This glossary will be updated on a regular basis. Interested in contributing? Email the Fuel editors at editor@fuelusergroup.org.  

 

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

Access Control List: A mechanism to control system resources within a network by listing the identities that persons and/or systems are permitted access to, and/or denied access to.

Attack Vectors: A means in which an attacker gains entry or access to a target system. Attackers’ methods are primarily via a human element or other known weak elements for systems that aren’t properly patched.

Application Programming Interface (API): A set of functions and procedures allowing the creation of applications that access the features or data of an operating system, application or other service.

Authentication: The process of identifying a piece of information or a connection. This can be done using username and password combinations, biometric methods like fingerprints or retinal scans, etc. (This is sometimes confused with Encryption.)

 

B

Backdoor: A tool installed after a compromise has occurred to allow attacker(s) easier access into the system at a later time.

Blue Team: A group that defends a network when mock attackers (i.e. Red Team) attempt to gain access. This is normally in conjunction with an operational exercise conducted according to a set of rules by a governing body (i.e. White Team).

Botnet: A large collection of compromised systems working in conjunction to perform a targeted task. This can include the distribution of viruses and/or spyware, the flooding of a network to perform an overload or denial of service attack, or any of several other uses.

Broadcast Address: The broadcast address is the last IP address in a subnet. This is used to send a message to all addresses on the given subnet, normally using either the UDP or ICMP protocols.

 

D

Data Breach: The occurrence of the disclosure of previously secured, often confidential information. 

DMZ (Demilitarized Zone): A subnet or zone that is exposed to the internet for external access while being segregated from internal network resources. Traditionally, this information has an extra level of protection and is more finely controlled, allowing companies to share information with the internet at large while still keeping their internal resources secured.

DoS (Denial of Service): An attack specifically intended to overload the resources on a network preventing normal functionality. Flooding attacks, connection exhaustion and resource demand are three of the most common methods of DoS attacks, but there are many others. 

DDoS (Distributed Denial of Service): An attack from multiple systems that simultaneously attacks a system. Attacking systems are typically part of a botnet that can be dynamically sized to orchestrate the attack. All DDoS are DoS, but not all DoS are DDoS.

 

E

Encryption: The process of converting information into an encoded string so the information is obfuscated as it is being sent across the internet, preventing other parties from reading the information. This encryption is done in many different ways depending on the endpoints and the need for the level of complexity of the data being protected. It can be done using many different cyphers including, but not limited to, AES (in multiple bit lengths), DES, 3DES and many more. (This is sometimes confused with Authentication.)

 

F

Firewall: A security tool that protects your network by filtering traffic. This can be done in many ways, including hardware or software solutions and commercial or open source tools. It can also be implemented in many different tiers depending on the level of protection a network needs.

 

G

Graphical User Interface (GUI): The component of a program that allows users to interact with electronic devices through graphical icons instead of text-based user interfaces, typed command labels or text navigation.

 

H

Honeypot: A trap or decoy for attackers. A honeypot is intended to look like a real resource that a company would publish, in an attempt to lure hackers to target it instead of real resources. The false system of the honeypot, in conjunction with what looks like legitimate data, will cause attackers to waste time trying to gain access to information that is, in truth, worthless.

Hypervisor: Software that creates and runs virtual machines. Also known as a virtual machine monitor (VMM). See Infrastructure as a Service (IaaS) for additional information.

 

I

Identity and Access Management (IAM): A framework of policies and technologies for ensuring that the proper people in an enterprise have the appropriate access to technology resources.

Infrastructure as a Service (IaaS): Services are a category or cloud computing that provides high-level APIs to dereference various low-level details of underlying network infrastructure like physical computing resources, location, data partitioning, scaling, security and backup. A hypervisor runs the virtual machines as guests. Pools of hypervisors within the cloud operational system can support large numbers of virtual machines and the ability to scale services up and down according to customers' varying requirements.

IDS (Intrusion Detection System): This is a system that actively look for users attempting to access resources within a network. This system will then notify the administrators of “unusual activity,” allowing the security administrators to look into said activity to confirm whether it is an actual attack or a false positive being reported.

IPS (Intrusion Protection System): Used in conjunction with IDS, this is a system that can automatically take action against unauthorized access attempts or intrusion attempts in addition to notifying the security administrators of the activity.

 

K

Keylogger: A means of keeping track of the entries into a computer, whether it is through a keyboard, mouse or any other kind of input device. Keyloggers can be hardware-based, software-based or any combination of both.

 

L

Loopback address: A pseudo-IP address (127.0.0.1 for IPv4  or ::1/128 for IPv6) allowing for easy access to map back to the current system being used, while never touching the network beyond the current system — meaning it keeps the data on the current machine.

