Cybersecurity Glossary

A 0day (pronounced as “zero day”) refers to a software vulnerability that is not publicly known and has no patch or fix available.

0day vulnerabilities are called such because attackers exploit them on the same day they become known, giving developers zero days to fix the issue before it can be used to attack systems.

Hackers and cybercriminals highly prize 0day vulnerabilities because they can help with gaining unauthorized access to systems, stealing data, or carrying out other malicious activities without the knowledge of the software developers or the general public.

256-bit encryption refers to the key length used to encrypt and decrypt data. Encryption is the process of turning plaintext data into ciphertext, a garbled version of the original data. To turn the ciphertext back to human-readable data, you would need the 256-bit key.

256-bit encryption is considered the strongest level of encryption since it currently uses the longest encryption key. This method requires 14 rounds of multiple processes to encrypt data and the same number of rounds to decrypt it.

Imagine having to go through 14 bank vault doors to get to your target. If you know the code for each lock, then you can open all 14 doors. Otherwise, it could take you a long time to get through.

Access governance is part of security management. It is the process of governing “who” should have access to a system and “how” they can gain entry into “what” within a network. The concept is often confused with access management. In reality, however, it is a higher form of access management since policies and procedures support access control.

Access governance is put in place to help organizations limit security risks that may arise from users trying to gain unauthorized access to confidential data. There has been a growing need for access governance as most organizations aim to comply with regulations and seek to improve their security posture.

Suppose you are the head of a human resources team, and your job is to secure all employee documents. You are responsible for ensuring that these are kept away from prying eyes. This is what access governance means in simple terms.

An active attack is considered an assault on a network or system. In such an attack, the threat actor interferes with how a network or system works by changing the target data or introducing new data.

The attack refers to all kinds of activities that occur when a person tries to “hack” into a server or computer. In contrast to passive attacks, wherein hackers do not make modifications but rather listen in or monitor activities, active attacks involve introducing unwanted changes. In some cases, hackers use the data they gathered from a passive attack to carry out an active attack. In a nutshell, an active attack refers to actual “hacking,” while a passive attack can be likened more to “spying.”

Active reconnaissance is a computer attack where hackers communicate with a target system to collect information. The process involves probing a network for weaknesses, such as open ports or other possible entry points that include vulnerable routers.

“Reconnaissance” is a military term used to refer to missions into enemy territory to gather relevant information before carrying out an attack. In computer security, active reconnaissance is often the first step attackers take to gain insights into how best to enter a target network.

Adaptive security is a model that continuously investigates threat events. This real-time monitoring method allows security officials to develop strategies that let them map out the threat landscape before attacks can occur.

The main goal of adaptive security is to develop a plan that allows cybersecurity personnel to visualize, detect, and prevent threats from penetrating their networks.

You can liken adaptive security to an automated closed-circuit television (CCTV) system. When an unusual incident is spotted, the system sounds an alarm to alert security personnel to a potential intrusion.

The administrative safeguard is one of the security rules set by the Health Insurance Portability and Accountability Act (HIPAA) that refers to standards that help prevent electronic protected health information (EPHI) from unauthorized access. The administrative safeguard is one of the three safeguards HIPAA requires covered entities to implement—physical and technical safeguards are the other two requisites.

There are nine administrative safeguard standards that HIPAA requires covered entities to implement. Examples of these administrative safeguards include:

• Establishing a security management process
• Assigning a security official
• Conducting security awareness training for employees
• Drawing up a contract for all third-party entities that have access to EPHI

Agentless threat hunting is the process of proactively searching for undetected cyber threats in a network without using software or agents on endpoints.

It relies on already existing infrastructure and real-time monitoring and protection instead. And that not only eases deployment but also minimizes resource usage.

Alert fatigue or alarm fatigue happens to cybersecurity experts that get exposed to vast numbers of frequent alerts or alarms, consequently desensitizing them to the warnings. It results in longer response times or missing important alerts or alarms.

Apart from cybersecurity, alert fatigue happens in other industries, too, such as construction, mining, and healthcare. As in the story of the boy who cried “Wolf!” false alerts or alarms can rob critical ones of the importance they deserve.

Alert triage is the process of analyzing and prioritizing security alerts so security teams can identify which ones require their immediate action. The term originally comes from the medical field, where nurses must decide which patients need urgent care and which can wait. 

In cybersecurity, triage acts as a filter that separates real security incidents from noise or false positives.

An allowlist, also known as a “whitelist,” is a cybersecurity term for a list of entities, items, or actions explicitly permitted or granted access within a specific context. It’s the opposite of a blocklist, also known as a “blacklist,” which contains entities, items, or actions that are explicitly denied or prohibited in a network.

You can compare an allowlist to the approved guest list of an exclusive event. If your name’s not on it, you won’t be allowed entry into the venue, regardless of who you are.

An anti-botnet refers to a set of practices, techniques, and technologies designed to prevent, detect, and mitigate the impact of botnets. A botnet is a network of compromised computers, often referred to as “bots” or “zombies,” that are controlled by a central server or group of servers called “command-and-control (C&C) servers.” These compromised computers are usually infected with malware, allowing cybercriminals to control them remotely without their owners’ knowledge.

As the word “anti” suggests, an anti-botnet prevents devices from becoming part of a botnet.

Application programming interface (API) attacks are attempts to use APIs for malicious or other unsanctioned purposes. They can result from exploiting technical vulnerabilities in API implementations, using stolen credentials and other account takeover techniques to masquerade as legitimate users, and abusing business logic that allows threat actors to use APIs unexpectedly.

Recent studies revealed that in January 2024 alone, attempts to attack web APIs impacted one in 4.6 organizations worldwide per week.

Application security posture management (ASPM) is a unified approach to an organization’s application security. It covers all processes, practices, and tools used to identify, mitigate, and protect against application vulnerabilities throughout the software development life cycle. Instead of performing critical security processes for each software, organizations can use an ASPM platform as a single solution.

These tools maintain an inventory of all the applications an organization uses, assess them for risks, and facilitate the remediation of identified vulnerabilities.

The security approach is similar to managing a fleet of cars. To simplify the job, the fleet manager identifies all the cars in the fleet, their models, ages, and conditions. Any issue gets reported to the manager, who then facilitates repairs, faulty part replacement, and other processes to ensure that all the cars meet safety standards. 

ASLR, short for “address space layout randomization,” is a computer security technique that helps prevent the exploitation of memory corruption vulnerabilities. How? Suppose an attacker wants to effectively jump to a specific exploitable function in memory. In that case, ASLR randomly arranges the address space positions of key data areas of a process to prevent the threat actor from doing so.

You can compare ASLR to rearranging the order of paintings in a gallery according to how likely they will get stolen. The technique would place the most expensive works of art in the most inaccessible place and move on down the line, placing the least likely to get stolen in the most accessible room.

Asset discovery is the continuous process of finding all digital assets connected to an organization. It is a critical first step in several security processes, such as attack surface discovery, attack surface management (ASM), and vulnerability management.

Asset discovery is not a one-time process. Organizations need to identify all assets regularly since their IT environment constantly changes. New technologies are added, applications are deployed, systems are upgraded, and configurations are modified. Continuous asset discovery will help capture all new assets added from ongoing changes.

ATM jackpotting is the process of manipulating an automated teller machine (ATM) to dispense cash. It can be done in two ways.

First, hackers can exploit an ATM software’s vulnerabilities to control it remotely. A money mule usually waits for the physical machine to dispense cash that he or she then sends to the mastermind.

Second, attackers exploit vulnerabilities in the ATM hardware to make it dispense cash. A mule or the mastermind can collect the money then physically.

An account takeover (ATO) attack occurs when cybercriminals gain unauthorized control over online accounts using stolen usernames and passwords. Bank, e-commerce shop, and other financial accounts are the typical ATO attack targets as these could present substantial monetary gains for the attackers. ATO attacks are thus considered a form of identity theft.

You can liken an ATO attack to a physical theft where the thieves get hold of your credit cards, ATM cards, and IDs. They can use the stolen credit cards and IDs to purchase goods online or empty your bank accounts before you can report them stolen.

An attack surface analysis is a comprehensive evaluation of an organization’s IT infrastructure to identify vulnerabilities, misconfigurations, and security issues that could pave the way for cyber attacks. It is part of a much broader cybersecurity process called “attack surface management (ASM)” that aims to help organizations reduce the risk of cyber attacks by identifying, monitoring, and remediating vulnerabilities before they can get exploited. 

Attack surface discovery is the process of identifying and understanding the various points through which unauthorized users or malicious entities can potentially exploit systems, networks, or applications. An attack surface refers to all the entry points, vulnerabilities, and potential compromise avenues in systems.

Attack surface discovery can be likened to determining how thieves can break into your home. In this case, the entry points can be unlocked doors, faulty locks, open windows, and practically anything that makes your house easy to enter.

A backdoor attack uses a specific type of malware so hackers can avoid normal authentication procedures to gain access to a target system. As a result, perpetrators can go through all resources such as file servers and databases to issue commands and change system settings without being discovered.

Hackers install backdoors to take control of vulnerable network components, allowing them to carry out targeted attacks. These attacks include website defacement, data theft, server hijacking, watering hole attacks, and distributed denial-of-service (DDoS) attacks, among others. 

Imagine this scenario. A burglar scouts your house for possible entry points. A check of the front door reveals a complicated security system with cameras to boot. A similar check of the back door, however, reveals a pet door that remains unlocked at night. That pet door can let the thief enter the target home without getting caught.

Banner grabbing is the process of obtaining a target company’s application names and versions, regardless of manner—manually or automatically by using an open-source tool—in preparation for an attack.

All connected systems and devices often expose confidential information that includes software names and operating systems (OSs), along with their versions, collectively known as “banner data.” Knowing these data points allows threat actors to find exploitable vulnerabilities in target networks.

Think of banner grabbing as sending a spy to work for a competitor so he or she can report the company’s weaknesses to his or her real employer.

A birthday attack occurs when a threat actor exploits the math behind the so-called “birthday paradox” in probability theory to carry out a cryptographic attack. It can be used to abuse communication between two or more parties.

According to the birthday paradox, the probability of two people sharing a birthday is higher than it seems.

BitLocker is a Windows security feature that encrypts entire volumes or data storage areas. It can thus address threats like data theft or exposure brought on by lost, stolen, or inappropriately decommissioned devices.

Think of it as keeping a vault locked even when you dispose of it. That way, anyone who ends up with it cannot open it and look at its contents.

A black hat hacker is a cybercriminal who breaks into computer networks maliciously. Sometimes, he also releases malware to destroy files; hold computers hostage; or steal victims’ passwords, credit card numbers, and other personally identifiable information (PII).

In most cases, black hat hackers do what they do for the money. So, they can also sometimes get involved in targeted attacks if state-sponsored threat actors pay them for their services or malware creations.

Note, though, that a black hat hacker is just one of the many types of hackers out there.

Blagging is a slang term for getting someone else’s personal information without his/her consent. Here’s an example: A blagger obtains a copy of your name and picture from Facebook then uses those to create an account. The blagger can then pose as you and trick your contacts into, say, donating to a fake cause but keep the money for himself/herself. Another scenario would be getting your bank account details and withdrawing your money using that stolen information.

In cybersecurity, blagging would fall under the umbrella of social engineering. In that case, blagging would be akin to other forms of social engineering like phishing where cybercriminals get your online account credentials in ingenious ways. In effect, the blagger steals your identity and more.

A blended threat is a type of malware whose functionality combines those of various malware types, such as worms, Trojans, and backdoors, to breach and take over a target network effectively. Its infection chain is usually triggered by an event, such as a website visit. From there, a victim is redirected to a malicious site. Once on it, the victim is tricked into downloading the threat through a clever social engineering ploy. Downloading the file installs the malware on the victim’s computer, and the infection starts.

The threats were borne out of threat actors’ need to evade detection and remediation. Using a piece of malware with a single capability, therefore, may prevent them from achieving their goal.

Blowfish encryption is a symmetric block cipher (a method that allows encrypting data in blocks) that can be used in place of Data Encryption Standard (DES) or International Data Encryption Algorithm (IDEA). It takes a key that varies in length from 32–448 bits. As such, it works for both domestic and exportable use.

Think of Blowfish as the passcode to your vault. You will need the Blowfish encryption algorithm to lock and unlock it.

Bluebugging is a hacking technique that allows individuals to access a device with a discoverable Bluetooth connection. Once the target device accesses a rigged link, the attacker can take full control of it. The hacker can read and send messages, access the victim’s phonebook, and initiate or eavesdrop on phone calls.

Initially, bluebugging focused on eavesdropping or bugging a computer with Bluetooth capability. With the increasing use of smartphones, cybercriminals shifted to hacking mobile phones. This attack is often limited due to the range of Bluetooth connections, which goes up to only 10 meters. Some attackers use booster antennas to widen their attack range.

It’s not much different from bugging a landline phone, except it can be done without gaining access to the physical device.

