Cybersecurity glossary

Certificate rotation is the process of replacing existing digital certificates with new ones before they expire. Regularly rotating certificates help…

Certificate Transparency (CT) is an open framework for monitoring and auditing SSL/TLS certificates. It aims to prevent the issuance of fraudulent ce…

CBC is a mode of operation for block ciphers where each block of plaintext is XORed with the previous ciphertext block before encryption. This helps…

Clickjacking is an attack where an attacker tricks a user into clicking something different from what they perceive, often by overlaying a transparen…

A client honeypot actively searches for malicious servers by visiting websites and interacting with web services. It allows defenders to identify and…

Client-side emulation involves emulating the client-side components of a web application, such as JavaScript code. This allows security analysts to i…

Securing backups stored in the cloud with encryption, access controls, and multi-factor authentication. Organizations need to ensure that their cloud…

Cloud DLP protects sensitive data stored or processed in cloud environments like AWS, Azure, or Google Cloud. It involves implementing DLP policies a…

The logging of traffic and events associated with cloud-based firewalls. This includes considerations for data residency, access control, and integra…

SSRF can be exploited to retrieve credentials stored in cloud environments, such as AWS IAM roles or Google Cloud service account keys. These credent…

Cloud security encompasses the practices and technologies designed to protect cloud-based infrastructure, data, and applications. SSRF vulnerabilitie…

CSPM tools automatically identify and remediate security misconfigurations in cloud environments. They help enforce default deny policies by ensuring…

Incorrectly configured cloud services used by shadow IT, leading to vulnerabilities like publicly accessible storage buckets or open databases. This…

Cloud storage encryption involves encrypting log data before it is stored in a cloud environment. This protects the data from unauthorized access by…

Cloud storage security involves implementing measures to protect data stored in cloud-based services. This includes access controls, encryption, and…

Code coverage measures the extent to which a program's source code has been tested. While primarily used in dynamic testing, static analysis can help…

Code injection is a type of vulnerability where an attacker can inject malicious code into a running application. Zero-day exploits may utilize code…

ASTs can be used to sanitize user inputs and validate code structures, preventing code injection attacks. By analyzing the code's structure, it's pos…

Code obfuscation involves transforming code to make it more difficult for attackers to understand and reverse engineer. While not a perfect solution…

Code review is the systematic examination of computer source code, intended to find and fix mistakes overlooked in initial development phases. Static…

Code signing involves digitally signing software applications to verify the identity of the publisher and ensure the integrity of the code. This proc…

A code smell is a characteristic in the source code of a program that possibly indicates a deeper problem. While not always bugs, they can indicate p…

AST transformations can be used to automatically rewrite code to improve its security. Examples include adding security checks, sanitizing inputs, or…

Coinhive was a JavaScript miner that gained notoriety for enabling website owners to monetize their traffic by mining Monero using visitors' CPUs. Wh…

A collusion attack involves combining multiple copies of watermarked content, each with a slightly different watermark, to statistically estimate and…

Command and Control (C2) refers to the infrastructure used by attackers to communicate with and control compromised endpoints. EDR systems monitor ne…

Command injection is an attack where an attacker executes arbitrary commands on the host operating system through a vulnerable application. This can…

A dictionary of publicly known information security vulnerabilities and exposures. CVE provides a standardized naming convention for vulnerabilities…

Compilers leverage ASTs to apply security hardening techniques such as stack canaries and address space layout randomization (ASLR). These techniques…

Compliance refers to adhering to industry regulations and standards, such as PCI DSS, HIPAA, and GDPR. Network segmentation is often a requirement fo…

A compliance audit assesses whether an organization adheres to regulatory standards, internal policies, and legal requirements. These audits are esse…

The process of generating reports to demonstrate adherence to security regulations and standards (e.g., GDPR, HIPAA, PCI DSS). SIEM systems automate…

Various regulations and standards, such as HIPAA and GDPR, mandate the protection of sensitive data, often requiring log encryption. Compliance with…

Shadow IT often violates regulatory compliance standards (e.g., GDPR, HIPAA) due to lack of oversight and adherence to security policies. This can re…

Compromised credentials are usernames and passwords that have been stolen or leaked. DLP solutions, combined with other security measures, can help d…

Ensuring that systems and applications are configured securely and consistently. Proper configuration management helps prevent vulnerabilities arisin…

Linux capabilities provide a finer-grained control over privileges than the traditional root/non-root model. Containers use capabilities to drop unne…

Container image scanning analyzes the layers of a container image for known vulnerabilities, malware, and configuration issues. This proactive approa…

