Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

163
votes
4answers
33k views

What does it mean to “burn a zero-day”?

I noticed a comment on this answer where another user said ...but it requires risking burning a 0day, which people are not always all that willing to do. I did an Internet Search for the phrase "...
79
votes
4answers
19k views

What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?

I reached out to an old friend of mine who was a terrific programmer back in my school days and he invited me to attend one of the CTF events with his university group. This group seems very beginner ...
41
votes
3answers
6k views

What is the meaning of Triage in Cybersec world?

I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? ...
38
votes
3answers
5k views

What is an SNI Hole?

Earlier today, Lone Learner asked Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com? The accepted answer explains that the issue was ...
33
votes
3answers
7k views

What does “in-house hash function” mean?

In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete ...
28
votes
6answers
19k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
27
votes
6answers
3k views

What do you call the entity seeking to be authenticated?

What do you call an entity seeking to be authenticated? Is there a single word or short phrase for it? What would you name a variable that represented the party asking to be authenticated?
25
votes
3answers
69k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
24
votes
6answers
30k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
23
votes
3answers
29k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
19
votes
3answers
6k views

What is the difference between “Incident”, “Attack” and “event”?

In the Computer and network security incident taxonomy what are the differences between "Incident", "Attack" and "event"? Where does "threat" fit with them?
19
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
17
votes
4answers
3k views

Where does authenticity fit into the CIA Triad?

Consider a chat application where an attacker is able to send messages in any user's name. This obviously violates the message's authenticity. But what aspect of CIA would be violated? Integrity ...
17
votes
6answers
16k views

What is the distinguishing point between a script kiddie and a hacker?

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker (...
17
votes
1answer
6k views

Oligomorphism vs polymorphism vs metamorphism in malware

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data appending/...
14
votes
4answers
26k views

Terminology: authentication vs verification

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
14
votes
2answers
2k views

Why is it called cross-site scripting? (XSS)

Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the ...
13
votes
2answers
3k views

Is the injection in a NoSQL database architecture also called SQL injection?

Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection? For example, an injection in code that communicates ...
13
votes
3answers
6k views

Security fields: AppSec vs. InfoSec vs. NetSec, etc

When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within ...
12
votes
4answers
4k views

Eavesdropping vs. sniffing

I'm taking a coursera course, and they take pains when talking about network security to distinguish between eavesdropping and sniffing. According to their definitions, sniffing involves reading or ...
12
votes
1answer
5k views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing my master thesis, I am wondering to which resource I ...
12
votes
2answers
3k views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...
12
votes
2answers
265 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS request ...
11
votes
2answers
2k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
10
votes
1answer
417 views

What is SpeedSurfing?

My Sophos antivirus detected what it calls "SpeedSurfing", and my Google-fu is failing me. The Chrome extension it deleted was Boomerang for Gmail.
10
votes
2answers
5k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
9
votes
1answer
3k views

What's the difference between escaping, filtering, validating and sanitizing?

An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and ...
9
votes
1answer
2k views

What is a security embargo?

Via Hackernews I landed on "An Ancient Security Hole is (Not) Closed", which mentions "embargoes" on several occasions, e.g.: ...I have no interest in digging out more details or ruining embargoes ...
9
votes
2answers
5k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
8
votes
7answers
3k views

Definition of Software Security

I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article. Most of the books starts already assuming that the user knows what that is, and they're ...
8
votes
2answers
333 views

Vulnerability Assessments - Vulnerability Taxonomies?

All, First question on here so please be as gentle as you can :-) I've been looking around for any writings or papers on a standard for classifying vulnerabilities. Not from a severity/risk/impact ...
8
votes
1answer
1k views

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related certificates/...
7
votes
4answers
2k views

What is War Dialing?

The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?
7
votes
3answers
2k views

What are the accepted naming convention for the terms “public/private keys” and “certificates”?

Is there an accepted naming convention for referring to PKI artifacts? There seems to be a lot of confusion with the naming of artifacts. For example, it seems that some people refer to: public ...
7
votes
2answers
3k views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
7
votes
3answers
327 views

When did we start to call malicious software “malware”?

I'm looking into the history of malware. When was malicious software fist called malware? I think that malicious software is called "computer virus".
7
votes
1answer
2k views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
7
votes
1answer
668 views

In IPSec what is the definition & purpose of SAD and SPD?

What is a Security Application Database & Security Policy Database? What is their role in processing models for OUTBOUND and INBOUND packets?
6
votes
4answers
9k views

Difference between a security analyst and a security engineer?

Looking out for jobs/internships, I see these two designations used almost interchangeably at times and at other times they mean different things. So as someone who have no experience in security, ...
6
votes
3answers
18k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
6
votes
3answers
1k views

Malware nomenclature

If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like? If one exists could someone explain it or ...
6
votes
2answers
361 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
6
votes
4answers
320 views

When should I use the word hacker, cracker, or black hat?

Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics. To others, it's the aggressor, bad-guy, cracker, or ...
6
votes
1answer
420 views

What is the difference between cybersecurity and information security? [closed]

I'm trying to differenciate between those two themes : cybersecurity vs information security. Broadly speaking I'd say cybersec is about network security (TCP/IP, router, firewall,...) and infosec is ...
6
votes
1answer
70 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
6
votes
3answers
2k views

What is the difference between misuse and abuse cases in security?

I know that misuse cases are use cases which help identify security requirements as they highlight the user's goal in misusing the system, but what exactly is abuse cases and what is the difference or ...
6
votes
2answers
131 views

What category of anonymity do onion routing and blockchains afford?

My understanding is that a strict definition of anonymity means that defeating the security mechanism is logically impossible or mathematically infeasible, and therefore so is deducing the identity. (...
5
votes
1answer
5k views

What is TTP hunting?

What is "TTP hunting" in terms of network security research? I came across this term, but do not know what this is . Tried to google it, but TTP seem to stand for many different things, but none of ...
5
votes
1answer
1k views

RBAC0 RBAC1 RBAC2 RBAC3 — What do they mean?

I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website: In 1996, Sandhu,...
5
votes
1answer
2k views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...