Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
1
vote
2answers
289 views

SIEM and Security Analytics

I've encountered the two terms 'SIEM' and 'Security Analytics' a lot in the past few weeks, unfortunately I still don't understand the difference. According to some research I've done about these ...
2
votes
2answers
243 views

Unambiguous terminology for different kinds of malware?

I noticed in the literatures that there are no exact boundaries for numerous information security terms such as malware, virus, etc. Some people say malware in the umbrella under which viruses, worms, ...
1
vote
2answers
74 views

Is crimeware defined by anything other than intent?

I'm learning about different types of viruses, and one category of virus is "crimeware." I read the wikipedia page for crimeware, and to me it seems that crimeware is just a specific usage of spyware. ...
0
votes
1answer
506 views

Difference between Non-discretionary and Role-based Access control?

What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
0
votes
1answer
207 views

Is IP geolocation threat intelligence?

If the suppliers of your business are all located in North America, but your supplier web portal suddenly receives a lot of traffic from elsewhere, you should investigate. Therefore, IP geolocation ...
2
votes
1answer
708 views

What is the difference between “web penetration testing” and “web application penetration testing”?

I decided to start learning "web application penetration testing". But while I am learning I find there is another term "web penetration testing". Can someone tell me what's the difference between ...
2
votes
1answer
409 views

What is an indicator of compromise?

I'm struggling to understand what is an indicator of compromise. I found different definitions on the web but I still don't know. The definitions I found are: 1 - Something (file, network connection) ...
4
votes
1answer
68 views

Is there a difference in terminology between the words “cryptogram” and “ciphertext”?

I've noticed that certain security professionals use the term "ciphertext" while others use "cryptogram". Is there any meaningful difference between those terms? Or can they be used interchangeably?
5
votes
1answer
307 views

Why is it called micalg?

RFC3851 says: The multipart/signed Content type has two required parameters: the protocol parameter and the micalg parameter. and The micalg parameter allows for one-pass processing when ...
0
votes
3answers
116 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
4
votes
1answer
1k views

What is the difference between local file inclusion (LFI) and remote file inclusion (RFI)?

Based on this previous question, it seems like the difference between directory traversal and file inclusion is as follows: Directory traversal Improper validation of user input leads to read ...
3
votes
1answer
346 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
2
votes
4answers
182 views

Why is phishing becoming synonymous with ransomware?

The Wikipedia definition of phishing is: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as ...
0
votes
2answers
747 views

What do you call an antivirus that detects suspicious activity?

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.) This does not help when defending against zero-days and ...
3
votes
2answers
4k views

What is the difference between Right and Permission?

I know that the term "rights" applies to users or groups of users (such as "the user X has the right to change system time") and the term "permissions" applies to an object (such as a folder or file, ...
0
votes
1answer
106 views

Verb for “turning a bug into an attack”? [closed]

I forget what word it is that refers to the work of turning known bugs into real-world attacks, for example when people string together two separate exploits to break out of the Chrome sandbox. It's ...
4
votes
1answer
100 views

Are command injections examples of confused deputies?

In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the ...
4
votes
2answers
177 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
6
votes
2answers
134 views

What category of anonymity do onion routing and blockchains afford?

My understanding is that a strict definition of anonymity means that defeating the security mechanism is logically impossible or mathematically infeasible, and therefore so is deducing the identity. (...
0
votes
2answers
226 views

Would one consider the breaking of Enigma in WWII to be an early example of a backdoor?

In a recent discussion re Tory Minister and British Home Secretary Amber Rudd's insistence that WhatsApp install a backdoor for government monitoring of encrypted data, I brought up Enigma as an early ...
1
vote
0answers
79 views

Privacy terminology: Online privacy vs Internet Privacy vs Digital Privacy

While, to my eyes, Digital Privacy is the broader term ( anything digital whether online or not), I have seen all 3 used interchangeably (i.e: link vs title). Also, despite having different entries in ...
1
vote
1answer
2k views

Rights vs permissions vs priveleges

I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be ...
1
vote
2answers
159 views

Is using attack tools from a compromised host considered “pivoting”?

I would like to get a better understanding of pivoting in pentesting. If I install attack tools (nmap, ...) on a compromised host and use them to attack other hosts on the network, is that considered ...
5
votes
1answer
2k views

RBAC0 RBAC1 RBAC2 RBAC3 — What do they mean?

I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website: In 1996, Sandhu,...
5
votes
3answers
4k views

What is the difference between a payload and shellcode?

I am new to penetration testing and I would like to know the differences between these two things: Payload (reverse TCP vs. bind shell) Shell vs. Shellcode Any help?
1
vote
0answers
78 views

Does “assesse” have a particular meaning in information security?

From this job description, bold added: The human factors expert is needed to conduct research on human subjects that perform tasks for full spectrum cyber operations. The researcher will define, ...
4
votes
2answers
157 views

Way of categorising and organising types of security issues and areas

I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
3
votes
1answer
639 views

Is Threat Risk Assessment the same as Threat Risk Modeling?

