Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
2
votes
1answer
825 views

What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?

I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and ...
4
votes
3answers
4k views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
1
vote
3answers
667 views

When is IP blocking OSI level 7 only and what is the purpose of doing so on multiple locations?

Let's say there is an application that has IP whitelisting, all other IP's are denied. This check takes place on three different locations: iptables, .htaccess, PHP script. Now in what OSI layers ...
1
vote
2answers
148 views

What is the niche that Kerberos authentication fills called?

Keberos authentication is a bit of a top down concept. I'm working my way up to it from the bottom learning from the bottom up. It seems to me that Keberos authentication can be thought of as a glue ...
2
votes
2answers
64 views

Does MITM refer to what you do in the middle or how you get there?

Does the term "MITM attack" refer to what happens once an attacker is between two hosts or to attacks like ARP poisoning, DHCP snooping that allow the attacker to insert himself between two hosts in ...
3
votes
2answers
288 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
1
vote
2answers
131 views

Do we still refer to a threat as a threat once it has been realised?

A threat is defined as something that might do harm but once a threat happens do we still refer to it as a threat? For instance, if malware infects our computer, do we still refer to the malware as a ...
2
votes
1answer
278 views

Incident response terminology

Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few ...
0
votes
2answers
808 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
0
votes
1answer
153 views

What is the difference between vulnerability identification and exploitation?

Are strings like AND '1' = '2 and <script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits? If so, when black-box testing a house made web application, ...
-4
votes
1answer
120 views

What is the difference between data and information when it comes to Data Security? [closed]

I'm currently enrolled for Data Security program and for our assignment the question is to differentiate data and information. What is the difference between those two?
19
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
1
vote
1answer
168 views

Who defined the term “end-to-end encryption”?

I am trying to find the origin of the term "end-to-end encryption", but have been unsuccessful until now.
1
vote
1answer
115 views

Terminology - DMZ

The term DMZ is used to describe a separation area between a trusted zone and an untrusted zone. Ex: internal network vs internet. Can it be used to refer to a separation area between a trusted zone ...
2
votes
1answer
3k views

Terminology - entry point, data source, sink

In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
1
vote
1answer
46 views

Does this case fit the definition of a replay attack?

I read the definition of a replay attack on Wikipedia. However I don't know if the following case fits the description: An attacker captures a HTTP request sent to a web server, modifies the request ...
3
votes
1answer
111 views

Who defined the term “fully homomorphic encryption”?

Rivest et al. proposed the concept of privacy homomorphisms, but did not distinguish between partial versus fully homomorphic encryption. Gentry seems to take for granted the idea that fully ...
1
vote
1answer
85 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
27
votes
3answers
70k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
7
votes
1answer
2k views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
0
votes
1answer
115 views

Is there a 'key space' equivalent for encryption keys?

If a key space is the term given to the collection of all possible decryption keys for a given cryptosystem, then what is the collection of all possible encryption keys called?
0
votes
2answers
3k views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
1answer
32 views

Technical term needed: Per default secured / blacklist vs whitelist

I'm currently working on a homework and missing a technical term / known best practice to describe what I have learned or what I feel that is better. It is about a publish / subscribe architecture, ...
3
votes
2answers
212 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
1
vote
2answers
469 views

Is steganography a part of “cryptography”?

In preparing for a security exam, the prep book I'm reading states: In the field of cryptography, the topic of encryption gets by far the most attention ... ... Other techniques such as ...
6
votes
3answers
19k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
6
votes
1answer
70 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
1
vote
1answer
132 views

Social engineering attacks terminology

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?
2
votes
2answers
57 views

What is the message called someone sends to verify a key?

Suppose Alice wants to check if Bob has a certain keypair. Alice could send some random payload to Bob and let Bob sign that payload with his private key. Alice is now able to check if the signature ...
1
vote
1answer
104 views

Terminology involving malware/virus/worm [duplicate]

What is the difference between "worms", "viruses", and "malware"? Some sources I've found said both viruses and worms infect files. But others say worms are stand alone programs, and are ...
-1
votes
5answers
302 views

Is there a name for this flawed way of thinking about security? [closed]

I've recently encountered a developer who thinks that she can implement security on the client end of a web application. Breaking the security is as trivial as reading a few lines of Javascript and ...
4
votes
1answer
186 views

Terminology: What kind of security applies to industrial control systems, fire alarm systems, etc.?

I am wondering what you would call the kind of security that applies to systems such as industrial control (SCADA) systems, building automation systems, fire alarm systems, etc. These systems are ...
1
vote
1answer
1k views

BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”

Note: Below are some information from searching around the Internet. To skip to my main question, go to the last line of this post. I've been searching around on how to change the Volume Master Key (...
3
votes
2answers
706 views

Registration or Enrollment?

When joining an authenticated network, I have seen the terms "Enrollment" and "Registration" used to describe the process of initially setting up your credentials on the network. "Authentication" ...
2
votes
1answer
452 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
1
vote
2answers
4k views

Difference between confidential, protected, and restricted data

I've been reading this article about Data Handling Security Measures, what's the difference between confidential, protected, and restricted data? Maybe I could understand it well with example of the ...
1
vote
1answer
94 views

What is the term for requiring a user to go through an additional activation/verification process on new devices only?

When I log onto my bank's website on a new device (be it a new phone or a web browser I haven't used before) it prompts me to send an activation code to my phone or email. I have to enter in this one-...
2
votes
1answer
152 views

Protecting vs Securing

I encountered a question "true or false, replication is NOT a way to protect data". I answered true since I felt that protecting data meant securing the network and preventing unauthorized access to ...
3
votes
2answers
114 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the voice-...
14
votes
2answers
3k views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...
4
votes
1answer
505 views

Safe/Secured room?

I was involved in this project where development got outsourced to a consulting company, but to seal the deal the consulting company had to set up a room in their office with restricted access so that ...
1
vote
0answers
2k views

Data Security vs Information Security [closed]

Is Information Security field and Data Security field same? If not then, What is the basic difference between "Information" and "Data" in security field? Is Data Security a sub-category of ...
-1
votes
3answers
135 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
2
votes
1answer
1k views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
1
vote
2answers
121 views

What is the proper terminology for the various SMTP tunnel encryption solutions?

I'm writing up documentation and want to ensure that I'm using proper terminology. 1) What is the proper technical term for the SMTP tunnel encryption standard that typically starts on TCP/25, ...
9
votes
2answers
6k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
3
votes
2answers
565 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
4
votes
1answer
124 views

Do voting machines rely on “security through obscurity”?

There was an interesting paper in 2013 from the University of Pennsylvania called Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities. One ...
30
votes
6answers
19k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
3
votes
1answer
872 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...