Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
0
votes
1answer
61 views

Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?

I apologize for the weird wording of the question title, I was hitting the character count. I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
0
votes
1answer
36 views

Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?

I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
0
votes
0answers
42 views

What is cybersecurity landscape?

What does "cybersecurity landscape" mean? Is it a cyber threat trend?
1
vote
0answers
46 views

Is using URL parameters together with body parameters in a POST request a defined security anti-pattern?

It is technically allowed by many programming languages to supply parameters in POST requests as part of the URL, similar to a GET request. You can do this in addition to supplying parameters in the ...
0
votes
0answers
49 views

Difference between Attack Pattern and Attack Vector

I am learning about InfoSec and I always found these two terms Attack Pattern an attack pattern is an abstraction mechanism for describing how a type of observed attack is executed Attack Vector a ...
3
votes
0answers
30 views

Threat / Adversary / Trust / Security model, what is the difference?

In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
4
votes
2answers
261 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
2
votes
4answers
248 views

Is Information Security a Cybersecurity area or the opposite?

I'm reading about Cybersecurity and Information Security and I have questions: Is Information Security part of Cybersecurity? Is Cybersecurity part of Information Security? Both have just common ...
2
votes
1answer
40 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
1
vote
1answer
68 views

Difference between Process and Practice in Information Security

I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean. While these two terms are quite easy to distinguish: policy is what to do to secure ...
5
votes
5answers
14k views

difference between need to know, least privilege and confidential

I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing? In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
6
votes
1answer
176 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
3
votes
1answer
102 views

MSTG-ARCH-7: All security controls have a centralized implementation

In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation". Now I'm struggling a bit by what ...
0
votes
0answers
55 views

What's the term for a hash sent early and plain text revealed later?

I think there is a known pattern where you post the hash of a document, e.g. on Twitter, in order to have its time registered. You could then later publish the document and have it accredited for the ...
0
votes
1answer
81 views

Anti virus vs Anti malware? [duplicate]

What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
1
vote
1answer
138 views

Is this considered DOM-XSS or self-XSS or both?

SCENARIO: A web page shows an error login page using these javascript lines <script> let queryParams = new URLSearchParams(window.location.search); document.getElementById("message")....
3
votes
2answers
102 views

Why is the term “nation state” used to refer to a government-sponsored effort in infosec, and is it accurate? [closed]

I work in infosec and as such, have read many whitepapers and been to many conference talks. I hear all the time, especially in conversation and literature about malware, the term "nation state" used ...
7
votes
2answers
2k views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TPM vs. HSM and TPM vs. SE)...
0
votes
0answers
49 views

What is securing an application platform called?

I'm searching for the right terminology for this element of cyber security. If I want to secure something like a PaaS for other applications to use, how is this usually called? It's not application ...
5
votes
1answer
353 views

What is an Origin Error Attack?

Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one. From The Forrester Wave™: DDoS Services Providers, Q3 2015 ...
1
vote
1answer
70 views

What does “hijack” mean in networking security?

How should I understand the word "hijack" in network security? In Cloudflare's page about the Mirai botnet, there is a sentence: The Mirai botnet employed a hundred thousand hijacked IoT devices ...
1
vote
0answers
21 views

Name of 'smart brute force' attack against sequential cipher lock [duplicate]

I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
18
votes
6answers
19k views

What is the distinguishing point between a script kiddie and a hacker?

When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker (...
-1
votes
1answer
196 views

Is there really such a thing as “script kiddies”? [duplicate]

All my life, well, at least since the late 1990s, I've heard of this concept of "script kiddies". Allegedly, it's a term to refer to young kids or teenagers who, apparently, are somehow able to find "...
4
votes
2answers
228 views

Why is the root in an Online CA model not a Single Point of Failure?

My textbook for CompTIA Security+ has the following practice question: In which one of following PKI Trust Models is the root NOT a single point of failure? Single CA Hierarchical CA ...
17
votes
2answers
3k views

Why is it called cross-site scripting? (XSS)

Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the ...
1
vote
1answer
243 views

What is the difference between “cipher” and “encryption”?

