ISC2 CSSLP: key terms

Flashcards for this exam ISC2 CSSLP guide Class dates

• Abuse CaseA description of how a user could intentionally misuse a system's functionality to cause harm, used to derive security requirements and tests.Intermediate
• Address Space Layout Randomization (ASLR)An OS exploit mitigation that randomizes where code, stack, heap and libraries are loaded in memory.Intermediate
• AddressSanitizer (ASan)A compiler-based runtime memory error detector that finds buffer overflows, use-after-free and similar bugs during testing.Advanced
• AFL++A widely used open-source coverage-guided fuzzer, the community-maintained successor to American Fuzzy Lop.Advanced
• Allowlist ValidationInput validation that accepts only values matching a known-good pattern or set and rejects everything else.Foundational
• Android App SigningSigning Android apps with a developer key so the OS can verify app origin and ensure updates come from the same developer.Advanced
• Android KeystoreAn Android system that stores cryptographic keys in a container that makes them hard to extract, often backed by secure hardware.Intermediate
• Android Network Security ConfigurationAn XML file that declares an Android app's network security settings, such as cleartext policy, trusted CAs and certificate pins.Advanced
• Android Runtime PermissionsAndroid's model requiring apps to request dangerous permissions, such as location or camera, from the user at runtime.Foundational
• Anti-CSRF TokenA secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.Foundational
• Anti-TamperingControls that detect or resist modification of an application's code, resources or runtime behavior.Intermediate
• API DiscoveryAutomatically identifying an organization's APIs and endpoints from traffic, gateways, code and cloud configurations.Intermediate
• API Schema ValidationRejecting API requests and responses that do not conform to a defined schema such as OpenAPI or JSON Schema.Intermediate
• App RepackagingDecompiling a legitimate app, modifying it (for example adding malware or removing checks), re-signing it and redistributing it.Intermediate
• App Transport Security (ATS)An iOS and macOS feature that requires apps to use HTTPS with strong TLS settings by default.Intermediate
• Application InventoryA maintained catalog of an organization's applications, APIs and components with owners, data classification and risk ratings.Foundational
• Application Security ProgramThe organizational structure, policies, tools and processes that manage security risk across an organization's software portfolio.Intermediate
• Artifact SigningCryptographically signing build artifacts or container images so consumers can verify their origin and integrity.Advanced
• Attack Surface AnalysisIdentifying and assessing all the points where an attacker could interact with or send input to an application.Foundational
• Attack TreeA hierarchical diagram with an attacker's goal at the root and the alternative ways to achieve it as child nodes.Intermediate
• Authentication BypassGaining access to protected functions without valid credentials due to flaws in authentication logic.Intermediate
• Auto-Escaping TemplateA templating engine feature that automatically output-encodes variables for their context unless explicitly marked safe.Intermediate
• Banned FunctionsUnsafe library functions that a secure coding standard prohibits because they commonly cause vulnerabilities.Intermediate
• Black-Box TestingTesting with no prior knowledge of the target's internals, simulating an external attacker; CompTIA calls it unknown-environment testing.Foundational
• Broken Access ControlOWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.Foundational
• Broken Authentication (API)API2:2023, weaknesses in API authentication mechanisms that let attackers assume other identities.Intermediate
• Broken Function Level Authorization (BFLA)API5:2023, failure to restrict access to administrative or privileged functions based on the caller's role.Intermediate
• Broken Object Level Authorization (BOLA)API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.Foundational
• Broken Object Property Level Authorization (BOPLA)API3:2023, failure to restrict which object properties a user can read or modify, combining excessive data exposure and mass assignment.Intermediate
• Bug Bounty ProgramA program in which organizations reward independent researchers for responsibly reporting security vulnerabilities.Foundational
• Build ProvenanceVerifiable metadata describing how, where, when and from what sources a software artifact was built.Advanced