Bluejacking is a hacking method that lets a person send unsolicited messages (typically flirtatious but can also be malicious) to any Bluetooth-enabled device within his own device’s range. Also known as “bluehacking,” the process begins by scanning one’s surroundings for discoverable Bluetooth-capable devices.

Bluejacking is much like doorbell ditching, wherein a person rings someone’s doorbell and disappears before the homeowner can answer the door.

Brand impersonation is a cybercrime tactic where attackers pretend to be legitimate companies, organizations, or well-known brands to deceive people. The goal? Typically financial gain, credential theft, malware distribution, fraud, or data collection.

Attackers exploit the trust users already have in familiar brands like those of banks, streaming platforms, delivery companies, software vendors, cloud providers, or online marketplaces.

You can compare the tactic to a ruse where a malicious actor wears a convincing delivery company uniform, drives a van with copied logos, and knocks on doors asking for payment or packages. Most people would initially trust them because the branding looks familiar.

Online attacks work the same way. Attackers recreate visual trust signals—logos, colors, domain names, email templates, and even writing style—to convince victims they are interacting with the real company. And you know what? The Internet makes this easier because users often make quick trust decisions based on appearance alone.

Brandjacking is the unauthorized use of a company’s brand identity—its name, logo, domain names, or online accounts—by a third party seeking to deceive audiences. Attackers hijack the trust a brand has already earned, typically to steal credentials, commit fraud, spread malware, divert customers, or damage the target brand’s reputation.

In comparison, imagine a stranger who steals a courier company’s uniform and van, then drives through your neighborhood collecting redelivery fees at each door. Residents hand over cash because they recognize the uniform, not the person wearing it. When the fraud surfaces, they don’t just feel cheated, they trust the real courier less, even though the company did nothing wrong.

The attack works the same way online. The attacker borrows the visual and verbal identity of a legitimate business, and every successful scam quietly transfers the cost of that deception onto the impersonated brand.

A breach-and-attack simulation (BAS) is a proactive cybersecurity technique organizations use to evaluate the effectiveness of their security infrastructure. It involves simulating various cyber attacks and breaches to assess how well their defenses can detect, prevent, and respond to threats.

BASs support attack surface management (ASM) in that they mimic the tactics, techniques, and procedures (TTPs) and attack vectors real threat actors may use against targets to identify protection and prevention strategies.

A bug bounty is an incentive organizations offer to individuals or security researchers to discover and report vulnerabilities in software, websites, or digital infrastructures. The goal? To identify and address security flaws before threat actors or hackers can exploit them.

Bug bounties serve as proactive approaches to security testing since they engage a community of skilled individuals to continuously test how secure a system is. They can be a cost-effective way for companies to identify and fix bugs and improve their overall security posture.

Camfecting refers to hacking into someone’s webcam and activating it without alerting its owner. Anything the camera can see, its operator (i.e., the hacker) can, too. It is usually done by infecting a victim’s computer with malware that lets the hacker access a connected webcam. The term is a combination of “cam,” short for “camera,” and “fecting” from “infecting.”

Capture the flag (CTF) in cybersecurity is a popular and engaging type of competition where participants, often referred to as “ethical hackers” or “cybersecurity enthusiasts,” attempt to solve various challenges to obtain flags. These flags are digital artifacts, usually strings of text or files, strategically placed within vulnerable systems or applications.

A CTF event’s challenges range from cryptography puzzles to reverse engineering tasks, web exploitation, binary exploitation, forensics, and more. Participants use their programming, network analysis, and system administration skills to uncover vulnerabilities, exploit them, and retrieve flags.

CTF events serve multiple purposes. They provide a platform for participants to hone their skills in a competitive environment, learn new techniques, and stay updated on the latest cybersecurity trends. In addition, they can help organizations identify and recruit talent by observing participants’ problem-solving abilities and technical prowess. Overall, they are a fun and effective way to develop and showcase cybersecurity skills.

CEO fraud, also known as “business email compromise (BEC)” or “executive impersonation,” is a type of cybercrime and social engineering scam where a cybercriminal impersonates a high-ranking executive of a target company, typically its chief executive officer (CEO).

CEO fraud primarily aims to deceive employees, particularly those responsible for financial transactions, into taking action that results in financial loss for the target organization.

A certificate revocation list (CRL) is a document that a Certificate Authority (CA) or another entity responsible for issuing digital certificates maintains. It provides a list of certificates that have been revoked before their expiration date. When a certificate is revoked, it is no longer considered valid often due to reasons, such as the compromise of a private key associated with a certificate, its expiration, or other security concerns.

Think of a CRL as a blacklist or a list of banned individuals in a security system. In many security systems, a blacklist contains the names or identities of individuals who are not allowed access due to various reasons like security threats, violations, or breaches. Similarly, a CRL contains the serial numbers or identities of digital certificates no longer considered valid due to a compromise, expiration, or other security concerns.

Cloud jacking is a cyber attack where threat actors gain unauthorized control over a cloud account, service, or environment. Think Google Workspace, Microsoft 365, Amazon Web Services (AWS), or Azure. Once inside, the attackers can read and exfiltrate data, spin up or delete resources, impersonate the account owners, and move deeper into connected systems. The term covers both cloud account hijacking (i.e., taking over user or admin accounts) and cloud service hijacking (i.e., abusing the infrastructure itself).

Imagine a burglar who steals the master keys to a self-storage facility. They don’t break a single lock. They walk in through the front door, open any unit, copy or remove what’s inside, rent new units in your name and, guess what? The security cameras log a “legitimate” visit.

Code injection is a cyber attack technique where threat actors insert malicious code into a legitimate application or system through an input mechanism, such as forms, uniform resource locators (URLs), or other data entry points. The code can exploit vulnerabilities in the target system to execute unauthorized actions, compromise data integrity, or gain unauthorized access.

Think of code injection as having a master key crafted to open any door.

Cognitive hacking is a cyber attack where threat actors manipulate victims’ perceptions by exploiting their psychological weaknesses. Attackers primarily use disinformation in their campaigns to fuel people’s biases and prejudices.

Cognitive security refers to the cybersecurity practice that applies artificial intelligence (AI) and machine learning (ML) techniques and technologies. Therefore, cognitive security is patterned after the human thought process in making sense of complex situations.

Cognitive security solutions are developed based on the skills of human threat, fraud, and other cybersecurity analysts. Hence, they are used in threat and fraud detection and strengthening an enterprise's cybersecurity posture.

A command-and-control server is a device or machine under the control of a cybercriminal. It’s also commonly referred to as a C&C or C2 server. An attacker uses this server to maintain communications with and remotely control malware or malicious scripts within a target network.

A command-and-control server can also receive stolen data from compromised systems, including computers, mobile phones, and even Internet of Things (IoT) devices connected to an infected network. Some cyber attackers hide command-and-control servers in file-sharing services to evade detection and blocking.

A command-and-control server can be likened to the puppeteer who controls the puppets in a show. The puppets’ actions depend on the instructions issued by the command-and-control server.

A compliance framework, also known as a “compliance and regulatory framework,” is a set of guidelines and best practices organizations follow to meet regulatory requirements, improve processes, strengthen cybersecurity, and achieve other business objectives.

Think of it as a set of company rules that everyone who wishes to stay gainfully employed must follow.

A computer security incident response team or CSIRT (pronounced “see-sirt”), for short, is responsible for exposing and averting cyber attacks that target an enterprise. It focuses on responding to security incidents, hence the name.

Continuous attack surface testing is the process of assessing all of an organization’s assets to identify and remediate potential exposures and cyber threats. It is fully automated and applies to both the internal and external attack surfaces. It is part and parcel of continuous attack surface management (CASM), which also includes risk management, vulnerability management, and remediation.

Think of it as putting your corporate network under a constant stress test to ensure it stays safeguarded against all kinds of intrusions or attacks.

Continuous security validation is the ongoing use of processes and technologies that allows organizations to constantly test the strength of their security measures. Its primary goal is to identify and address security issues before they can be exploited, which is a priority for most organizations with expanding attack surfaces.

Just as a regular health checkup helps you stay on top of your physical well-being, the process helps keep your organization’s security posture in shape through regular attack surface testing and monitoring.

Continuous threat exposure management (CTEM) is the constant process of monitoring, evaluating, and reducing your exposure to threats. It’s like having security guards continuously scanning your entire digital perimeter, looking for weaknesses and suspicious activities before attackers can exploit them.

Any organization that wants to take a proactive cybersecurity stance, especially those with sensitive data or critical infrastructures, can benefit from CTEM. Implementing this cybersecurity approach helps you prioritize security efforts, focusing resources on the most critical vulnerabilities and imminent threats.

Credential dumping is a cyber attack where a threat actor hacks into devices and steals their owners’ credentials from the random access memory (RAM). Also known as “password dumping,” the attacker steals and copies the data to a predetermined storage (typically a server). Once that’s done, the credentials are said to have been “dumped.”

You should know that each time someone logs in to an account on your device, his/her username-password combination gets stored in its RAM. An attacker can read that information since it is saved in plaintext. 

Credential dumping is a crucial step in phishing and other cyber attacks.

Credentialed scanning is a cybersecurity technique where network administrators give a security tool authorized login credentials to assess systems from the inside. As a result, instead of guessing what may be exposed externally, the scanner authenticates like a real user and inspects configurations, installed software, missing patches, and insecure settings with much greater accuracy.

In the real world, the technique is comparable to a building inspector with a master key. Rather than walking around the perimeter looking for open windows, the inspector enters each room, checks wiring, fire exits, and locks, and identifies issues that would otherwise stay hidden. This inside access reduces blind spots, false positives, and missed vulnerabilities.

The Creeper virus is the first computer virus ever developed. Bob Thomas created it in 1971 as an experimental self-duplication program. His idea, however, was not to cause harm and damage but merely illustrate how a mobile application works.

Without planning to, the Creeper virus corrupted Digital Equipment Corporation’s PDP-10 mainframe computers operating on the TEN-Extended (TENEX) operating system (OS). It messed up connected teletype computer screens, causing them to display the message, “I’m the creeper, catch me if you can!”

While the Creeper virus did corrupt systems, it is not considered a piece of malware like most of today’s computer viruses. The only damage it did was to display a message, nothing more. It did not destroy or steal data, demand a ransom, or render the actual mainframe inoperable.

Cryptanalysis is a means to decrypt ciphertext, ciphers, and cryptosystems. It works by understanding how they work to find ways to crack them despite the lack of plaintext source, encryption key, or algorithm used to mask information.

Ciphertext refers to encrypted text transformed from plaintext using an encryption algorithm. You can’t read ciphertext until you convert it into plaintext or decrypt it with a key. A cipher, meanwhile, is an algorithm used to encrypt or decrypt data. It is a series of well-defined steps to follow to encrypt or decrypt plaintext. Finally, a cryptosystem is a suite of cryptographic algorithms used to secure or encrypt information. It typically uses three algorithms—one for key generation, another for encryption, and one more for decryption.

Cryptanalysis can, therefore, be likened to cracking a safe without the passcode and accompanying key, if any.

Crypting, also known as “encryption,” is the process of converting data into a code or cipher to make it unreadable for unauthorized parties. Its primary purpose is to ensure data confidentiality and protect sensitive information from getting accessed or understood by individuals who don’t have the necessary authorization or decryption key.

You can compare it to using a self-made alphabet to write diary entries so only you can read them. That way, even if your parents get hold of your journal and manage to open it, they won’t be able to understand anything you wrote.

A crypto malware is a type of malware that allows threat actors to use someone else’s computer or server to mine for cryptocurrencies. It has become one of the most prominent malware types since 2017. Why?

Crypto malware’s rise in popularity probably has a lot to do with the fact that cryptomining is a resource-intensive process that jacks up a user’s electricity bill for one and uses up his or her computer’s processing power, disallowing other tasks to be performed at the same time. 

CWE, which stands for “Common Weakness Enumeration,” is a community-developed list of common software vulnerabilities. It has become a standard means to describe and categorize weaknesses that could lead to vulnerabilities. These vulnerabilities can include system misconfigurations and code errors that have not been exploited yet.

In simpler terms, CWE is a list of weaknesses that threat actors can take advantage of but have not yet done so.

CWE-79 is a Common Weakness Enumeration (CWE) ID that pertains to a vulnerability that exists in a product that does not neutralize or incorrectly neutralizes user-controllable inputs before they are placed in outputs used as web pages served to other users.

It is officially known as “Improper Neutralization of Input during Web Page Generation” or “Cross-Site Scripting (XSS).”

It is comparable to a bad actor providing a trusted employee with another employee’s ID (i.e., someone with greater access privileges), allowing the impersonator to gain unauthorized access to the assets and data only the one being impersonated has access to.

A cyber asset refers to any device, solution, or service that makes up an organization’s attack surface. It can thus be a computer, a tablet, a smartphone, a cloud service, a software, an app, or data accessible via a network or the Internet.

