Cybersecurity glossary

Data aggregation is the process of collecting data from multiple sources and combining it into a single summary for reporting. While not directly mal…

Data classification involves categorizing data based on its sensitivity and value to the organization. This process helps prioritize data protection…

A data diode is a network security device that allows data to flow in only one direction. This can be used to protect highly sensitive systems by pre…

Data discovery involves identifying and locating sensitive data across an organization's systems and repositories. It is a fundamental step in implem…

Data encryption protects sensitive information by converting it into an unreadable format. While not directly default deny, it supports the concept b…

Data encryption at rest involves encrypting sensitive data when it is stored on disk or other storage media. This protects data from unauthorized acc…

Shadow IT solutions often lack proper data encryption, leaving sensitive data vulnerable to interception and theft. This is especially concerning for…

DES is a symmetric block cipher that was once a dominant encryption algorithm. It uses a 56-bit key, which is now considered too short and vulnerable…

DEP is a security feature that prevents code from being executed in memory regions that are intended for data storage. This helps to mitigate buffer…

Data exfiltration is the unauthorized transfer of sensitive data from an organization's network. EDR systems monitor network traffic and file access…

Honeypots can detect data exfiltration attempts by monitoring for unauthorized data transfers. This helps organizations identify and respond to data…

Data fingerprinting creates unique identifiers or hashes for sensitive data to enable accurate detection even if the data is modified or obfuscated…

Data flow analysis tracks the movement of data through a program to identify potential vulnerabilities like uninitialized variables or tainted data u…

DLP is a set of technologies and processes designed to prevent sensitive data from leaving an organization's control. DLP systems can identify and bl…

A DLP audit assesses the effectiveness of data loss prevention measures in protecting sensitive data. It verifies that policies and technologies are…

Data masking is a technique used to obscure sensitive data while preserving its format for testing or development purposes. This involves replacing s…

Data minimization is the principle of collecting and retaining only the data that is necessary for a specific purpose. Implementing data minimization…

The process of converting data from different sources into a consistent format. SIEM systems normalize log data to facilitate correlation and analysi…

Data redaction involves permanently removing sensitive information from a document or file. DLP systems can automatically redact sensitive data befor…

Data residency refers to the geographic location where an organization's data is stored. DLP policies need to consider data residency requirements to…

A data retention policy defines how long different types of data should be kept by an organization. DLP systems should be configured to align with th…

Data sovereignty refers to the legal and regulatory requirements governing the storage and processing of data within a specific country or region. DL…

Storing data in shadow IT solutions that are located in different geographic regions can lead to data sovereignty issues and compliance violations. O…

DAM systems monitor database activity for suspicious behavior and policy violations. Contextualizing database queries with user roles, application co…

A database honeypot simulates a vulnerable database server. It allows defenders to monitor attempted database attacks, identify SQL injection attempt…

Logs generated by database management systems that record database operations, such as queries, updates, and authentication attempts. Analyzing datab…

This audit verifies the security of databases, including access controls, encryption, and data integrity. It helps protect sensitive data stored in d…

Database watermarking involves embedding watermarks into databases to protect against illegal copying or distribution of sensitive data. The watermar…

The process of logging Distributed Denial-of-Service (DDoS) attack events detected by the firewall. This includes capturing information about source…

DDoS mitigation techniques are used to protect systems from distributed denial-of-service attacks, including reflection attacks. These techniques can…

DDoS mitigation services provide specialized protection against DDoS attacks. These services typically use a combination of techniques, such as traff…

Dead code is code that is never executed, and its presence can indicate errors or unnecessary complexity. Static analysis can identify and remove dea…

Data stored in various unmanaged locations, such as personal cloud accounts or USB drives, making it difficult to track and secure. This increases th…

Deception technology encompasses a range of techniques, including honeypots, to mislead and detect attackers. It aims to create a deceptive environme…

A decoy file is a file placed within a honeypot system to entice attackers. These files often contain fake sensitive information to further engage th…

A secret key used to reverse the encryption process and restore access to the encrypted data. In ransomware attacks, the decryption key is held by th…

DPI is a technique that examines the data part of network packets, not just the headers, to identify applications, content, and potential threats. NG…

