Cybersecurity glossary

Network forensics involves analyzing network traffic to identify the source and nature of security incidents. Network forensics can be used to invest…

A system that monitors network traffic for suspicious activity and policy violations. NIDS logs are often ingested into SIEM systems for correlation…

An IPS monitors network traffic for malicious activity and takes automated actions to block or prevent attacks. By default, traffic is inspected, and…

NSM involves continuous monitoring of network traffic for suspicious activity and potential security threats. Analysis of traffic patterns can help i…

Dividing a network into smaller, isolated segments to limit the impact of a security breach. Network segmentation can help prevent attackers from mov…

This audit checks if the network is properly divided into segments to isolate critical systems and limit the impact of a security breach. Proper netw…

Logging traffic flows between different network segments separated by the firewall. This helps verify the effectiveness of segmentation strategies an…

Network traffic analysis involves examining network communication patterns to identify suspicious activities. Unusual spikes in network traffic relat…

Network zoning is the practice of dividing a network into multiple zones based on security levels and access requirements. This is a core concept in…

NGFWs provide advanced features beyond traditional firewalls, such as deep-packet inspection, intrusion prevention, application control, and integrat…

A U.S. government repository of standards-based vulnerability management data. NVD includes CVEs, severity scores, impact analysis, and fix informati…

A powerful network scanning tool used to discover hosts and services on a computer network. Penetration testers use Nmap to map out the network and i…

"No Coin" is a browser extension and filter list designed to block cryptocurrency miners on websites. It helps users prevent their computers from bei…

North-South traffic refers to network communication between a data center and external clients, typically over the internet. Network segmentation hel…

NTP amplification is a type of amplification attack that exploits NTP servers. Attackers send small NTP queries with a spoofed source address, causin…

A null route is a network route that directs traffic to a non-existent destination. Implementing a null route can be used to drop malicious traffic d…

OCSP stapling allows a web server to query the OCSP responder and cache the response, then include (staple) the OCSP response in the TLS handshake. T…

Encrypting backup data before it is transferred and stored offsite. This protects the confidentiality of sensitive information in case the offsite st…

The Online Certificate Status Protocol (OCSP) is an alternative to CRLs for checking the revocation status of digital certificates. It provides real…

An open redirect vulnerability allows an attacker to redirect users to an arbitrary website. Burp Suite can be used to identify and exploit open redi…

An open resolver is a DNS server that accepts queries from any source, making it vulnerable to DNS amplification attacks. Securing or closing open re…

Logs generated by operating systems that record system events, such as user logins, process executions, and hardware errors. Analyzing OS logs helps…

OCR technology is used in DLP to extract text from images and scanned documents. This enables DLP systems to analyze the content of images and preven…

An Origin Shield is a protective layer in front of the origin server, typically implemented within the CDN infrastructure. It reduces the load on the…

Out-of-band management allows administrators to access and manage systems in the DMZ even if the primary network is down. This provides a more secure…

Outbound firewall rules control the network traffic that is allowed to leave the internal network. These rules are important for preventing data exfi…

Output encoding converts potentially dangerous characters into a safe format when displaying user-supplied data. This prevents injected JavaScript co…

The Open Web Application Security Project (OWASP) is a non-profit organization focused on improving software security. OWASP provides resources and g…

A list of the ten most critical web application security risks. It provides developers and security professionals with awareness and guidance on addr…

An open-source web application security scanner. It is a free alternative to Burp Suite and is used to find vulnerabilities in web applications durin…

Padding is the process of adding extra data to a plaintext message to ensure that its length is a multiple of the block size required by a block ciph…

Parameter tampering involves modifying parameters in a web request to manipulate application behavior. Attackers can alter values in the URL or form…

Pass-the-hash is a technique where an attacker steals a user's password hash and uses it to authenticate to a system without needing the actual passw…

The process of acquiring, testing, and installing software updates to address vulnerabilities and security flaws. Effective patch management is cruci…

A patch management audit reviews the process of applying security patches to software and systems. It ensures that patches are applied in a timely ma…

A Path Rule in AppLocker allows or denies applications based on their file path. While easy to configure, Path Rules can be less secure than other ru…

Penetration testing is a simulated cyberattack against a computer system, network, or application to identify vulnerabilities that could be exploited…

Perceptible watermarking involves embedding a watermark that is visible or audible to the end-user, although ideally it should be minimally intrusive…

The characteristic of a watermark being invisible or inaudible to the human senses. A good watermark should not degrade the quality of the host media.

