Application & OT Security terms

Study this subject with thinQcards™

• Abuse CaseA description of how a user could intentionally misuse a system's functionality to cause harm, used to derive security requirements and tests.Intermediate
• Active ReconnaissanceGathering information by directly interacting with target systems, such as scanning or probing services.Foundational
• Address Space Layout Randomization (ASLR)An OS exploit mitigation that randomizes where code, stack, heap and libraries are loaded in memory.Intermediate
• AddressSanitizer (ASan)A compiler-based runtime memory error detector that finds buffer overflows, use-after-free and similar bugs during testing.Advanced
• AFL++A widely used open-source coverage-guided fuzzer, the community-maintained successor to American Fuzzy Lop.Advanced
• Allowlist ValidationInput validation that accepts only values matching a known-good pattern or set and rejects everything else.Foundational
• Android App SigningSigning Android apps with a developer key so the OS can verify app origin and ensure updates come from the same developer.Advanced
• Android KeystoreAn Android system that stores cryptographic keys in a container that makes them hard to extract, often backed by secure hardware.Intermediate
• Android Network Security ConfigurationAn XML file that declares an Android app's network security settings, such as cleartext policy, trusted CAs and certificate pins.Advanced
• Android Runtime PermissionsAndroid's model requiring apps to request dangerous permissions, such as location or camera, from the user at runtime.Foundational
• Anti-CSRF TokenA secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.Foundational
• Anti-Rollback ProtectionA mechanism that prevents installing older, vulnerable firmware or software versions after an update.Advanced
• Anti-TamperingControls that detect or resist modification of an application's code, resources or runtime behavior.Intermediate
• API DiscoveryAutomatically identifying an organization's APIs and endpoints from traffic, gateways, code and cloud configurations.Intermediate
• API Schema ValidationRejecting API requests and responses that do not conform to a defined schema such as OpenAPI or JSON Schema.Intermediate
• API Security TestingTesting APIs for authentication, authorization, input handling, rate limiting and business logic flaws, guided by the API specification.Intermediate
• App RepackagingDecompiling a legitimate app, modifying it (for example adding malware or removing checks), re-signing it and redistributing it.Intermediate
• App Transport Security (ATS)An iOS and macOS feature that requires apps to use HTTPS with strong TLS settings by default.Intermediate
• Application InventoryA maintained catalog of an organization's applications, APIs and components with owners, data classification and risk ratings.Foundational
• Application Security ProgramThe organizational structure, policies, tools and processes that manage security risk across an organization's software portfolio.Intermediate
• Assumed BreachA testing approach that starts with attacker access already inside the environment to focus on post-compromise detection and impact.Intermediate
• Attack NarrativeA chronological story in a pen test report describing how testers moved from initial access to their objective.Intermediate
• Attack Surface AnalysisIdentifying and assessing all the points where an attacker could interact with or send input to an application.Foundational
• Attack TreeA hierarchical diagram with an attacker's goal at the root and the alternative ways to achieve it as child nodes.Intermediate
• Authentication BypassGaining access to protected functions without valid credentials due to flaws in authentication logic.Intermediate
• Authorization LetterWritten permission from an asset owner allowing testers to attack specified systems, sometimes called a get-out-of-jail-free letter.Foundational
• Auto-Escaping TemplateA templating engine feature that automatically output-encodes variables for their context unless explicitly marked safe.Intermediate
• BACnetBuilding Automation and Control Networks, an ASHRAE/ISO standard protocol for HVAC, lighting, access control and other building systems.Advanced
• Banned FunctionsUnsafe library functions that a secure coding standard prohibits because they commonly cause vulnerabilities.Intermediate
• Black-Box TestingTesting with no prior knowledge of the target's internals, simulating an external attacker; CompTIA calls it unknown-environment testing.Foundational
