Cybersecurity glossary

A race condition occurs when the output of a program becomes unexpectedly and critically dependent on the sequence or timing of other events. Exploit…

A precomputed table used for reversing cryptographic hash functions, typically for cracking password hashes. Penetration testers may use rainbow tabl…

A message displayed to the victim after their files have been encrypted, providing instructions on how to pay the ransom and receive the decryption k…

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment to restore access. It often spreads through phishing emai…

Ransomware frequently targets backup systems to prevent data recovery. Protecting backups with air-gapping, immutability, and strong access controls…

Shadow IT environments can serve as entry points for ransomware attacks, which can then spread to other parts of the organization. Proper endpoint pr…

A business model where ransomware developers lease their malicious code to affiliates, who then carry out attacks and share the profits. RaaS makes r…

Rate limiting is a mitigation technique that limits the number of requests a user or IP address can make within a given time period. This can prevent…

AST analysis can help identify code sections that need to be refactored for security reasons. This involves restructuring the code to improve its sec…

Reflected XSS occurs when user-supplied input is immediately outputted in the response without proper sanitization. An attacker can craft a malicious…

A reflection attack involves sending requests to a server that will then send the response to the victim, amplifying the attack. DNS and NTP servers…

A sequence of characters that define a search pattern. Regex is used in log analysis to extract specific information from log messages or to identify…

A Registration Authority (RA) is an entity that verifies the identity of certificate requesters before a Certificate Authority (CA) issues a certific…

Regular expressions are patterns used to match specific text strings, making them useful for identifying sensitive data patterns like social security…

Regular expressions are used in DLP to define patterns for identifying sensitive data within files and network traffic. They allow for flexible and a…

Regular security audits involve systematically reviewing an application and its environment to identify vulnerabilities and security weaknesses. Thes…

The process of fixing or mitigating vulnerabilities that have been identified. Remediation may involve patching, configuration changes, or other secu…

A vulnerability that allows an attacker to execute arbitrary code on a remote server. RCE vulnerabilities are highly critical and are often targeted…

RDP is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network c…

RFI is a vulnerability that allows an attacker to include remote files on a web server. This can lead to arbitrary code execution if the included fil…

RTBH filtering allows a network operator to signal to upstream providers to blackhole traffic destined for a specific IP address. This enables faster…

Reputation-based application control uses threat intelligence feeds and reputation services to assess the trustworthiness of applications. Applicatio…

HTTP Request Smuggling vulnerabilities can sometimes be chained with SSRF to amplify the impact or bypass certain protections. It involves manipulati…

Resource monitoring involves tracking the utilization of system resources, such as CPU, memory, and network bandwidth. This practice is essential for…

Validating the response from the requested URL can help detect and prevent SSRF attacks. By inspecting the content or headers of the response, the ap…

Reverse engineering is the process of analyzing a software or hardware system to understand its functionality and design, often without access to the…

Techniques like AST obfuscation are used to hinder reverse engineering efforts by making the code more difficult to understand. This can protect sens…

A reverse proxy server sits in front of web servers in the DMZ and retrieves resources on behalf of clients. This protects the origin web servers fro…

Reverse tabnabbing is a phishing attack where a malicious website that is linked to from a legitimate website modifies the original website when the…

Risk appetite defines the level of risk an organization is willing to accept. It guides decision-making regarding resource allocation for security co…

The process of identifying, analyzing, and evaluating potential risks and vulnerabilities. It helps organizations prioritize mitigation efforts and a…

Robust watermarking refers to watermarking techniques that are resistant to various attacks and distortions, such as compression, noise addition, and…

Wireless access points set up by employees without IT approval, creating unsecured network entry points. These can be exploited by attackers to gain…

A rogue CA is a fraudulent or compromised Certificate Authority that issues certificates without proper authorization. These certificates can be used…

The use of unauthorized hardware or software within an organization's network. Insiders may introduce rogue IT devices or applications, creating secu…

RBAC assigns permissions based on a user's role within an organization. It supports default deny by granting only the necessary permissions for each…

Root cause analysis is the process of determining the underlying cause of a security incident. EDR solutions facilitate root cause analysis by provid…

A root certificate is the foundation of a chain of trust in a Public Key Infrastructure (PKI). It is a self-signed certificate issued by a Certificat…

A rootkit is a type of malware that hides its presence and the presence of other malicious software on a system. Zero-day exploits can be used to ins…

Route Injection is the process of adding routes to a routing table, potentially to divert traffic. Blackholing uses route injection (specifically, in…

The rule base is the complete set of firewall rules configured on a firewall. It determines how the firewall handles network traffic and enforces sec…

In AppLocker, rule collections are groups of rules that apply to specific file types (e.g., executables, scripts, Windows Installer files). Each rule…

Runtime Application Self-Protection (RASP) is a security technology that embeds protection directly into an application, allowing it to detect and pr…

Runtime emulation refers to emulating the execution of code during runtime, allowing for dynamic analysis and debugging. This is essential for unders…