Cybersecurity glossary

An AST is a tree representation of the abstract syntactic structure of source code. Static analysis tools use ASTs to understand the program's struct…

Access control mechanisms restrict access to sensitive resources based on user roles and permissions. Risk assessments help determine the appropriate…

An Access Control List (ACL) is a set of permissions attached to a network resource (like a firewall rule) that specifies which users or systems are…

ACLs are sets of permissions attached to network resources, specifying which users or systems are granted or denied access. They implement default de…

Access control review involves examining user permissions and access rights to ensure that individuals only have access to the resources they need. T…

Attackers gaining control of user accounts on shadow IT services due to weak passwords or lack of multi-factor authentication. This can allow them to…

Active Directory is a directory service developed by Microsoft for Windows domain networks. It is used to manage users, computers, and other resource…

ASLR is a memory protection technique that randomizes the memory addresses used by a process. This makes it more difficult for attackers to predict t…

AES is a symmetric block cipher widely used for securing sensitive data. It operates on 128-bit blocks of data and supports key sizes of 128, 192, an…

An APT is a sophisticated, long-term cyberattack in which an attacker gains unauthorized access to a network and remains undetected for an extended p…

Adware is software that displays unwanted advertisements on a user's computer, often without their consent. Some forms of adware have been known to i…

Creating backups that are physically isolated from the network. This protects against ransomware and other network-based attacks that could corrupt o…

An amplification attack is a type of reflection attack where the response is significantly larger than the request. This amplifies the attacker's ban…

The amplification factor represents the ratio between the size of the attacker's request and the size of the server's response in a reflection attack…

The use of statistical methods and machine learning algorithms to identify unusual patterns in firewall logs. This can help detect potential security…

Anti-emulation techniques are methods used by malware to detect and evade emulated environments. These techniques can include checking for specific h…

Antivirus software is designed to detect, prevent, and remove malicious software, including cryptojacking scripts. Modern antivirus solutions often i…

An anycast network distributes traffic across multiple servers with the same IP address. This can help to mitigate DDoS attacks, including reflection…

API emulation mimics the behavior of specific APIs to analyze how software interacts with system resources or external services. This is useful for u…

The connection of different software systems through their Application Programming Interfaces (APIs). SIEM systems often use APIs to integrate with o…

Application blacklisting is a security measure that blocks the execution of specific applications known to be malicious or unwanted. It operates on a…

Application control restricts the execution of unauthorized applications on endpoints. While not always integrated into EDR, it complements EDR by pr…

An application firewall is a security system that monitors and controls network traffic based on the application protocol being used. It examines the…

Application hardening is the process of securing an application by reducing its attack surface and eliminating vulnerabilities. This includes removin…

An application layer firewall analyzes network traffic at the application layer (e.g., HTTP, SMTP) to identify and block malicious requests. It can p…

Capturing log data related to specific applications passing through the firewall. This provides insight into application usage, potential vulnerabili…

Application patching involves applying software updates to fix security vulnerabilities and improve application stability. Regular patching is crucia…

API security focuses on protecting APIs from unauthorized access and misuse. Contextualizing API requests with user authentication, authorization pol…

AST tools, including SAST and DAST, identify vulnerabilities in application code and runtime environments. Contextualizing these vulnerabilities with…

Application segmentation involves isolating applications from each other on the network to reduce the impact of a security breach. It restricts commu…

Application virtualization is a technology that allows applications to run in an isolated environment, separate from the underlying operating system…

Application whitelisting only allows pre-approved applications to run on a system, blocking all others by default. This is a strong defense against m…

Application-layer attacks target specific vulnerabilities in applications to exhaust server resources. These attacks often involve complex requests d…

AppLocker is a Microsoft Windows feature that provides application control functionality, allowing administrators to define rules for which applicati…

Asset identification involves cataloging and classifying all valuable assets within an organization, including hardware, software, data, and intellec…

Maintaining an accurate asset inventory provides essential context for security monitoring and incident response. Knowing the business function, crit…

Mutation testing involves creating modified versions of the source code based on AST transformations to assess the effectiveness of security testing…

ASTs can be used to identify code clones or similar code fragments across different projects. This is useful for identifying potential vulnerabilitie…

This technique uses abstract syntax trees to analyze source code for potential vulnerabilities. By representing code structure, ASTs enable automated…

Asymmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption. While slower than symmetric encryption, it p…

The sum of all the different points where an attacker could try to enter or extract data from a system. A larger attack surface implies more potentia…