• Building Security In Maturity Model (BSIMM)A descriptive software security maturity model built from observing the real practices of participating organizations.Advanced
• Business Logic VulnerabilityA flaw in the design or workflow of an application that allows misuse of legitimate functionality.Intermediate
• CanonicalizationConverting data to its standard, simplest form before validating or using it.Intermediate
• ClickjackingTricking a user into clicking something different from what they perceive by overlaying a transparent framed page.Foundational
• Client-Side ValidationInput checks performed in the browser or mobile app before data is sent to the server.Foundational
• Code InjectionA flaw in which input is evaluated as application code by the interpreter, such as through eval or dynamic includes.Intermediate
• Code ObfuscationTransforming code to make it harder to read and reverse engineer while preserving its behavior.Intermediate
• Code SigningDigitally signing software so users and systems can verify its publisher and that it has not been modified.Foundational
• Code Signing TimestampA trusted timestamp applied to a code signature so it remains valid after the signing certificate expires.Advanced
• Common Attack Pattern Enumeration and Classification (CAPEC)MITRE's catalog of common attack patterns describing how adversaries exploit known weaknesses.Intermediate
• Common Weakness Enumeration (CWE)A community-developed catalog of software and hardware weakness types, maintained by MITRE.Intermediate
• Compiler Hardening FlagsCompiler and linker options that add exploit mitigations and stricter checks to built binaries.Advanced
• Content Security Policy (CSP)An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.Intermediate
• Continuous Integration SecurityProtecting CI/CD systems, runners, secrets and pipeline definitions from tampering and misuse.Intermediate
• Control-Flow Integrity (CFI)A mitigation that restricts indirect calls and jumps to valid targets determined at compile time, blocking control-flow hijacking.Advanced
• Coordinated Vulnerability Disclosure (CVD)A disclosure model where a researcher privately reports a flaw and publication is delayed until the vendor can release a fix.Intermediate
• Coverage-Guided FuzzingFuzzing that uses instrumentation feedback about which code paths were executed to prioritize inputs that reach new code.Advanced
• Cross-Origin Resource Sharing (CORS)A browser mechanism using HTTP headers that lets a server allow specific other origins to read its responses.Intermediate
• Cryptographic FailuresOWASP Top 10 category for failures to protect data with appropriate cryptography, formerly called Sensitive Data Exposure.Foundational
• CWE Top 25MITRE's annually updated ranking of the most dangerous software weaknesses, based on CVE data, severity and exploitation.Intermediate
• CycloneDXAn OWASP SBOM standard (ECMA-424) designed for security use cases, supporting software, hardware, services, cryptographic assets and VEX data.Intermediate
• Data Execution Prevention (DEP)A mitigation that marks memory regions such as the stack and heap as non-executable, using the CPU's NX/XD bit.Intermediate
• Debug Mode in ProductionLeaving framework debug features, consoles or verbose diagnostics enabled on production systems.Foundational
• Deep Link HijackingAbuse of custom URL schemes or unverified links so a malicious app receives links intended for another app.Advanced
• Denylist ValidationInput validation that rejects values matching known-bad patterns and accepts everything else.Foundational
• Dependency ConfusionA supply chain risk in which a package manager installs a malicious public package instead of an internal private package with the same name.Intermediate
• Dependency PinningSpecifying exact versions (and ideally cryptographic hashes) of dependencies so builds use known, reviewed components.Intermediate
• DevSecOpsThe integration of security practices and automated security testing into every stage of the DevOps pipeline.Intermediate
• Double FreeCalling free on the same memory twice, which can corrupt the heap allocator and enable code execution.Advanced
• Double-Submit CookieA stateless CSRF defense in which a random value is sent both in a cookie and in a request parameter or header, and the server checks they match.Advanced
• DREADA threat risk-rating model scoring Damage, Reproducibility, Exploitability, Affected users and Discoverability.Intermediate
• Dynamic Application Security Testing (DAST)Testing a running application from the outside by sending crafted requests to find vulnerabilities.Intermediate