Container orchestration security focuses on securing the platforms used to manage and deploy containers, such as Kubernetes. This includes securing t…

Container runtime security focuses on securing the container runtime environment, which is responsible for running containers. This includes protecti…

Container security involves securing containerized applications and infrastructure. By default, containers should have limited access to the host sys…

A security context defines the security parameters for a container or pod, such as user ID, group ID, and capabilities. It controls the privileges an…

Container security and VM security are related but distinct concepts. While VMs provide hardware virtualization, containers offer operating system-le…

A CDN is a distributed network of servers that caches content closer to users. CDNs can help mitigate DoS attacks by absorbing traffic and distributi…

Encrypting content stored on the CDN helps protect it from unauthorized access in case of a security breach. Encryption can be applied to both static…

Content inspection is the process of analyzing the actual content of data, such as files, emails, or network traffic, to identify sensitive informati…

Watermarking can be used to track the origin and history of digital content, providing a means to establish content provenance. This is particularly…

CSP is a security standard that allows web developers to control the resources that a web page is allowed to load. By defining a whitelist of allowed…

Content-aware DLP analyzes the content of data to identify sensitive information based on predefined rules and patterns. This includes techniques lik…

Contextual analysis involves evaluating the surrounding context of data to determine its sensitivity and risk level. This helps DLP systems make more…

The process of adding additional information to security events to provide context and improve understanding. SIEM systems contextualize events by en…

Control flow analysis examines the execution paths a program can take to find vulnerabilities related to incorrect logic or unexpected program states…

ASTs are used to generate Control Flow Graphs, which represent the execution paths within a program. CFGs are then analyzed for potential vulnerabili…

Control gap analysis identifies discrepancies between desired security controls and implemented security controls. It helps to understand where vulne…

Control groups (cgroups) are a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network) of pr…

Cookies are used to store user-specific information on the client-side. Burp Suite allows testers to intercept and modify cookies to test for vulnera…

Cookie theft is a common objective of JavaScript injection attacks, where the injected script steals a user's cookies containing session information…

A copy attack involves copying watermarked content and redistributing it without authorization, thus bypassing copyright protection. Watermarks can h…

Using watermarks to identify unauthorized copies of digital content. The watermark acts as a unique identifier for the original source.

Predefined rules that define how a SIEM should analyze logs and events to identify potential security threats. These rules are critical to the effect…

CORS is a mechanism that allows web pages from one origin to access resources from a different origin. While not directly related to JavaScript injec…

CTR mode is a mode of operation for block ciphers that turns a block cipher into a stream cipher. It generates a unique keystream for each block by e…

Counterfeit detection uses watermarks to verify the authenticity of products or documents. The presence and integrity of the watermark confirm that t…

CPU utilization refers to the percentage of a computer's processing power being used at any given time. High CPU utilization, especially when unexpec…

Credential stuffing uses stolen usernames and passwords from previous breaches to gain access to accounts on other systems. Jump servers are vulnerab…

Cross-certification is a process where two or more Certificate Authorities (CAs) mutually recognize each other's certificates. This allows users to t…

An attack that forces a user to execute unwanted actions on a web application in which they're currently authenticated. Penetration testers will ofte…

XSS is a type of web security vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. These scripts c…

XSS prevention techniques aim to prevent attackers from injecting malicious scripts into web pages viewed by other users. This often involves encodin…

A cryptocurrency wallet is a digital storage for cryptocurrency. Cryptojacking malware aims to steal processing power to mine cryptocurrency, and the…

Cryptographic agility refers to the ability to quickly and easily switch between different cryptographic algorithms and protocols. This is important…

A cryptographic audit verifies the strength and proper implementation of encryption algorithms and key management practices. It ensures that sensitiv…

A cryptographic hash function is a one-way function that takes an input and produces a fixed-size hash value. While not encryption itself, hash funct…

The unauthorized use of someone else's computer to mine cryptocurrency. While not directly ransomware, it is a related threat that can indicate a com…

A dictionary of publicly known information security vulnerabilities and exposures. CVEs provide a standardized naming convention for vulnerabilities…

A standardized scoring system for rating the severity of software vulnerabilities. CVSS scores help prioritize remediation efforts based on the poten…

Cyber threat intelligence involves gathering and analyzing information about potential cyber threats, including reflection attacks. This information…

The practice of protecting systems, networks, and programs from digital attacks aimed at accessing, changing, or destroying sensitive information, ex…

Data aggregation is the process of collecting data from multiple sources and combining it into a single summary for reporting. While not directly mal…

Data classification involves categorizing data based on its sensitivity and value to the organization. This process helps prioritize data protection…