Think of it as anything you own, also known as your “assets.” You would never want anyone with malicious intent to get their hands on any of them. That’s also true for cyber assets. If malicious actors get to them, your organization suffers.

Cyber reconnaissance or cyber intelligence gathering involves collecting information about a system. Threat actors usually perform it as the initial phase in cyber attacks. They gather as many details about a target system as possible and analyze them to see which can help them plan and launch cyber attacks.

However, security teams also strategically use cyber reconnaissance in their cybersecurity efforts. They aim to look at their systems the way attackers do so they can immediately see and fix any weaknesses.

Cyber risk quantification (CRQ) is the process of measuring cybersecurity risks in numerical or financial terms. Rather than describing threats qualitatively like high risk or critical vulnerabilities, CRQ estimates the probability of related incidents occurring and their expected financial impact.

In practical terms, it answers questions like:

• How much can a ransomware attack cost a company?
• What is the financial impact of exposed cloud assets?
• How much risk reduction will a new security control provide?

By translating cybersecurity exposure into business metrics like dollars, probability, and loss scenarios, CRQ lets organizations treat cybersecurity as a measurable business risk.

So, instead of saying, “Our exposed cloud storage bucket poses a high security risk.” CRQ reframes it as “There is a 12% probability of data exposure next year, with an estimated loss of US$2.5 million.”

This level of clarity makes cybersecurity decisions easier to make for executives and evaluate for board members.

A cybersecurity maturity assessment evaluates how well an organization’s security processes, tools, and capabilities are developed and how effectively they protect against real-world threats. That said, it is not just a score but instead a road map for improvement.

In many cases, the most effective approaches connect maturity with external attack surface management (EASM), helping organizations prioritize real, observable risks instead of theoretical gaps.

Table of Contents

• Traditional vs. Connected Maturity Assessment
• Connection with External Attack Surface Management
• Benefits of Connecting the Assessment with EASM
• Common Cybersecurity Maturity Levels
• The Cybersecurity Maturity Journey: Beyond a One-Time Assessment
• Common Misconceptions about Cybersecurity Maturity
• Key Components of a Cybersecurity Maturity Assessment
• The Cybersecurity Maturity Assessment Process
• The Technical Side of the Assessment
• Frameworks and Tools for Cybersecurity Maturity Assessment
• Cybersecurity Maturity Assessment vs. Cybersecurity Risk Assessment
• Benefits and Challenges
• Best Practices to Improve Cybersecurity Maturity

A cybersecurity mesh is a security architecture that treats every device and user as an independent security perimeter. Each one is responsible for its own security. It is designed to protect organizations from cyber attacks that exploit vulnerabilities in a single security point.

This distributed approach to security makes it more difficult for attackers to exploit vulnerabilities. Even if attackers compromise one device or user, they will not be able to access the rest of the network because each device and user will have independent security controls in place.

Cybersecurity performance management is the ongoing process of evaluating how mature and effective an organization’s cybersecurity program is. It measures risks, security metrics, and the investments (e.g., people, processes, and technologies) needed to meet business goals and compliance requirements.

Today, it uses data-driven, risk-based metrics like security ratings to continuously monitor posture and inform decision-making rather than relying on periodic audits or static reports.

In the real world, it can be likened to treating your security program like your business’s financial performance. Instead of taking occasional snapshots, you use continuous key performance indicators (KPIs) like revenue, expenses, or profit trends to understand your business’s health, guide strategy, and benchmark against your competitors.

A cybersecurity risk assessment is a process that identifies, evaluates, and prioritizes potential threats and vulnerabilities to an organization’s information systems to mitigate risks and enhance security measures.

Think of it as a process that identifies persons of interest possibly involved in a crime. First, investigators enumerate everyone at the crime scene when the act was committed. They then look at who among the people they identified have criminal records. Those with records are then scheduled for interrogation. The entire process singles out suspects.

Cybersquatting is the act of registering or using a domain name to profit at the expense of someone else’s trademarked or copyrighted “brand” or “name.” It typically occurs when a malicious individual misspells a domain name to steal traffic intended for its legitimate counterpart. An example would be running a site named mike[.]com that mimics nike[.]com.

Cybersquatting also happens when a malicious individual grabs an expired domain name when its owner fails to re-register it. He can then sell it back to its original owner for a hefty sum.

Also known as “domain squatting,” cybersquatting is a cybercrime.

A dangling Domain Name System (DNS) record is essentially an outdated or “orphan” DNS record pointing to a nonexistent website or service. It’s like an old phone book listing for a company that moved, thus providing the wrong information.

DNS records are entries in an extensive Internet directory, linking a website’s domain name (e.g., techslang.com) to a computer-readable IP address (e.g., 123.456.78).

Dangling DNS records emerge when websites or web services shut down or change, but their DNS records aren’t updated. This occurrence can be dangerous because attackers can take advantage of outdated records to send visitors to fake websites that steal information or install malware, potentially enabling them to launch more nefarious cyber attacks. As such, a dangling DNS record contributes to an organization’s attack surface.

Dark Web intelligence simply refers to data collated from the Dark Web and the Deep Web. It is used to fight fraud proactively and substantially reduce losses. Apart from the Dark Web and the Deep Web, this intelligence can also come from malware networks, botnets, and other technical infrastructure cybercriminals use.

Since the Dark Web allows users to remain anonymous and, therefore, unidentifiable and untraceable, it has become a haven for cybercriminals. You should know, though, that the Dark Web wasn’t initially meant for sinister purposes.

DAST, short for “dynamic application security testing,” is the process of analyzing the frontend of a web application using attack simulations to uncover vulnerabilities. In it, security testers evaluate the application from the outside by attacking it like threat actors would.

Security testers typically use a DAST scanner for testing. The scanner looks for results that are not part of the expected result set to identify vulnerabilities.

So, what is DAST comparable to? You can compare the scanner to security guards who ensure all the doors and windows in the building are locked so no intruders can enter. They also stand guard at night or when none of the tenants are in.

Data interception, also known as “data eavesdropping” or “data monitoring,” is the unauthorized or surreptitious interception of data as it is transmitted over a network or communication channel. This practice involves capturing and sometimes altering the data sent between two parties without their knowledge or consent.

Data interception can occur in various contexts, including computer networks, telephone systems, and wireless communications.

Data obfuscation is a security measure that aims to mask any kind of information or file. It involves scrambling information to ensure anonymity. It is often a strategy organizations employ as a security measure, as it renders data useless in case of a breach. That way, no severe compromise can occur.

So, what is data obfuscation in simple terms? It can be likened to someone wearing a mask in public to remain unrecognizable. Obfuscation ensures that the data remains intact and that malicious individuals cannot read it.

Deception technology is a cybersecurity strategy that deploys decoys and traps to mislead attackers and detect network intrusions. It is designed to deceive threat actors by creating an environment that appears authentic but is, in fact, a controlled and monitored setup.

You can compare deception technology to a net over a hole in the ground hidden under a pile of leaves designed to fool intruders who may wish to infiltrate a facility meant only for authorized personnel.

Defensive security is a cybersecurity approach that focuses on preventing, detecting, and responding to attacks to defend an organization. In many cases, it involves the formation of so-called “blue teams.”

The approach is often contrasted with offensive security that typically involves penetration testers and so-called “red teams.”

A denylist, also known as a “blocklist” or “blacklist,” is a list of items, entities, or actions explicitly prohibited or denied on a network. In cybersecurity, technology, and information management, it specifies items considered harmful, malicious, or unwanted. These items may include IP addresses, domain names, email addresses, links, keywords, or software associated with security threats, spamming, or other undesirable activities.

Think of a denylist as a list of persona non grata in a country that airport officials use to deny entry to the people on it.

Deperimeterization is an information security strategy that strengthens an organization’s security posture by implementing multiple levels of protection, including inherently secure computer systems and protocols, high-level encryption, and authentication. It is called such since it implies that the enterprise no longer relies on its network perimeter for security.

Deperimeterization refers to perimeterless or borderless security, as the boundaries of an organization’s information systems (ISs) are removed, thereby connecting them directly to the outside world. It’s similar to taking down the walls of a fortified city and deploying armed soldiers everywhere instead.

Deprovisioning is the process of revoking access rights and removing privileges granted to a user, an employee, or a system upon termination, resignation, or any other event that necessitates discontinuing their access to resources within an organization’s network or system. It involves systematically deactivating accounts, removing user profiles, and ensuring any digital asset or sensitive information associated with the individual or system is appropriately handled or transferred.

Deprovisioning is comparable to getting locked out of your apartment after your lease expires or if your landlord decides to terminate your contract due to a violation or if he decides to sell the property.

A digital footprint refers to the data Internet users leave behind as they navigate the Web. It’s a collection of information about a person’s online activities that can be gathered from several sources, including social media platforms, online forums, and browsing histories.

Remember the trail of breadcrumbs Hansel and Gretel left so they can get back home? Digital footprints work the same way. They can be traced back to specific people or organizations and can significantly impact their employment, education, reputation, security, and other aspects of their lives or operations.

A disaster recovery team is the group in an organization tasked to develop, document, and execute processes and procedures for data recovery, business continuity, and IT infrastructure repairs in case of an attack or a failure.

Think of it as a race car’s pit crew that ensures it will run efficiently throughout a race.

DNS blocking refers to a technique that restricts access to certain websites and online content. One of its primary uses is to help organizations prevent employees from accessing nonwork-related websites.

The technique is also used in school and at home to control what websites children can visit. Also called “DNS filtering” and “Internet content filtering,” DNS blocking helps improve productivity, enhance cybersecurity, and protect user privacy.  

A Domain Name System (DNS) sinkhole is simply a DNS server that gives users false domain names. It is also known as a “sinkhole server,” an “Internet sinkhole,” or a “blackhole DNS.”

The DNS was set up to point users to the correct IP address every time they type a specific domain name into their browsers in hopes of visiting a particular website. When a sinkhole appears after an earthquake, for instance, all of the structures on the ground in it sink. In the same vein, a DNS sinkhole disrupts the intended flow of Internet traffic from a domain name to its correct IP address. As a result, anyone who accesses one gets sent to a different IP address.

Domain Name Server (DNS) spoofing is a cyber attack where threat actors manipulate DNS records to redirect users to fraudulent or malicious websites that may resemble users’ intended destinations.

When users land on the fake sites, they are tricked into logging in to what seems to be their genuine accounts. This lets attackers steal their access credentials or other sensitive information. The malicious websites can install malware on users’ computers in the background, giving threat actors prolonged access to the victims’ devices and data.

Document sanitization is the process of removing metadata from a document to avoid sensitive information falling into unauthorized people’s hands. Document metadata refers to invisible information in a document, such as its creation date, author’s name, revision history, and the comments exchanged by the author and editor.

Even when some of the said data is deleted, there’s still a chance it has been digitally stored within the document. And since metadata can contain sensitive information, removing it is crucial before distributing the document to other people.

For example, a contract drawn by a law office may have undergone several editing and revision phases. The author, editor, and everyone involved may have left and addressed comments in the document before the contract was finalized. Before sending the contract to the necessary parties, it has to go through document sanitization first so that only the intended information is sent.

Domain hijacking is a malicious act where someone illegally takes control of a domain name by changing its registration details without the rightful owner’s consent. This can happen by exploiting vulnerabilities within domain hosting and registration services or taking advantage of the domain owner’s negligence. 

Since domains are critical assets, the legitimate owner of a hijacked domain could face severe losses. They would lose control over the domain, but this is only the start. The attack could further lead to service disruption if the domain is used to host critical services like online stores, customer portals, and email services.

A drive-by attack is a cyber attack where attackers gain access to a computer, device, or network by exploiting vulnerabilities in software, typically through a user’s web browser.

The term “drive-by” comes from the idea that attacks occur when users visit malicious websites, often without their knowledge or consent, and malware is automatically delivered to their systems.

A dumpster diving attack is a type of cyber attack made possible by searching through the victim’s trash.

While you might be imagining a messy and filthy scenario where a person dives into a dumpster, the reality is less unsanitary. In a dumpster diving attack, threat actors could be in and out of the dumpster in a matter of minutes. But they may already have their hands on a box full of confidential documents, storage devices, and workstations.

An eavesdropping attack occurs when cybercriminals steal information sent or received by a user over an unsecured network. It is also known as a “sniffing attack” and can come in different forms.

The use of the two terms “eavesdropping” and “sniffing” makes the attack seemingly mild but attackers actually do more than eavesdrop or sniff. Victims of an eavesdropping attack could suffer severe losses, as eavesdroppers could obtain sensitive information that they can sell for malicious purposes. 

Edge security refers to the technologies and practices organizations use to secure data, applications, and users at the “edge” of a network where devices connect, data is generated, and interactions happen.

Think of modern infrastructure that employs the approach as a city with many entry points. People (users or devices) enter and leave from multiple locations. Data also moves constantly between locations. You need security at each checkpoint, not just at the center as in traditional security.

The approach places those checkpoints closer to where activity happens, rather than relying only on a central point of control.

