228
votes
Accepted
What does it mean to "burn a zero-day"?
I was the one who wrote the comment you quoted.
Quick answer: A 0day is burned when the exploit is used too often or haphazardly, resulting in it being discovered and patched. Virtually every time a ...
- 67.1k
112
votes
What does it mean to "burn a zero-day"?
A zero-day is a vulnerability that is unknown by the software manufacturer and for which no patch exists.
When using a zero-day vulnerability against a remote server, it may give away how it works. ...
- 33k
90
votes
Accepted
What does "in-house hash function" mean?
From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people".
Here it means ...
- 206k
84
votes
Accepted
What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?
CTFs (Capture The Flag) are like courses within games. Some website provide easy ones to learn the ropes, with simple challenges of increasing difficulty. For example http://overthewire.org/wargames/ ...
- 825
75
votes
Accepted
What is the meaning of Triage in Cybersec world?
We just got reports that 4000 of our systems are infected with ransomeware.
3000 are end users, 800 are non-critical servers, 200 are critical servers.
Triage is looking at this mess and deciding ...
71
votes
Why define CIA in security like this?
You're focusing on a very narrow scope here. The CIA triad is about security of a whole system, not just an encrypted message.
That being said, all elements of the triad do apply to your example:
...
- 136k
54
votes
Accepted
What is the difference between "Incident", "Attack" and "event"?
Assuming that you have looked up the official terms and wanted further help:
An event is something that has triggered notice. An event need not be an indication of wrongdoing. Someone successfully ...
- 132k
48
votes
What do you call the entity seeking to be authenticated?
In IEEE 802.1X terminology that would be the supplicant:
Authenticator
An Authenticator is an entity that requires authentication from
the Supplicant. The Authenticator may be ...
- 45k
37
votes
Accepted
What is an SNI Hole?
SNI (Server Name Indication) is a TLS (Transport Layer Security) extension in which the client presents the server the domain name for the target it wants to access within the TLS handshake. It is ...
- 206k
28
votes
Does phishing include ransomware?
The term you're looking for here is social engineering. This is an umbrella term that describes any attempt to get a person to perform a particular action - particularly one that benefits the social ...
- 136k
24
votes
What's the difference between escaping, filtering, validating and sanitizing?
Escaping. Converting a control character to its escape sequence. For example, a < symbol may be converted to < so that the characters following the < are not interpreted as an XML tag ...
- 9,341
23
votes
What does it mean to "burn a zero-day"?
Security researches find exploits. The day they report it is day Zero because developers will start work on patching it.
Good Security researchers (as in white hat) will publish the zero day to the ...
- 7,922
21
votes
What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?
To say "CTF" is a little like saying "video game". How do you prepare for a video game? Well, it depends on what the game is! Tetris is very different from Skyrim, which is different from Mario Kart.
...
- 132k
21
votes
Accepted
Eavesdropping vs. sniffing
Both are same kind of attacks. The difference is Eavesdropping could be in any form (Physical to logical), where the sniffing is more electronics/network related term.
- 396
18
votes
Where does authenticity fit into the CIA Triad?
I support David's view that if you had to fit your scenario into one of the CIA categories, integrity would be the appropriate one because you're creating an unintended state thus violating integrity.
...
- 45k
17
votes
Accepted
Where does authenticity fit into the CIA Triad?
That would still be covered in integrity: creating or deleting data is still a violation of integrity. (This can be seen as a mutation on the overall data set.)
- 16.1k
17
votes
What is the difference between "Incident", "Attack" and "event"?
While schroeder's answer is certainly correct, it might not be formal enough. In the the terms and definitions of the ISO/IEC 27000 you will find the following:
threat
potential cause of an ...
- 8,001
16
votes
Accepted
What is TTP hunting?
According to this TTP refers to the Tactics, Techniques and Procedures of cyber threats.
Edit:
Traditional security measures like firewalls, IDS, endpoint protection, and SIEMs are only part of ...
- 537
16
votes
What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?
What is a CTF? It's a type of computer security competition, called CTF because you capture a "flag", a unique string, and submit it to the scoring infrastructure for points. CTFs are almost always ...
- 261
15
votes
Accepted
Why is it called cross-site scripting? (XSS)
From the link schroeder gave in the comment the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite....
- 374
15
votes
Accepted
What do you call the entity seeking to be authenticated?
While Arminius covered the domain of 802.1X, I'd like to add my answer from the perspective of authorization standards/frameworks.
OAuth 2.0
Several key terms are defined in section 1.1 of RFC 6749:
...
- 2,289
15
votes
Accepted
Does phishing include ransomware?
"Phishing" is attempting to catch something, hence the name. Most often the "something" in question is credentials, but it can be any number of things (money, source code or other ...
- 50.3k
14
votes
What is the meaning of Triage in Cybersec world?
In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it.
A virus or ransomware attack ...
- 34.6k
13
votes
What is the difference between a payload and shellcode?
When exploiting an application, the payload is the code that the attacker actually wants to execute. It's the part that not just serves the purpose of leveraging the vulnerability itself, but does ...
- 45k
13
votes
RBAC0 RBAC1 RBAC2 RBAC3 -- What do they mean?
These are 'levels' for the NIST RBAC Model, as described in: The NIST Model for Role-Based Access Control: Towards a Unified Standard.(pdf)
They respectively refer to:
Flat RBAC
Hierarchical RBAC
...
- 7,712
12
votes
Accepted
What are the differences between HSM and SE?
A hardware security module (HSM), a secure element (SE), a smart card, a trusted execution environment (TEE) and a secure enclave (SE again) are all computing environments designed for secure ...
11
votes
Accepted
What is a security embargo?
Embargo of a security issue means that the issue will not be publicly disclosed for some time by the vendor/discoverer. This is usually done to give the affected companies enough time to fix the ...
- 206k
11
votes
What is an SNI Hole?
An SNI hole is when you have a default site set up for an IP address that does not require SNI to be present in order to complete an HTTPS connection.
This is, in fact, how all HTTPS connections ...
- 35.9k
11
votes
What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?
CTF is basically what it is known under in games. It's Capture The Flag, but instead of a flag to steal you must achieve multiple goals which act as flags.
For example a flag in the competition could ...
- 509
Only top scored, non community-wiki answers of a minimum length are eligible