 

M

MAC Address: The physical address of the network interface card that uniquely identifies the machine that is communicating on the internet.

Malware: A generic term intended to cover all of the different types of malicious code out there, including viruses, spyware, etc. Essentially, it refers to any code that is “malicious,” hence the “mal” prefix.

 

N

NAT (Network Address Translation): This process is used to share a single or smaller number of publicly available IP addresses, preventing the need for a one-to-one pairing. This allows for the internal network of a company to use whatever IP address scheme they’d like to organize their network — be it logically, physically or some combination of both.

 

O

OAuth (Open Standard Authorization): Protocol or framework that provides applications the ability to access other applications using tokens instead of passwords. (Varonis describes this as a valet key for your car: It will start the car, but not grant access to the trunk or glove box.) Used mainly by apps or the Internet of Things (IoT).

 

P

Penetration (“Pen") Test: A term for the testing of a network’s security from the outside world in a somewhat controlled manner. This allows an organization to see how secured or protected a network is from attacks.

Phishing: A form of social engineering to trick or deceive individuals into providing information that can be used to gain additional access to systems.

Platform as a Service (PaaS): A category of cloud computing services that provides a platform allowing customers to develop, run and manage applications without the complexity of building and maintaining the underlying infrastructure (physical components) typically associated with developing and launching an app. Also known as application platform as a service or platform-based service.

Private Key: A cryptographic key that is used to enable the operation of an asymmetric (public key) cryptographic algorithm that should be kept confidential. Private keys are never to be transmitted across the internet — that’s what public keys are for.

Public Key: The other half of a private key, this is what is passed out to any remote sites that need to make a secure connection to a site a user controls. This public key is then paired to a private key on the destination server to make a secure, encrypted handshake.

 

R

Ransomware: A type of malware that locks a user out of their files or device until a ransom is paid, usually in bitcoin or other crypto currency.

Red Team: A group authorized to perform a simulated, controlled attack on a network. This can be done as part of a cyber competition, part of a penetration test, or done in working on learning more about certified ethical hacking and related technologies.

Rootkit: A set of software tools that allow for administrator-level access and privileges that are installed on a system, with the intention of hiding their presence until they are necessary.

 

S

SAML (Security Assertion Markup Language): XML-based open standard that enables SSO to pass credentials from an identity provider (like Active Directory) to a service provider (like an SaaS application). Used mainly by users, and not applications.

Secure Sockets Layer (SSL): See Transport Layer Security (TLS).

SSH (Secure Shell): A command line-based interface into a system that doubles as a protocol for making a secured connection into a system. This allows for secure, encrypted sending of commands to a remote system most commonly used when accessing ix-based systems (Unix, Linux, AIX, etc.).

SOC (Security Operations Center): The team that is responsible for monitoring, assessing and defending the security of a firm.

Software as a Service (SaaS): A software licensing and delivery model in which software is licensed on a subscription basis and is centrally hosted by a third party. It is sometimes referred to as "on-demand software." Also known as subscribeware or rentware.

Spoofing: Pretending to be someone else by faking the sender email address in a communication. This is a very common method used when trying to make a phishing attack to gain information via social engineering.

SSO (Single Sign On): The process that allows users within an organization to access different resources with a single set of credentials.

Spyware: Intended to infiltrate and collect data unknown to the user for later use to attack and/or compromise systems.

 

T

TIPSec Tunnel: A secure connection between two remote systems. This is a many-to-many type of tunnel, allowing for multiple machines on either network to communicate with each other over an encrypted connection.

Tunnel: A connection between two networks, allowing for communication at a Layer 2 Protocol level. This allows for TCP communication and, along with the proper authentication and encryption methods, the data can also be encoded in a manner preventing others for inspecting and reading the traffic.

Transport Layer Security (TLS): A cryptographic protocol designed to provide communications security over a computer network. Now-deprecated predecessor was Secure Sockets Layer (SSL).

Trojan (Trojan Horse): Malware that misleads users as to its true intent. Typically, must be invited in by the unsuspecting user (akin to the Greek myth).

 

V

Virus: Primarily intended to attack and damage systems.

VPN (Virtual Private Network): A secure connection between a remote system and another network. This is a one-to-many type of IPSec tunnel connection.

 

W

Web Application Firewall (WAF): Used to filter, monitor and block HTTP traffic to and from a web application. A WAF is different from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers.

White Team: The group that oversees an engagement between a Red Team, or teams of mock attackers, and a Blue Team, or teams of defenders of information systems.

Whitelist: A list of entries that are explicitly granted permission or access to a given system.