Attack surface reduction is the process of minimizing the areas of a system or network that are exposed to potential attackers. Network segmentation…

Honeypots assist in attack vector analysis by revealing how attackers attempt to compromise systems. This information helps organizations understand…

Audit Mode in AppLocker allows administrators to monitor application usage without enforcing the rules. This provides valuable insights into which ap…

Audit trails are chronological records of system activities, including log access and modifications. They provide a valuable resource for investigati…

Authentication bypass vulnerabilities allow attackers to gain access to an application without providing valid credentials. Burp Suite can be used to…

Authentication hardening involves implementing strong authentication mechanisms to verify the identity of users and prevent unauthorized access. Mult…

Logs that record user authentication attempts, including successful logins, failed logins, and password changes. Analyzing authentication logs helps…

A specific type of watermark designed to verify the authenticity and integrity of digital content. It helps detect tampering and ensure the content h…

ASTs are used in automated code review tools to enforce coding standards and identify potential security flaws. Automated reviews help catch errors e…

AST analysis can be used to automate the process of generating exploits for identified vulnerabilities. This allows security researchers to quickly a…

Automated remediation involves automatically taking actions to remediate security incidents, such as removing malware, quarantining files, and blocki…

The process of verifying an individual's identity, employment history, and criminal record before hiring them. Thorough background checks can help to…

Creating copies of data that can be restored in case of data loss or corruption. Regular backups are crucial for recovering from ransomware attacks w…

Implementing strict access controls to limit who can access and modify backup data. This prevents unauthorized users from deleting or altering backup…

Using machine learning or other techniques to identify unusual patterns in backup behavior. This can help detect ransomware attacks or other security…

Evaluating the security posture of Backup as a Service (BaaS) providers. Ensuring that the provider has robust security controls in place to protect…

Ensuring the security of data deduplication processes used in backups. Vulnerabilities in deduplication algorithms can lead to data corruption or una…

Implementing DLP measures to prevent sensitive data from being backed up to unauthorized locations. This helps protect against data breaches and comp…

Ensuring that backup data is stored in compliance with data sovereignty regulations. This is particularly important for organizations that operate in…

Properly managing encryption keys used to protect backup data. Losing or compromising the encryption key can render the backup data unrecoverable.

Restricting the geographic locations from which backups can be accessed or restored. This can help prevent unauthorized access from foreign countries…

Regularly verifying the integrity of backup files to ensure they haven't been corrupted or tampered with. This involves using checksums or other vali…

Monitoring backup logs for suspicious activity, such as unauthorized access attempts or unusual backup behavior. This can help detect security incide…

Securely erasing or destroying backup media when it is no longer needed. This prevents sensitive data from falling into the wrong hands if the media…

Protecting the metadata associated with backups, such as file names, creation dates, and access logs. This metadata can be valuable to attackers and…

Isolating the backup network from the production network to prevent the spread of malware. This limits the impact of a security incident by containin…

Regularly testing the backup restoration process to ensure that backups are viable and can be restored quickly and reliably. This is essential for ve…

A defined set of rules governing how long backups are stored and when they are destroyed. This helps organizations comply with legal and regulatory r…

Securing the backup server itself with strong passwords, patching, and access controls. A compromised backup server can be used to delete or corrupt…

Maintaining multiple versions of backup data, allowing for recovery from different points in time. This is crucial for recovering from ransomware att…

A bastion host is a hardened server that sits within the DMZ and acts as a gateway to the internal network. It is designed to withstand attacks and p…

Behavioral analysis involves monitoring endpoint activities to identify deviations from normal or expected behavior. EDR systems use behavioral analy…

The process of analyzing user and entity behavior to identify anomalies that could indicate malicious activity or security threats. This is often use…

While less direct, AST concepts are relevant to reverse engineering and analyzing compiled binaries. Decompilers attempt to reconstruct a high-level…

Blackholing is a mitigation technique where all traffic to a specific IP address is dropped. This can be effective in stopping a DoS attack, but it a…

Blacklisting is a security mechanism where specific items are denied while everything else is allowed. While sometimes used to mitigate SSRF, it is l…

Blind SSRF occurs when an attacker cannot directly see the response from the server's internal request but can still trigger actions or observe side…

Blind watermarking schemes do not require the original, unwatermarked content for watermark extraction. The watermark can be detected and extracted s…

A block cipher is a type of symmetric encryption algorithm that encrypts data in fixed-size blocks. It contrasts with stream ciphers, which encrypt d…

Bogon filtering involves blocking traffic from IP addresses that should not be routable on the public internet, such as private IP address ranges. Th…