• Elevation of Privilege (EoP)Gaining capabilities beyond those that were authorized, such as a normal user gaining administrative rights.Foundational
• Excessive Data ExposureAn API flaw (API3:2019) where endpoints return more data than the client needs and rely on the client to filter it.Intermediate
• Executive Order 14028The May 2021 U.S. order 'Improving the Nation's Cybersecurity' that drove federal SBOM and secure development attestation requirements.Intermediate
• Exported Android ComponentAn Android activity, service, broadcast receiver or content provider that other apps can invoke.Advanced
• Fail-Safe DefaultsBase access decisions on explicit permission rather than exclusion, so the default is no access.Intermediate
• Final Security Review (FSR)A pre-release assessment confirming that all security requirements and SDL activities were completed and residual risks are accepted.Intermediate
• Format String VulnerabilityPassing user input as the format argument to functions such as printf, allowing memory reads or writes.Advanced
• Four Question FrameworkAdam Shostack's threat modeling structure: What are we working on, what can go wrong, what are we going to do about it, and did we do a good job?Intermediate
• FulcioSigstore's certificate authority that issues short-lived code-signing certificates bound to an OpenID Connect identity.Advanced
• Fuzz TestingAn automated testing technique that feeds large volumes of malformed, unexpected or random input to a program to find crashes and bugs.Foundational
• Fuzzing CorpusThe set of seed inputs a fuzzer starts from and grows as it finds inputs that reach new behavior.Advanced
• Fuzzing HarnessSmall code that connects a fuzzer to the function or API under test by passing generated input to it.Advanced
• Generation-Based FuzzingFuzzing that builds test inputs from a model, grammar or specification of the expected input format.Intermediate
• Gray-Box TestingTesting with partial knowledge of the target, such as user-level credentials or limited documentation; CompTIA's partially known environment.Foundational
• Hard-Coded CredentialsPasswords, API keys or cryptographic keys embedded directly in source code, scripts or binaries.Foundational
• Heap-Based Buffer OverflowWriting beyond the bounds of memory allocated on the heap, corrupting adjacent data or allocator metadata.Advanced
• Hermetic BuildA build that is fully isolated from the network and host environment, using only declared, pinned inputs.Advanced
• HTML SanitizationRemoving or neutralizing dangerous elements and attributes from user-supplied HTML while keeping safe formatting.Intermediate
• HTTP Security HeadersResponse headers that enable browser security features such as HSTS, CSP, frame restrictions and MIME sniffing protection.Intermediate
• HttpOnly Cookie AttributeA cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.Foundational
• Identification and Authentication FailuresOWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.Foundational
• IEC 62443-4-1The part of IEC 62443 that specifies secure product development lifecycle requirements for suppliers of industrial automation components.Advanced
• Improper Credential UsageMobile Top 10 2024 risk (M1) covering hard-coded credentials, insecure credential transmission and storage, and weak authentication of the app to backends.Foundational
• Improper Inventory ManagementAPI9:2023, failure to track API hosts, versions and endpoints, leaving old, debug or undocumented APIs exposed.Intermediate
• in-totoA framework (a CNCF graduated project) for securing software supply chains by creating signed attestations of each step and verifying them end to end.Advanced
• Information DisclosureExposure of information to someone not authorized to see it.Foundational
• Infrastructure as Code ScanningStatic analysis of Terraform, CloudFormation, Kubernetes manifests, Helm charts and similar templates for security misconfigurations before deployment.Intermediate
• InjectionOWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.Foundational
• Input ValidationChecking that all untrusted input conforms to expected type, length, format and range before it is processed.Foundational
• Insecure Communication (Mobile)Mobile Top 10 risk (M5) where an app transmits data without strong transport security or validates certificates improperly.Foundational
• Insecure Data Storage (Mobile)Storing sensitive data on a mobile device in a way that other apps, backups or someone with physical access can read.Foundational
• Insecure DeserializationDeserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.Intermediate