• Blind Server-Side Request ForgerySSRF in which the attacker cannot see the response but can still make the server send requests.Advanced
• Blind SQL InjectionSQL injection where the application does not return query results or errors, so impact is inferred from behavior or timing.Intermediate
• Breach and Attack Simulation (BAS)Automated platforms that continuously run safe simulated attacks to validate whether security controls detect and block them.Intermediate
• Broken Access ControlOWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.Foundational
• Broken Authentication (API)API2:2023, weaknesses in API authentication mechanisms that let attackers assume other identities.Intermediate
• Broken Function Level Authorization (BFLA)API5:2023, failure to restrict access to administrative or privileged functions based on the caller's role.Intermediate
• Broken Object Level Authorization (BOLA)API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.Foundational
• Broken Object Property Level Authorization (BOPLA)API3:2023, failure to restrict which object properties a user can read or modify, combining excessive data exposure and mass assignment.Intermediate
• Bug Bounty ProgramA program in which organizations reward independent researchers for responsibly reporting security vulnerabilities.Foundational
• Build ProvenanceVerifiable metadata describing how, where, when and from what sources a software artifact was built.Advanced
• Building Security In Maturity Model (BSIMM)A descriptive software security maturity model built from observing the real practices of participating organizations.Advanced
• Burp SuiteA widely used web application security testing platform from PortSwigger built around an intercepting proxy.Intermediate
• Business Logic VulnerabilityA flaw in the design or workflow of an application that allows misuse of legitimate functionality.Intermediate
• CanonicalizationConverting data to its standard, simplest form before validating or using it.Intermediate
• CAPTCHAA challenge-response test intended to distinguish humans from automated bots.Foundational
• Capture the Flag (CTF)A security competition or training exercise in which participants solve challenges to find hidden 'flags'.Foundational
• CBESTThe Bank of England's intelligence-led penetration testing framework for UK financial institutions and critical market infrastructure.Advanced
• CensysAn internet-wide scanning and search platform for hosts, services and certificates.Intermediate
• Certificate Transparency (CT)Public, append-only logs of issued TLS certificates that let anyone monitor which certificates exist for a domain.Intermediate
• CheckovAn open-source IaC static analysis tool (from Prisma Cloud by Palo Alto Networks) that scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more.Intermediate
• ClickjackingTricking a user into clicking something different from what they perceive by overlaying a transparent framed page.Foundational
• Client-Side ValidationInput checks performed in the browser or mobile app before data is sent to the server.Foundational
• Code InjectionA flaw in which input is evaluated as application code by the interpreter, such as through eval or dynamic includes.Intermediate
• Code ObfuscationTransforming code to make it harder to read and reverse engineer while preserving its behavior.Intermediate
• Code SigningDigitally signing software so users and systems can verify its publisher and that it has not been modified.Foundational
• Code Signing TimestampA trusted timestamp applied to a code signature so it remains valid after the signing certificate expires.Advanced
• Common Attack Pattern Enumeration and Classification (CAPEC)MITRE's catalog of common attack patterns describing how adversaries exploit known weaknesses.Intermediate
• Common Vulnerabilities and Exposures (CVE)A public dictionary of unique identifiers for publicly disclosed cybersecurity vulnerabilities.Foundational
• Common Vulnerability Scoring System (CVSS)An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.Foundational
• Common Weakness Enumeration (CWE)A community-developed catalog of software and hardware weakness types, maintained by MITRE.Intermediate
• Compiler Hardening FlagsCompiler and linker options that add exploit mitigations and stricter checks to built binaries.Advanced
• Compliance-Based Penetration TestingPenetration testing performed to satisfy a regulatory or standards requirement, such as PCI DSS or FedRAMP.Intermediate
• Constrained Application Protocol (CoAP)A lightweight REST-like UDP protocol (RFC 7252) for constrained IoT devices, secured with DTLS or OSCORE.Advanced
