Cybersecurity glossary

Padding is the process of adding extra data to a plaintext message to ensure that its length is a multiple of the block size required by a block ciph…

Parameter tampering involves modifying parameters in a web request to manipulate application behavior. Attackers can alter values in the URL or form…

Pass-the-hash is a technique where an attacker steals a user's password hash and uses it to authenticate to a system without needing the actual passw…

The process of acquiring, testing, and installing software updates to address vulnerabilities and security flaws. Effective patch management is cruci…

A patch management audit reviews the process of applying security patches to software and systems. It ensures that patches are applied in a timely ma…

A Path Rule in AppLocker allows or denies applications based on their file path. While easy to configure, Path Rules can be less secure than other ru…

Penetration testing is a simulated cyberattack against a computer system, network, or application to identify vulnerabilities that could be exploited…

Perceptible watermarking involves embedding a watermark that is visible or audible to the end-user, although ideally it should be minimally intrusive…

The characteristic of a watermark being invisible or inaudible to the human senses. A good watermark should not degrade the quality of the host media.

Phishing is a type of social engineering attack where attackers impersonate legitimate entities to trick individuals into revealing sensitive informa…

Phishing simulations are used to test employees' susceptibility to phishing attacks. The results of these simulations inform risk assessments by iden…

Users of shadow IT applications may be more susceptible to phishing attacks due to a lack of security awareness training and the use of personal emai…

A physical security audit assesses the security of physical access controls, such as locks, alarms, and surveillance systems. It helps protect physic…

Policy enforcement ensures that DLP policies are consistently applied across the organization's systems and networks. This involves implementing tech…

Port forwarding is a technique that redirects network traffic from a specific port on the firewall to a specific device or service on the internal ne…

SSRF can be used to perform port scanning on internal networks by sending requests to different ports on internal IP addresses. This allows attackers…

Activities performed after successfully exploiting a vulnerability, such as privilege escalation, data exfiltration, and maintaining access. This pha…

PowerShell is a command-line shell and scripting language developed by Microsoft. It can be used by attackers for various malicious activities, inclu…

PowerShell Constrained Language Mode limits the features and functionality of PowerShell scripts that can be executed. This can be used in conjunctio…

Defense in depth involves implementing multiple layers of security controls to protect an application or system. If one layer fails, other layers are…

The principle of fail-safe defaults dictates that in the event of a failure, the system should default to a secure state. This aligns with default de…

A private CA is a Certificate Authority that is operated within an organization for internal use. It's used to issue certificates for internal server…

Exploiting a bug or design flaw in an application or operating system to gain elevated access to resources that are normally protected from an applic…

Privilege management involves controlling the level of access that users and applications have to system resources. By limiting privileges, organizat…

PAM focuses on managing and controlling access to privileged accounts and resources. By limiting who has access to sensitive data and systems, PAM ca…

Users may gain excessive privileges on shadow IT systems, increasing the potential for abuse and data breaches. Proper privileged access management (…

Process emulation simulates the execution of a process, allowing security analysts to observe its behavior and interactions with other processes. Thi…

Process injection is a technique used by malware to inject malicious code into legitimate processes. EDR systems monitor process activity to detect a…

Process monitoring involves observing the processes running on a system to identify suspicious or unauthorized activities. Unusual processes consumin…

Protocol emulation simulates the behavior of network protocols, such as HTTP or SMTP, to test the security of applications and services. This can rev…

SSRF vulnerabilities can be exploited to turn the vulnerable server into a proxy, allowing the attacker to route traffic through it. This can be used…

Public Key Infrastructure (PKI) is a system for creating, managing, distributing, using, storing, and revoking digital certificates. It involves Cert…

A Publisher Rule in AppLocker allows or denies applications based on their digital signature and publisher information. These rules are useful for al…