Glossary

3

  • 3-2-1 Backup Rule

    The 3-2-1 backup rule helps your data survive a fire, a flood or a burglary: keep three copies, on two different types of storage, with one copy offsite.

A

  • Address Resolution Protocol (ARP)

    Most local networks use the Address Resolution Protocol (ARP) to resolve IP addresses to Media Access Control (MAC) addresses. IP addresses are used for internet routing, but local network traffic needs MAC addresses.

  • Allow Lists

    In computer science, an allow list (formerly "whitelist") is a list of valid inputs to a system. Anything not on the list is refused.

B

  • Block Lists

    A block list (formerly "blacklist") is a list of values that a system explicitly refuses, such as banned IP addresses, file extensions or words.

  • Botnets

    A botnet is network of computers infected with malware that can be used by a hacker to do their bidding.

  • Break-Glass Access

    Break-glass access is a way to get emergency access to a system that is normally locked down, with every use logged and reviewed.

  • Browser Fingerprinting

    Fingerprinting describes the process of building a unique profile of a web user by using a combination of information available to websites and JavaScript.

  • Brute Force Attacks

    A brute-force attack occurs when an attacker checks all possible passwords until the correct one is found.

C

  • Clean URLs

    Clean URLs (or semantic URLs) are readable URLs for websites or web services that intuitively represent the underlying resource.

  • Code Injection

    Code injection can be used by an attacker to introduce malicious code into a vulnerable computer program and change the course of execution.

  • Content Management Systems

    Content Management Systems (CMS) allow non-technical users to publish and edit online resources.

  • Content Security Policy

    A content security policy (CSP) allows you, as the author of the web application, to specify where various types of resources — such as JavaScript files, image files, or stylesheets — can be loaded from. In particular, it can prevent the execution of JavaScript that is loaded from suspicious URLs or injected into a web page.

  • Cookies

    HTTP is a stateless protocol. Cookies are the most common way to make a conversation between a browser and server stateful.

  • CORS Preflight Request

    For certain types of requests, the browser will send a "preflight" request using the OPTIONS method to check what's allowed before sending the actual request.

  • Credential Stuffing

    Credential stuffing is an attack in which hackers take username and password pairs stolen in one data breach and try them on other websites.

  • CRLF Injection

    CRLF injection is an attack that slips carriage return (CR: \r) and line feed (LF: \n) characters into input that an application writes into a line-based format, such as HTTP headers or log files.

D

  • DDL

    Data Definition Language (DDL) is the subset of the SQL language that allows table structures to be edited.

  • Defense in Depth

    Defense in depth refers to employing multiple layers or security controls to reduce the likelihood and impact of an attack.

  • Denial of Service Attacks

    A denial-of-service (DOS) attack is an attempt to make a web service or website unavailable by flooding it with network packets.

  • Dictionary Attacks

    A dictionary attack is an attempt to guess passwords by using well-known words or phrases.

  • Digital Signatures

    Digital signatures are used to demonstrate the authenticity of a digital message.

  • DML

    Data Manipulation Language (DML) is the subset of the SQL language that allows querying and updating of table content.

E

  • Encryption

    Encryption describes the process of disguising information by converting it to a form that is unreadable by unauthorized parties.

  • Encryption at Rest

    Encryption at rest describes the process of using encryption to secure data written to disk. Encrypting data on the disk protects against an attacker who manages to gain access to the disk because they will be unable to make sense of the data without the appropriate decryption key.

F

  • Four-Eyes Principle

    Highly secure systems often implement the four-eyes principle — a control mechanism requiring two people to approve critical changes before implementation.

H

  • Hacktivism

    Hacktivism describes hacking that's done for political reasons by provocateurs who want to further their cause.

  • Hashing

    You should store user passwords as strong, cryptographic hashes.

  • HMAC

    HMAC (Hash-based Message Authentication Code) uses a secret key so only authorized parties can generate a valid code for a message.

  • HSTS Preload List

    The HSTS preload list is a list of domains, built into major browsers, that should always be loaded over HTTPS, even on the first visit.

  • HTTP

    Hypertext Transfer Protocol (HTTP) is the mechanism that websites and web services use to communicate with user agents such as browsers.