• Insecure DesignOWASP Top 10 category for flaws rooted in missing or ineffective security controls at the design level rather than implementation bugs.Intermediate
• Insecure Direct Object Reference (IDOR)An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.Foundational
• Insecure Password RecoveryWeak account recovery flows that let attackers reset other users' passwords.Intermediate
• Insecure RandomnessUsing a predictable random number generator for security-sensitive values such as tokens, keys or nonces.Intermediate
• Insufficient Binary ProtectionsMobile Top 10 2024 risk (M7) where app binaries lack protections against reverse engineering and tampering.Intermediate
• Integer OverflowAn arithmetic result that exceeds the maximum value of its integer type and wraps around, often leading to undersized buffers.Advanced
• Interactive Application Security Testing (IAST)Security testing that uses agents instrumented inside a running application to observe code execution and data flow during functional tests.Intermediate
• iOS KeychainApple's encrypted storage service for small secrets such as passwords, tokens and keys on iOS and macOS.Intermediate
• LDAP InjectionInjection that alters LDAP queries built from user input, potentially bypassing authentication or disclosing directory data.Intermediate
• Leveraging Existing ComponentsReuse proven, vetted security components instead of building new ones, to reduce attack surface and errors.Intermediate
• Log InjectionWriting unvalidated user input to logs, allowing forged entries, log parsing exploits or injection into log viewers.Intermediate
• Log4ShellA critical 2021 remote code execution vulnerability (CVE-2021-44228) in Apache Log4j 2 caused by JNDI lookups in logged strings.Foundational
• Malicious PackageAn open-source package intentionally published or modified to perform harmful actions such as stealing credentials or installing backdoors.Intermediate
• Mass AssignmentA vulnerability where a framework binds all request parameters to object properties, letting users set fields they should not control.Intermediate
• Memory-Safe LanguageA programming language that prevents memory errors such as buffer overflows and use-after-free by design.Intermediate
• Microsoft Security Development Lifecycle (SDL)Microsoft's prescriptive secure development process defining security practices from training and requirements through release and response.Intermediate
• Microsoft Threat Modeling ToolA free Microsoft application for drawing DFDs and automatically generating STRIDE-based threats.Intermediate
• Mishandling of Exceptional ConditionsOWASP Top 10 2025 category (A10) for improper error handling, failing open and logic errors under abnormal conditions.Intermediate
• MISRA CA set of C language coding guidelines from the Motor Industry Software Reliability Association for safety- and security-critical embedded systems.Advanced
• Misuse CaseA UML-style use case that models an actor performing actions the system should prevent, linked to the use cases it threatens.Intermediate
• Mobile App AttestationPlatform services that let a backend verify a request came from a genuine, unmodified app on a genuine device.Advanced
• Mobile App SandboxOperating system isolation that restricts each mobile app to its own data and resources unless granted permissions.Foundational
• Mutation-Based FuzzingFuzzing that creates test inputs by randomly modifying valid sample inputs.Intermediate
• Negative TestingTesting how software behaves with invalid, unexpected or malicious input and conditions.Foundational
• Null Pointer DereferenceAccessing memory through a pointer whose value is null, typically causing a crash and denial of service.Intermediate
• Off-by-One ErrorA boundary error where a loop or calculation uses one too many or too few iterations, often overwriting a single byte past a buffer.Advanced
• Open Source License ComplianceEnsuring that use of open-source components follows the obligations of their licenses.Intermediate
• Open Source Security Foundation (OpenSSF)A Linux Foundation project that improves the security of open-source software through tools, standards and best practices.Intermediate
• OpenSSF ScorecardAn automated tool that rates open-source projects on security practices such as branch protection, code review, signed releases and dependency updates.Advanced
• OS Command Injection PreventionDefenses that prevent user input from being executed as operating system commands.Intermediate
• OSS-FuzzGoogle's free continuous fuzzing service for critical open-source projects.Advanced
