Questions tagged [terminology]

For questions about names of attacks, vulnerabilities, concepts, etc.

Filter by
Sorted by
Tagged with
1
vote
1answer
3k views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA deprecated, like SHA1? Are they the ...
1
vote
1answer
127 views

What does “fd” stand for in the context of public key infrastructure? [closed]

I'm reading the OpenSSL Cookbook. Early in Chapter 1 on page 9, the author generates a private key using the RSA algorithm: openssl genrsa -aes128 -out fd.key 2048 I understand that the key could be ...
1
vote
1answer
84 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
1
vote
2answers
462 views

Is steganography a part of “cryptography”?

In preparing for a security exam, the prep book I'm reading states: In the field of cryptography, the topic of encryption gets by far the most attention ... ... Other techniques such as ...
1
vote
2answers
121 views

What is the proper terminology for the various SMTP tunnel encryption solutions?

I'm writing up documentation and want to ensure that I'm using proper terminology. 1) What is the proper technical term for the SMTP tunnel encryption standard that typically starts on TCP/25, ...
1
vote
2answers
80 views

adaptive vs. non-adaptive adversaries; Is there a precise, unique and general definition?

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
1answer
29 views

Is this description of the term “event” accurate within the context of Business Continuity and Disaster recovery?

I'm studying for the CCSP exam and I came across this description: An event is any unscheduled adverse impact to the operating environment. An event is distinguished from a disaster by the ...
1
vote
2answers
2k views

Rights vs permissions vs privileges

I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be ...
1
vote
2answers
1k views

what does 0day vulnerability specifically mean? [duplicate]

is any unknown vulnerability from any type considered as 0 day vulnerability ? as example if i discovered xss vulnerability in a website which is unknown for users and developers, then does that mean ...
1
vote
2answers
129 views

Do we still refer to a threat as a threat once it has been realised?

A threat is defined as something that might do harm but once a threat happens do we still refer to it as a threat? For instance, if malware infects our computer, do we still refer to the malware as a ...
1
vote
2answers
4k views

Difference between confidential, protected, and restricted data

I've been reading this article about Data Handling Security Measures, what's the difference between confidential, protected, and restricted data? Maybe I could understand it well with example of the ...
1
vote
1answer
311 views

What is this phishing technique called using subdomains

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
1
vote
2answers
304 views

SIEM and Security Analytics

I've encountered the two terms 'SIEM' and 'Security Analytics' a lot in the past few weeks, unfortunately I still don't understand the difference. According to some research I've done about these ...
1
vote
2answers
1k views

Is there a meaningful difference between Cyber Defense and Cyber Security? [closed]

I've been describing some entrepreneurial aspirations to people and one of them in the IT area interrupted when I said I was interested in starting a "Cyber Defense" firm, and he said "Cyber Security" ...
1
vote
1answer
76 views

Protecting vs Defending a system

What is the difference between saying defending a system from attacks or protecting a system from attacks? This question might be trivial to most of you but I really don't see the fine line here. In ...
1
vote
1answer
37 views

Question about removal-notice if sued or compromised

What do you call the old notices that say: If this notice is removed the site is to be assumed compromised or litigation to compromise the site has been filed. I used to see these a lot as a ...
1
vote
1answer
115 views

Terminology - DMZ

The term DMZ is used to describe a separation area between a trusted zone and an untrusted zone. Ex: internal network vs internet. Can it be used to refer to a separation area between a trusted zone ...
1
vote
1answer
167 views

Who defined the term “end-to-end encryption”?

I am trying to find the origin of the term "end-to-end encryption", but have been unsuccessful until now.
1
vote
1answer
46 views

Does this case fit the definition of a replay attack?

I read the definition of a replay attack on Wikipedia. However I don't know if the following case fits the description: An attacker captures a HTTP request sent to a web server, modifies the request ...
1
vote
1answer
103 views

Terminology involving malware/virus/worm [duplicate]

What is the difference between "worms", "viruses", and "malware"? Some sources I've found said both viruses and worms infect files. But others say worms are stand alone programs, and are ...
1
vote
0answers
37 views

Difference between IAG and IDM

What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)? Apologies for ...
1
vote
0answers
19 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
1
vote
1answer
265 views

When to model a concept via object vs taxonomy vs galaxy in MISP?

Taxonomies in MISP are a triple of (namespace, predicate, value) referred to as "machinetags". Galaxies seem to be similar. The MISP galaxy docs state that MISP galaxy is a simple method to ...
1
vote
0answers
82 views

Privacy terminology: Online privacy vs Internet Privacy vs Digital Privacy

While, to my eyes, Digital Privacy is the broader term ( anything digital whether online or not), I have seen all 3 used interchangeably (i.e: link vs title). Also, despite having different entries in ...
1
vote
0answers
78 views

Does “assesse” have a particular meaning in information security?

