Cybersecurity glossary

Secure configuration management involves establishing and maintaining secure configurations for all components of an application and its environment…

SDLC integrates security considerations into every phase of the software development process. It ensures that security is considered from the initial…

SFTP is a secure protocol for transferring files over a network. DLP systems can monitor SFTP traffic to prevent the unauthorized transfer of sensiti…

Secure logging practices refer to the policies and procedures that ensure logs are generated, stored, and accessed securely. This includes encrypting…

SSH is a cryptographic network protocol for secure communication between systems. It is often used to securely transmit encrypted logs to a central r…

The use of statistical and machine learning techniques to analyze security data and identify anomalies or patterns indicative of malicious activity…

A security audit is a systematic evaluation of an organization's security policies, procedures, and infrastructure. It provides an independent assess…

Security auditors use AST analysis to manually review source code for potential vulnerabilities and security weaknesses. This helps ensure that the c…

Educating users about cybersecurity threats and best practices to help them avoid becoming victims of attacks. Security awareness training can help p…

Security baselines are a set of recommended security settings and configurations for a system or application. Implementing AppLocker is often part of…

A security descriptor is a data structure that contains the security information associated with an object, such as a file, process, or registry key…

The SDLC is a process for developing secure software. Static code analysis is integrated into the SDLC to identify and address vulnerabilities early…

Security groups are virtual firewalls that control network traffic to and from virtual machines or cloud resources. They are often used in cloud envi…

Security hardening involves configuring systems in the DMZ to minimize vulnerabilities. This includes patching software, disabling unnecessary servic…

Security headers are HTTP response headers that can be used to enable various security features in web browsers. These headers can help prevent attac…

SIEM systems aggregate and analyze security logs and events from various sources across an organization's IT infrastructure. This helps security team…

A vulnerability caused by improperly configured security settings. This is a common source of vulnerabilities and can often be easily exploited.

A technology that allows organizations to collect security data from various sources and automate incident response workflows. SOAR platforms often i…

A security policy is a set of rules and guidelines that define how an organization protects its assets. Firewalls are a key component in implementing…

Security policy enforcement involves ensuring that software adheres to predefined security standards and guidelines. Static analysis tools can automa…

A security policy review ensures that security policies are up-to-date, comprehensive, and effectively communicated to employees. It helps maintain a…

Network segmentation divides a network into smaller, isolated segments to limit the blast radius of a security breach. By default, traffic between se…

A segmentation fault is a specific type of error caused by a program attempting to access memory that it is not allowed to access, possibly due to a…

Semantic code analysis leverages ASTs to understand the meaning and context of code. It goes beyond syntax to identify logical errors and security we…

A type of watermarking that is robust to some types of distortions (e.g., compression) but fragile to others (e.g., malicious modification). This all…

A security practice that divides critical tasks among multiple individuals to prevent any single person from having complete control over a process o…

SSRF is a vulnerability that allows an attacker to make requests to internal resources from a vulnerable server. This can be used to access sensitive…

Service meshes provide a dedicated infrastructure layer for handling service-to-service communication, offering features like authentication, authori…

Session hijacking is a type of cyberattack in which an attacker takes control of a legitimate user's session. The attacker can then use the hijacked…

Secure session management is crucial for maintaining the security of user sessions after authentication. This involves generating strong session IDs…

Session management vulnerabilities occur when an application fails to properly manage user sessions, leading to potential security breaches. Burp Sui…

Session monitoring involves actively observing user sessions on jump servers to detect suspicious activity in real-time. This can help identify and p…

Session recording captures all activities performed on a jump server, providing an audit trail for security analysis and compliance. This allows admi…

Setuid (set user ID) and setgid (set group ID) are file permission flags that allow a program to be executed with the privileges of the file's owner…

Unofficial repositories of data created outside of IT's purview, often lacking proper governance and security controls. These can become honeypots fo…

Shadow IT refers to IT systems and solutions built and used inside an organization without explicit organizational approval. DLP solutions need to di…

A shadow VM is a malicious, unauthorized virtual machine created within a legitimate virtualized environment, often by an attacker who has compromise…

A side-channel attack exploits information leaked during the execution of an encryption algorithm, such as power consumption or timing variations. Th…

Attacks that exploit information leaked during the watermark embedding or extraction process, such as power consumption or timing variations. These a…

Side-channel attacks exploit information leaked from the physical implementation of a cryptographic system or algorithm. VMs are potentially vulnerab…

A platform that collects, analyzes, and manages security logs and events from various sources. SIEM systems provide real-time monitoring, correlation…

