Cybersecurity glossary

The SOP is a web browser security mechanism that restricts scripts from one origin from accessing resources from a different origin. While it doesn't…

An isolated environment used to safely execute and analyze potentially malicious code. Sandboxes can be used to test suspicious files and identify ra…

Sandbox analysis involves executing suspicious files or processes in a controlled environment to observe their behavior. EDR systems can integrate wi…

The sandbox attribute on an `` element restricts the capabilities of the content within the iframe. This can be used to limit the impact of injected…

Sandbox emulation involves running potentially malicious code within a controlled environment that mimics a real system. This allows security analyst…

Sandboxing is a security mechanism that isolates applications or processes in a controlled environment. This prevents them from accessing sensitive s…

SAST tools analyze source code, bytecode, or binary code for security vulnerabilities without executing the code. SAST is a crucial part of the SDLC…

The process of capturing visual data from a computer display. Insiders may use screen scraping to extract sensitive information from applications or…

Seccomp is a Linux kernel feature that restricts the system calls a process can make. In container security, seccomp profiles are used to limit the s…

Secure Boot is a security standard that ensures a device boots using only software that is trusted by the device manufacturer. It prevents malicious…

Properly configuring a CDN involves implementing secure caching policies, enabling HTTPS, and configuring appropriate access controls. Regular securi…

Secure coding practices include techniques to minimize vulnerabilities in software. Default deny principles are applied by validating inputs and expl…

Secure configuration management involves establishing and maintaining secure configurations for all components of an application and its environment…

SDLC integrates security considerations into every phase of the software development process. It ensures that security is considered from the initial…

SFTP is a secure protocol for transferring files over a network. DLP systems can monitor SFTP traffic to prevent the unauthorized transfer of sensiti…

Secure logging practices refer to the policies and procedures that ensure logs are generated, stored, and accessed securely. This includes encrypting…

SSH is a cryptographic network protocol for secure communication between systems. It is often used to securely transmit encrypted logs to a central r…

The use of statistical and machine learning techniques to analyze security data and identify anomalies or patterns indicative of malicious activity…

A security audit is a systematic evaluation of an organization's security policies, procedures, and infrastructure. It provides an independent assess…

Security auditors use AST analysis to manually review source code for potential vulnerabilities and security weaknesses. This helps ensure that the c…

Educating users about cybersecurity threats and best practices to help them avoid becoming victims of attacks. Security awareness training can help p…

Security baselines are a set of recommended security settings and configurations for a system or application. Implementing AppLocker is often part of…

A security descriptor is a data structure that contains the security information associated with an object, such as a file, process, or registry key…

The SDLC is a process for developing secure software. Static code analysis is integrated into the SDLC to identify and address vulnerabilities early…

Security groups are virtual firewalls that control network traffic to and from virtual machines or cloud resources. They are often used in cloud envi…

Security hardening involves configuring systems in the DMZ to minimize vulnerabilities. This includes patching software, disabling unnecessary servic…

Security headers are HTTP response headers that can be used to enable various security features in web browsers. These headers can help prevent attac…

SIEM systems aggregate and analyze security logs and events from various sources across an organization's IT infrastructure. This helps security team…

A vulnerability caused by improperly configured security settings. This is a common source of vulnerabilities and can often be easily exploited.

A technology that allows organizations to collect security data from various sources and automate incident response workflows. SOAR platforms often i…

A security policy is a set of rules and guidelines that define how an organization protects its assets. Firewalls are a key component in implementing…

Security policy enforcement involves ensuring that software adheres to predefined security standards and guidelines. Static analysis tools can automa…

A security policy review ensures that security policies are up-to-date, comprehensive, and effectively communicated to employees. It helps maintain a…

Network segmentation divides a network into smaller, isolated segments to limit the blast radius of a security breach. By default, traffic between se…

A segmentation fault is a specific type of error caused by a program attempting to access memory that it is not allowed to access, possibly due to a…

Semantic code analysis leverages ASTs to understand the meaning and context of code. It goes beyond syntax to identify logical errors and security we…

A type of watermarking that is robust to some types of distortions (e.g., compression) but fragile to others (e.g., malicious modification). This all…

A security practice that divides critical tasks among multiple individuals to prevent any single person from having complete control over a process o…

SSRF is a vulnerability that allows an attacker to make requests to internal resources from a vulnerable server. This can be used to access sensitive…

Service meshes provide a dedicated infrastructure layer for handling service-to-service communication, offering features like authentication, authori…

Session hijacking is a type of cyberattack in which an attacker takes control of a legitimate user's session. The attacker can then use the hijacked…

Secure session management is crucial for maintaining the security of user sessions after authentication. This involves generating strong session IDs…

Session management vulnerabilities occur when an application fails to properly manage user sessions, leading to potential security breaches. Burp Sui…

Session monitoring involves actively observing user sessions on jump servers to detect suspicious activity in real-time. This can help identify and p…

Session recording captures all activities performed on a jump server, providing an audit trail for security analysis and compliance. This allows admi…

Setuid (set user ID) and setgid (set group ID) are file permission flags that allow a program to be executed with the privileges of the file's owner…

Unofficial repositories of data created outside of IT's purview, often lacking proper governance and security controls. These can become honeypots fo…

Shadow IT refers to IT systems and solutions built and used inside an organization without explicit organizational approval. DLP solutions need to di…

A shadow VM is a malicious, unauthorized virtual machine created within a legitimate virtualized environment, often by an attacker who has compromise…