Embedded systems security is a strategy that provides embedded systems protection from cyber attacks. Embedded systems, also known as “embedded computers,” are small devices with a dedicated function within a more extensive system.

Internet of Things (IoT) devices are examples of embedded systems. For instance, smart household appliances, such as your refrigerator, thermostat, and security alarm perform different functions. However, they are part of the whole household system and interconnected to each other through the Internet.

Embedded systems security aims to protect the software running on these devices since malicious actors are increasingly targeting them.

Endpoint management is an IT security process comprising two primary tasks—evaluating, assigning, and overseeing access rights to all endpoints and applying security policies and tools to reduce or prevent attacks.

Given its coverage, several cross-functional teams comprising network administrators and information security (infosec) professionals handle the process. Typically, organizations that employ the process use specialized software that can remotely access all network-connected devices.

The European Vulnerability Database (EUVD) is a repository of cybersecurity vulnerability information. It was launched in May 2025 by the European Union (EU) Agency for Cybersecurity (ENISA), which is also responsible for maintaining the database.

The EUVD is similar to the U.S. National Vulnerability Database (NVD). It works alongside MITRE’s Common Vulnerabilities and Exposures (CVE) program, Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog, and other cybersecurity data sources.

An evil maid attack targets an unattended device. The attackers with physical access to the device make undetectable changes to it so they can access it or the data stored on it later on.

The attack got its somewhat derogatory name from the scenario where a hotel maid could access an unattended device while cleaning a room. Note, though, that the concept can also occur in situations where a device is temporarily taken away from its owner, such as by airport personnel or law enforcement agents.

An evil twin attack uses a fake Wi-Fi access point that seems legitimate but is actually meant to eavesdrop on wireless communications. It is a phishing scam targeting wireless local area networks (WLANs). It lets attackers steal the passwords of unsuspecting WLAN users by monitoring their connections or through phishing. The latter requires threat actors to set up fraudulent websites to lure people to.

Physically, an evil twin attack can be compared to the following scenario: The attackers set up a booth in a conference. They ask attendees to leave their business cards in a fishbowl in exchange for freebies. Little do the people who unknowingly give out their personal details know that they are being targeted for scams.

Executive phishing, also known as “chief executive officer (CEO) fraud” or “whaling,” is a type of cyber attack that explicitly targets high-level executives or individuals in prominent positions within an organization. It’s a more sophisticated and targeted form of phishing that aims to trick senior executives into disclosing sensitive information or performing specific actions that can harm the target company.

Executive phishing’s goal? To exploit the authority and trust associated with high-ranking executives to manipulate employees or gain unauthorized access to sensitive data or systems.

The Exploit Prediction Scoring System (EPSS) is a method used to predict how likely a malicious actor will abuse a system vulnerability. Imagine a long list of security weaknesses if you will. EPSS aids in vulnerability management by helping security teams decide which weaknesses are most likely to cause trouble.

To do that, the EPSS model is powered by machine learning (ML) algorithms that analyze several types of information, including real-world vulnerability exploitation data. EPSS is commonly used alongside the Common Vulnerability Scoring System (CVSS) to rank system vulnerabilities. While EPSS computes the likelihood of a vulnerability exploitation, CVSS looks at its potential impact.

Exposure management refers to the process of identifying, assessing, and mitigating risks that an organization or individual may face in various operational aspects. It is a risk management strategy that involves analyzing potential exposures to risks, such as financial, operational, strategic, security, or reputational risks, and implementing measures to minimize their impact.

In the context of cybersecurity, exposure management is a preventive measure to reduce an organization’s attack surface.

Think of exposure management as a means to anticipate all sorts of dangers your family can get exposed to if you don’t lock your doors and windows at night or when you’re away.

In information technology (IT), an external asset can refer to resources, services, or data hosted or located outside an organization’s internal network that threat actors can exploit.

External assets can include cloud-based services, external servers, or third-party applications an organization uses.

You can liken an external asset to a book borrowed from a library. You can use it as a reference for your research even if you do not own it. In this case, the book is an external asset as opposed to the books in your library, aka your internal assets.

External attack surface management (EASM) refers to the process of continuously discovering, monitoring, and analyzing the status of an organization’s Internet-exposed or external assets. These assets include domains, subdomains, IP addresses, cloud resources, web applications, and other systems visible from outside the corporate network.
EASM platforms help security teams identify unknown assets or shadow IT, detect misconfigurations, and reduce the number of entry points attackers can exploit or attack vectors. Instead of waiting for alerts from vulnerability scanners or threat feeds, the process focuses on understanding an organization’s full external footprint and managing the risks associated with it.

External penetration testing is a security strategy that assesses an organization’s external-facing assets. These assets include web applications, virtual private network (VPN) solutions, routers, firewalls, and smartphones.

In an external penetration test, assessors attempt to breach an internal network by exploiting vulnerabilities on external-facing assets. Testers can also try to access confidential data using external-facing assets like emails, websites, and file shares.

The pen-testers first need to conduct reconnaissance on the organization’s assets. They must gather intelligence, including open ports, vulnerabilities, and general information about its password creation policies. Once they successfully breach the network’s perimeter, the external penetration test is done.

Federated identity in information technology (IT) refers to the identity management model that links a person’s account details across multiple websites. Federated identity management (FIM) is the reason why you can log in to websites like Canva, Pinterest, and eBay with either your Google, Facebook, or Apple account.

Despite having their identity management systems, these websites are linked through standard policies and protocols. Canva, for instance, is federated with Google, Facebook, and Apple so that the users of the three sites can log in to its platform without having to go through a different login process.

File hashing is the process of calculating a fixed-size bit string value called a “hash” from a file using a mathematical algorithm. It transforms data into a far shorter hash or key representing the original string. As such, the hash value can be considered a distilled summary of everything within that file.

Fileless malware refer to a type of malicious software that uses trusted applications to carry out attacks instead of storing malicious files in a target system’s hard drive.

Traditionally, a piece of malware is delivered as a digital file, which must be downloaded, stored on a computer hard drive, and then executed. Fileless malware, however, run directly within a system’s memory and does not need a digital file or an installation process.

The term “FileRepMalware” does not refer to a specific type of malware but rather a detection name used by some antivirus software to indicate that a file has a low reputation or is potentially malicious. When an antivirus encounters a file it has never encountered, it may use various methods to determine its reputation and potential threat level.

One common method is by using a cloud-based reputation system. The antivirus sends the file information to a central server for analysis. If the file is associated with a known malware, it will be flagged as malicious. But if it is relatively new or has only been distributed in a limited fashion, it may not have a known reputation. As such, the antivirus may flag it as a FileRepMalware or use a similar generic name.

In essence, the term “FileRepMalware” implies that a file in question lacks a well-established reputation and could potentially be harmful. It is a must to exercise caution when encountering such a file. Consider scanning it with an updated antivirus or consult an IT professional before opening or executing it.

Firewall-as-a-service, often abbreviated as “FWaaS,” is a firewall solution delivered via the cloud. It not only allows organizations to simplify their IT infrastructure but also provides next-generation firewall (NGFW) capabilities. As such, it lets users filter web traffic, enable advanced threat protection, prevent intrusions, and implement Domain Name System (DNS) security.

In many ways, FWaaS is no different from hardware firewalls that companies have on their premises. The only difference is that a third-party vendor operates and manages it.

Fleeceware refers to mobile apps typically found on platforms like the Google Play Store or the Apple App Store that exploit the trial period or subscription model to overcharge users for basic functionality. These apps often offer a seemingly free trial but automatically enroll users into an expensive subscription once the trial period ends, sometimes with exorbitant fees.

Think of fleeceware as supposed discounts on products when the sellers hiked up the original prices before applying the fake discount. Users who buy the products thus end up paying the actual product prices.

A Geek Squad email scam is a form of phishing where threat actors impersonate Best Buy’s Geek Squad service to trick individuals into revealing their personal information and financial details or downloading malicious software onto their computers.

The Geek Squad is a legitimate tech support and repair service offered by Best Buy, a famous electronics retailer. Scammers thus bank on the Geek Squad’s popularity to lure in victims.

There are several ways attackers roll out a Geek Squad email scam. They may send a bogus automatic renewal email to Geek Squad subscribers or offer free tech support services, among other tactics.

Grayware is a type of software that's not necessarily malicious but definitely unwanted. While they are not necessarily harmful like malware, they can slow down your computer, track your online behavior, or bombard you with annoying ads.

They usually sneak into your computer when you download a legitimate program or use pirated or cracked software. They can also get into computers the same way malware do, through malicious links and infected files.

A governance, risk, and compliance (GRC) framework is a structured approach that organizations use to align their business objectives with appropriate risk management and compliance activities. It helps companies manage their operations more effectively, make informed decisions, and comply with relevant laws and regulations.

Think of a this framework as a company’s mission and vision statements that typically state its primary goal with which it aligns all of its specific business and operational objectives.

A green hat hacker is a newbie in the hacking world. They may not be as familiar with all the security mechanisms companies or more seasoned hackers are using. Unlike the other hackers, green hat hackers are not yet as well-versed with the inner workings of the web.

However, what green hat hackers lack in experience, they make up for in eagerness to learn and determination to go up the ranks of the hacker community.

Green hat hackers are not necessarily threat actors. In fact, they may not intentionally want to cause harm to others but may do so while practicing their craft.

Homomorphic encryption is a cryptographic technique that lets you perform computations on encrypted data without decrypting it first. In other words, it enables computations on sensitive information while it remains encrypted. It is vital for privacy and security when data needs to be processed or analyzed, but its raw form is sensitive and should not be exposed.

Did you know that the term “homomorphic” comes from the Greek words “homo,” meaning “same,” and “morphe,” meaning “form”? In the context of encryption, homomorphism is a property where you can perform certain functions on encrypted data, and when the result is decrypted, it is the same as if the operations were done to its unencrypted form.

Image steganography is a technique used to hide secret information within an image without visibly altering its appearance. The word “steganography” is a combination of two Greek words. They are “steganos,” which means “covered” or “concealed,” and “graphein” that translates to “writing.” In essence, therefore, steganography involves embedding data, such as text, another image, or any file type, into an image in a way that the human eye can’t easily detect.

If you’re a “Prisonbreak” fan, you’d have seen image steganography in action. One of the main characters, Micheal Scofield, used the technique to hide the Fox River Prison blueprints in plain sight as tattoos.

Incident reporting in the context of cybersecurity refers to the practice of reporting an incident (e.g., a cyber attack, data breach, data leak, or any situation that exposed sensitive information) to the affected parties (e.g., stakeholders, law enforcement agencies, affected customers, business partners, and government officials).

Like a physical incident report that documents a workplace accident, work-related injury, or situation that resulted in an accident, a cyber incident report contains details, including when and how the issue happened, who or what was affected, and its scope.

An incident response playbook standardizes responses to specific incident types with procedures that include particular actions organizations must take to prepare for, respond to, and recover from different incident types.

Incident response playbooks are just like sports playbooks. While incident response playbooks contain specific guidelines for particular incidents, sports playbooks have detailed plays for handling different team actions.

Indicators of attack are real-time signals or behavioral patterns that suggest a cyber attack is in progress. Security teams rely on them to identify malicious activities before attackers can cause serious damage.

Indicators of attack, also referred to as IoA, cover a broad range of suspicious activities, from unusual network traffic and unauthorized access attempts to abnormal process execution and data exfiltration patterns. 

These signals capture what an attacker is doing rather than what tools they are using. As such, they remain relevant even when attackers change their tools and methods.

Indicators of compromise (IoCs) refer to forensic data like that found in system or file logs that indicate potentially malicious activity on a system or network. They help information security and IT professionals detect data breaches, malware infections, or the presence of threats.

Monitoring for IoCs lets organizations detect attacks and act quickly to prevent breaches or limit the damage by thwarting attacks as soon as possible.

Information risk management is the practice organizations use to identify, assess, reduce, and monitor risks to their information assets across their entire lifecycle. 

It combines policies, procedures, and technology to protect information assets from security-related threats (such as supply chain attacks, data breaches, ransomware, denial-of-service (DoS) attacks, and unauthorized access) and nonsecurity-related events (such as system glitches, shifts in privacy laws, and human error).

Put simply, information risk management is how a company decides what information assets it has, what could go wrong with them, and what to do about those risks before something actually goes wrong.

An information security control or cybersecurity control is any safeguard used to prevent, identify, and respond to security risks that can compromise an organization’s data and systems. These controls include software solutions, hardware devices, and security policies and procedures.

They are designed to help maintain the confidentiality, integrity, and availability of an organization’s information assets. As such, asset discovery, which is part of attack surface management, is crucial to them.

Each organization uses different types or combinations of controls, depending on their unique requirements. However, all organizations need preventive, detective, and corrective controls for a robust security posture.

Input validation attack is a form of cyber attack where threat actors type a malicious input into a system. The input can be a piece of code, a script, or a command, which the target system then executes. As a result, threat actors can damage the system and access, copy, and manipulate sensitive information.