• Out-of-Bounds ReadReading memory outside the bounds of an allocated buffer, which can leak sensitive data or crash a program.Advanced
• Output EncodingConverting untrusted data into a safe representation for the specific context where it is output, such as HTML, JavaScript, URL or SQL.Foundational
• OWASP API Security Top 10OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.Foundational
• OWASP Application Security Verification Standard (ASVS)An OWASP standard listing testable security requirements for web applications and services at three verification levels.Intermediate
• OWASP Cheat Sheet SeriesA collection of concise OWASP guides giving developers specific defensive guidance on individual security topics.Foundational
• OWASP DevSecOps Maturity Model (DSOMM)An OWASP model that defines security activities for DevOps pipelines and rates their implementation across maturity levels.Advanced
• OWASP Mobile Application Security Testing Guide (MASTG)OWASP's comprehensive manual of techniques and test cases for verifying mobile apps against MASVS.Intermediate
• OWASP Mobile Application Security Verification Standard (MASVS)OWASP's standard of security requirements for mobile apps, organized into control groups and verified with the MASTG.Intermediate
• OWASP Mobile Top 10OWASP's list of the ten most critical security risks for mobile applications, last updated in 2024.Foundational
• OWASP Secure Coding PracticesOWASP's technology-agnostic checklist of secure coding practices, originally the Secure Coding Practices Quick Reference Guide.Foundational
• OWASP Threat DragonAn open-source OWASP threat modeling tool for creating diagrams and recording threats using STRIDE, LINDDUN, CIA and other methods.Intermediate
• OWASP Top 10OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.Foundational
• OWASP Top 10 CI/CD Security RisksAn OWASP list of the ten most significant security risks in CI/CD environments.Advanced
• OWASP Top 10 Proactive ControlsOWASP's list of the most important security techniques developers should apply in every project.Intermediate
• OWASP Web Security Testing Guide (WSTG)OWASP's comprehensive guide for testing the security of web applications and services, organized by test category with unique test IDs.Intermediate
• Parameter TamperingModifying request parameters such as prices, quantities, IDs or hidden fields to change application behavior.Foundational
• Path Traversal PreventionDefenses that stop user input from accessing files outside an intended directory.Intermediate
• Poisoned Pipeline Execution (PPE)A CI/CD risk in which an attacker who can modify pipeline configuration or build scripts gets malicious commands executed by the build system.Advanced
• Process for Attack Simulation and Threat Analysis (PASTA)A seven-stage, risk-centric threat modeling methodology that aligns technical threats with business objectives.Intermediate
• Protocol FuzzingFuzzing network protocol implementations by sending malformed or out-of-sequence messages.Advanced
• Reachability AnalysisDetermining whether vulnerable code in a dependency is actually called by the application, to prioritize SCA findings.Advanced
• Reflected Cross-Site ScriptingXSS in which a malicious script in a request is immediately echoed in the response without proper encoding.Foundational
• Regular Expression Denial of Service (ReDoS)A denial of service caused by a regular expression that takes exponential time to evaluate certain inputs due to catastrophic backtracking.Advanced
• RekorSigstore's public, append-only transparency log that records signing events and attestations.Advanced
• Reproducible BuildA build process that produces bit-for-bit identical output from the same source, allowing anyone to verify that a binary matches its source.Advanced
• RepudiationA user or system denying that it performed an action because there is insufficient evidence to prove otherwise.Foundational
• Requirements Traceability Matrix (RTM)A table that maps each requirement to its design elements and test cases to show it is implemented and verified.Intermediate
• Root and Jailbreak DetectionMobile app checks that determine whether a device has been rooted (Android) or jailbroken (iOS), indicating weakened platform security.Intermediate
• Runtime Application Self-Protection (RASP)Security technology embedded in an application's runtime that detects and blocks attacks in real time using application context.Intermediate
• Safe HarborA commitment in a disclosure policy not to pursue legal action against researchers acting in good faith within the stated rules.Intermediate
