We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
3
votes
1answer
109 views

Who defined the term “fully homomorphic encryption”?

Rivest et al. proposed the concept of privacy homomorphisms, but did not distinguish between partial versus fully homomorphic encryption. Gentry seems to take for granted the idea that fully ...
3
votes
2answers
1k views

Difference between “weakness” and “vulnerability”?

What is the difference between the terms "vulnerability" and "weakness" when it comes to security? I was looking at the CWE page and it mentions that a weakness leads to a security vulnerability. I ...
3
votes
3answers
392 views

False Match vs False Acceptance

Studying up on biometric security terms, can someone clarify the difference between 'Match'/'Non-Match' and 'Rejection'/'Acceptance'?
2
votes
2answers
251 views

Unambiguous terminology for different kinds of malware?

I noticed in the literatures that there are no exact boundaries for numerous information security terms such as malware, virus, etc. Some people say malware in the umbrella under which viruses, worms, ...
2
votes
1answer
773 views

What is the difference between “web penetration testing” and “web application penetration testing”?

I decided to start learning "web application penetration testing". But while I am learning I find there is another term "web penetration testing". Can someone tell me what's the difference between ...
2
votes
4answers
184 views

Why is phishing becoming synonymous with ransomware?

The Wikipedia definition of phishing is: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as ...
2
votes
1answer
803 views

What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?

I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and ...
2
votes
1answer
145 views

Protecting vs Securing

I encountered a question "true or false, replication is NOT a way to protect data". I answered true since I felt that protecting data meant securing the network and preventing unauthorized access to ...
2
votes
1answer
297 views

Does “crypto offloading” require the use of ASICs? Can the concept be applied elsewhere?

I'm studying for the CCSP exam and the training material is a little vague on the term "crypto offloading". The term was mentioned in passing while describing TLS: TLS is a protocol designed to ...
2
votes
1answer
275 views

Incident response terminology

Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few ...
2
votes
2answers
56 views

What is the message called someone sends to verify a key?

Suppose Alice wants to check if Bob has a certain keypair. Alice could send some random payload to Bob and let Bob sign that payload with his private key. Alice is now able to check if the signature ...
2
votes
1answer
427 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
2
votes
3answers
173 views

Are all vulnerabilities security related?

Are all vulnerabilities security related? When people talk about vulnerabilities and security vulnerabilities, are they the same concept? My understanding is that a vulnerability is the a weakness in ...
2
votes
1answer
49 views

What's the difference between OVAL definitions, objects, and tests?

I'm trying to become more familiar with OVAL tst def and obj references in joval xml definition files. For example, I'll see stuff like: <criterion comment="Foo" test_ref="oval:org.mitre.oval:...
2
votes
1answer
69 views

Is it reasonable to consider logs as a “technical control”?

I'm studying for the CCSP exam and one of the examples of technical controls (referenced in the course training material) confuse me: Technical controls, also referred to as logical controls, are ...
2
votes
1answer
52 views

What is an electronic document in the context of encryption?

I'm reading about a Public key certificate: In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ...
2
votes
2answers
310 views

why do they call packet filter firewall a PACKET filter firewall

Why do we call packet filter firewalls .... packet filter firewalls? A firewall operating as a packet filter passes or blocks traffic to specific addresses based on the type of application. The ...
2
votes
1answer
145 views

What is the difference between data owner, data custodian and system owner?

I just started studying up for the CISSP and am having trouble understanding few concepts: Data owner Data custodian System owner Somewhere I read: The data owner (information owner) is usually a ...
2
votes
3answers
133 views

Terminology for reduced brute-force attack?

Many security algorithms today have such a large key length, that there's just no use in trying to brute-force a key. For example to find one AES-256 key you would have to try 2^255 keys on average. ...
2
votes
2answers
69 views

Definition of information in ISO 2700x

I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at ...
2
votes
1answer
435 views

What is an indicator of compromise?

I'm struggling to understand what is an indicator of compromise. I found different definitions on the web but I still don't know. The definitions I found are: 1 - Something (file, network connection) ...
2
votes
2answers
109 views

What do these terms means with relation to viruses and operating system?

Often times I've heard viruses using "hooks" and "embeding" themself into files. For example from Wikipedia's article on Mebroot The Trojan tries to avoid detection by hooking itself into atapi....
2
votes
2answers
228 views

injection attacks - terminology

I have a question related to injection attacks like SQL injections and command injections. I have a good grasp about how those attacks are performed, but I would like to know where the term injection ...
2
votes
2answers
64 views

Does MITM refer to what you do in the middle or how you get there?

Does the term "MITM attack" refer to what happens once an attacker is between two hosts or to attacks like ARP poisoning, DHCP snooping that allow the attacker to insert himself between two hosts in ...
2
votes
1answer
1k views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
2
votes
1answer
635 views

What is the origin of the three factors of authentication?