Default deny is a security principle where all traffic is blocked by default, and only explicitly allowed traffic is permitted to pass through the fi…

An attack that aims to make a system or network unavailable to legitimate users. DoS attacks can exploit vulnerabilities or simply overwhelm the syst…

A DoS attack is an attempt to make a machine or network resource unavailable to its intended users by overwhelming it with traffic or requests. Distr…

This is a security principle where all network traffic is blocked by default, and only explicitly permitted traffic is allowed through firewall rules…

Exploiting vulnerabilities in differential backup processes to inject malicious code. Attackers target the incremental nature of differential backups…

A digital certificate is an electronic document used to verify the identity of an individual, organization, or device. They are used in code signing…

Digital certificates are electronic documents used to verify the identity of individuals, organizations, or devices. Application control systems use…

Digital forensics involves the investigation of digital evidence to identify the cause and scope of a security incident. Contextualizing forensic fin…

A set of technologies used to control access to and use of digital content. Robust watermarking is often used as a component of DRM systems to track…

A digital signature is a cryptographic mechanism used to verify the authenticity and integrity of a digital document or message. It uses public-key c…

Digital watermarking is a technique used to embed information into a digital signal (e.g., audio, video, or image) in a way that is difficult to remo…

Directory traversal is a vulnerability that allows attackers to access restricted directories and files on a web server. By manipulating file paths…

A DRP outlines the procedures for recovering IT systems and data after a disaster. Risk assessments identify potential disaster scenarios and inform…

Disk encryption is the process of encrypting an entire hard drive or storage device. Symmetric encryption algorithms are commonly used to protect the…

A DDoS attack is a type of DoS attack where the malicious traffic originates from multiple, often compromised, sources. This makes it harder to mitig…

DLL hijacking is a technique where an attacker replaces a legitimate DLL (Dynamic Link Library) with a malicious one, which is then loaded by a progr…

A DMZ is a network segment that sits between the internal network and the external network, typically the Internet. It hosts publicly accessible serv…

DNS amplification is a type of amplification attack that exploits DNS servers. Attackers send small DNS queries with a spoofed source address, causin…

A DNS firewall protects against DNS-based attacks, such as DNS tunneling, DNS spoofing, and domain generation algorithms (DGAs). It monitors DNS traf…

Logs generated by DNS servers that record DNS queries and responses. Analyzing DNS logs helps identify malicious domains, command-and-control (C2) co…

DNS rebinding is a technique where an attacker manipulates DNS records to make a server connect to an initially approved domain and then switch to a…

A DNS security audit verifies the configuration of DNS servers and records to prevent DNS-based attacks such as DNS spoofing and cache poisoning. It…

DNSSEC helps to prevent DNS spoofing and cache poisoning attacks by digitally signing DNS records. Integrating DNSSEC with a CDN ensures that users a…

A DNS sinkhole is a server configured to provide incorrect DNS resolution for malicious domains. This redirects traffic from infected machines to a c…

DNS tunneling is a technique used to exfiltrate data by encoding it within DNS queries and responses. Attackers can bypass firewalls and other securi…

DOM-based XSS vulnerabilities arise when the client-side JavaScript code processes untrusted data in a way that modifies the Document Object Model (D…

Domain Validated (DV) certificates are the most basic type of SSL/TLS certificate and only require verification that the applicant controls the domai…

A ransomware tactic where attackers not only encrypt the victim's data but also steal it and threaten to release it publicly if the ransom is not pai…

Drive-by mining is a form of cryptojacking where malicious code is injected into websites or advertisements to mine cryptocurrency using the resource…

Analyzing a running program to identify vulnerabilities and runtime errors. Dynamic analysis involves testing the application with various inputs and…

Dynamic analysis emulation executes a program and monitors its actions in a simulated environment to detect malicious behavior. This technique is com…

DAST involves testing a running application to identify vulnerabilities by simulating real-world attacks. It focuses on identifying vulnerabilities t…

A dynamic honeypot adapts its behavior and appearance over time to make it more difficult for attackers to identify. This can involve changing the em…

While primarily a runtime technique, Dynamic Taint Analysis can be informed by AST analysis to identify potential sources of tainted data. This allow…