The cyber attack takes advantage of a vulnerability in applications and systems where user input is not thoroughly filtered and validated. Such a vulnerability creates an opportunity for malicious actors to exploit the system. An input validation attack falls under the injection vulnerability umbrella, one of the top 10 web application security risks named by the Open Web Application Security Project (OWASP) Foundation.

Insider risk management refers to the process of implementing strategies, policies, and procedures designed to identify, assess, mitigate, and monitor the potential risks insiders pose. Insiders, including employees, contractors, vendors, or partners, have privileged access to or knowledge of an organization’s systems, data, or operations.

Insider risk management gained increasing attention due to the growing recognition that insider threats can pose significant risks to organizations, often with severe consequences, such as data breaches, intellectual property theft, fraud, sabotage, or insider trading. These threats can arise from insiders’ malicious intent, negligence, or careless actions.

Integrated risk management (IRM) refers to practices and processes done via a risk-aware culture and enabling technology. It improves business decision-making and performance by giving users the whole picture of how well their organization manages risks.

Think of it as a way to monitor and manage risks (e.g., security threats, compliance requirements, etc.) using a single platform. You only need to look at one monitor, for instance, and already see if problems can potentially spring up from identified issues.

An internal vulnerability scan is an automated security assessment that runs from inside an organization’s network to find weaknesses attackers could exploit like unpatched software, misconfigured systems, weak credentials, and unnecessary open ports. It shows what someone who already has access, like an employee or an intruder, could reach and abuse.

Think of it as a home inspector walking through your house rather than just checking the front door. The inspector tests every room for faulty wiring, loose floorboards, and windows that don’t lock, which are problems invisible from the street but dangerous once someone gets inside. An internal scan does exactly that for your network.

IP address blocking is a network security measure that restricts access to and from specific IP addresses. Websites use it to restrict the access of specific individuals, depending on factors like their geography and the reliability of their IP address.

Think of it as a way for security guards to limit who can enter a building based on factors like authority and trustworthiness.

An IP booter, also known as a “booter service,” is an on-demand distributed denial-of-service (DDoS) attack service that enterprising cybercriminals offer to bring down websites and networks. As such, it also came to be known as a “DDoS booter.” It obscures the identity of the attacking server by using proxy servers that reroute the attackers’ connection while masking their IP address.

It is a cybercrime tool often confused with an IP stresser.

An IP grabber is a link that, when clicked, records and stores the clickers’ IP addresses. As a result, the user who grabs the IP addresses can use another tool to track them on the Web, noting how it interacts with various web pages.

IP grabbing can be likened to phone tracking but it can also allow the user to recall the third-party cookies belonging to the one being spied on. Note, though, that unlike phone tracking that can reveal call and message content along with the user’s location, IP grabbers do not record anything more than IP addresses. The danger can come from the fact that anyone else who knows your IP address can find out much more about you.

ISO 27002 is a globally recognized standard that guides the selection of information security controls for information security management systems (ISMSs). It was jointly published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) back in 2013.

Since then, the standard has undergone several updates, with the latest version (ISO 27002:2022) published in February 2022. It’s important to note that organizations cannot get certified for ISO 27002, as it is only a guideline that can help achieve ISO 27001 certification.

IT risk assessment is a process that identifies, evaluates, and prioritizes IT risks within an organization. Its primary goal? To understand the potential threats to IT systems, assess their likelihood and impact, and develop mitigation strategies.

The Known Exploited Vulnerabilities (KEV) Catalog is the authoritative source of vulnerabilities that have already been exploited in the wild. Maintained by the Cybersecurity and Infrastructure Security Agency (CISA), it aims to benefit the cybersecurity community and network defenders by helping every organization better manage vulnerabilities and stay abreast of threat activity.

A key fob originally referred to tiny security hardware with built-in authentication to control and secure access to mobile devices, computer systems, network services, and data. It randomly generates an access code that changes periodically, typically every 30–60 seconds. To use a key fob-locked device, users need to authenticate themselves on the fob with a personal identification number (PIN), followed by the current code displayed on it.

These days, though, even car keys come in the form of key fobs to open doors and even ignite their engines. Before the first key fobs for American Motors cars emerged in 1983, these were only used on personal computers (PCs).

A key management system is a solution that manages the cryptographic keys in a cryptosystem. Think of it as the cabinet where a hotel stores all the room keys. It’s where the receptionist obtains the key to your room so he or she can hand it over to you once you’ve completed the check-in process.

Unlike the hotel’s key cabinet, however, which you can see physically, the key management system we’ll talk about in this post exists virtually—inside your computer.

Quantile normalization, in the field of statistics, is a technique that makes two distributions identical in statistical properties. The two distributions in this instance, which we’ll discuss later, are the test and reference distributions. To make them identical in terms of statistical properties, the highest entry in the test and reference distributions should be aligned, followed by the next highest, and so on.

While it sounds complex, you can think of it as two lines of five students arranged by height (i.e., shortest to tallest). The first line could have Ross, Chandler, Joey, Gunther, and Frank, and the second could have Phoebe, Monica, Rachel, Ursula, and Janice. To quantile-normalize the lines, Ross and Phoebe (the shortest male and female, making them identical in the statistical property height) will be the first test and reference subjects, respectively, followed by Chandler and Monica, and so on.

Koobface is the name of a piece of malware and the cybercriminal gang behind it that gained infamy in the late 2000s.

As a malware variant, Koobface emerged in 2008. It spread via social media platforms, notably Facebook, hence its name—a palindrome of the social networking site’s name.

The Koobface gang, meanwhile, is believed to have five Russian members. They called themselves “Ali Baba & 4.” They were Anton Korotchenko, also known as “KrotReal”; Stanislav Avdeyko, AKA “leDed”; Svyatoslav E. Polichuck, AKA “PsViat” and “PsycoMan”; Roman P. Koturbach, AKA “PoMuc”; and Alexander Koltysehv, AKA “Floppy.”

An LDAP injection is an attack that exploits vulnerable Web-based applications that construct LDAP statements based on user input. If a program fails to sanitize user input, attackers can modify LDAP statements using a local proxy. That could let them execute arbitrary commands, such as granting permissions to unauthorized queries and content modification inside the LDAP tree.

An LDAP injection attack often uses the same exploitation techniques employed in SQL injection attacks.

Local File Inclusion (LFI) is a web application vulnerability where attackers manipulate inputs, typically Uniform Resource Locator (URL) parameters, to include unintended files from the server.

Simply put, LFI occurs when a web application dynamically loads files based on user inputs without proper validation. This allows attackers to access local files on the server.

Table of Contents

• How LFI Works
• Programming Languages Affected by LFI
• How to Test for LFI
• LFI Testing Tools
• Notable LFI Vulnerabilities: CVE Examples
• Real-World LFI Attack Examples
• Risks and Impact of LFI Attacks
• LFI versus Remote File Inclusion
• LFI versus Directory Traversal
• Common Misconceptions about LFI and Their Practical Implications
• LFI Prevention and Mitigation

A logic bomb is a piece of malicious code purposely inserted into software that executes when a specific set of conditions are met. An example would be one that starts deleting files from say a salary database should the company fire its creator.

Many malware variants contain logic bombs that execute specific payloads at predefined times or when certain conditions are met. The tactic allows the malware to spread before they get noticed. Some can attack the systems they’re dropped on a specific date like April Fools’ Day and so are often called “time bombs.”

A malicious payload is an attack component responsible for executing an activity to harm the target. Some common examples of malicious payloads are worms, ransomware, and other malware that arrive on computers by clicking bad links or downloading harmful attachments.

Malicious payloads can cause data deletion, encryption, and exfiltration. In some cases, threat actors encrypt payloads to keep their malicious code hidden from antimalware solutions.

Think of malicious payloads as soldiers in camouflage. They only attack when given a signal. Malicious payloads also remain inactive until activated.

Malware-as-a-service (MaaS) is a business model wherein cybercriminals give fellow threat actors access to malicious software and related infrastructure for a fee.

In a sense, MaaS is a malicious variant of the software-as-a-service (SaaS) model. It is also a part of the cybercrime-as-a-service (CaaS) model. So, just like CaaS, marketplaces for MaaS typically reside in the Dark Web.

A manual penetration test is a security test wherein human experts attempt to break into a system with the owner’s written permission, then report the weaknesses they found and how to fix them. Testers use tools like port scanners, proxies, and custom scripts but the strategy, improvisation, and judgment come from people.

Think about the difference between a fire inspector and a burglar. The inspector walks your building with a clipboard to check if extinguishers are charged, exit signs are lit, and sprinkler heads are clear. Every item gets a tick or a cross.

The burglar, on the other hand, watches a loading dock and notices the driver props the side door open with a brick every Tuesday. He sees the badge reader beep green when someone tailgates in behind an employee. No checklist told him to look for either.

A manual pentest is the second exercise. The pentester’s real product isn’t a list of open ports. It is a demonstrated path from “outsider on the Internet” to “reading your customer database” with reproduction steps.

A mule account typically refers to a bank or financial account criminals use for illegal or fraudulent activities, such as money laundering, scamming, or transferring illicit funds. Bad guys, including cybercriminals, often use mule accounts to move money around while obscuring its origins, thus making it hard for law enforcement to trace.

The term “mule” is often used to describe an individual who could be unwittingly or knowingly involved in an illegal activity. Criminals often recruit mules to receive funds into their accounts and then transfer these elsewhere, often to international accounts the bad guys own. Mules usually get a cut of the money they move or are coerced or deceived into participating.

A network security assessment is an exhaustive audit designed to uncover vulnerabilities attackers may exploit that could harm an organization’s business operations or expose sensitive information.

Think of it as an extensive check on your building premises to see if any doors or windows that could allow thieves to enter have been left unlocked.

Network segmentation is the process of dividing a network into smaller parts for various reasons—control, security, and boosting performance. It is also referred to as “network segregation,” “network partitioning,” and “network isolation.” Each part of a segmented network is called a “subnetwork” or “subnet.”

So when you’re asked “What is network segmentation?,” think of a subnet as a room in your house. You divide your living area into different spaces to designate areas for rest, recreation, and work. Without the partitions, you may end up eating anywhere, thus inviting pests if you don’t have that much time to clean daily.

Next-generation antivirus (NGAV) is an advanced form of endpoint security solution designed to replace or significantly upgrade traditional antivirus software. The solution goes beyond signature-based detection. It relies on modern technologies to protect against a broader, more sophisticated range of threats by analyzing behaviors with artificial intelligence (AI) and machine learning (ML).

For example, if a normal Microsoft Word file suddenly tries to encrypt all your other documents (the classic ransomware move), the solution flags that behavior as malicious and shuts it down, even if the file itself doesn’t match a known malware signature.

Security providers began developing the solutions around 2014, when it became clear that traditional antivirus was no longer sufficient to protect against modern threats.

NIS 2, short for “Network and Information Security Directive 2,” is a legislative framework established by the European Union (EU) to enhance cybersecurity measures across member states. It builds upon the original NIS Directive (NIS 1) to address emerging cyber threats and challenges in the digital landscape.

An open relay or open mail relay is an unsecured Simple Mail Transfer Protocol (SMTP) server that permits anyone to send messages anonymously. When you have an open relay SMTP server, outsiders can send emails to anyone through it. The outsiders in this case could be anyone on the Internet, including spammers, phishers, and other threat actors.

The mail recipients won’t know who the email is from, so threat actors are accorded anonymity. But their mail servers would know that the message was sent through your mail server and can get it blocklisted as a result. Some blocklists even automatically block open relay servers to protect email users from spam.

Open source audits are in-depth reviews of the open source software components within a codebase. These audits then evaluate the open source software for security vulnerabilities, license violations,  and any risks introduced by the integrations.

The goal of an open source audit is to help the organization understand its software supply chain risks. The data gathered from the audit can then be used to create a Software Bill of Materials (SBOM), which is an inventory of every component, library, and dependency within the application.

Operating system (OS) security is a means to protect one’s OS from all kinds of threats. The OS, of course, is the user interface (UI) that allows a user to interact with his or her computer. He or she types in commands for the system to execute.

Operating system security includes all of the preventive and control measures one puts on his or her computer to safeguard it and other connected devices (e.g., printer, etc.) that contain confidential information that hackers would likely steal, modify, or delete if the system is compromised.

Think of operating system security as all of the procedures (e.g., going through a security check at a building entrance, etc.) and measures (e.g., locking out all unauthorized personnel from internal staff-only rooms, etc.) that building managers and staff employ to keep thieves and other unwanted people out of office premises.

Operational security (OPSEC) is a risk management process that helps organizations identify information that adversaries could find useful and then take steps to protect it.

At its core, it asks a simple question: “What information are we unintentionally revealing that someone could use against us?”

Imagine you are planning a surprise birthday party. You do not tell the celebrator about the event but you post photos of the decorations online, discuss catering in a public group chat, and leave invitations on your desk. Individually, these may seem harmless but together, they reveal your entire plan.