• Saltzer and Schroeder Design PrinciplesEight classic secure design principles from 1975 that underpin modern secure software design.Intermediate
• Same-Origin Policy (SOP)A browser security model that restricts scripts on one origin from reading data from another origin.Foundational
• SameSite Cookie AttributeA cookie attribute (Strict, Lax or None) controlling whether a cookie is sent with cross-site requests, mitigating CSRF.Intermediate
• SAST False Positive ManagementProcesses for triaging, suppressing and tuning static analysis results so developers trust and act on findings.Intermediate
• SBOM Minimum ElementsThe baseline data fields an SBOM must contain, defined by the U.S. NTIA in 2021 and updated by CISA.Advanced
• Screen Capture ProtectionMobile controls that prevent sensitive screens from appearing in screenshots, screen recordings or the app switcher.Advanced
• Secure Code ReviewManual examination of source code to find security flaws, often focused on high-risk components and guided by checklists and tool output.Foundational
• Secure Coding StandardAn organization's documented rules for writing code that avoids known vulnerability classes.Foundational
• Secure Cookie AttributeA cookie flag that instructs browsers to send the cookie only over HTTPS connections.Foundational
• Secure Error HandlingHandling errors and exceptions so the application fails securely, reveals minimal information and logs useful detail internally.Foundational
• Secure Firmware UpdateA device update mechanism that delivers firmware authenticated by digital signature, protected in transit and resistant to rollback.Intermediate
• Secure Software Development Attestation FormA CISA form in which software producers attest that they follow key secure development practices derived from NIST SSDF.Advanced
• Secure Software Development Framework (SSDF)NIST SP 800-218, a set of high-level secure software development practices grouped into Prepare, Protect, Produce and Respond categories.Intermediate
• Secure Software Development Life Cycle (SSDLC)A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.Foundational
• Security ChampionA developer or engineer embedded in a product team who acts as the team's security advocate and liaison to the security group.Foundational
• Security DebtAccumulated unresolved security flaws and deferred security work in software, which increase risk over time.Foundational
• Security GateA checkpoint in the SDLC or CI/CD pipeline where defined security criteria must be met before work proceeds.Foundational
• Security Logging and Monitoring FailuresOWASP Top 10 category for insufficient logging, detection, alerting and response that allows breaches to go unnoticed.Foundational
• Security MisconfigurationOWASP Top 10 category for insecure default, incomplete or ad hoc configurations across the application stack.Foundational
• Security Regression TestingRe-running security tests after changes to confirm that previously fixed vulnerabilities have not returned.Foundational
• Security RequirementsStatements of what security properties and controls software must provide, defined early in the SDLC alongside functional requirements.Foundational
• Security Test CaseA documented test that verifies a specific security requirement or control behaves as intended.Foundational
• Security User StoryAn agile user story written to capture a security requirement, often from the viewpoint of a defender or attacker.Foundational
• security.txtA standard file (RFC 9116) placed at /.well-known/security.txt that tells researchers how to report security vulnerabilities to an organization.Intermediate
• SEI CERT Coding StandardsLanguage-specific secure coding rules from Carnegie Mellon's Software Engineering Institute for C, C++, Java, Perl and Android.Intermediate
• SemgrepAn open-source, pattern-based static analysis tool that scans code for bugs and security issues using rules that resemble source code.Intermediate
• Separation of PrivilegeRequire more than one condition, key or party to grant access to sensitive functions.Intermediate
• Session FixationAn attack in which the attacker sets a victim's session ID before login and then uses it after the victim authenticates.Intermediate
• Session ID in URLPassing session tokens in URL query strings or paths, which exposes them in logs, history and Referer headers.Foundational
• Session InvalidationDestroying a session on the server so its identifier can no longer be used, such as at logout or password change.Foundational
• Session ManagementThe secure creation, maintenance and termination of user sessions after authentication.Foundational