From this job description, bold added: The human factors expert is needed to conduct research on human subjects that perform tasks for full spectrum cyber operations. The researcher will define, ...
1
vote
1answer
131 views

Social engineering attacks terminology

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?
1
vote
1answer
991 views

BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”

Note: Below are some information from searching around the Internet. To skip to my main question, go to the last line of this post. I've been searching around on how to change the Volume Master Key (...
1
vote
0answers
2k views

Data Security vs Information Security [closed]

Is Information Security field and Data Security field same? If not then, What is the basic difference between "Information" and "Data" in security field? Is Data Security a sub-category of ...
1
vote
2answers
109 views

Terms for differentiating between key-exchange and public-key cryptosystem

The RSA and Diffie-Hellman protocols are part of asymmetric cryptography. But is there a word to distinguish between cryptosystem like RSA (i.e. there are two keys, one for encryption and another for ...
0
votes
6answers
396 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - "...
0
votes
2answers
230 views

Would one consider the breaking of Enigma in WWII to be an early example of a backdoor?

In a recent discussion re Tory Minister and British Home Secretary Amber Rudd's insistence that WhatsApp install a backdoor for government monitoring of encrypted data, I brought up Enigma as an early ...
0
votes
3answers
193 views

What is the difference between Compliance and Auditing in Information Security?

I am a student working on my semester project and it's about developing a SIEM solution with Big Data tools to be used in a SOC (security operations centre) and I know that collecting logs can be used ...
0
votes
3answers
2k views

What *exactly* does it mean to detonate malware?

Does it mean the same as to eliminate or disarm the threat or does it mean that the malware was activated/executed (whether it reached its target or detonated in a "controlled" manner, e.g., in a ...
0
votes
1answer
251 views

What is a “security bod”?

This is a term I ran across in a blog post by Troy Hunt (which was linked from an answer on this site): I heard a perfect example of this just the other day when speaking to a security bod in a ...
0
votes
3answers
3k views

Port sweep vs port scan

I was asked this question in an interview: "What is a port sweep?" When I replied with port scan he said that my answer was not a scan, it was a port sweep. I googled and found "tcp sweep: but not "...
0
votes
2answers
755 views

What do you call an antivirus that detects suspicious activity?

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.) This does not help when defending against zero-days and ...
0
votes
2answers
801 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
0
votes
1answer
3k views

What is a “cuckoo's egg”? [closed]

I remember that Clifford Stoll wrote a book called "The Cuckoo's Egg". In the book, the reader follows him as he pursues a hacker through networks across the world. I seem to recall that the title ...
0
votes
1answer
106 views

Verb for “turning a bug into an attack”? [closed]

I forget what word it is that refers to the work of turning known bugs into real-world attacks, for example when people string together two separate exploits to break out of the Chrome sandbox. It's ...
0
votes
2answers
3k views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
2answers
582 views

Is constantly downloading large amount of files from a web server considered DDoS?

For example, there's like a million files stored on a website (publicly, anyone with a link can get it), and I wrote a program to retrieve it one by one. Since obviously my program pings the server ...
0
votes
1answer
213 views

Is IP geolocation threat intelligence?

If the suppliers of your business are all located in North America, but your supplier web portal suddenly receives a lot of traffic from elsewhere, you should investigate. Therefore, IP geolocation ...
0
votes
2answers
84 views

Terminology: What's the appropriate term for the digest output of various integrity hash and HMAC functions?

I've heard conflicting statements from various CISSP instructors, so I'd like some "real world" perspective: What is the appropriate terminology for the digest output of the following algorithms: ...
0
votes
1answer
64 views

SNMP - need help with terminology

In many resources, I see that community strings are also called default passwords. But in the Server Manager, I see "Community name" and it makes more sense. So why people often use the phrase "...
0
votes
1answer
82 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
0
votes
1answer
112 views

Benign, Malicious Domains and Definitions

I am working on a research project where we segregate domains used for malicious purpose from benign domains. However, my guide does not want the term malicious domain and benign domain in the paper....
0
votes
1answer
98 views

What's the difference between “directory services” and “identity repositories”?

I'm studying for the CCSP exam and the study material references two different terms which seems very similar: Directory Services A system for managing identities and attributes. These allow the ...
0
votes
1answer
600 views

Difference between Non-discretionary and Role-based Access control?

What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
0
votes
3answers
117 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
0
votes
2answers
3k views

In cyptography what is “Key Space”?

What is a Key space and how does it relate to the strength of a cryptosystem? Comment on the strength of the DES algorithm with a 56 bit key. What relevance does the key space have for passwords? ...