The design and structure of a SIEM system, including its components, data flow, and integration points. A well-designed SIEM architecture ensures sca…

The process of connecting firewall logs to a Security Information and Event Management (SIEM) system. This integration enables real-time monitoring…

The process of optimizing a SIEM system to improve its accuracy and reduce false positives. SIEM tuning involves adjusting correlation rules, whiteli…

Attacks that use common signal processing techniques like filtering, compression, and noise addition to remove or weaken the watermark. These attacks…

Signature-based detection relies on comparing files and processes against a database of known malware signatures. While useful for detecting well-kno…

Sinkhole DNS redirects requests for malicious domains to a controlled server, preventing users from accessing harmful websites. This can work in tand…

A sinkhole server is a decoy server designed to attract and capture malicious traffic, allowing security analysts to study attack patterns. While not…

Sinkholing redirects malicious traffic to a controlled network where it can be analyzed. This can help identify the source of the attack and develop…

SNMP amplification attacks exploit Simple Network Management Protocol (SNMP) servers to amplify traffic towards a target. Attackers send SNMP queries…

The art of manipulating people into divulging confidential information. Penetration testers may use social engineering techniques to gain initial acc…

A social engineering audit tests employees' awareness of social engineering tactics through simulated attacks. It identifies weaknesses in employee b…

SCA tools use ASTs to analyze the dependencies of a software project and identify known vulnerabilities in third-party libraries. This helps ensure t…

Software Restriction Policies (SRP) are a Group Policy-based feature that allows administrators to control which software applications can run on a W…

Unpatched or outdated software used in shadow IT environments, creating exploitable vulnerabilities. Attackers can leverage these vulnerabilities to…

Attackers may use AST manipulation techniques to obfuscate source code, making it harder to analyze and understand. This technique is used to protect…

A spam honeypot is designed to attract and capture spam emails. It allows administrators to analyze spam trends, identify spammers, and improve spam…

A spoofed IP address is a fake source IP address used in network packets to disguise the origin of the traffic. In reflection attacks, attackers spoo…

Spoofing is the act of disguising a network packet to appear as if it originated from a different source. In DoS attacks, attackers often spoof IP ad…

Spread spectrum watermarking is a technique where the watermark signal is spread across a wide frequency band, making it difficult to detect and remo…

SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry fie…

SQL injection prevention involves sanitizing user input to prevent attackers from injecting malicious SQL code into database queries. Prepared statem…

Using SSL/TLS encryption protects data in transit between clients and servers in the DMZ. This prevents eavesdropping and ensures the confidentiality…

A stateful firewall tracks the operating state of network connections traversing it. By analyzing the context and state of network traffic, it can ma…

Stateful inspection is a firewall technique that examines the entire context of a network connection, including past and present packets. This allows…

A stateless firewall examines network packets individually, without considering the context of previous packets or connections. It relies solely on t…

Proper configuration of static analysis tools is critical to their effectiveness. This includes selecting appropriate rules, setting sensitivity leve…

Static analysis techniques can be enhanced by using emulation to resolve indirect calls and understand dynamic code behavior. This hybrid approach im…

SAST tools use ASTs to analyze source code without executing it, identifying vulnerabilities early in the development lifecycle. This helps developer…

Analyzing source code without executing the program to identify potential vulnerabilities and coding flaws. Static analysis can detect issues like bu…

Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video. Attackers may use stegano…

Steganography aims to conceal the existence of a message, while watermarking aims to protect content ownership or authenticity, even if the watermark…

Stored XSS, also known as persistent XSS, occurs when malicious JavaScript code is injected into a website's database or other persistent storage. Wh…

A stream cipher is a type of symmetric encryption algorithm that encrypts data one bit or byte at a time using a pseudorandom keystream. Examples inc…

Subject Alternative Name (SAN) is an extension to X.509 certificates that allows specifying multiple domain names and IP addresses that are protected…

SRI is a security feature that allows browsers to verify that files fetched from a CDN or other third-party source haven't been tampered with. It hel…

Sudo is a program that allows users to run commands with the privileges of another user, typically the root user. Misconfiguration of sudo rules can…

An attack that targets vulnerabilities in a vendor's network to compromise the vendor's customers. Ransomware can be spread through supply chain atta…

Supply chain risk refers to the risks associated with third-party vendors and suppliers. Risk assessments should extend to the supply chain to identi…

Symmetric encryption uses the same key for both encryption and decryption. It is a fast and efficient method commonly used for encrypting large volum…

A SYN flood attack exploits the TCP handshake process by sending a flood of SYN packets without completing the handshake. This can exhaust server res…

