Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
5
votes
1answer
2k views

RBAC0 RBAC1 RBAC2 RBAC3 — What do they mean?

I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website: In 1996, Sandhu,...
5
votes
1answer
3k views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
5
votes
1answer
399 views

What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
5
votes
1answer
339 views

Why is it called micalg?

RFC3851 says: The multipart/signed Content type has two required parameters: the protocol parameter and the micalg parameter. and The micalg parameter allows for one-pass processing when ...
5
votes
1answer
135 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
4
votes
2answers
169 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
4
votes
4answers
8k views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
4
votes
4answers
4k views

What is the difference between a backdoor and a rootkit?

I was reading the "What is a rootkit ?" post and I'm confused about the difference between a rootkit and a backdoor. As I understood it, both : Are a piece of code written by the attacker and ...
4
votes
3answers
192 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
4
votes
2answers
187 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
4
votes
1answer
483 views

Safe/Secured room?

I was involved in this project where development got outsourced to a consulting company, but to seal the deal the consulting company had to set up a room in their office with restricted access so that ...
4
votes
1answer
305 views

What is an Origin Error Attack?

Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one. From The Forrester Wave™: DDoS Services Providers, Q3 2015 ...
4
votes
2answers
627 views

What is the etymology of “Salt” in relation to password storage?

Simple question: When talking about appending a random string to a password before hashing in order to defend against dictionary attacks, we call it a salt. Why do we call it a salt?
4
votes
1answer
2k views

What is the difference between local file inclusion (LFI) and remote file inclusion (RFI)?

Based on this previous question, it seems like the difference between directory traversal and file inclusion is as follows: Directory traversal Improper validation of user input leads to read ...
4
votes
1answer
107 views

Are command injections examples of confused deputies?

In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the ...
4
votes
1answer
563 views

Penetration Testing Vocabulary

The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?
4
votes
1answer
170 views

Terminology: What kind of security applies to industrial control systems, fire alarm systems, etc.?

I am wondering what you would call the kind of security that applies to systems such as industrial control (SCADA) systems, building automation systems, fire alarm systems, etc. These systems are ...
4
votes
1answer
693 views

What does colluded truncation attack mean?

I'm doing my final year engineering project. I went through some ieee papers and came across something called colluded truncation attack. Can someone explain what it is. I'm planning to do the project ...
4
votes
1answer
621 views

What's the difference between “load testing” and “stress testing” within the context of a security audit?

I'm preparing for the CCSP examine and am trying to wrap my mind around the concepts of "load testing" and "stress testing" within the context of security. I think the difference here is that: ...
4
votes
1answer
76 views

Is there a difference in terminology between the words “cryptogram” and “ciphertext”?

I've noticed that certain security professionals use the term "ciphertext" while others use "cryptogram". Is there any meaningful difference between those terms? Or can they be used interchangeably?
4
votes
3answers
4k views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
4
votes
1answer
121 views

Do voting machines rely on “security through obscurity”?

There was an interesting paper in 2013 from the University of Pennsylvania called Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities. One ...
4
votes
2answers
160 views

Way of categorising and organising types of security issues and areas

I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
4
votes
1answer
433 views

Is FAR (False Accept Rate) a property of algorithm or a property of the system?

As known in biometrics: https://en.wikipedia.org/wiki/Biometrics#Performance False match rate (FMR, also called FAR = False Accept Rate): the probability that the system incorrectly matches the ...
4
votes
1answer
57 views

Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, what is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an AuthenticationToken....
4
votes
1answer
98 views

Looking for a taxonomy of anonymization or re-identification properties

We are working with personally identifiable information that needs to be de-identified. Is there an existing hierarchy or taxonomy of different kinds of re-identification properties?
3
votes
2answers
283 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
3
votes
2answers
210 views

Why are Protection Rings called rings?

Protection rings are different privilege levels granted to software, with the kernel being the most privileged, applications the least privileged, and drivers somewhere in between. My question is why ...
3
votes
3answers
3k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
3
votes
3answers
794 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
3
votes
2answers
4k views

Cyber Security vs. Digital Security

What is the difference between Cyber Security and Digital Security? They sound very similar (same) to me, But I have read that current techniques of Machine Learning can provide Digital Security, ...
3
votes
2answers
987 views

Is server public key and Diffie Hellman public are the same?

I am trying to understand the working of TLS. I understand that there are various way to generate the master secret used to encrypting the data. Such as DH (Ephemeral DHE) and RSA. I understand that, ...
3
votes
2answers
5k views

What is the difference between Right and Permission?

I know that the term "rights" applies to users or groups of users (such as "the user X has the right to change system time") and the term "permissions" applies to an object (such as a folder or file, ...
3
votes
4answers
11k views

difference between need to know, least privilege and confidential

I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing? In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
3
votes
1answer
600 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
3
votes
1answer
856 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
3
votes
2answers
546 views

Trust vs Reputation

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these ...
3
votes
1answer
1k views

What's the difference between an “application-aware firewall” and a “web application firewall”?

I'm studying for the CCSP and my training material isn't very clear on the definition between "application-aware firewall" and "web application firewall". The training material states: Early on, ...
3
votes
1answer
365 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
3
votes
1answer
175 views

Why are overused buzzwords like Cyber and Hacking still prevalent in our industry? [closed]

Proper terminology is important for anyone who wants to learn something. The best way to develop professionalism is to rely on a set of well defined technical terms. So it should be in any ...
3
votes
2answers
113 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the voice-...
3
votes
2answers
305 views

What are client-side exploits

I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
3
votes
2answers
472 views

Is there a difference between “risk tolerance” and “risk appetite”?

I'm studying for the CCSP exam and I'm a little confused on the difference between "Risk Appetite" and "Risk Tolerance". Is there a clear and discernible difference? Can the terms be used ...
3
votes
3answers
2k views

What's the difference between privacy and anonymity? [closed]

In the previous topic I was talking about VPN and TOR browser, and someone mentioned privacy VS anonymity. What's the actual difference between them?
3
votes
2answers
201 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
3
votes
1answer
867 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
3
votes
3answers
282 views

Difference between white-box testing and secure code review

As far as I know, penetration testing can be divided into black-box, gray-box, and white-box testing. But then what about secure code review? Is it part of white-box testing or is it separate?
3
votes
1answer
161 views

What does Frank Abagnale mean by “Level 4 security” in his talk at Google?

During his talk at Google, Frank Abagnale mentioned the following: ...we will be doing away with passwords in the next 24 months. Passwords will leave the world, there will be no more passwords. ...
3
votes
1answer
706 views

Is Threat Risk Assessment the same as Threat Risk Modeling?

I've been asked to help fill out a survey and one of the questions is whether a Threat Risk Assessment has been performed on a blog we're setting up for a charity. The WordPress blog will use a free ...
3
votes
2answers
678 views

Registration or Enrollment?

When joining an authenticated network, I have seen the terms "Enrollment" and "Registration" used to describe the process of initially setting up your credentials on the network. "Authentication" ...