A side-channel attack exploits information leaked during the execution of an encryption algorithm, such as power consumption or timing variations. Th…

Attacks that exploit information leaked during the watermark embedding or extraction process, such as power consumption or timing variations. These a…

Side-channel attacks exploit information leaked from the physical implementation of a cryptographic system or algorithm. VMs are potentially vulnerab…

A platform that collects, analyzes, and manages security logs and events from various sources. SIEM systems provide real-time monitoring, correlation…

The design and structure of a SIEM system, including its components, data flow, and integration points. A well-designed SIEM architecture ensures sca…

The process of connecting firewall logs to a Security Information and Event Management (SIEM) system. This integration enables real-time monitoring…

The process of optimizing a SIEM system to improve its accuracy and reduce false positives. SIEM tuning involves adjusting correlation rules, whiteli…

Attacks that use common signal processing techniques like filtering, compression, and noise addition to remove or weaken the watermark. These attacks…

Signature-based detection relies on comparing files and processes against a database of known malware signatures. While useful for detecting well-kno…

Sinkhole DNS redirects requests for malicious domains to a controlled server, preventing users from accessing harmful websites. This can work in tand…

A sinkhole server is a decoy server designed to attract and capture malicious traffic, allowing security analysts to study attack patterns. While not…

Sinkholing redirects malicious traffic to a controlled network where it can be analyzed. This can help identify the source of the attack and develop…

SNMP amplification attacks exploit Simple Network Management Protocol (SNMP) servers to amplify traffic towards a target. Attackers send SNMP queries…

The art of manipulating people into divulging confidential information. Penetration testers may use social engineering techniques to gain initial acc…

A social engineering audit tests employees' awareness of social engineering tactics through simulated attacks. It identifies weaknesses in employee b…

SCA tools use ASTs to analyze the dependencies of a software project and identify known vulnerabilities in third-party libraries. This helps ensure t…

Software Restriction Policies (SRP) are a Group Policy-based feature that allows administrators to control which software applications can run on a W…

Unpatched or outdated software used in shadow IT environments, creating exploitable vulnerabilities. Attackers can leverage these vulnerabilities to…

Attackers may use AST manipulation techniques to obfuscate source code, making it harder to analyze and understand. This technique is used to protect…

A spam honeypot is designed to attract and capture spam emails. It allows administrators to analyze spam trends, identify spammers, and improve spam…

A spoofed IP address is a fake source IP address used in network packets to disguise the origin of the traffic. In reflection attacks, attackers spoo…

Spoofing is the act of disguising a network packet to appear as if it originated from a different source. In DoS attacks, attackers often spoof IP ad…

Spread spectrum watermarking is a technique where the watermark signal is spread across a wide frequency band, making it difficult to detect and remo…

SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry fie…

SQL injection prevention involves sanitizing user input to prevent attackers from injecting malicious SQL code into database queries. Prepared statem…

Using SSL/TLS encryption protects data in transit between clients and servers in the DMZ. This prevents eavesdropping and ensures the confidentiality…

A stateful firewall tracks the operating state of network connections traversing it. By analyzing the context and state of network traffic, it can ma…

Stateful inspection is a firewall technique that examines the entire context of a network connection, including past and present packets. This allows…

A stateless firewall examines network packets individually, without considering the context of previous packets or connections. It relies solely on t…

Proper configuration of static analysis tools is critical to their effectiveness. This includes selecting appropriate rules, setting sensitivity leve…

Static analysis techniques can be enhanced by using emulation to resolve indirect calls and understand dynamic code behavior. This hybrid approach im…

SAST tools use ASTs to analyze source code without executing it, identifying vulnerabilities early in the development lifecycle. This helps developer…

Analyzing source code without executing the program to identify potential vulnerabilities and coding flaws. Static analysis can detect issues like bu…

Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video. Attackers may use stegano…

Steganography aims to conceal the existence of a message, while watermarking aims to protect content ownership or authenticity, even if the watermark…

Stored XSS, also known as persistent XSS, occurs when malicious JavaScript code is injected into a website's database or other persistent storage. Wh…

A stream cipher is a type of symmetric encryption algorithm that encrypts data one bit or byte at a time using a pseudorandom keystream. Examples inc…

Subject Alternative Name (SAN) is an extension to X.509 certificates that allows specifying multiple domain names and IP addresses that are protected…

SRI is a security feature that allows browsers to verify that files fetched from a CDN or other third-party source haven't been tampered with. It hel…

Sudo is a program that allows users to run commands with the privileges of another user, typically the root user. Misconfiguration of sudo rules can…

An attack that targets vulnerabilities in a vendor's network to compromise the vendor's customers. Ransomware can be spread through supply chain atta…

Supply chain risk refers to the risks associated with third-party vendors and suppliers. Risk assessments should extend to the supply chain to identi…

Symmetric encryption uses the same key for both encryption and decryption. It is a fast and efficient method commonly used for encrypting large volum…

A SYN flood attack exploits the TCP handshake process by sending a flood of SYN packets without completing the handshake. This can exhaust server res…

Securing the process of creating synthetic full backups, which are created from incremental backups. Vulnerabilities in this process can lead to data…

A standard protocol for message logging. Many devices and applications use syslog to send event notifications, and SIEM systems commonly use syslog t…

System call emulation intercepts and simulates system calls made by a program. This allows analysts to understand how the program interacts with the…