Securing the process of creating synthetic full backups, which are created from incremental backups. Vulnerabilities in this process can lead to data…

A standard protocol for message logging. Many devices and applications use syslog to send event notifications, and SIEM systems commonly use syslog t…

System call emulation intercepts and simulates system calls made by a program. This allows analysts to understand how the program interacts with the…

Tainted data refers to data that originates from an untrusted source, such as user input or external APIs. Static analysis tools track tainted data t…

Tamper detection mechanisms identify unauthorized modifications to log files. This can be achieved through cryptographic hashing or digital signature…

Tamper resistance, when related to watermarking, describes the degree to which a watermarked system prevents unauthorized alteration or removal of th…

A tarpit is a type of honeypot that intentionally slows down attackers by delaying responses. This wastes the attacker's time and resources, making t…

Trusted Execution Environment (TEE) emulation simulates the secure environment within a processor. This is critical for testing security-sensitive ap…

Telemetry data from honeypots provides insights into attack trends and patterns. This data can be used to improve security defenses and proactively a…

Applications often rely on third-party libraries and frameworks, which can introduce vulnerabilities if they are not properly managed. Regularly upda…

This assessment evaluates the security practices of third-party vendors and service providers. It helps organizations understand and mitigate the ris…

Threat hunting is a proactive security activity that involves searching for threats that have evaded automated detection systems. EDR solutions provi…

Threat intelligence is information about existing or emerging threats that can be used to inform decisions and improve security posture. This include…

Streams of information about known threats, vulnerabilities, and indicators of compromise (IOCs). Integrating threat intelligence feeds with log anal…

TIPs collect, aggregate, and analyze threat data from multiple sources, providing contextual information about threat actors, malware, and vulnerabil…

Threat modeling involves identifying potential threats to a system or application and assessing their likelihood and impact. Contextualizing threats…

This type of SSRF exploits the time it takes for a server to respond to a request. By sending requests to resources that take varying amounts of time…

Time-based firewall rules allow administrators to define rules that are only active during specific times of day or days of the week. This can be use…

Proper TLS/SSL configuration is essential for securing web traffic. Burp Suite can be used to analyze the TLS/SSL configuration of a web server and i…

CDNs often handle TLS/SSL termination, decrypting incoming traffic and encrypting outgoing traffic, which reduces the load on the origin server. Prop…

Token manipulation involves modifying or replacing access tokens in Windows to gain elevated privileges. This technique can be used to impersonate ot…

Token-based authentication can be used to secure access to CDN resources by requiring users to present a valid token before accessing content. This h…

The process of replacing sensitive data with non-sensitive substitutes, referred to as tokens. This protects the actual data from being exposed to in…

The examination of network traffic patterns recorded in firewall logs to understand network usage and identify potential bottlenecks. This can help o…

Traffic emulation involves generating synthetic network traffic to simulate real-world usage patterns. This is used to assess the performance and sec…

Traffic filtering involves inspecting network traffic and blocking packets that match certain criteria, such as spoofed IP addresses or malicious pat…

Traffic flooding involves overwhelming a network or server with a large volume of packets. This can exhaust resources and prevent legitimate traffic…

TLS is a cryptographic protocol that provides secure communication over a network. It is commonly used to encrypt log data during transmission betwee…

3DES is a symmetric block cipher that applies the DES algorithm three times to each data block to enhance security. While more secure than DES, it is…

A trust store is a repository of trusted root certificates. Operating systems, browsers, and applications use trust stores to verify the validity of…

A trust zone is a defined area of a network with a specific level of security and access control. Network segmentation creates multiple trust zones w…

A Trusted Platform Module (TPM) is a hardware security module that provides secure storage for cryptographic keys and supports secure boot processes…

2FA is a security process that requires users to provide two different authentication factors to verify their identity. This adds an extra layer of s…

A UDP flood attack involves overwhelming a target with a large volume of UDP packets. Because UDP is connectionless, the target server wastes resourc…

User Datagram Protocol (UDP) is often exploited in reflection attacks because it is a connectionless protocol, allowing attackers to easily spoof the…

This refers to employees using applications not approved by the IT department, potentially bypassing security controls and exposing sensitive data. I…

uRPF is a security feature used to verify the source IP address of incoming packets, dropping those that don't match expected routes. While not direc…

Unikernels are specialized, single-address-space machine images constructed by using library operating systems. They improve security by minimizing t…

Personal devices or systems used for work purposes without proper security configurations or monitoring. These devices can act as entry points for ma…