- Difference Between Privilege Escalation Attack and IDOR Attack - 04/03/2024
- Exploring TISAX Version 6 – A Comprehensive Guide - 10/01/2024
- TLS Based Attacks - 11/12/2023
Confidentiality is the term used to describe information/data privacy which means the information is not made available or disclosed to unauthorized entities or individuals.
Integrity is the term used to describe information/data accuracy and completeness throughout its lifecycle. That means that the data cannot be modified by an unauthorized entities or individuals.
Availability is the term used to describe information/data being available when needed. Availability systems needs to remain available at all times preventing service disruptions due to the power outages, hardware failures or system upgrades.
Policy is defined as the criteria for security objectives and the organization’s security framework.
Process is step by step information which helps in specifying what would be next action and an implementation part.
Guideline is the recommendation is given to the applications or network, which can be customized and these can be used while creating any procedures.
Authentication is the process of determining if a user is legitimate to use the system and the network. Authentication is usually done using login and password. For example, you will use a username and password to access your email. The email server authenticates your username and password and provides further access.
Authorization refers to the access control rights. This implies every user on the network is allowed access to certain portions of data and information and applications according to his/her level in the organization. For example, a marketing person will not be able to record financial transactions. Hence, a user is authorized to perform only certain functions on the network system. These authorization levels are defined by the system administrator who has access to all the resources and user policies in the network.
Risk is any potential loss of, damage, or destruction of an asset as a result of threat exploiting a vulnerability. Risk is the intersection of assets, threats and vulnerabilities.
Vulnerability is a weaknesses or gaps that can be exploited by any threats to gain unauthorized access to an asset.
Threat is an outcome of a vulnerability that can get exploited, unintentionally or maliciously, to obtain, damage of destroy an asset.
SIEM is Security Information and Event Management software that provides a holistic view of what is happening on a network in real-time and help cyber security analyst to be more proactive in the fight against security threats.
MITM attack happens when a communication between two parties is intruded or intercepted by an outside entity.
DDOS (Distributed Denial of Service) when a network is flooded with large number of requests which is not recognized to handle and making the server unavailable to the legitimate requests.
Brute force is an attack in which the attacker tries to determine password for a target through permutation or fuzzing process.
Encoding is a technique that converts the data in a desired format required for exchange between different systems.
Hashing is a technique that maintains the integrity of a message or data. Any change done any day could be noticed.
Encryption is a technique that ensures that the data is secure and one needs a digital verification code or image in order to open it or access it.
Black hat hackers are those who hack without authority.
White hat hackers are authorized to perform a hacking attempt under signed NDA (non-disclosure agreement)
Grey hat hackers are white hat hackers who sometimes perform unauthorized activities.
Malware is a malicious software that infects your computer, such as computer viruses, worms, Trojan horses, spyware, and adware.
Hacking is a term used to describe actions taken by someone to gain unauthorized access to a computer.
Phishing is a technique wherein fake emails, text messages and websites created to look like they’re from authentic companies. They’re sent by criminals to steal personal and financial information from you. This is also known as “spoofing”.
Salt is a random data. When a properly protected password system receives a new password, it creates a hash value of that password, a random salt value, and then the combined value is stored in its database. This helps defend against dictionary attacks and known hash attacks.
SSL is Secure Socket Layer. It is a protocol which enables safe conversation between two or more parties. It is designed to identify and verify that the person you are talking to on the other end is who they say they are.
TLS is Transport Layer Security is another cryptographic protocol provides authentication and data encryption between servers, machines and applications. SSL is predecessor to TLS and they can be used together.
Virus is program which disrupts functionality of a legitimate software program. A virus can do advanced damages such as data leakage or stealing.
Worm is much like viruses, worms can automatically replicate and infect multiple files. Unlike viruses, they can operate within a computer without a host file and without attaching to an existing file. Many times, worms gain access to a computer via an email, while other times they enter the network through a vulnerability. Instead of targeting a single computer, worms typically seek to harm an entire network or open a backdoor for other malware.
Trojan is a software that is disguised as a legitimate or even beneficial program, and once a user enables them, they infect the computer. They are not self-replicating and can only be spread by user interaction, typically through email attachments or internet downloads.
XSS (cross-site scripting) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject malicious client-side scripts into web pages viewed by other users. XSS vulnerability may be used by attackers to bypass access controls such as the same-origin policy. XSS vulnerability attack can steal data, take control of a user’s session, run malicious code or used for phishing scam. they attack an application’s users, not the application or server. XSS attacks is to gather cookie data, as cookies are commonly and regularly used incorrectly to store information such as session IDs, user preferences or login information.
DMZ or demilitarized zone (sometimes referred to as a perimeter network or screened subnet) is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, usually a larger network such as the Internet.
VAPT is a complete sets of methods and practices that cyber security experts use to know the status of a website or portal or network, here status means how vulnerable that website is? you can say cyber security experts are those hackers who hack to your website and portals with your permission only to tell you how it can be exploited and how to patch it so, that no user can do any malicious activity.
Vulnerability assessment, is a process that defines, identifies, and classifies the security holes (vulnerabilities) in a computer, network, or communications infrastructure.
Penetration testing (also called pen testing) is the practice of testing a computer system, network or Web application to find vulnerabilities that an attacker could exploit.