• Container EscapeBreaking out of a container's isolation to gain access to the host or other containers.Advanced
• Container Image HardeningBuilding container images with minimal contents, non-root users and no secrets to reduce attack surface.Intermediate
• Container Image ScanningScanning container images for vulnerable OS packages and libraries, misconfigurations, secrets and malware before and after deployment.Intermediate
• Content Security Policy (CSP)An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.Intermediate
• Continuous Automated Red Teaming (CART)Automated, ongoing simulation of attacker reconnaissance and attack paths against an organization's external attack surface.Advanced
• Continuous Integration SecurityProtecting CI/CD systems, runners, secrets and pipeline definitions from tampering and misuse.Intermediate
• Control-Flow Integrity (CFI)A mitigation that restricts indirect calls and jumps to valid targets determined at compile time, blocking control-flow hijacking.Advanced
• Cookie PrefixesThe __Secure- and __Host- cookie name prefixes that make browsers enforce secure attributes on cookies.Advanced
• Coordinated Vulnerability Disclosure (CVD)A disclosure model where a researcher privately reports a flaw and publication is delayed until the vendor can release a fix.Intermediate
• CORS MisconfigurationAn overly permissive CORS policy that lets untrusted origins read authenticated responses.Advanced
• CosignSigstore's command-line tool for signing, verifying and attaching attestations to container images and other OCI artifacts.Advanced
• Coverage-Guided FuzzingFuzzing that uses instrumentation feedback about which code paths were executed to prioritize inputs that reach new code.Advanced
• CRLF InjectionInjection of carriage return and line feed characters into data used in protocol headers or logs.Intermediate
• Cross-Origin Opener Policy (COOP)An HTTP response header that isolates a page's browsing context group from cross-origin windows that open it or that it opens.Advanced
• Cross-Origin Resource Sharing (CORS)A browser mechanism using HTTP headers that lets a server allow specific other origins to read its responses.Intermediate
• Cross-Site Leaks (XS-Leaks)Browser side-channel attacks that infer a user's state on another site, such as whether they are logged in or a search returned results.Advanced
• Cross-Site Script Inclusion (XSSI)An attack in which a malicious page includes a target's authenticated script or JSON response via a script tag to read sensitive data.Advanced
• Cross-Site WebSocket Hijacking (CSWSH)A CSRF-like attack in which a malicious site opens a WebSocket to a target using the victim's cookies.Advanced
• Crowdsourced Security TestingEngaging many independent researchers through a managed platform to find vulnerabilities, via bug bounties or private vulnerability programs.Intermediate
• Cryptographic FailuresOWASP Top 10 category for failures to protect data with appropriate cryptography, formerly called Sensitive Data Exposure.Foundational
• CSV InjectionEmbedding spreadsheet formulas in data that is later exported to CSV and opened in a spreadsheet application.Advanced
• CWE Top 25MITRE's annually updated ranking of the most dangerous software weaknesses, based on CVE data, severity and exploitation.Intermediate
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Cyber RangeA controlled virtual environment that simulates networks, systems and applications for security training, testing and exercises.Foundational
• Cyber-Physical System (CPS)A system that integrates computing, networking and physical processes so that digital actions have physical effects.Intermediate
• CycloneDXAn OWASP SBOM standard (ECMA-424) designed for security use cases, supporting software, hardware, services, cryptographic assets and VEX data.Intermediate
• Dangling DNS RecordA DNS record that points to an IP address or cloud resource no longer owned or controlled by the organization.Intermediate
• Data Execution Prevention (DEP)A mitigation that marks memory regions such as the stack and heap as non-executable, using the CPU's NX/XD bit.Intermediate
• Data HistorianA database that collects and stores time-series process data from industrial control systems for analysis and reporting.Intermediate
• Debug Mode in ProductionLeaving framework debug features, consoles or verbose diagnostics enabled on production systems.Foundational
• DeconflictionThe process of distinguishing authorized testing activity from a real attack when defenders detect suspicious behavior.Intermediate