Phishing is a type of social engineering attack where attackers impersonate legitimate entities to trick individuals into revealing sensitive informa…

Phishing simulations are used to test employees' susceptibility to phishing attacks. The results of these simulations inform risk assessments by iden…

Users of shadow IT applications may be more susceptible to phishing attacks due to a lack of security awareness training and the use of personal emai…

A physical security audit assesses the security of physical access controls, such as locks, alarms, and surveillance systems. It helps protect physic…

Policy enforcement ensures that DLP policies are consistently applied across the organization's systems and networks. This involves implementing tech…

Port forwarding is a technique that redirects network traffic from a specific port on the firewall to a specific device or service on the internal ne…

SSRF can be used to perform port scanning on internal networks by sending requests to different ports on internal IP addresses. This allows attackers…

Activities performed after successfully exploiting a vulnerability, such as privilege escalation, data exfiltration, and maintaining access. This pha…

PowerShell is a command-line shell and scripting language developed by Microsoft. It can be used by attackers for various malicious activities, inclu…

PowerShell Constrained Language Mode limits the features and functionality of PowerShell scripts that can be executed. This can be used in conjunctio…

Defense in depth involves implementing multiple layers of security controls to protect an application or system. If one layer fails, other layers are…

The principle of fail-safe defaults dictates that in the event of a failure, the system should default to a secure state. This aligns with default de…

A private CA is a Certificate Authority that is operated within an organization for internal use. It's used to issue certificates for internal server…

Exploiting a bug or design flaw in an application or operating system to gain elevated access to resources that are normally protected from an applic…

Privilege management involves controlling the level of access that users and applications have to system resources. By limiting privileges, organizat…

PAM focuses on managing and controlling access to privileged accounts and resources. By limiting who has access to sensitive data and systems, PAM ca…

Users may gain excessive privileges on shadow IT systems, increasing the potential for abuse and data breaches. Proper privileged access management (…

Process emulation simulates the execution of a process, allowing security analysts to observe its behavior and interactions with other processes. Thi…

Process injection is a technique used by malware to inject malicious code into legitimate processes. EDR systems monitor process activity to detect a…

Process monitoring involves observing the processes running on a system to identify suspicious or unauthorized activities. Unusual processes consumin…

Protocol emulation simulates the behavior of network protocols, such as HTTP or SMTP, to test the security of applications and services. This can rev…

SSRF vulnerabilities can be exploited to turn the vulnerable server into a proxy, allowing the attacker to route traffic through it. This can be used…

Public Key Infrastructure (PKI) is a system for creating, managing, distributing, using, storing, and revoking digital certificates. It involves Cert…

A Publisher Rule in AppLocker allows or denies applications based on their digital signature and publisher information. These rules are useful for al…

Quantization watermarking modifies the quantization indices of the host signal to embed the watermark. This technique is often used in audio and vide…

A race condition occurs when the output of a program becomes unexpectedly and critically dependent on the sequence or timing of other events. Exploit…

A precomputed table used for reversing cryptographic hash functions, typically for cracking password hashes. Penetration testers may use rainbow tabl…

A message displayed to the victim after their files have been encrypted, providing instructions on how to pay the ransom and receive the decryption k…

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment to restore access. It often spreads through phishing emai…

Ransomware frequently targets backup systems to prevent data recovery. Protecting backups with air-gapping, immutability, and strong access controls…

Shadow IT environments can serve as entry points for ransomware attacks, which can then spread to other parts of the organization. Proper endpoint pr…

A business model where ransomware developers lease their malicious code to affiliates, who then carry out attacks and share the profits. RaaS makes r…

Rate limiting is a mitigation technique that limits the number of requests a user or IP address can make within a given time period. This can prevent…

AST analysis can help identify code sections that need to be refactored for security reasons. This involves restructuring the code to improve its sec…

Reflected XSS occurs when user-supplied input is immediately outputted in the response without proper sanitization. An attacker can craft a malicious…

A reflection attack involves sending requests to a server that will then send the response to the victim, amplifying the attack. DNS and NTP servers…

A sequence of characters that define a search pattern. Regex is used in log analysis to extract specific information from log messages or to identify…

A Registration Authority (RA) is an entity that verifies the identity of certificate requesters before a Certificate Authority (CA) issues a certific…

Regular expressions are patterns used to match specific text strings, making them useful for identifying sensitive data patterns like social security…

Regular expressions are used in DLP to define patterns for identifying sensitive data within files and network traffic. They allow for flexible and a…

Regular security audits involve systematically reviewing an application and its environment to identify vulnerabilities and security weaknesses. Thes…

