and are ...