A data diode is a network security device that allows data to flow in only one direction. This can be used to protect highly sensitive systems by pre…

Data discovery involves identifying and locating sensitive data across an organization's systems and repositories. It is a fundamental step in implem…

Data encryption protects sensitive information by converting it into an unreadable format. While not directly default deny, it supports the concept b…

Data encryption at rest involves encrypting sensitive data when it is stored on disk or other storage media. This protects data from unauthorized acc…

Shadow IT solutions often lack proper data encryption, leaving sensitive data vulnerable to interception and theft. This is especially concerning for…

DES is a symmetric block cipher that was once a dominant encryption algorithm. It uses a 56-bit key, which is now considered too short and vulnerable…

DEP is a security feature that prevents code from being executed in memory regions that are intended for data storage. This helps to mitigate buffer…

Data exfiltration is the unauthorized transfer of sensitive data from an organization's network. EDR systems monitor network traffic and file access…

Honeypots can detect data exfiltration attempts by monitoring for unauthorized data transfers. This helps organizations identify and respond to data…

Data fingerprinting creates unique identifiers or hashes for sensitive data to enable accurate detection even if the data is modified or obfuscated…

Data flow analysis tracks the movement of data through a program to identify potential vulnerabilities like uninitialized variables or tainted data u…

DLP is a set of technologies and processes designed to prevent sensitive data from leaving an organization's control. DLP systems can identify and bl…

A DLP audit assesses the effectiveness of data loss prevention measures in protecting sensitive data. It verifies that policies and technologies are…

Data masking is a technique used to obscure sensitive data while preserving its format for testing or development purposes. This involves replacing s…

Data minimization is the principle of collecting and retaining only the data that is necessary for a specific purpose. Implementing data minimization…

The process of converting data from different sources into a consistent format. SIEM systems normalize log data to facilitate correlation and analysi…

Data redaction involves permanently removing sensitive information from a document or file. DLP systems can automatically redact sensitive data befor…

Data residency refers to the geographic location where an organization's data is stored. DLP policies need to consider data residency requirements to…

A data retention policy defines how long different types of data should be kept by an organization. DLP systems should be configured to align with th…

Data sovereignty refers to the legal and regulatory requirements governing the storage and processing of data within a specific country or region. DL…

Storing data in shadow IT solutions that are located in different geographic regions can lead to data sovereignty issues and compliance violations. O…

DAM systems monitor database activity for suspicious behavior and policy violations. Contextualizing database queries with user roles, application co…

A database honeypot simulates a vulnerable database server. It allows defenders to monitor attempted database attacks, identify SQL injection attempt…

Logs generated by database management systems that record database operations, such as queries, updates, and authentication attempts. Analyzing datab…

This audit verifies the security of databases, including access controls, encryption, and data integrity. It helps protect sensitive data stored in d…

Database watermarking involves embedding watermarks into databases to protect against illegal copying or distribution of sensitive data. The watermar…

The process of logging Distributed Denial-of-Service (DDoS) attack events detected by the firewall. This includes capturing information about source…

DDoS mitigation techniques are used to protect systems from distributed denial-of-service attacks, including reflection attacks. These techniques can…

DDoS mitigation services provide specialized protection against DDoS attacks. These services typically use a combination of techniques, such as traff…

Dead code is code that is never executed, and its presence can indicate errors or unnecessary complexity. Static analysis can identify and remove dea…

Data stored in various unmanaged locations, such as personal cloud accounts or USB drives, making it difficult to track and secure. This increases th…

Deception technology encompasses a range of techniques, including honeypots, to mislead and detect attackers. It aims to create a deceptive environme…

A decoy file is a file placed within a honeypot system to entice attackers. These files often contain fake sensitive information to further engage th…

A secret key used to reverse the encryption process and restore access to the encrypted data. In ransomware attacks, the decryption key is held by th…

DPI is a technique that examines the data part of network packets, not just the headers, to identify applications, content, and potential threats. NG…

Default deny is a security principle where all traffic is blocked by default, and only explicitly allowed traffic is permitted to pass through the fi…

An attack that aims to make a system or network unavailable to legitimate users. DoS attacks can exploit vulnerabilities or simply overwhelm the syst…

A DoS attack is an attempt to make a machine or network resource unavailable to its intended users by overwhelming it with traffic or requests. Distr…

This is a security principle where all network traffic is blocked by default, and only explicitly permitted traffic is allowed through firewall rules…

Exploiting vulnerabilities in differential backup processes to inject malicious code. Attackers target the incremental nature of differential backups…