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
2
votes
2answers
174 views

Is there a term for a “Master + extension” style password scheme?

I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component. So for Gmail my password might be correcthorsebatterystaple + ...
2
votes
1answer
43 views

The use of “over” in cryptography (as in “a hash over the key”)

This is the ultimate noob question. When reading discussions of cryptography, I often come across phrases like these: ...calculates a hash over the primary key... ...a key derivation function ...
2
votes
1answer
474 views

How do I interpret output that produces gpg listing keys?

Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
2
votes
1answer
80 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
2
votes
1answer
296 views

Is there a difference between “Maximum Tolerable Downtime” and “Maximum Allowed Downtime”?

I'm studying for the CCSP exam and one of the BC/DR terms that is referenced in my study material is "Maximum Allowable Downtime". The definition for it is: MAD (Maxium Allowable Downtime) How ...
2
votes
2answers
1k views

What's the difference between an API gateway and XML gateway?

I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway". The training material I have states: API gateways are also an important part of a ...
2
votes
1answer
662 views

How the 'probability of verification' is inversely related to the 'false accept rate'?

I was reading a document discussing biometrics and came across this statement: Typical finger-print verification systems employed by FBI achieve 90% probability of verification at 1% false accept ...
2
votes
3answers
205 views

Is Information Security a Cybersecurity area or the opposite?

I'm reading about Cybersecurity and Information Security and I have questions: Is Information Security part of Cybersecurity? Is Cybersecurity part of Information Security? Both have just common ...
2
votes
1answer
156 views

What is “Intentionally misleading Artificial Intelligence to create a misleading outcome” called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
2
votes
3answers
103 views

Confusing terminologies: Incident, alert, event, ticket [duplicate]

I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused. We are currently following the workflow like: some security events ...
2
votes
1answer
60 views

Terminology (analogy?) for losing control of a secret due to re-sharing

Regarding sharing a password/access/secret to someone... and then you don't have control whether they will also share this on, and potentially it could/will end up publicly known, thus insecure. The ...
1
vote
3answers
194 views

Why is it called WEP? [closed]

The WEP standard is called "wired equivalent privacy"? Why does it include "wired"? Does have it have to do with ethernet codes or something else?
1
vote
5answers
181 views

What does “hacked” actually mean? [duplicate]

In the context of a) information security and b) an operating system such as Windows 10 or OS X, what actually constitutes a "hack"? Most non-technical end-users associate the term "hack" with the ...
1
vote
3answers
646 views

When is IP blocking OSI level 7 only and what is the purpose of doing so on multiple locations?

Let's say there is an application that has IP whitelisting, all other IP's are denied. This check takes place on three different locations: iptables, .htaccess, PHP script. Now in what OSI layers ...
1
vote
2answers
1k views

How exactly are registration authorities related to certificate authorities?

In preparing for the CISSP exam, the course material seems to emphasize a distinct role between a Certificate Authority and a Registration Authority. As per the study guide description: ...
1
vote
2answers
77 views

Is crimeware defined by anything other than intent?

I'm learning about different types of viruses, and one category of virus is "crimeware." I read the wikipedia page for crimeware, and to me it seems that crimeware is just a specific usage of spyware. ...
1
vote
2answers
178 views

Is using attack tools from a compromised host considered “pivoting”?

I would like to get a better understanding of pivoting in pentesting. If I install attack tools (nmap, ...) on a compromised host and use them to attack other hosts on the network, is that considered ...
1
vote
3answers
13k views

What's the difference between “Due Care” and “Due Diligence”?

Can someone please explain the difference between "due care" and "due diligence"? They seem very similar to one another and after researching more and more, I'm getting confused. One tech book ...
1
vote
2answers
2k views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”?

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy"? I had an argument about this with my management and whilst some think that its basically the same thing,...
1
vote
2answers
148 views

What is the niche that Kerberos authentication fills called?

Keberos authentication is a bit of a top down concept. I'm working my way up to it from the bottom learning from the bottom up. It seems to me that Keberos authentication can be thought of as a glue ...
1
vote
2answers
126 views

What do you call an attack vector that consists of filling the whole server RAM using a single process?

I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That ...
1
vote
1answer
94 views

What is the term for requiring a user to go through an additional activation/verification process on new devices only?

When I log onto my bank's website on a new device (be it a new phone or a web browser I haven't used before) it prompts me to send an activation code to my phone or email. I have to enter in this one-...
1
vote
1answer
90 views

What is the difference between full end-to-end encryption and end-to-end encryption?

What is the difference between full end-to-end encryption and end-to-end encryption? Are there any differences between these two terms?
1
vote
1answer
3k views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA deprecated, like SHA1? Are they the ...