The process of fixing or mitigating vulnerabilities that have been identified. Remediation may involve patching, configuration changes, or other secu…

A vulnerability that allows an attacker to execute arbitrary code on a remote server. RCE vulnerabilities are highly critical and are often targeted…

RDP is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network c…

RFI is a vulnerability that allows an attacker to include remote files on a web server. This can lead to arbitrary code execution if the included fil…

RTBH filtering allows a network operator to signal to upstream providers to blackhole traffic destined for a specific IP address. This enables faster…

Reputation-based application control uses threat intelligence feeds and reputation services to assess the trustworthiness of applications. Applicatio…

HTTP Request Smuggling vulnerabilities can sometimes be chained with SSRF to amplify the impact or bypass certain protections. It involves manipulati…

Resource monitoring involves tracking the utilization of system resources, such as CPU, memory, and network bandwidth. This practice is essential for…

Validating the response from the requested URL can help detect and prevent SSRF attacks. By inspecting the content or headers of the response, the ap…

Reverse engineering is the process of analyzing a software or hardware system to understand its functionality and design, often without access to the…

Techniques like AST obfuscation are used to hinder reverse engineering efforts by making the code more difficult to understand. This can protect sens…

A reverse proxy server sits in front of web servers in the DMZ and retrieves resources on behalf of clients. This protects the origin web servers fro…

Reverse tabnabbing is a phishing attack where a malicious website that is linked to from a legitimate website modifies the original website when the…

Risk appetite defines the level of risk an organization is willing to accept. It guides decision-making regarding resource allocation for security co…

The process of identifying, analyzing, and evaluating potential risks and vulnerabilities. It helps organizations prioritize mitigation efforts and a…

Robust watermarking refers to watermarking techniques that are resistant to various attacks and distortions, such as compression, noise addition, and…

Wireless access points set up by employees without IT approval, creating unsecured network entry points. These can be exploited by attackers to gain…

A rogue CA is a fraudulent or compromised Certificate Authority that issues certificates without proper authorization. These certificates can be used…

The use of unauthorized hardware or software within an organization's network. Insiders may introduce rogue IT devices or applications, creating secu…

RBAC assigns permissions based on a user's role within an organization. It supports default deny by granting only the necessary permissions for each…

Root cause analysis is the process of determining the underlying cause of a security incident. EDR solutions facilitate root cause analysis by provid…

A root certificate is the foundation of a chain of trust in a Public Key Infrastructure (PKI). It is a self-signed certificate issued by a Certificat…

A rootkit is a type of malware that hides its presence and the presence of other malicious software on a system. Zero-day exploits can be used to ins…

Route Injection is the process of adding routes to a routing table, potentially to divert traffic. Blackholing uses route injection (specifically, in…

The rule base is the complete set of firewall rules configured on a firewall. It determines how the firewall handles network traffic and enforces sec…

In AppLocker, rule collections are groups of rules that apply to specific file types (e.g., executables, scripts, Windows Installer files). Each rule…

Runtime Application Self-Protection (RASP) is a security technology that embeds protection directly into an application, allowing it to detect and pr…

Runtime emulation refers to emulating the execution of code during runtime, allowing for dynamic analysis and debugging. This is essential for unders…

The SOP is a web browser security mechanism that restricts scripts from one origin from accessing resources from a different origin. While it doesn't…

An isolated environment used to safely execute and analyze potentially malicious code. Sandboxes can be used to test suspicious files and identify ra…

Sandbox analysis involves executing suspicious files or processes in a controlled environment to observe their behavior. EDR systems can integrate wi…

The sandbox attribute on an `` element restricts the capabilities of the content within the iframe. This can be used to limit the impact of injected…

Sandbox emulation involves running potentially malicious code within a controlled environment that mimics a real system. This allows security analyst…

Sandboxing is a security mechanism that isolates applications or processes in a controlled environment. This prevents them from accessing sensitive s…

SAST tools analyze source code, bytecode, or binary code for security vulnerabilities without executing the code. SAST is a crucial part of the SDLC…

The process of capturing visual data from a computer display. Insiders may use screen scraping to extract sensitive information from applications or…

Seccomp is a Linux kernel feature that restricts the system calls a process can make. In container security, seccomp profiles are used to limit the s…

Secure Boot is a security standard that ensures a device boots using only software that is trusted by the device manufacturer. It prevents malicious…

Properly configuring a CDN involves implementing secure caching policies, enabling HTTPS, and configuring appropriate access controls. Regular securi…

Secure coding practices include techniques to minimize vulnerabilities in software. Default deny principles are applied by validating inputs and expl…