OPSEC works the same way. Attackers may not need access to confidential files if they can piece together information from employees’ social media posts, public documents, conference presentations, job listings, and vendor announcements.

Keep in mind that OPSEC aims to identify and eliminate clues before they become security problems.

An orphan account is a user account within a network or system that no longer has a valid owner. It is also known as an “orphaned account” or a “dead user account.”

Orphan accounts arise for various reasons, including role changes, employee resignations, and changes in vendor relationships. Regardless of the reason behind the emergence of an orphan account, it poses security risks, especially when it has access to sensitive data or critical systems.

OSINT, short for “open-source intelligence,” refers to information obtained from publicly available sources to produce actionable intelligence. If you’ve never come across the term “actionable intelligence” before, it is the data cybersecurity specialists use to thwart cyber attacks, prevent threats from entering their networks, or mitigate ongoing attacks.

Given the OSINT meaning above, it’s primarily used for national security, law enforcement, and business intelligence gathering.

OT security refers to “operational technology security,” the practice of protecting systems that monitor and control physical devices and processes. The goal is to prevent disruptions that could lead to operation downtime or inefficiency, equipment damage, and safety hazards.

OT security is necessary for water treatment facilities, oil and gas pipelines, power plants, transportation networks, manufacturing plants, and other critical infrastructures where a breakdown can have a widespread negative impact.

Packet capture refers to seizing a data packet that is traveling to or from a specific computer network. When a packet is “captured,” it is stored temporarily for analysis. It is inspected to diagnose and solve network problems and determine if its structure follows network security policies.

Hackers or threat actors use packet capturing techniques to steal data transmitted over a network.

You can liken packet capturing to an airport’s passenger entrance security protocol. Pieces of baggage and passengers go through a stringent check to make sure they don’t contain or aren’t carrying any forbidden items that can cause any damage to anyone or the establishment itself.

Packet filtering refers to a network security mechanism that controls the flow of data packets entering or leaving a network. It involves inspecting and managing network traffic based on the administrator’s predetermined rules. Its goal? Enhance network security by allowing or blocking data packets based on specific criteria.

You can compare packet filtering to deciding who can get into a party and who cannot. In this analogy, the party host (network administrator in packet filtering’s case) sets rules and guidelines for the party (network) guests (data packets). Guards (filtering devices) control guest entrance based on the predefined rules (invitation list). Only guests (packets) on the invitation list (rules) are allowed to enter the party (network).

A passive attack is a cyber attack where an attacker attempts to gain unauthorized access to systems or information without directly affecting a target system’s functionality. In other words, it does not involve altering or disrupting the regular operation of a target system. The attackers instead focus on observing and collecting information.

You can compare a passive attack to corporate espionage. Spies who get in as employees do not instigate disruptive activities in the company but gather confidential information about it and send the intel to their actual employer, typically a rival enterprise.

Passive reconnaissance is an attempt to gather information about targeted computers and networks without actually communicating with them. The term originated from the military, which does passive reconnaissance before embarking on an information-gathering mission. Instead of attacking right away, they first obtain the necessary information to direct their strategies. Today, passive reconnaissance has become the first step hackers take before exploiting system or network vulnerabilities.

Think of passive reconnaissance as stalking someone on social media. While you’re not necessarily talking directly to your subject, you are actively seeking information on him/her.

Passkeys are a modern, secure method of authentication designed to replace traditional passwords. They rely on a user's identity—who a user is (biometrics)—rather than what a user has (hardware, device) or knows (passwords).

They employ asymmetric cryptography, a methodology based on paired cryptographic keys, one public, one private. This allows users to authenticate without having to remember or type passwords and avoid a lot of security risks related to password-based authentication.

The core functionality of passkeys is the WebAuthn standard, which is part of the broader FIDO2 framework. WebAuthn (Web Authentication), developed by World Wide Web Consortium (W3C) and FIDO Alliance, is an API that enables authentication across browsers and devices by using public-private key cryptography.

Think of passkeys like a digital keycard that gives you access to a private club, and you’re the only one that can use it as it is tied to your own special features, such as your fingerprint or face. Each time you enter the club, your keycard is recognized without ever needing to leave your possession, and it’s uniquely tied to you for authentication.

Password cracking is the process of using a computer program to identify an unknown or forgotten password. It can help users recover access to their locked accounts and enterprise admins to check if anyone in the organization uses weak passwords. Unfortunately, threat actors can also use them to access users’ accounts without authorization.

The program threat actors use is known as a “password cracker.” In most cases, password crackers use a list of commonly used passwords to access accounts. Sometimes, the programs use an algorithm to repeatedly guess a target account’s password.

Password hashing is a technique to protect sensitive user passwords by converting them into hashed representations that are difficult to reverse. It’s a one-way mathematical function that takes an input, a password in this case, and produces a fixed-size string of characters called a “hash.” The resulting hash is unique to the input, meaning that even a tiny change in the password will produce a significantly different hash.

Password hashing is comparable to wearing a disguise. With its help, pretty much no one else would recognize the costume wearer.

Password management is a set of principles and processes to be followed online in order to manage and store passwords securely and effectively and prevent unauthorized access as much as possible.

People use password managers to handle their passwords due to the more extensive security and comfort that they provide.

Password salting is a technique used in cryptography and computer security to make password storage more secure. It involves adding random data, called a “salt,” to a user’s password before it gets hashed and stored in a database.

Salting prevents attackers from easily using precomputed tables or “rainbow tables” to crack passwords.

You must add salt to almost any dish to enhance its flavor when cooking. In cryptography and computer security, adding salt means putting another layer of protection to your password.

A perimeter firewall, also known simply as a “firewall,” is a network security device positioned at the boundary between an organization’s internal and external networks. It primarily monitors and controls incoming and outgoing network traffic based on predetermined security rules.

Perimeter firewalls protect internal networks from unauthorized access, cyber attacks, and other security threats by filtering traffic according to specified criteria, such as IP addresses, port numbers, and protocols.

Think of a perimeter firewall as the fence surrounding your home. It protects your property from intruders by only permitting those you have invited to enter through the gate.

A perimeter intrusion detection system (PIDS) is a security measure designed to detect and prevent unauthorized access to a defined perimeter, such as intellectual property, data center, or network. It employs various sensors and technologies to monitor the perimeter continuously and alert security personnel when an intrusion is detected.

Perimeter security comes from a built-in multipurpose system that detects threats, performs surveillance, and analyzes attack patterns. As such, it often serves as a network’s first line of defense against many dangers that can harm connected systems.

An airport that serves as the gateway to and from a country typically uses perimeter security made up of intrusion detection systems (IDSs), alarms, and 24-hour-manned closed-circuit television (CCTV) cameras to ensure that any criminal who goes in and out of a protected territory is caught.

In computing, perimeter security follows the same principle to protect valuable data. Various elements or systems work together to keep confidential data safe from unauthorized access.

Phishing-as-a-service (PhaaS) occurs when cybercriminals sell access to all the things you’ll need to instigate a phishing attack in the black market typically found on the Dark Web. The business model follows the legitimate software-as-a-service (SaaS) model. Companies offer users access to their specially crafted solutions for a subscription fee instead of purchasing a license to install the program on their computers.

PhaaS has made it easy even for cybercriminal newbies to launch phishing campaigns even if they can’t code.

The ping of death (PoD) command is a type of denial-of-service (DoS) attack where hackers work to destabilize or freeze the target computer service. They do so by sending oversized packets via a ping command. The ping command checks the availability of a network resource.

Using the ping of death command requires attackers to send data packets above the maximum limit that the Transmission Control Protocol/Internet Protocol (TCP/IP) allows. Since the packets are more than what a server can handle, they can cause the target system to reboot, freeze, or completely crash.

Post-quantum cryptography is an encryption approach that aims to provide security in anticipation of the development of quantum computers. These computers can perform more powerful computations than regular ones and are believed to break existing cryptographic algorithm approaches. 

Post-quantum cryptography is also referred to as “quantum-resistant,” “quantum-proof,” or “quantum-safe” cryptography. Cryptographic experts started exploring the development of post-quantum cryptography around the 1990s after mathematician Peter Shor demonstrated that a quantum computer could easily crack public-key encryption.

Back then, the quantum computer was still theoretical. Large tech companies like IBM and Intel have invested billions of dollars in developing quantum computers in recent years. Post-quantum cryptography helps us protect our data when these quantum computers become available.

Privilege escalation occurs when attackers gain higher access rights than they are supposed to have. An example would be when a supposed regular user becomes an administrator. It is a critical step in many cyber attacks because it lets threat actors move deeper into systems, access sensitive data, and maintain control. Preventing it requires strong access controls, patching vulnerabilities, and monitoring unusual behavior. In simple terms, it happens when someone “levels up” his permissions without authorization.

Purple team security is a methodology where so-called red and blue security teams work closely to maximize their cyber capabilities through continuous feedback and knowledge transfer. It helps security teams improve their vulnerability detection, threat hunting, and network monitoring through accurate simulations of common threat scenarios and creating new techniques to prevent and detect new threats.

You can think of purple team security or purple teaming as a red and blue team security combination. We’ll tell you all about each type of security methodology in the following sections.

A quid pro quo attack is a low-level form of hacking that relies on social engineering. An example would be when an attacker calls your phone pretending to be from one of your service providers’ technical support representatives. He or she will offer you some assistance, which would, however, only work if you’re experiencing some difficulty.

Availing of the hacker’s “service” actually gives him or her access to your computer, device, or home network to plant malware. Therein lies the rub, as successful ransomware installation, for instance, can let attackers hostage your files for large sums of money.

RCE vulnerability, short for “remote code execution” vulnerability, is any exploitable security issue that allows cyber attackers to run their own malicious code on a target network or system. As a result, they can take control of the system and perform actions that let them steal data, install malware, or disrupt operations.

These vulnerabilities may be similar in concept to those found in armed forces’ aerobots or unmanned aerial vehicles (UAVs), which are guided by remote control and can be used to destroy targets or perform reconnaissance.

The vulnerabilities pose a significant threat to organizations, as they can significantly expand attack surfaces. In fact, out of more than 240,000 security issues on the Common Vulnerabilities and Exposures (CVE) list, more than 500 are either RCE vulnerabilities or lead to them.

The term recovery time objective (RTO) refers to the maximum acceptable amount of time allotted for restoring a network or an application and regaining access to data after an unplanned disruption. It depends on how much revenue an organization can stand to lose when its operation gets disrupted. It also depends on how much a disrupted process affects an organization’s business continuity.

Depending on the nature of the business and process or system involved, RTOs can vary greatly. The RTO for a payroll system can be as long as two weeks, for example, while that for a sensitive financial process may be zero.

A red hat hacker is a hacker who takes aggressive steps to stop black hat hackers. While red hat hackers are not inherently evil, they do everything they can to stop the bad guys, including taking matters into their own hands. They go to the lengths of launching full-scale attacks to take down cybercriminals’ or cyber attackers’ servers and destroy their resources.

Red hat hackers are often dubbed the “Robin Hoods of the virtual world.” Like the heroic outlaw, they are not opposed to stealing back what the cybercriminals or cyber attackers stole from their victims. And like Robin Hood and his Merry Men, they won’t keep the stolen goods for themselves. Instead, they will give them back to their owners.

A replay attack happens when cybercriminals eavesdrop on secure network communications, intercept them, and change them to make the receivers do what they want. What makes it more dangerous, though, is that it does not require advanced hacking skills when the target messages are not encrypted.

You can compare it to fraudsters who steal mail from your mailbox (a service provider bill), open it, replace its content (the account details where payment should be sent with those that point to an account under the attackers’ control), and resend it via the same postal office like nothing happened.

A reverse shell is a type of session cyber attackers commonly use to open communication ports between their machines and the victims’. It is also one of the penetration testers’ go-to methods.

A reverse shell, also known as a “connect-back shell,” takes advantage of the target system’s vulnerabilities to initiate a shell session then gain access to the victim’s computer. The goal is to connect to a remote computer and redirect the input and output connections of the target system’s shell so the attacker can access it remotely.

Radio frequency identification (RFID) skimming is a type of electronic theft involving the unauthorized access and capture of information from RFID chips or tags.

RFID uses radio waves to identify and track objects, people, or animals wirelessly. It’s commonly used in various applications, such as access control systems, inventory management systems, payment cards, and even in some passport and identification cards.

RFID skimming typically involves a malicious individual using a handheld RFID reader or a specially designed RFID skimming device to intercept and capture the data transmitted by RFID tags. These devices can read the information stored on RFID tags at close range, sometimes without the victim’s knowledge.

A risk control matrix (RCM) is a tool for documenting, assessing, and managing risks and their associated controls within an organization. It provides a structured approach to identifying risks and the controls implemented to address them.

Think about a table with two columns—one for risks and another enumerating the security controls used to minimize each risk. An RCM helps ensure all potential risks are systematically managed and mitigated.

A risk operations center (ROC) is a cyber risk management platform that enables cross-functional collaboration across security, finance, and compliance operations with unified risk management for coordinated response to risks in real time.

