Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
0
votes
3answers
118 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
4
votes
1answer
2k views

What is the difference between local file inclusion (LFI) and remote file inclusion (RFI)?

Based on this previous question, it seems like the difference between directory traversal and file inclusion is as follows: Directory traversal Improper validation of user input leads to read ...
4
votes
1answer
370 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
13
votes
1answer
6k views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing my master thesis, I am wondering to which resource I ...
2
votes
4answers
186 views

Why is phishing becoming synonymous with ransomware?

The Wikipedia definition of phishing is: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as ...
0
votes
2answers
760 views

What do you call an antivirus that detects suspicious activity?

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.) This does not help when defending against zero-days and ...
2
votes
2answers
229 views

injection attacks - terminology

I have a question related to injection attacks like SQL injections and command injections. I have a good grasp about how those attacks are performed, but I would like to know where the term injection ...
3
votes
2answers
5k views

What is the difference between Right and Permission?

I know that the term "rights" applies to users or groups of users (such as "the user X has the right to change system time") and the term "permissions" applies to an object (such as a folder or file, ...
0
votes
1answer
106 views

Verb for “turning a bug into an attack”? [closed]

I forget what word it is that refers to the work of turning known bugs into real-world attacks, for example when people string together two separate exploits to break out of the Chrome sandbox. It's ...
4
votes
1answer
111 views

Are command injections examples of confused deputies?

In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the ...
4
votes
2answers
195 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
8
votes
1answer
2k views

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related certificates/...
1
vote
2answers
126 views

What do you call an attack vector that consists of filling the whole server RAM using a single process?

I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That ...
12
votes
2answers
277 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS request ...
1
vote
2answers
118 views

Terms for differentiating between key-exchange and public-key cryptosystem

The RSA and Diffie-Hellman protocols are part of asymmetric cryptography. But is there a word to distinguish between cryptosystem like RSA (i.e. there are two keys, one for encryption and another for ...
0
votes
2answers
230 views

Would one consider the breaking of Enigma in WWII to be an early example of a backdoor?

In a recent discussion re Tory Minister and British Home Secretary Amber Rudd's insistence that WhatsApp install a backdoor for government monitoring of encrypted data, I brought up Enigma as an early ...
1
vote
0answers
82 views

Privacy terminology: Online privacy vs Internet Privacy vs Digital Privacy

While, to my eyes, Digital Privacy is the broader term ( anything digital whether online or not), I have seen all 3 used interchangeably (i.e: link vs title). Also, despite having different entries in ...
1
vote
0answers
78 views

Does “assesse” have a particular meaning in information security?

From this job description, bold added: The human factors expert is needed to conduct research on human subjects that perform tasks for full spectrum cyber operations. The researcher will define, ...
1
vote
2answers
181 views

Is using attack tools from a compromised host considered “pivoting”?

I would like to get a better understanding of pivoting in pentesting. If I install attack tools (nmap, ...) on a compromised host and use them to attack other hosts on the network, is that considered ...
38
votes
3answers
6k views

What is an SNI Hole?

Earlier today, Lone Learner asked Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com? The accepted answer explains that the issue was ...
3
votes
4answers
11k views

difference between need to know, least privilege and confidential

I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing? In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
14
votes
4answers
29k views

Terminology: authentication vs verification

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
2
votes
2answers
115 views

What do these terms means with relation to viruses and operating system?

Often times I've heard viruses using "hooks" and "embeding" themself into files. For example from Wikipedia's article on Mebroot The Trojan tries to avoid detection by hooking itself into atapi....
10
votes
1answer
2k views

What is a security embargo?

Via Hackernews I landed on "An Ancient Security Hole is (Not) Closed", which mentions "embargoes" on several occasions, e.g.: ...I have no interest in digging out more details or ruining embargoes ...
14
votes
2answers
2k views

Why is it called cross-site scripting? (XSS)

Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the ...
1
vote
2answers
2k views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”?

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy"? I had an argument about this with my management and whilst some think that its basically the same thing,...
1
vote
2answers
1k views

How exactly are registration authorities related to certificate authorities?

In preparing for the CISSP exam, the course material seems to emphasize a distinct role between a Certificate Authority and a Registration Authority. As per the study guide description: ...
13
votes
2answers
3k views

Is the injection in a NoSQL database architecture also called SQL injection?

Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection? For example, an injection in code that communicates ...
0
votes
2answers
87 views

Terminology: What's the appropriate term for the digest output of various integrity hash and HMAC functions?

I've heard conflicting statements from various CISSP instructors, so I'd like some "real world" perspective: What is the appropriate terminology for the digest output of the following algorithms: ...
1
vote
1answer
127 views

What does “fd” stand for in the context of public key infrastructure? [closed]

I'm reading the OpenSSL Cookbook. Early in Chapter 1 on page 9, the author generates a private key using the RSA algorithm: openssl genrsa -aes128 -out fd.key 2048 I understand that the key could be ...
2
votes
1answer
60 views

Terminology (analogy?) for losing control of a secret due to re-sharing

Regarding sharing a password/access/secret to someone... and then you don't have control whether they will also share this on, and potentially it could/will end up publicly known, thus insecure. The ...
27
votes
6answers
3k views

What do you call the entity seeking to be authenticated?

What do you call an entity seeking to be authenticated? Is there a single word or short phrase for it? What would you name a variable that represented the party asking to be authenticated?
2
votes
1answer
52 views

What is an electronic document in the context of encryption?

I'm reading about a Public key certificate: In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ...
0
votes
0answers
36 views

Is there a common general placeholder name for the “protected secret”?

I wonder if there is a general name for the "protected information" that you are trying to protect. Sometimes it's a code or a password or a token and I would like to know if there is a word for ...
-2
votes
1answer
66 views

What is the term to describe “Transitivity” in network security?

If A's security is breached, while A and B are in the same network, then B's security is breached. I can imagine this could happen to computer networks, but also to social networks; for example if ...
6
votes
1answer
447 views

What is the difference between cybersecurity and information security? [closed]

I'm trying to differenciate between those two themes : cybersecurity vs information security. Broadly speaking I'd say cybersec is about network security (TCP/IP, router, firewall,...) and infosec is ...
3
votes
1answer
896 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
1
vote
3answers
198 views

Why is it called WEP? [closed]

The WEP standard is called "wired equivalent privacy"? Why does it include "wired"? Does have it have to do with ethernet codes or something else?
1
vote
2answers
1k views

what does 0day vulnerability specifically mean? [duplicate]

is any unknown vulnerability from any type considered as 0 day vulnerability ? as example if i discovered xss vulnerability in a website which is unknown for users and developers, then does that mean ...
9
votes
1answer
4k views

What's the difference between escaping, filtering, validating and sanitizing?

An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and ...
14
votes
3answers
7k views

Security fields: AppSec vs. InfoSec vs. NetSec, etc

When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within ...
2
votes
2answers
320 views

why do they call packet filter firewall a PACKET filter firewall

Why do we call packet filter firewalls .... packet filter firewalls? A firewall operating as a packet filter passes or blocks traffic to specific addresses based on the type of application. The ...
1
vote
2answers
2k views

Is there a meaningful difference between Cyber Defense and Cyber Security? [closed]

I've been describing some entrepreneurial aspirations to people and one of them in the IT area interrupted when I said I was interested in starting a "Cyber Defense" firm, and he said "Cyber Security" ...
2
votes
3answers
208 views

Is Information Security a Cybersecurity area or the opposite?

I'm reading about Cybersecurity and Information Security and I have questions: Is Information Security part of Cybersecurity? Is Cybersecurity part of Information Security? Both have just common ...
2
votes
1answer
677 views

How the 'probability of verification' is inversely related to the 'false accept rate'?

I was reading a document discussing biometrics and came across this statement: Typical finger-print verification systems employed by FBI achieve 90% probability of verification at 1% false accept ...
1
vote
1answer
76 views

Protecting vs Defending a system

What is the difference between saying defending a system from attacks or protecting a system from attacks? This question might be trivial to most of you but I really don't see the fine line here. In ...
1
vote
1answer
37 views

Question about removal-notice if sued or compromised

What do you call the old notices that say: If this notice is removed the site is to be assumed compromised or litigation to compromise the site has been filed. I used to see these a lot as a ...
3
votes
1answer
176 views

Why are overused buzzwords like Cyber and Hacking still prevalent in our industry? [closed]

Proper terminology is important for anyone who wants to learn something. The best way to develop professionalism is to rely on a set of well defined technical terms. So it should be in any ...
4
votes
4answers
8k views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
2
votes
1answer
821 views

What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?

I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and ...