Cybersecurity glossary

Shadow IT environments are typically not subject to regular security audits, leaving vulnerabilities undiscovered. This creates blind spots in the or…

By using intermediate representations like ASTs, vulnerability detection tools can be made more language-agnostic. This allows the same tools to be u…

Lateral movement refers to the techniques used by attackers to move from one compromised endpoint to other systems within a network. EDR systems trac…

LDAP injection is an attack technique used to exploit web applications that construct LDAP statements from user-supplied input. It allows attackers t…

The Least Known Publisher rule configuration within AppLocker helps to identify and manage applications from less established or unknown software pub…

The principle of least privilege dictates that users and processes should only have the minimum necessary access rights to perform their tasks. This…

The principle of least privilege dictates that users and processes should only have the minimum necessary access rights to perform their tasks. Apply…

Likelihood assessment determines the probability of a threat exploiting a vulnerability. It considers factors like threat actor capabilities, attack…

Live migration is the process of moving a running virtual machine from one physical server to another without downtime. Securing live migrations is c…

LFI is a vulnerability that allows an attacker to include local files on a web server. Attackers exploit this by manipulating input parameters to inc…

The process of collecting logs from various sources (servers, applications, network devices) into a central repository. This centralized collection i…

Analyzing logs from systems in the DMZ can help identify security incidents. Log analysis tools can detect suspicious patterns and alert administrato…

The process of moving older firewall logs to long-term storage for compliance and historical analysis. Archived logs should be securely stored and re…

The process of identifying relationships and patterns between different log entries to uncover security incidents. By correlating events from various…

Encrypting firewall logs at rest and in transit to protect sensitive information from unauthorized access. Encryption ensures confidentiality and int…

A security process and set of tools that validate the integrity of log files to ensure they haven't been altered or corrupted. This is crucial for ma…

The process of verifying that firewall logs have not been tampered with or modified. This ensures the reliability of log data for security investigat…

A classification assigned to log messages based on their severity, such as debug, info, warning, error, or critical. Log levels allow administrators…

The process of redacting or obfuscating sensitive data within firewall logs, such as personally identifiable information (PII) or financial data. Thi…

The process of converting firewall logs from different formats into a standardized format. This makes it easier to analyze logs from various firewall…

The process of extracting specific data fields from firewall logs, such as source IP address, destination IP address, and port number. This enables e…

The practice of storing log data for a specific period to meet compliance requirements and enable forensic investigations. SIEM systems manage log re…

A set of rules that define how long firewall logs should be stored and maintained. This policy ensures compliance with regulatory requirements and pr…

The process of automatically archiving and deleting old firewall logs to prevent disk space exhaustion. This ensures that the logging system remains…

A widely used open-source logging library for Java applications. Vulnerabilities in Log4j, such as Log4Shell, can allow remote code execution and hav…

A low-interaction honeypot simulates basic services or applications, offering limited functionality. It's easier to deploy and maintain but provides…