• Session TimeoutAutomatic expiration of a session after inactivity (idle timeout) or after a maximum lifetime (absolute timeout).Foundational
• Session Token EntropyThe unpredictability of a session identifier, which must be high enough that guessing a valid one is infeasible.Intermediate
• Shadow APIAn API endpoint that is undocumented or unknown to the security team and therefore unmanaged.Intermediate
• Shift LeftThe practice of moving testing, security, and quality activities earlier in the software delivery lifecycle.Foundational
• SigstoreAn open-source project (OpenSSF) providing free tooling and public infrastructure for signing and verifying software artifacts.Advanced
• SLSA Build LevelsThe graded levels of the SLSA Build track that describe increasing guarantees about how an artifact was built.Advanced
• Software and Data Integrity FailuresOWASP Top 10 category for code and infrastructure that do not protect against integrity violations, such as untrusted updates and insecure deserialization.Intermediate
• Software Assurance (SwA)The level of confidence that software is free from vulnerabilities and functions as intended throughout its life cycle.Foundational
• Software Assurance Maturity Model (SAMM)OWASP's open framework for assessing and improving an organization's software security posture across five business functions.Intermediate
• Software Bill of Materials (SBOM)A formal, machine-readable inventory of all components and dependencies in a piece of software.Intermediate
• Software Composition Analysis (SCA)Identifying open-source and third-party dependencies in software and checking them for known vulnerabilities and license issues.Intermediate
• Software Package Data Exchange (SPDX)An open standard (ISO/IEC 5962:2021) from the Linux Foundation for communicating SBOM information, including components, licenses and relationships.Intermediate
• Software Security Group (SSG)The central team responsible for an organization's software security initiative.Advanced
• Software Supply Chain FailuresOWASP Top 10 2025 category (A03) for compromises or weaknesses in dependencies, build systems and distribution infrastructure.Intermediate
• Software Supply Chain SecurityProtecting the integrity, provenance and security of all code, dependencies, tools and processes used to build and deliver software.Intermediate
• SolarWinds Supply Chain AttackThe 2020 compromise in which attackers inserted the SUNBURST backdoor into SolarWinds Orion builds, which were signed and distributed to about 18,000 customers.Foundational
• SonarQubeA code quality and security platform (from SonarSource) that performs static analysis for bugs, code smells, vulnerabilities and security hotspots.Intermediate
• SpoofingPretending to be another user, system or component in order to gain its access or trust.Foundational
• SQL Injection PreventionThe set of defenses that stop SQL injection, led by parameterized queries and supported by validation and least privilege.Foundational
• SSRF PreventionDefenses that stop an application from being used to send requests to unintended internal or external destinations.Intermediate
• Stack CanaryA random value placed before the return address on the stack and checked before a function returns, detecting stack buffer overflows.Intermediate
• Stack-Based Buffer OverflowWriting past the end of a buffer allocated on the call stack, which can overwrite the saved return address and hijack execution.Intermediate
• Static Application Security Testing (SAST)Analyzing source code, bytecode, or binaries for security vulnerabilities without executing the application.Intermediate
• Static Code Analysis Taint AnalysisA static analysis technique that tracks untrusted data from sources to dangerous sinks to find injection-type flaws.Advanced
• Stored Cross-Site ScriptingXSS in which a malicious script is saved by the application and later served to other users.Foundational
• STRIDEMicrosoft's threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.Foundational
• STRIDE per ElementA threat modeling technique that applies only the STRIDE categories relevant to each DFD element type.Advanced
• Subresource Integrity (SRI)A browser feature that verifies scripts or stylesheets loaded from third parties against a cryptographic hash in the HTML tag.Intermediate
• Supply-chain Levels for Software Artifacts (SLSA)An OpenSSF security framework of graduated levels for ensuring the integrity of build processes and artifact provenance.Advanced
• Symbolic Link AttackExploiting a privileged process that follows an attacker-created symbolic link to read or overwrite a protected file.Advanced
