The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
1
vote
2answers
1k views

what does 0day vulnerability specifically mean? [duplicate]

is any unknown vulnerability from any type considered as 0 day vulnerability ? as example if i discovered xss vulnerability in a website which is unknown for users and developers, then does that mean ...
9
votes
1answer
4k views

What's the difference between escaping, filtering, validating and sanitizing?

An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and ...
2
votes
2answers
308 views

why do they call packet filter firewall a PACKET filter firewall

Why do we call packet filter firewalls .... packet filter firewalls? A firewall operating as a packet filter passes or blocks traffic to specific addresses based on the type of application. The ...
2
votes
2answers
228 views

injection attacks - terminology

I have a question related to injection attacks like SQL injections and command injections. I have a good grasp about how those attacks are performed, but I would like to know where the term injection ...
3
votes
3answers
2k views

What's the difference between privacy and anonymity? [closed]

In the previous topic I was talking about VPN and TOR browser, and someone mentioned privacy VS anonymity. What's the actual difference between them?
7
votes
4answers
10k views

Difference between a security analyst and a security engineer?

Looking out for jobs/internships, I see these two designations used almost interchangeably at times and at other times they mean different things. So as someone who have no experience in security, ...
1
vote
2answers
1k views

Is there a meaningful difference between Cyber Defense and Cyber Security? [closed]

I've been describing some entrepreneurial aspirations to people and one of them in the IT area interrupted when I said I was interested in starting a "Cyber Defense" firm, and he said "Cyber Security" ...
2
votes
1answer
661 views

How the 'probability of verification' is inversely related to the 'false accept rate'?

I was reading a document discussing biometrics and came across this statement: Typical finger-print verification systems employed by FBI achieve 90% probability of verification at 1% false accept ...
1
vote
1answer
76 views

Protecting vs Defending a system

What is the difference between saying defending a system from attacks or protecting a system from attacks? This question might be trivial to most of you but I really don't see the fine line here. In ...
6
votes
1answer
6k views

What is TTP hunting?

What is "TTP hunting" in terms of network security research? I came across this term, but do not know what this is . Tried to google it, but TTP seem to stand for many different things, but none of ...
14
votes
2answers
2k views

Why is it called cross-site scripting? (XSS)

Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the ...
1
vote
1answer
37 views

Question about removal-notice if sued or compromised

What do you call the old notices that say: If this notice is removed the site is to be assumed compromised or litigation to compromise the site has been filed. I used to see these a lot as a ...
2
votes
3answers
204 views

Is Information Security a Cybersecurity area or the opposite?

I'm reading about Cybersecurity and Information Security and I have questions: Is Information Security part of Cybersecurity? Is Cybersecurity part of Information Security? Both have just common ...
3
votes
1answer
175 views

Why are overused buzzwords like Cyber and Hacking still prevalent in our industry? [closed]

Proper terminology is important for anyone who wants to learn something. The best way to develop professionalism is to rely on a set of well defined technical terms. So it should be in any ...
2
votes
1answer
794 views

What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?

I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and ...
3
votes
1answer
828 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
4
votes
3answers
4k views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
1
vote
2answers
2k views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”?

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy"? I had an argument about this with my management and whilst some think that its basically the same thing,...
3
votes
2answers
4k views

Cyber Security vs. Digital Security

What is the difference between Cyber Security and Digital Security? They sound very similar (same) to me, But I have read that current techniques of Machine Learning can provide Digital Security, ...
1
vote
2answers
147 views

What is the niche that Kerberos authentication fills called?

Keberos authentication is a bit of a top down concept. I'm working my way up to it from the bottom learning from the bottom up. It seems to me that Keberos authentication can be thought of as a glue ...
1
vote
3answers
633 views

When is IP blocking OSI level 7 only and what is the purpose of doing so on multiple locations?

Let's say there is an application that has IP whitelisting, all other IP's are denied. This check takes place on three different locations: iptables, .htaccess, PHP script. Now in what OSI layers ...
2
votes
2answers
63 views

Does MITM refer to what you do in the middle or how you get there?

Does the term "MITM attack" refer to what happens once an attacker is between two hosts or to attacks like ARP poisoning, DHCP snooping that allow the attacker to insert himself between two hosts in ...
3
votes
2answers
282 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
4
votes
1answer
431 views

Is FAR (False Accept Rate) a property of algorithm or a property of the system?

As known in biometrics: https://en.wikipedia.org/wiki/Biometrics#Performance False match rate (FMR, also called FAR = False Accept Rate): the probability that the system incorrectly matches the ...
4
votes
4answers
7k views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
13
votes
2answers
3k views

Is the injection in a NoSQL database architecture also called SQL injection?

Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection? For example, an injection in code that communicates ...
1
vote
2answers
126 views

Do we still refer to a threat as a threat once it has been realised?

A threat is defined as something that might do harm but once a threat happens do we still refer to it as a threat? For instance, if malware infects our computer, do we still refer to the malware as a ...
2
votes
1answer
272 views

Incident response terminology

Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few ...
0
votes
2answers
773 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
0
votes
1answer
150 views

What is the difference between vulnerability identification and exploitation?

Are strings like AND '1' = '2 and <script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits? If so, when black-box testing a house made web application, ...
-4
votes
1answer
120 views

What is the difference between data and information when it comes to Data Security? [closed]

I'm currently enrolled for Data Security program and for our assignment the question is to differentiate data and information. What is the difference between those two?
1
vote
1answer
111 views

Terminology - DMZ

The term DMZ is used to describe a separation area between a trusted zone and an untrusted zone. Ex: internal network vs internet. Can it be used to refer to a separation area between a trusted zone ...
19
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
1
vote
1answer
2k views

Terminology - entry point, data source, sink

In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
1
vote
1answer
167 views

Who defined the term “end-to-end encryption”?

I am trying to find the origin of the term "end-to-end encryption", but have been unsuccessful until now.
1
vote
1answer
45 views

Does this case fit the definition of a replay attack?

I read the definition of a replay attack on Wikipedia. However I don't know if the following case fits the description: An attacker captures a HTTP request sent to a web server, modifies the request ...
1
vote
1answer
84 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
3
votes
4answers
11k views

difference between need to know, least privilege and confidential

I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing? In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
3
votes
1answer
600 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
7
votes
1answer
2k views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
4
votes
1answer
57 views

Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, what is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an AuthenticationToken....
4
votes
1answer
547 views

Penetration Testing Vocabulary

The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?
0
votes
1answer
114 views

Is there a 'key space' equivalent for encryption keys?

If a key space is the term given to the collection of all possible decryption keys for a given cryptosystem, then what is the collection of all possible encryption keys called?
0
votes
2answers
2k views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
6
votes
2answers
406 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
0
votes
1answer
32 views

Technical term needed: Per default secured / blacklist vs whitelist

I'm currently working on a homework and missing a technical term / known best practice to describe what I have learned or what I feel that is better. It is about a publish / subscribe architecture, ...
0
votes
2answers
167 views

Confusing definitions of “parasitic virus” and “worm”

I was studying for CISSP certification when I came across the question "what type of virus attaches itself to an executable?" The answer was "parasitic". I find terms relating to viruses and malware ...
4
votes
1answer
303 views

What is an Origin Error Attack?

Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one. From The Forrester Wave™: DDoS Services Providers, Q3 2015 ...
12
votes
2answers
273 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS request ...
3
votes
2answers
198 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...