A bootkit in a virtual machine is a type of malware that infects the VM's boot sector or boot process. It allows the attacker to gain control of the…

BGP Blackholing involves using BGP to propagate null routes across a network, allowing multiple routers to participate in dropping malicious traffic…

CDNs can employ bot mitigation techniques to identify and block malicious bots that may be scraping content, performing credential stuffing attacks…

A botnet is a network of computers infected with malware that are controlled by a single attacker (the bot herder). Botnets are often used to launch…

Honeypots can be used to identify botnet activity by attracting infected machines. This allows security teams to track botnet behavior and disrupt th…

Broken authentication vulnerabilities allow attackers to compromise user credentials and impersonate users. Common causes include weak passwords, ses…

Browser emulation simulates the behavior of a web browser, allowing security analysts to test web applications for vulnerabilities. This is useful fo…

A browser extension is a small software program that adds functionality to a web browser. Malicious browser extensions can be used for cryptojacking…

An attack that attempts to guess passwords by trying all possible combinations. Penetration testers may use brute-force attacks to test the strength…

A buffer overflow is a software vulnerability that occurs when a program attempts to write data beyond the allocated memory buffer. This can lead to…

Burp Extensions are plugins that extend the functionality of Burp Suite. These extensions can provide additional scanning capabilities, custom attack…

A popular web application security testing tool used to identify vulnerabilities in web applications. Penetration testers use Burp Suite to intercept…

Burp Collaborator is a network service that helps discover blind, out-of-band vulnerabilities. It allows Burp Suite to detect vulnerabilities where t…

Burp Intruder is a powerful tool for automating customized attacks against web applications. It allows users to perform fuzzing, brute-force attacks…

The Burp Suite Proxy acts as an intercepting proxy, allowing users to intercept, inspect, and modify HTTP/S traffic between their browser and web app…

Burp Repeater allows users to manually modify and resend individual HTTP requests. This is crucial for testing the behavior of web applications under…

Burp Scanner is an automated web vulnerability scanner that identifies a wide range of security flaws, such as SQL injection, cross-site scripting (X…

A BCP ensures that critical business functions can continue operating during and after a disruptive event. Risk assessments identify potential disrup…

Business logic vulnerabilities are flaws in the design and implementation of an application's business rules. Burp Suite's manual testing capabilitie…

Bring Your Own Device (BYOD) policies, when not properly managed, can contribute to shadow IT. Users may install unapproved apps on their personal de…

Bypassing a firewall refers to techniques used by attackers to circumvent the security measures implemented by the firewall. This can be achieved thr…

Bypass techniques are methods used by attackers to circumvent security controls, such as AppLocker. Understanding these techniques is crucial for har…

Cache poisoning occurs when an attacker injects malicious content into the CDN cache, which is then served to legitimate users. This can lead to wide…

Linux capabilities are a set of fine-grained privileges that can be assigned to a process, providing a more granular control over access rights than…

A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a type of challenge-response test used to determine whether…

Cache invalidation ensures that outdated or compromised content is removed from the CDN cache. Timely cache invalidation is crucial for mitigating th…

Data leakage can occur if sensitive information is inadvertently exposed through the CDN, such as in HTTP headers or error messages. Careful configur…

Comprehensive logging and monitoring of CDN traffic and events are crucial for detecting security incidents and performance issues. Logs should be an…

The security of the CDN provider itself is critical, as a compromise of the CDN infrastructure can impact all customers using the service. Regular se…

Attackers can try to exhaust CDN resources by flooding the network with requests, leading to service disruptions. Proper rate limiting, traffic filte…

Security misconfigurations in CDN settings, such as improper access controls or caching policies, can expose sensitive data or allow attackers to byp…

Regular vulnerability scanning of the CDN infrastructure helps identify and address security weaknesses before they can be exploited by attackers. Vu…

Centralized management refers to the ability to manage security policies and configurations from a central location. AppLocker policies are typically…

CERT (Computer Emergency Response Team) coding standards provide guidelines for developing secure and reliable software. Static analysis tools can he…

A CA is a trusted entity that issues digital certificates to verify the identity of users and devices. Using certificates for authentication on jump…

CAA records are DNS records that allow domain owners to specify which Certificate Authorities (CAs) are authorized to issue certificates for their do…

Certificate mis-issuance refers to the incorrect or unauthorized issuance of a digital certificate. This can occur due to errors, vulnerabilities in…

Certificate pinning is a security mechanism that allows an application to associate a specific certificate with a website or service. This prevents m…

A Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their s…