Think of it as a hub for the security, finance, and compliance teams of an organization that lets them work together seamlessly to identify, manage, and address all the risks their business may face.

Risk tolerance in cybersecurity refers to the level of cyber risk an organization can handle. It’s essentially an organization’s pain threshold for cyber attacks, which varies, depending on several factors. Some companies, such as large tech companies, may be able to endure significant attacks, while smaller businesses may struggle with even a minor security incident.

Understanding an organization’s risk tolerance requires determining its business goals, its financial capacity to recover from a cyber attack, and the amount of risk it is willing to accept, among other things.

A rootkit is a type of malware that lets cyber attackers gain access to and infiltrate data from systems without being detected. An example would be a software toolbox designed to infect computers to give attackers remote control while remaining hidden for an extended period.

The malware is one of the most difficult to discover and remove. It is, therefore, frequently used to eavesdrop on users and launch destructive attacks.

The malware can come with multiple capabilities. The most common can turn systems into bots for launching distributed denial-of-service (DDoS) attacks,  disable cybersecurity software, steal banking and credit card details and passwords, and log keystrokes.

Finally, the malware can give attackers back doors into systems, providing unfettered access that lets them change or remove software and components.

Sandboxing is a process where an application is separated from other programs and system resources for security purposes. So if the application proves malicious, the other systems and programs in the same network would not be affected or infected with malware. Afterward, the malicious program can either be cleaned if it is required or deleted if it is unnecessary, without causing problems within the networked environment—essentially, the systems and devices that are connected to one another and the Internet.

It is just like building sandboxes in real life. They are made to contain playtime within a specified area because you don’t want toys to be scattered throughout your yard. It also prevents your child from wandering to potentially dangerous areas.

Sasser (detected as Sasser.A) is a computer worm, a type of malware, that affects computers running vulnerable versions of Microsoft Windows XP and Windows 2000. It spreads by exploiting a port vulnerability, specifically in Transmission Control Protocol (TCP) port 445, which authenticates or identifies network users.

While Microsoft released a patch for Sasser in its MS04-011 bulletin 17 days before the first attack hit, the worm still wreaked a lot of havoc when it spread to many computers back in April 2004.

SecOps, which stands for “security operations,” is a business approach that combines security and IT processes, tools, and expertise. This strategy has become critical with the acceleration of digital transformation. Traditionally, IT operations and security teams are distinct departments with goals that don’t always align.

IT teams are tasked with implementing IT infrastructure for business agility and could be pressured to do so quickly. On the other hand, security teams aim to protect the IT infrastructure from cyber attacks. That could mean scrutinizing IT systems, applications, and services before deployment, which could create friction between the IT team.

With SecOps, security is fused with all aspects of IT operations, and the goals of both teams are melded and balanced.

Security by design or secure by design is an approach to product development that considers cybersecurity at the onset. It does away with the “let’s cross the bridge when we get there” outlook on cybersecurity and makes software or hardware more secure. It is similar to designing a house and ensuring that it is earthquake-resistant and hurricane- or typhoon-proof.

Security by design ensures that security controls are built into a product’s design, rather than as an afterthought. Such an approach reduces the likelihood of cybersecurity breaches and has become common in product development.

A security framework is a compilation of state-mandated and international cybersecurity policies and processes to protect critical infrastructure. It includes precise instructions for companies to handle the personal information stored in systems to ensure their decreased vulnerability to security-related risks.

Since a security framework has proven useful to entire industries, many, if not all, organizations strive to adhere to their mandates when crafting security guidelines for their networks.

A security hole refers to a vulnerability or weakness in a computer system, network, application, or any other information technology (IT) infrastructure that malicious actors can exploit to compromise the integrity, confidentiality, or availability of data or resources.

Security holes can take various forms and may exist due to flaws in software code, misconfigurations, or inadequate security measures.

Think of a security hole as a physical hole in the ground that can cause damage to anyone who falls into it.

A security misconfiguration is an error that occurs when security controls are inaccurately configured or left insecure. It puts systems and data at risk. And any poorly documented configuration changes, default settings, or technical issues in any system component could lead to a misconfiguration.

Simply put, therefore, a security misconfiguration is any error in how a device has been set up to work.

Security posture refers to the state of cybersecurity readiness of an organization’s IT infrastructure. It pertains to a company’s ability to identify, prevent, and respond to cyber attacks. Organizations with a strong security posture have the capacity to protect their valuable assets.

The cybersecurity processes that contribute to a strong cybersecurity posture include vulnerability management, identity and access management (IAM), endpoint protection, and network security. 

A security or cybersecurity rating is an objective, quantifiable, and factual analysis of a network’s security to understand its strengths and weaknesses. To assess a network’s rating, the assessors take the role of hackers to spot loopholes within a system. They launch attacks to determine if a system can resist them and mitigate damages.

Think of it as the grades students get in school. The higher they are, the better the learners’ performance is. In organizations’ case, the higher their ratings are, the better they can protect against cyber attacks.

Security theater refers to the practice of implementing security measures in the form of people, processes, or technologies that give the illusion of improved security. Simply put, it means something is happening, but what that is and how it actually provides protection is questionable.

It is essentially the illusion of security that often results from prioritizing actions that appear effective but fail to improve security.

A security zone is the part of a network that defines specific policies and protocols to keep the entire network threat-free. The components of a security zone may have limited access to other parts of the internal network to prevent unauthorized access.

You can think of a security zone as parts of your home that only specific family members can enter. You can disallow helpers and your kids to enter your home office, for instance. Security zones can refer to executives’ offices and the HR department's document storage room in an office. They should be closed off to all other employees because they may contain confidential files that no one else should see.

Security zones come in various types and have different uses, which will be discussed in greater detail in the succeeding sections. We’ll also tackle some policies applied to security zones.

Security-as-a-service is any service obtained from a third party to handle and manage cybersecurity needs. As with software-as-a-service (SaaS), security-as-a-service delivers cybersecurity from the cloud, making it a popular choice for organizations to limit their number of in-house security personnel, reduce maintenance costs, and scale security along with business growth.

With security-as-a-service, companies no longer need to purchase security solutions and manage and maintain them locally. Their IT departments no longer need to install antimalware and other security tools on each device or server. All of these would be taken care of by their providers.

Think of it as hiring a professional team of security guards that ensures that no unauthorized personnel or unwanted guests are allowed entry into your premises. You don’t need to hire nor train them yourself.

Sensitive data exposure occurs when an application does not have the proper measures to secure confidential information, such as passwords, credit card numbers, health records, and other personal data.

The root causes of such an exposure can vary, including weak passwords, lack of encryption, data storage and sharing practices, and human error. However, the Open Worldwide Application Security Project (OWASP) points out that the occurrence is a broad symptom of cryptographic failures, second on the list of OWASP Top 10 Vulnerabilities.  

Shift left security is the practice of applying security to an application in development at the earliest possible stage. Instead of testing how secure your program is when it’s near the end of the product development life cycle, you do so as early as possible. That not only saves you time and effort in revamping the entire software code in the end but also ensures better security and efficiency.

When you’re cooking, you can liken shift left security to tasting your dish as soon as you finish seasoning it to quickly make adjustments before it’s too late.

A side-channel attack is a kind of security exploitation that targets vulnerabilities in a computer or cryptographic implementation by analyzing information leaked through unintended channels. Instead of directly attacking an encryption or algorithm, this attack takes advantage of a currently operating system’s physical or environmental characteristics.

You can compare a side-channel attack to a bank heist. In a side-channel attack, threat actors go after the information stored on a computer. In a bank heist, they’d go after the money in the vault. The attackers and thieves must break through built-in security systems to get what they want.

Signature-based detection is a cybersecurity technique that identifies known threats by comparing files, network traffic, or other activity against a database of predefined malicious patterns, known as signatures.

When a match is found, the security system can flag, quarantine, or block the suspected threat, which may include malware, viruses, worms, Trojans, and many others. 

The antivirus programs you installed on your computer may be using signature-based detection to check for malware.

SIM jacking, also known as “SIM swapping” or “SIM hijacking,” is a type of cyber attack where threat actors take control of victims’ phone numbers by convincing their mobile carriers to transfer the numbers to a SIM card they own. Such an attack exploits the fact that many online accounts and services use phone numbers as a form of two-factor authentication (2FA) or account recovery method.

SIM jacking, simply put, is stealing someone else’s number so the thief can pose as the SIM card’s owner. You can liken it to when an impostor creates a social media account while posing as you.

An SMTP hack abuses vulnerabilities found in the Simple Mail Transfer Protocol (SMTP), allowing hackers to rely on the victim’s reputation when sending spam and phishing emails. For example, when attackers hack into the SMTP server of Company A, they can send emails using the victim’s domain. These emails could contain spammy messages or malware but would look like they were from someone within the organization whose domain was used.

As a result, the hacked organization’s email domain or Internet Protocol (IP) address could be blocklisted. But this is just the tip of the iceberg. The victim’s reputation can get severely damaged because of the SMTP hack, causing clients to lose their confidence in the company.

A sniffing attack is an act of intercepting or capturing data while in transit through a network. The concept is similar to law enforcers wiretapping a suspect’s phone line to gather necessary information. Remember when the Federal Bureau of Investigation (FBI) wiretapped Leonardo DiCaprio’s phones in the movie The Wolf of Wall Street? So instead of using wiretaps to catch bad guys and seek justice, sniffing attacks are employed by cybercriminals to steal data.

During a sniffing attack, hackers can steal any information victims transmit as long as it is not encrypted. The data can include usernames, passwords, bank and credit card accounts, favorite websites, and email messages. Cybercriminals can then use this data to further steal from victims. For one, they could access a victim’s bank accounts and use his/her credit card details in fraudulent transactions. They could also sell stolen usernames and passwords on the Dark Web or steal victims’ identities.

SOAR stands for “security orchestration, automation, and response.” Gartner coined the term in 2017 to refer to security platforms that gather cyberthreat data from multiple solutions into one location for more accessible and more efficient incident response and threat management.

The threat intelligence fed to SOAR platforms can come from firewalls, vulnerability scanners, endpoint protection systems, threat intelligence feeds, and security information and event management (SIEM) platforms.

The rationale behind SOAR is similar to that of storing data in the cloud, such as syncing photos from different devices to iCloud or Google Photos. Instead of saving photos on each of the devices you own, you can log in to these cloud services and browse through them from there.

Security operations center-as-a-service (SOCaaS) is a cloud-based subscription model for managed threat detection and response solutions. It includes best-in-class SOC solutions and capabilities to help fill in gaps in existing security teams and systems.

In the business model, a third-party vendor operates and maintains a fully managed SOC and offers its services to subscribers via the cloud.

Software supply chain security is the practice of securing all components involved in developing and deploying a software. The software supply chain includes several elements, ranging from third-party and proprietary code to deployment methods, infrastructures, interfaces, protocols, developer habits, and development tools—and all these need to be safeguarded.

As you’d imagine, the software supply chain makes up a huge part of an organization’s attack surface. Attackers often target weak links in this chain and, in doing so, compromise software providers and their product users.

A Secure Sockets Layer (SSL) stripping attack allows threat actors to downgrade a web connection from HyperText Transfer Protocol Secure (HTTPS) to the less secure HTTP. It is also known as an “SSL or HTTP downgrade attack.”

An SSL stripping attack decrypts all communications, allowing hackers to perform a man-in-the-middle (MitM) attack where they sit in the middle of a conversation to listen to or intercept confidential information.

Stateful inspection is a security feature in firewalls to monitor and filter network traffic based on context and established connections. Imagine a busy apartment building with a security guard who remembers everyone coming and going. Stateful inspection is like that guard but for your computer network! It acts as a smart filter, keeping an eye out on all the data packets flowing in and out.

In essence, stateful inspection provides an extra security layer by understanding ongoing conversations between devices and only allowing traffic aligned with established connections. This capability helps keep your network safe from unauthorized access and malicious activity.

A stealth virus is a kind of malware that does everything to avoid detection by antivirus or antimalware. It can hide in legitimate files, boot sectors, and partitions without alerting the system or user about its presence. Once inside a computer, a stealth virus allows an attacker to take over the functions of the infected computer.

A stealth virus is like a rebel who wears a camouflage suit to remain unidentifiable among soldiers. He or she can then pretend to be one of the good guys to infiltrate a target.

The STRIDE model, short for “spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege model,” is a threat model created by Praerit Garg and Loren Kohnfelder to identify digital security threats.

The STRIDE model involves going through all of a network’s processes, data repositories, data flows, and trust boundaries to find threats. It basically answers the question: What can go wrong in a computer system?

Subdomain enumeration is the process of discovering all subdomains associated with a specific domain. It is often used in various contexts, including mapping out an organization’s attack surface and finding hidden or forgotten applications.

For example, mystore[.]com may have subdomains dedicated to different functions, such as help[.]mystore[.]com for customer support, login[.]mystore[.]com for user login, and blog[.]mystore[.]com for blogs and other articles.