  • HTTPS

    Sensitive web traffic should be sent over an encrypted channel -- that's what HTTPS is for.

I

  • Insecure Deserialization

    Serialization converts in-memory data structures to binary or text format for storage or transmission. Deserialization reverses the process. If your application accepts serialized data from untrusted sources, attackers can manipulate behavior and possibly execute code.

  • Integrity Checking

    Integrity checking is like a digital tamper-evident seal. Just as medication packaging shows when a container has been opened, integrity checks reveal when data has been modified.

L

  • LDAP

    Lightweight Directory Access Protocol (LDAP) is a technology used to create directories of individuals or resources.

  • Log Injection

    Log injection happens when an application writes untrusted input to its log files, letting an attacker add fake log entries or hide their tracks.

N

  • Netmasks

    Netmasks (or subnet masks) are a shorthand for referring to ranges of consecutive IP addresses in the Internet Protocol. They used for defining networking rules in e.g. routers and firewalls.

O

  • OAuth

    OAuth is an open standard for authorization.

  • OpenID Connect

    OpenID Connect (OIDC) is an identity layer on top of OAuth 2.0 that tells an application who a user is.

  • OWASP

    The Open Web Application Security Project (OWASP) is an online community that tracks common vulnerabilities and publishes information about web application security.

P

  • Parameterized Statements

    Parameterized statements (also called prepared statements) separate SQL commands from parameter values, preventing injection attacks.

  • Password Lists

    Users are creatures of habit, which means they tend to choose obvious passwords and re-use them over multiple sites.

  • Password Spraying

    Password spraying is a brute-force attack that tries a few common passwords against many usernames, rather than many passwords against one.

  • Phishing

    Phishing is when an attacker sends an email (or other electronic message) to a user, in an attempt to trick them into disclosing sensitive information.

  • Principle of Least Privilege

    Secure organizations often share information on a "need to know" basis, and this model can be applied to technical systems too.

R

  • Randomness

    Modern encryption techniques require the generation of random numbers on demand. This is a surprisingly hard problem.

  • Ransomware

    Ransomware is a form of malicious software that encrypts a victim's files and prevents access to them until a cryptocurrency ransom is paid to the attacker.

  • Releases

    Software is rarely unchanging; it is important to have a clear strategy when pushing out new versions.

  • REST

    REpresentational State Transfer (REST) is a style of web service architecture designed to map create, read, update, and delete operations with their corresponding HTTP verbs.

S

  • Salting

    Salting refers to adding a random token to a password before hashing it.

  • Secure Sockets Layer (SSL)

    The older and less secure predecessor of TLS is Secure Sockets Layer (SSL), and you will see both protocols used in a similar context.

  • Session Hijacking

    Session hijacking allows attackers to impersonate users by stealing or forging session identifiers. If attackers can hijack sessions, they can access user accounts without knowing passwords.

  • Sessions

    A session is a stateful conversation between a website and a user agent, such as a browser.

  • Social Engineering

    Social engineering is when an attacker interacts directly with your users or staff, in an effort to trick them into disclosing sensitive information or performing restricted actions.

  • SQL

    Structured Query Language (SQL) is a special purpose programming language for accessing and updating data in a relational database.

  • Symmetric Encryption

    If the same key is used to encrypt and decrypt data, we have a symmetric encryption algorithm.

U

  • URI Fragment

    The final (optional) part of the URL after the pound sign (#) is the URI fragment.

  • URLs

    A Uniform Resource Locator (URL) -- informally called a web address -- specifies the location of a resource on the internet.

W

  • Web Shell

    A web shell is a malicious script that an attacker plants on a web server, so they can run commands on the server by sending it HTTP requests.

  • Webhook

    A webhook is an HTTP request that one service sends to another service's URL when an event happens, such as a payment going through or code being pushed to a repository.

  • Worms

    A worm is a malicious program that replicates itself in order to spread to other systems.

Z

  • Zero-Day Exploits

    A zero-day vulnerability is a vulnerability that the application author has not yet become aware of.

  • Zip Bomb

    A zip bomb is a small compressed file that expands to an enormous size when it is extracted, filling up the disk or memory of whatever tries to open it.