• Deep Link HijackingAbuse of custom URL schemes or unverified links so a malicious app receives links intended for another app.Advanced
• Default CredentialsFactory-set usernames and passwords on applications, devices or services that are publicly documented.Foundational
• Denylist ValidationInput validation that rejects values matching known-bad patterns and accepts everything else.Foundational
• Dependency ConfusionA supply chain risk in which a package manager installs a malicious public package instead of an internal private package with the same name.Intermediate
• Dependency PinningSpecifying exact versions (and ideally cryptographic hashes) of dependencies so builds use known, reviewed components.Intermediate
• Directory ListingA web server setting that displays a list of files in a directory when no index file is present.Foundational
• Distributed Control System (DCS)A process control system in which controllers are distributed throughout a single plant or facility under centralized supervision.Intermediate
• DNP3Distributed Network Protocol 3, an industrial protocol used mainly in electric and water utilities for communication between SCADA masters, RTUs and IEDs.Intermediate
• DNP3 Secure Authentication (DNP3-SA)An extension to DNP3 that authenticates critical messages using HMAC-based challenge-response and session keys.Advanced
• DNS EnumerationDiscovering hostnames, records and infrastructure details by querying a target's DNS.Foundational
• DNS RebindingA technique in which a domain's DNS answer changes between validation and use, so a host check passes but the request goes to an internal IP.Advanced
• DNS Zone Transfer (AXFR)A DNS mechanism for replicating zones between servers that, if allowed to anyone, leaks every record in a domain.Intermediate
• DOM-Based Cross-Site ScriptingXSS that occurs entirely in client-side JavaScript when it writes untrusted data from a source into a dangerous sink.Intermediate
• Double FreeCalling free on the same memory twice, which can corrupt the heap allocator and enable code execution.Advanced
• Double-Submit CookieA stateless CSRF defense in which a random value is sent both in a cookie and in a request parameter or header, and the server checks they match.Advanced
• DREADA threat risk-rating model scoring Damage, Reproducibility, Exploitability, Affected users and Discoverability.Intermediate
• Egress FilteringRestricting outbound network traffic from systems to only approved destinations and protocols.Intermediate
• Elevation of Privilege (EoP)Gaining capabilities beyond those that were authorized, such as a normal user gaining administrative rights.Foundational
• Embedded System SecurityProtecting purpose-built computing devices with constrained resources, often running real-time operating systems and long-lived firmware.Intermediate
• Engineering Workstation (EWS)A computer used by control engineers to configure, program and troubleshoot PLCs, DCS controllers and other ICS devices.Intermediate
• EtherNet/IPAn industrial Ethernet protocol that carries the Common Industrial Protocol (CIP) over standard TCP/IP, used widely with Rockwell Automation equipment.Advanced
• ETSI EN 303 645A European standard setting baseline cybersecurity provisions for consumer IoT devices.Advanced
• EvilginxAn adversary-in-the-middle phishing framework that proxies real login pages to capture credentials and session cookies, bypassing many MFA methods.Advanced
• Excessive Data ExposureAn API flaw (API3:2019) where endpoints return more data than the client needs and rely on the client to filter it.Intermediate
• Executive Order 14028The May 2021 U.S. order 'Improving the Nation's Cybersecurity' that drove federal SBOM and secure development attestation requirements.Intermediate
• Executive SummaryA short, non-technical section of a report summarizing overall risk, key findings and business impact for leadership.Foundational
• Exploit Prediction Scoring System (EPSS)A FIRST data-driven model estimating the probability that a CVE will be exploited in the wild within the next 30 days.Intermediate
• Exported Android ComponentAn Android activity, service, broadcast receiver or content provider that other apps can invoke.Advanced
• External Attack Surface Management (EASM)Continuous discovery and monitoring of an organization's internet-facing assets as an attacker would see them.Intermediate
• Fail-Safe DefaultsBase access decisions on explicit permission rather than exclusion, so the default is no access.Intermediate