It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
0
votes
0answers
35 views

Risk, threat, vulnerability with an example

Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate: Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
4
votes
4answers
6k views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
3
votes
2answers
297 views

Unambiguous terminology for different kinds of malware?

I noticed in the literatures that there are no exact boundaries for numerous information security terms such as malware, virus, etc. Some people say malware i the umbrella under which viruses, worms, ...
24
votes
4answers
11k views

Why define CIA in security like this?

As we know CIA of the demand for security means: Confidentiality Integrity Availability I don't understand why define the "Integrity" and "Availability`, If we make a plaintext Confidentiality, the ...
-5
votes
1answer
112 views

Should we consider Deepfakes and fakenews as disinformation or misinformation? [closed]

Cognitive hacking some say is a new type of hacking field and some say it is something that been there for many years. Exploring the chapters of WIKI and using projects like MisinfoSec, got me ...
0
votes
1answer
728 views

Difference between Non-discretionary and Role-based Access control?

What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
2
votes
1answer
3k views

What is the difference between data owner, data custodian and system owner?

I just started studying up for the CISSP and am having trouble understanding few concepts: Data owner Data custodian System owner Somewhere I read: The data owner (information owner) is usually a ...
1
vote
0answers
38 views

Name of security measure that shows user a personal word / phrase / drawing [duplicate]

I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
1
vote
3answers
17k views

What's the difference between “Due Care” and “Due Diligence”?

Can someone please explain the difference between "due care" and "due diligence"? They seem very similar to one another and after researching more and more, I'm getting confused. One tech book ...
27
votes
3answers
38k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
2
votes
3answers
236 views

Confusing definitions of “parasitic virus” and “worm”

I was studying for CISSP certification when I came across the question "what type of virus attaches itself to an executable?" The answer was "parasitic". I find terms relating to viruses and malware ...
1
vote
0answers
42 views

Facial Recognition Attack Nomenclature

Is there a generally acknowledged term for spoofing facial recognition with a photo of the target face (Samsung smartphone facial recognition, not Apple FaceID (depth measurement)).
4
votes
4answers
4k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
3
votes
3answers
473 views

False Match vs False Acceptance

Studying up on biometric security terms, can someone clarify the difference between 'Match'/'Non-Match' and 'Rejection'/'Acceptance'?
1
vote
2answers
4k views

Rights vs permissions vs privileges

I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be ...
0
votes
3answers
3k views

What *exactly* does it mean to detonate malware?

Does it mean the same as to eliminate or disarm the threat or does it mean that the malware was activated/executed (whether it reached its target or detonated in a "controlled" manner, e.g., in a ...
4
votes
1answer
777 views

Penetration Testing Vocabulary

The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?
6
votes
1answer
3k views

RBAC0 RBAC1 RBAC2 RBAC3 — What do they mean?

I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website: In 1996, Sandhu,...
1
vote
0answers
106 views

Difference between IAG and IDM

What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)? Apologies for ...
0
votes
1answer
65 views

SNMP - need help with terminology

In many resources, I see that community strings are also called default passwords. But in the Server Manager, I see "Community name" and it makes more sense. So why people often use the phrase "...
80
votes
5answers
28k views

What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?

I reached out to an old friend of mine who was a terrific programmer back in my school days and he invited me to attend one of the CTF events with his university group. This group seems very beginner ...
2
votes
1answer
45 views

The use of “over” in cryptography (as in “a hash over the key”)

This is the ultimate noob question. When reading discussions of cryptography, I often come across phrases like these: ...calculates a hash over the primary key... ...a key derivation function over a ...
164
votes
4answers
35k views

What does it mean to “burn a zero-day”?

I noticed a comment on this answer where another user said ...but it requires risking burning a 0day, which people are not always all that willing to do. I did an Internet Search for the phrase "...

1
2 3 4 5