Security Glossary

Cross-Site Scripting

An attacker injects malicious client-side scripts into a webpage. When other users view the page, the script executes in their browser, allowing the attacker to steal cookies or perform phishing.

Cross-Site Request Forgery

Inducing an authenticated user to unknowingly send unintended requests to a trusted website by leveraging the user's active session credentials.

SQL Injection

Inserting malicious SQL statements into web form inputs or query strings to manipulate the back-end database query logic.

JSON Web Token

An open standard (RFC 7519) used for securely transmitting information between parties as a JSON object.

HTTP Strict Transport Security

A security mechanism that informs browsers via a response header to only interact with the site using HTTPS, prohibiting insecure HTTP connections.

Content Security Policy

An added layer of security that allows website administrators to declare which external resources (JS, CSS, images) are permitted to load and execute.

Salting

Adding a unique random string to a plaintext password before hashing it to defend against rainbow table attacks.

Pepper

Similar to salting, but a 'pepper' is usually a global secret stored in code or a hardware security module rather than the database.

Insecure Direct Object Reference

A vulnerability where an application allows users to access unauthorized data by modifying identifiers (such as IDs) in a request.

Server-Side Request Forgery

A vulnerability where an attacker induces a server-side application to make requests to an arbitrary URL of the attacker's choosing.

Cross-Origin Resource Sharing

A mechanism that uses HTTP headers to tell browsers to give a web application running at one origin access to selected resources from a different origin.

Path Traversal

Exploiting insufficient input validation to access files and directories outside the web root folder using characters like '../'.

Clickjacking

Using transparent layers or iframes to overlay a webpage, tricking users into clicking hidden buttons or links.

SameSite Attribute

A cookie attribute used to control whether cookies are sent with cross-site requests, primarily to mitigate CSRF.

HttpOnly Attribute

An attribute that prevents client-side scripts (like JavaScript) from accessing cookies, mitigating session theft via XSS.

Secure Attribute

A cookie attribute that ensures the cookie is only transmitted over encrypted HTTPS connections.

Rate Limiting

Restricting the number of requests a user or IP address can make within a specific timeframe.

Brute Force Attack

An attempt to gain access by systematically trying all possible combinations of passwords or codes.

Credential Stuffing

A type of attack where stolen account credentials from one platform are used to gain unauthorized access to other systems.

Session Hijacking

An attack where the attacker gains unauthorized access to information or services by stealing or predicting a valid Session ID.

Session Fixation

An attack where the attacker provides a valid Session ID to a victim and induces them to log in with it, thereby gaining control over the session.

Authorization Framework

An authorization protocol that allows third-party applications to obtain limited access to user resources on another service without sharing the password.

OpenID Connect

An identity layer built on top of the OAuth 2.0 protocol used to verify the identity of the end-user.

Role-Based Access Control

A method of regulating access to resources based on the roles of individual users within an organization.

Attribute-Based Access Control

An authorization model that provides access based on attributes of the user, the resource, and the environment.

Multi-Factor Authentication

A security process that requires users to provide two or more different factors to verify their identity.

Hashing

A one-way function that converts input of any length into a fixed-length output string, which is irreversible.

Rainbow Table

A precomputed table for reversing cryptographic hash functions, usually for cracking password hashes.

Advanced Encryption Standard

A symmetric encryption algorithm standard where the same key is used for both encryption and decryption.

Asymmetric Encryption Algorithm

An asymmetric encryption algorithm that uses a public key for encryption and a private key for decryption.

Transport Layer Security

A protocol that provides authentication and data encryption between different endpoints.

Subresource Integrity

A security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation.

X-Frame-Options Header

An HTTP response header used to indicate whether a browser should be allowed to render a page in a frame, iframe, or object.

X-Content-Type-Options Header

A header used by the server to prevent the browser from 'guessing' the MIME type of a file (MIME sniffing).

Web Application Firewall

A firewall that monitors and filters HTTP traffic between a web application and the internet to protect against attacks like SQLi and XSS.

Intrusion Detection/Prevention System

IDS monitors network traffic for suspicious activity; IPS blocks suspicious activity when it is discovered.

CAPTCHA

A type of challenge-response test used in computing to determine whether or not the user is human.

Zero Trust Architecture

A security framework requiring all users to be authenticated, authorized, and continuously validated before being granted access to data.

Principle of Least Privilege

The concept that a user or program should only have access to the specific data and resources needed to complete a task.

Defense in Depth

An information security strategy that uses multiple layers of security controls throughout an IT system.

Attack Surface

The sum total of all possible entry points and vulnerabilities in a system that an attacker can exploit.

Penetration Testing

A simulated cyberattack against your computer system to check for exploitable vulnerabilities.

Vulnerability Scanning

An automated process to identify security vulnerabilities in a system or network.

Static Application Security Testing

Scanning and analyzing source code for security vulnerabilities without executing the code.

Dynamic Application Security Testing

Testing an application in its running state to find security vulnerabilities through external inputs.

Software Composition Analysis

Analyzing third-party open-source libraries used in a project for known security vulnerabilities.

Common Vulnerabilities and Exposures

A list of publicly disclosed cybersecurity vulnerabilities, each assigned a unique identification number.

Zero-Day Vulnerability

A vulnerability in software that is unknown to the vendor and has no patch available.

Open Redirect

When an application redirects a user to an external, potentially malicious website specified in a URL parameter.

Command Injection

When an attacker executes arbitrary system commands on the host operating system via a vulnerable application.