• Final Security Review (FSR)A pre-release assessment confirming that all security requirements and SDL activities were completed and residual risks are accepted.Intermediate
• Firmware AnalysisExamining device firmware images to find vulnerabilities, hard-coded secrets, outdated components and insecure configurations.Advanced
• FootprintingThe process of collecting as much information as possible about a target organization to build a profile of its attack surface.Foundational
• Forced BrowsingDirectly requesting URLs or resources that are not linked in the application, to find unprotected pages or files.Foundational
• Format String VulnerabilityPassing user input as the format argument to functions such as printf, allowing memory reads or writes.Advanced
• Four Question FrameworkAdam Shostack's threat modeling structure: What are we working on, what can go wrong, what are we going to do about it, and did we do a good job?Intermediate
• FulcioSigstore's certificate authority that issues short-lived code-signing certificates bound to an OpenID Connect identity.Advanced
• Fuzz TestingAn automated testing technique that feeds large volumes of malformed, unexpected or random input to a program to find crashes and bugs.Foundational
• Fuzzing CorpusThe set of seed inputs a fuzzer starts from and grows as it finds inputs that reach new behavior.Advanced
• Fuzzing HarnessSmall code that connects a fuzzer to the function or API under test by passing generated input to it.Advanced
• Gadget ChainA sequence of existing classes and methods in an application's classpath that, when triggered during deserialization, performs unintended actions.Advanced
• Generation-Based FuzzingFuzzing that builds test inputs from a model, grammar or specification of the expected input format.Intermediate
• Google DorkingUsing advanced search engine operators to find sensitive information or vulnerable systems indexed by search engines.Foundational
• Google Hacking Database (GHDB)A curated collection of search engine queries that reveal sensitive information or vulnerable systems, hosted by Exploit-DB.Intermediate
• GophishAn open-source phishing framework for running and tracking authorized phishing campaigns.Intermediate
• GraphQL IntrospectionA GraphQL feature that lets clients query the full schema, which can disclose sensitive types and operations in production.Intermediate
• GraphQL Query Depth LimitingRestricting how deeply nested or how costly a GraphQL query may be to prevent resource exhaustion.Advanced
• Gray-Box TestingTesting with partial knowledge of the target, such as user-level credentials or limited documentation; CompTIA's partially known environment.Foundational
• Hard-Coded CredentialsPasswords, API keys or cryptographic keys embedded directly in source code, scripts or binaries.Foundational
• Hardware Debug InterfacePhysical interfaces such as JTAG, SWD and UART used during development that can expose device memory, firmware and consoles.Advanced
• Heap-Based Buffer OverflowWriting beyond the bounds of memory allocated on the heap, corrupting adjacent data or allocator metadata.Advanced
• HeartbleedA 2014 OpenSSL vulnerability (CVE-2014-0160) in the TLS heartbeat extension that let attackers read up to 64 KB of server memory per request.Foundational
• Hermetic BuildA build that is fully isolated from the network and host environment, using only declared, pinned inputs.Advanced
• Host Header InjectionAbuse of an application's trust in the HTTP Host header to poison links, caches or routing.Advanced
• HTML SanitizationRemoving or neutralizing dangerous elements and attributes from user-supplied HTML while keeping safe formatting.Intermediate
• HTTP Request SmugglingExploiting disagreement between front-end and back-end servers about where an HTTP request ends, to hide a second request.Advanced
• HTTP Response SplittingAn attack using CRLF injection to make a server emit what a client or cache interprets as two separate HTTP responses.Advanced
• HTTP Security HeadersResponse headers that enable browser security features such as HSTS, CSP, frame restrictions and MIME sniffing protection.Intermediate
• HttpOnly Cookie AttributeA cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.Foundational
• Human-Machine Interface (HMI)The software and screens operators use to view process status and issue commands to an industrial control system.Foundational
• Idempotency KeyA unique client-supplied value that lets a server recognize repeated requests and perform an operation only once.Advanced