• TamperingUnauthorized modification of data, code or configuration in transit, at rest or in memory.Foundational
• Threat Model Data Flow Diagram (DFD)A diagram of processes, data stores, external entities, data flows and trust boundaries used as the basis for threat modeling.Intermediate
• Threat Modeling as CodeDefining system models and threat rules in code or structured files stored with the application, so threat models are versioned and generated automatically.Advanced
• Time-of-Check to Time-of-Use (TOCTOU)A race condition in which a resource changes between the time it is checked and the time it is used.Intermediate
• Timing AttackInferring secret information by measuring how long operations take.Advanced
• TrikeA risk-based threat modeling methodology that starts from a requirements model of actors, assets and allowed actions.Advanced
• Unicode NormalizationConverting equivalent Unicode character sequences to a single standard form (NFC, NFD, NFKC or NFKD) before comparison or validation.Advanced
• Unrestricted Access to Sensitive Business FlowsAPI6:2023, exposure of a business flow (such as purchasing or posting) to automated abuse that harms the business, even without a code bug.Intermediate
• Unrestricted File UploadAllowing users to upload files without adequately validating type, content, name and size, which can lead to code execution or stored XSS.Foundational
• Unrestricted Resource ConsumptionAPI4:2023, APIs that do not limit the resources a request or client can consume, enabling denial of service or cost exhaustion.Intermediate
• Unsafe Consumption of APIsAPI10:2023, trusting data from third-party APIs more than user input, leading to injection, redirects or data exposure.Intermediate
• Unsafe ReflectionUsing user-controlled input to choose which classes or methods an application loads or invokes via reflection.Advanced
• Use-After-Free (UAF)Using a pointer to memory after it has been freed, which may now hold attacker-controlled data.Advanced
• Username EnumerationDetermining which usernames or emails are valid from differences in an application's responses.Foundational
• Verbose Error MessageAn error message that reveals internal details such as stack traces, queries, file paths or software versions.Foundational
• Verification and Validation (V&V)Verification checks that software is built correctly against its specifications; validation checks that the right software was built for user needs.Intermediate
• Virtual PatchingBlocking exploitation of a known vulnerability with an external control such as a WAF or IPS rule while the code fix is pending.Intermediate
• Visual, Agile and Simple Threat modeling (VAST)A scalable threat modeling methodology that produces separate application and operational threat models for agile enterprises.Advanced
• Vulnerability Disclosure Policy (VDP)A public policy explaining how external parties can report vulnerabilities and what they can expect in return.Foundational
• Vulnerability Remediation SLAA defined maximum time to fix a vulnerability based on its severity or risk rating.Foundational
• Vulnerable and Outdated ComponentsOWASP Top 10 2021 category for using libraries, frameworks or platforms with known vulnerabilities or that are unsupported.Foundational
• Weakest LinkA system is only as secure as its weakest component, so defenses should be balanced.Foundational
• WebView SecuritySecure configuration of embedded browser components in mobile apps to prevent XSS escalation and data exposure.Advanced
• White-Box TestingTesting with full knowledge of the target, including source code, architecture and credentials; called known-environment testing by CompTIA.Foundational
• XML BombA small XML document using nested entity expansion to consume huge amounts of memory and crash the parser.Advanced
• XML External Entity (XXE)A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.Intermediate
• XPath InjectionInjection that modifies XPath queries against XML data by inserting crafted input.Advanced
• XZ Utils BackdoorA 2024 supply chain compromise (CVE-2024-3094) in which a long-term contributor inserted a backdoor into the xz/liblzma compression library.Intermediate
• ZAPAn open-source dynamic application security testing proxy and scanner, formerly OWASP ZAP and now maintained under Checkmarx sponsorship as ZAP by Checkmarx.Intermediate
• Zip SlipA path traversal vulnerability in archive extraction where entries with ../ in their names are written outside the target directory.Advanced
• Zombie APIA deprecated or retired API version that is still deployed and reachable.Intermediate