I've been asked to help fill out a survey and one of the questions is whether a Threat Risk Assessment has been performed on a blog we're setting up for a charity. The WordPress blog will use a free ...
2
votes
2answers
98 views

What do these terms means with relation to viruses and operating system?

Often times I've heard viruses using "hooks" and "embeding" themself into files. For example from Wikipedia's article on Mebroot The Trojan tries to avoid detection by hooking itself into atapi....
39
votes
3answers
5k views

What is an SNI Hole?

Earlier today, Lone Learner asked Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com? The accepted answer explains that the issue was ...
5
votes
1answer
131 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
9
votes
1answer
2k views

What is a security embargo?

Via Hackernews I landed on "An Ancient Security Hole is (Not) Closed", which mentions "embargoes" on several occasions, e.g.: ...I have no interest in digging out more details or ruining embargoes ...
3
votes
4answers
4k views

What is the difference between a backdoor and a rootkit?

I was reading the "What is a rootkit ?" post and I'm confused about the difference between a rootkit and a backdoor. As I understood it, both : Are a piece of code written by the attacker and ...
0
votes
2answers
2k views

In cyptography what is “Key Space”?

What is a Key space and how does it relate to the strength of a cryptosystem? Comment on the strength of the DES algorithm with a 56 bit key. What relevance does the key space have for passwords? ...
0
votes
2answers
1k views

How exactly are registration authorities related to certificate authorities?

In preparing for the CISSP exam, the course material seems to emphasize a distinct role between a Certificate Authority and a Registration Authority. As per the study guide description: ...
0
votes
2answers
1k views

What *exactly* does it mean to detonate malware?

Does it mean the same as to eliminate or disarm the threat or does it mean that the malware was activated/executed (whether it reached its target or detonated in a "controlled" manner, e.g., in a ...
1
vote
2answers
100 views

Terms for differentiating between key-exchange and public-key cryptosystem

The RSA and Diffie-Hellman protocols are part of asymmetric cryptography. But is there a word to distinguish between cryptosystem like RSA (i.e. there are two keys, one for encryption and another for ...
0
votes
2answers
80 views

Terminology: What's the appropriate term for the digest output of various integrity hash and HMAC functions?

I've heard conflicting statements from various CISSP instructors, so I'd like some "real world" perspective: What is the appropriate terminology for the digest output of the following algorithms: ...
1
vote
1answer
122 views

What does “fd” stand for in the context of public key infrastructure? [closed]

I'm reading the OpenSSL Cookbook. Early in Chapter 1 on page 9, the author generates a private key using the RSA algorithm: openssl genrsa -aes128 -out fd.key 2048 I understand that the key could be ...
27
votes
6answers
3k views

What do you call the entity seeking to be authenticated?

What do you call an entity seeking to be authenticated? Is there a single word or short phrase for it? What would you name a variable that represented the party asking to be authenticated?
2
votes
1answer
45 views

What is an electronic document in the context of encryption?

I'm reading about a Public key certificate: In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ...
0
votes
0answers
36 views

Is there a common general placeholder name for the “protected secret”?

I wonder if there is a general name for the "protected information" that you are trying to protect. Sometimes it's a code or a password or a token and I would like to know if there is a word for ...
1
vote
3answers
12k views

What's the difference between “Due Care” and “Due Diligence”?

Can someone please explain the difference between "due care" and "due diligence"? They seem very similar to one another and after researching more and more, I'm getting confused. One tech book ...
2
votes
1answer
60 views

Terminology (analogy?) for losing control of a secret due to re-sharing

Regarding sharing a password/access/secret to someone... and then you don't have control whether they will also share this on, and potentially it could/will end up publicly known, thus insecure. The ...
6
votes
1answer
435 views

What is the difference between cybersecurity and information security? [closed]

I'm trying to differenciate between those two themes : cybersecurity vs information security. Broadly speaking I'd say cybersec is about network security (TCP/IP, router, firewall,...) and infosec is ...
-2
votes
1answer
66 views

What is the term to describe “Transitivity” in network security?

If A's security is breached, while A and B are in the same network, then B's security is breached. I can imagine this could happen to computer networks, but also to social networks; for example if ...
1
vote
3answers
186 views

Why is it called WEP? [closed]

The WEP standard is called "wired equivalent privacy"? Why does it include "wired"? Does have it have to do with ethernet codes or something else?
6
votes
1answer
923 views

In IPSec what is the definition & purpose of SAD and SPD?

What is a Security Application Database & Security Policy Database? What is their role in processing models for OUTBOUND and INBOUND packets?
1
vote
2answers
1k views

what does 0day vulnerability specifically mean? [duplicate]

is any unknown vulnerability from any type considered as 0 day vulnerability ? as example if i discovered xss vulnerability in a website which is unknown for users and developers, then does that mean ...
8
votes
1answer
3k views

What's the difference between escaping, filtering, validating and sanitizing?

An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and ...