• Identification and Authentication FailuresOWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.Foundational
• IEC 60870-5-104 (IEC 104)An IEC telecontrol protocol carrying SCADA traffic over TCP/IP, widely used in European power grids.Advanced
• IEC 61850An international standard for communication in electrical substation automation, defining data models and protocols such as GOOSE, Sampled Values and MMS.Advanced
• IEC 62351A series of IEC standards that add security to power system communication protocols such as IEC 61850, IEC 60870-5-104 and DNP3.Advanced
• IEC 62443The ISA/IEC series of standards for cybersecurity of industrial automation and control systems (IACS), covering asset owners, integrators and product suppliers.Intermediate
• IEC 62443 Foundational Requirements (FR)The seven groups of security requirements in IEC 62443 against which systems and components are assessed.Advanced
• IEC 62443 Security Levels (SL)Four security levels in IEC 62443 describing the capability required to protect against increasingly capable attackers.Advanced
• IEC 62443-4-1The part of IEC 62443 that specifies secure product development lifecycle requirements for suppliers of industrial automation components.Advanced
• Image SigningCryptographically signing container images so deployment systems can verify their origin and integrity before running them.Intermediate
• Improper Credential UsageMobile Top 10 2024 risk (M1) covering hard-coded credentials, insecure credential transmission and storage, and weak authentication of the app to backends.Foundational
• Improper Inventory ManagementAPI9:2023, failure to track API hosts, versions and endpoints, leaving old, debug or undocumented APIs exposed.Intermediate
• in-totoA framework (a CNCF graduated project) for securing software supply chains by creating signed attestations of each step and verifying them end to end.Advanced
• Industrial Control System (ICS)A general term for control systems (SCADA, DCS, PLC-based systems) used to operate industrial processes.Foundational
• Industrial DMZ (IDMZ)A buffer network between enterprise IT and OT networks that brokers all data exchange so no traffic flows directly between them.Intermediate
• IndustroyerMalware used in the December 2016 attack that caused a power outage in Kyiv, Ukraine, by directly speaking grid control protocols.Advanced
• Information DisclosureExposure of information to someone not authorized to see it.Foundational
• Infrastructure as Code ScanningStatic analysis of Terraform, CloudFormation, Kubernetes manifests, Helm charts and similar templates for security misconfigurations before deployment.Intermediate
• InjectionOWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.Foundational
• Input ValidationChecking that all untrusted input conforms to expected type, length, format and range before it is processed.Foundational
• Insecure Communication (Mobile)Mobile Top 10 risk (M5) where an app transmits data without strong transport security or validates certificates improperly.Foundational
• Insecure Data Storage (Mobile)Storing sensitive data on a mobile device in a way that other apps, backups or someone with physical access can read.Foundational
• Insecure DeserializationDeserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.Intermediate
• Insecure DesignOWASP Top 10 category for flaws rooted in missing or ineffective security controls at the design level rather than implementation bugs.Intermediate
• Insecure Direct Object Reference (IDOR)An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.Foundational
• Insecure Password RecoveryWeak account recovery flows that let attackers reset other users' passwords.Intermediate
• Insecure RandomnessUsing a predictable random number generator for security-sensitive values such as tokens, keys or nonces.Intermediate
• Insufficient Binary ProtectionsMobile Top 10 2024 risk (M7) where app binaries lack protections against reverse engineering and tampering.Intermediate
• Integer OverflowAn arithmetic result that exceeds the maximum value of its integer type and wraps around, often leading to undersized buffers.Advanced
• Intelligent Electronic Device (IED)A microprocessor-based controller in power systems, such as a protection relay, that performs control, protection and communication functions.Advanced
• Interactive Application Security Testing (IAST)Security testing that uses agents instrumented inside a running application to observe code execution and data flow during functional tests.Intermediate
• Intercepting ProxyA tool that sits between a browser or app and a server to capture, inspect and modify HTTP(S) traffic.Foundational