While these subdomains are active and known, subdomain enumeration may also reveal the presence of test[.]mystore[.]com. This unused subdomain may have been set up during the early days of the business for testing purposes. As such, listing and securing all subdomains, both known and forgotten, is essential.

A subdomain takeover is a type of cyberattack where a hacker gains control over a legitimate subdomain of a company. This usually happens due to dangling DNS records. A dangling DNS record occurs when a company points a subdomain to an external service but later stops using that service without updating its DNS settings.

Think of it like a business that moves out of an office but forgets to take down its sign off the building. If a new tenant moves in and keeps the old sign, they can pretend to be the previous business. In the digital world, a hacker "moves in" to the vacated space and uses your trusted name to trick users.

Supply chain risk management (SCRM) is the process of identifying, assessing, and mitigating cyber risks within a supply chain. It aims to safeguard the continuity of operations and minimize disruptions caused by internal or external factors that can impact the supply chain.

Symmetric encryption is a means of protecting data using a secret key to encrypt (lock) and decrypt (unlock) it. The sender and recipient share the key or password to gain access to the information. The key can be a word; a phrase; or a nonsensical or random string of letters, numbers, and symbols.

Many organizations use symmetric encryption because it is relatively inexpensive. But it does come with some flaws. A key in symmetric encryption can be used forever. And that sometimes leads organizations to forget to change them. As a result, even users who may no longer be part of the company can intercept and read encrypted data.

Think of symmetric encryption as the combination to an office vault. Anyone who has it can unlock and access the vault's contents.

A SYN flood attack is a denial-of-service (DoS) attack that renders a server unavailable to legitimate traffic by using up all of its resources. Also known as a “half-open attack,” threat actors repeatedly send initial connection requests or SYN packets to overwhelm all the available ports on the target server, causing it to respond to legitimate traffic slowly or not at all.

You can compare it to an intersection where only one of the crisscrossing streets allows vehicles to pass through while the other street fills up with vehicles that wish to cross to the other side.

A tailgating attack, also referred to as “piggybacking,” involves attackers seeking entry to a restricted area without proper authentication. In it, the perpetrators can simply follow an authorized person into a restricted location. They can impersonate delivery men carrying tons of packages, waiting for an employee to open the door. They can ask the unknowing target to hold the door, bypassing security measures like electronic access control.

Tarpitting is the process of intentionally delaying the sending of mass emails to avoid getting tagged as a spammer. In it, system administrators can configure a specific mail server to insert a pause in-between sending emails with huge recipient numbers. But while tarpitting can benefit legitimate companies that want to stay protected from spamming, cybercriminals can also abuse it to bypass security measures. They can delay spam mail sending time so these would not be considered spam.

The term “tarpitting” came from the concept of a “tar pit.” Falling into one would significantly slow you down.

A teardrop attack is a kind of denial-of-service (DoS) attack or one that’s meant to take a target website or network offline. In it, an attacker sends fragmented data packets to the target device. The nature of the packets makes it hard for the system to read the data. The effort to do so ultimately overwhelms the machine, causing it to crash.

A teardrop attack typically works on computers with older operating systems (OSs) such as Windows 95, Windows 3.1x, Windows NT, and earlier Linux versions. Some attacks also worked, though, on systems running Windows 7 and Windows Vista.

A teardrop attack can be likened to an unruly group of shoppers all trying to enter an establishment with a massive sale at the same time. Once the shop doors open, they run en masse, causing a stampede and accidents. The establishment may need to close until the situation is dealt with because the shop owner needs to attend to the injured.

Threat intelligence feeds refer to continuous data streams that provide information on threats that can adversely affect an organization’s security. They give security teams a list of indicators of compromise (IoCs) that includes malicious URLs, malware hashes, and malicious email and IP addresses related to attacks.

Often, the data obtained from threat intelligence feeds dictate the next steps or actions that security teams need to take to protect their organizations. These actions include blacklisting IoCs or blocking connection requests from identified threat sources and preventing malware from reaching connected systems.

Threat intelligence feeds differ from threat information, which refers to general data without contextual relevance that a security analyst or investigator can use to take the necessary action to prevent loss. They can be likened to routes on a driving app that tells the driver which is the best way to take, depending on his/her goal (e.g., less time, no traffic, no traffic enforcers, etc.).

Threat modeling is the process of identifying network vulnerabilities and optimizing security to enhance mitigation strategies. The practice is often done to protect valuable information or prevent adverse events that may lead to malicious attacks. It is ideal in building a culture of security throughout an enterprise.

Think of threat modeling as predicting what could go wrong. For example, before walking into a dark alley, you should assess if you’re likely to be attacked. Ask yourself questions like “Where will the attacker come from?” and “Can I defend myself? How?”

Threatware refers to computer programs developed by threat actors to gain unauthorized access to victims’ computers. They are used to harm devices with the end goal of stealing their owners’ sensitive information. Threatware are also called “malware,” specifically “spyware.”

Various kinds of threatware have alarmingly spread over the years, including ransomware, keyloggers, trojans, and adware.

In cybersecurity, traffic filtering is the process of checking and verifying each data packet transmitted or received over a network. If the traffic filter identifies threats or finds data whose signature matches known malware, it prevents such data packets from entering or leaving the network. The filter’s decision is based on preexisting rules established by the organization’s cybersecurity personnel.

Traffic filters, in a sense, work like overhead controls with height requirements that prevent oversized vehicles from entering particular roads, thus filtering road traffic.

A true negative (TN) in cybersecurity occurs when a security system or tool correctly identifies benign, legitimate activity and does not raise an alert. In it, no threat exists and none is detected, allowing business operations to continue without disruption. It works hand in hand with true positives (TPs) to allow organizations to accurately gauge their security performance.

Tactics, techniques, and procedures (TTPs) refer to how threat actors behave and their structured frameworks for executing cyber attacks. These bad actors can be hacktivists, hobbyist hackers, downright cybercriminals, part of underground rings, or state-sponsored adversaries.

TTPs would be like the different plays in a sports team’s playbook that dictate what each player should do in a particular game situation. The motivation, as in a cyber attack, is to succeed.

A tunneling virus is any virus that gets installed before an antivirus can detect it. It executes without alerting the sensors of the operating system (OS) to avoid antivirus detection.

A tunneling virus disables a computer’s interception programs. While some antivirus solutions can detect the malicious code, they can’t stop this type of virus from getting installed. More advanced antivirus programs that employ tunneling strategies may be the only ones capable of detecting and preventing the execution of a tunneling virus.

You can compare a tunneling virus to thieves entering an establishment via the sewer system, so they don’t have to deal with alarms.

Twofish encryption is a block cipher (or an encryption method in simple terms) that is 128 bits in size and uses a key that’s up to 256 bits long. Let’s break that definition down to its components to simplify.

As a block cipher, twofish encryption encrypts data in blocks using a deterministic algorithm and a symmetric key. A deterministic algorithm is an algorithm that will always produce the same output no matter the input used so long as the machine that uses it follows the same procedure. A symmetric key, meanwhile, is a single key that encrypts and decrypts data.

Typosquatting is a type of cybersquatting that is also known as “URL hijacking” or “domain hijacking.”It occurs when malicious actors mimic someone else’s brand using misspellings to target Internet users who may incorrectly read website addresses in their web browsers. Threat actors can, for instance, use the domain g00gle.com (substituting two zeroes for the two lowercase Os) to trick users into thinking they are on the search engine’s site when they may be on a malicious web page designed to steal their credentials or other personal data.

Today, the threat is exploited in various forms of cybercrime like phishing, brand impersonation, copyright infringement, and malware distribution, among others.

Unified threat management (UTM) is a security model that brings multiple cybersecurity functions together in one system. Instead of using a firewall, an antivirus gateway, a web filter, a spam filter, and an intrusion prevention system (IPS), an organization manages many of these defenses through a single UTM platform.

Think of UTM as an airport security checkpoint. Travelers do not go to five different buildings for identity checks, baggage scanning, customs review, access control, and suspicious item detection. These functions are coordinated in a single controlled area. UTM works similarly for network traffic. It checks who or what is trying to enter, what data is being sent, if the intended destination looks risky, and if the activity matches known attack patterns.

A UTM solution may sit at the edge of a company network, between internal users and the public Internet. It inspects traffic moving in and out, applies security rules, blocks known threats, and gives administrators a central place to manage policies.

Keep in mind, though, that UTM is not a single security feature but rather a bundle of security capabilities managed together.

User access control (UAC), also known as “user account control,” is a security feature on Windows computers that protects its operating system (OS) from unauthorized changes. When enabled, any modification to the system that requires administrator-level permission alerts the user, giving him/her a chance to approve or deny the change.

As such, UAC limits the access malicious actors or code have to execute with administrator privileges. It helps users make informed decisions about actions affecting their computers’ stability and security. It is enabled by default and can only be configured by users with administrative privileges.

UAC is comparable to homeowners who have the right to change the security alarm code. Advanced systems can also alert them if anyone else tries to modify the alarm settings, including the code.

A Unified Threat Management (UTM) firewall is a network security device that performs multiple security functions. These functions include firewall, intrusion detection/prevention, antivirus, content filtering, and virtual private network (VPN) services.

A UTM firewall protects networks from various threats, such as malware, viruses, spam, phishing attacks, and malicious traffic. By integrating multiple security functions, UTM firewalls provide a comprehensive approach to network security, making it easier for organizations to manage their security infrastructure.

A vulnerability assessment identifies and evaluates security issues in digital systems and infrastructures that may serve as cyber attack gateways. It should be conducted on internal and external systems as a critical part of the attack surface management (ASM) process. As such, it helps organizations detect and tackle vulnerabilities before threat actors can exploit them.

The process is similar to trying to open the doors and windows in a house to see if any of them can allow unauthorized entry, say, for thieves.

The vulnerability management process refers to the never-ending and constant practice of identifying, assessing, reporting, managing, and remediating vulnerabilities across devices, workloads, and systems. It requires a vulnerability management tool that detects vulnerabilities and employs different processes to patch or remediate them.

Effective vulnerability management processes utilize threat intelligence and IT and business operation knowledge to prioritize risks and address vulnerabilities as fast as possible.

Warchalking is the practice of drawing symbols in areas to indicate the presence of an open Wi-Fi network. The symbols used typically indicate if the access point is open or closed.  At its height, warchalking unfortunately served as a beacon for hackers looking for vulnerable Wi-Fi to exploit and collect user data.

Think of warchalking as street signs that point people to certain locations. While helpful, the signs may also direct the wrong type of people.

Wardriving is the act of looking for publicly accessible Wi-Fi networks while in a moving vehicle (hence the word “driving”) for later potential use in attacks (now you know why the term “war”).

Due to its nature, wardriving requires the use of portable devices like a laptop or a smartphone. Software that aids perpetrators in the task are sadly available free of charge on the Web. Other terms have been coined for similar tactics, depending on the transportation means used. We’ve seen warbiking, warcycling, warcarting, warwalking, warflying, warrocketing, warballooning, and warboating used as well.

Think of wardriving as a thief going house to house in search of poorly protected ones to rob.

Web application penetration testing refers to testing the security of web application firewalls (WAFs), which filter, monitor, and block incoming and outgoing web service traffic, to make them as impenetrable as possible. To do it, penetration testers or pen-testers, for short, can attempt to breach a company’s applications, such as application protocol interfaces (APIs) and frontend and backend servers, to see if they have weaknesses that can be exploited through code injection attacks.

The results and findings of web application penetration tests are useful in fine-tuning WAF security policies and patching uncovered vulnerabilities.

Whaling in cybersecurity is a targeted social engineering attack that impersonates a trusted individual or organization to trick a high-profile target into transferring money, revealing confidential information, sharing credentials, opening malicious files, and granting access to corporate systems.

Think of phishing, spearphishing, and whaling in terms of fishing. In phishing’s case, a fisherman often throws a large net into the ocean and hopes something bites. In spearphishing, he uses a fishing rod aimed at a specific fish. In whaling, he targets the biggest fish in the water.

Zoom bombing is the slang term for the practice of uninvited individuals infiltrating a private or public Zoom meeting. Zoom bombers are the digital version of gate-crashers. While some remain silent and merely observe, other Zoom bombers may disrupt the entire meeting by sharing their screens or showing disturbing images. 

Zoom bombing became prominent during the pandemic, when most teams conduct meetings through Zoom. The online platform had to deploy stricter security features to reduce the risk of Zoom bombing. 

ZTNA, which stands for “zero-trust network access,” is also known as “software-defined perimeter (SDP).” It refers to a set of technologies and functionalities that allows remote users to access internal applications securely.

The tech is grounded on an adaptive trust model. The organization never implicitly trusts anyone or anything. As such, access is granted on a need-to-know, least-privileged basis defined by particular policies.

Think of it as security personnel inside a building who strictly and consistently perform additional checks on everyone who enters and exits, even those they see every day. So, apart from checking IDs, they also check bags.