• iOS KeychainApple's encrypted storage service for small secrets such as passwords, tokens and keys on iOS and macOS.Intermediate
• JWT Algorithm ConfusionA JWT flaw where an attacker switches the token's algorithm (for example RS256 to HS256) so the server verifies it with the wrong key type.Advanced
• JWT Claims ValidationChecking a JSON Web Token's standard claims, such as expiry, issuer and audience, in addition to its signature.Intermediate
• JWT None AlgorithmA JSON Web Token flaw where a library accepts tokens whose header specifies alg 'none', meaning no signature, allowing forged tokens.Advanced
• Known Exploited Vulnerabilities Catalog (KEV)CISA's authoritative list of vulnerabilities confirmed to be actively exploited in the wild.Intermediate
• Kubernetes Security ContextPod and container settings that define privilege and access controls, such as user ID, privilege escalation, capabilities and filesystem permissions.Advanced
• LDAP InjectionInjection that alters LDAP queries built from user input, potentially bypassing authentication or disclosing directory data.Intermediate
• Leveraging Existing ComponentsReuse proven, vetted security components instead of building new ones, to reduce attack surface and errors.Intermediate
• Limit OverrunA race condition in which parallel requests exceed a business limit, such as redeeming a coupon more than once.Advanced
• Local File Inclusion (LFI)A vulnerability where an application includes or reads a local file whose path is controlled by user input.Intermediate
• Log InjectionWriting unvalidated user input to logs, allowing forged entries, log parsing exploits or injection into log viewers.Intermediate
• Log4ShellA critical 2021 remote code execution vulnerability (CVE-2021-44228) in Apache Log4j 2 caused by JNDI lookups in logged strings.Foundational
• Malicious PackageAn open-source package intentionally published or modified to perform harmful actions such as stealing credentials or installing backdoors.Intermediate
• MaltegoA graphical link-analysis tool that maps relationships between people, domains, organizations and infrastructure for OSINT.Intermediate
• Mass AssignmentA vulnerability where a framework binds all request parameters to object properties, letting users set fields they should not control.Intermediate
• Master Service Agreement (MSA)An umbrella contract setting the general legal terms for all future work between a client and a service provider.Foundational
• Memory Tagging Extension (MTE)An ARM hardware feature that tags memory allocations and pointers so mismatched accesses, such as use-after-free or overflows, are detected.Advanced
• Memory-Safe LanguageA programming language that prevents memory errors such as buffer overflows and use-after-free by design.Intermediate
• Metadata AnalysisExtracting hidden information such as usernames, software versions and paths from public documents and images.Intermediate
• Microsoft Security Development Lifecycle (SDL)Microsoft's prescriptive secure development process defining security practices from training and requirements through release and response.Intermediate
• Microsoft Threat Modeling ToolA free Microsoft application for drawing DFDs and automatically generating STRIDE-based threats.Intermediate
• Mishandling of Exceptional ConditionsOWASP Top 10 2025 category (A10) for improper error handling, failing open and logic errors under abnormal conditions.Intermediate
• MISRA CA set of C language coding guidelines from the Motor Industry Software Reliability Association for safety- and security-critical embedded systems.Advanced
• Misuse CaseA UML-style use case that models an actor performing actions the system should prevent, linked to the use cases it threatens.Intermediate
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• Mobile App AttestationPlatform services that let a backend verify a request came from a genuine, unmodified app on a genuine device.Advanced
• Mobile App SandboxOperating system isolation that restricts each mobile app to its own data and resources unless granted permissions.Foundational
• Mobile Security Framework (MobSF)An open-source automated tool for static and dynamic security analysis of Android and iOS applications.Intermediate
• ModbusA simple master/slave (client/server) industrial communication protocol created by Modicon in 1979, widely used to read and write PLC registers.Foundational
• MQTT SecurityProtecting the MQTT publish/subscribe messaging protocol widely used by IoT devices.Intermediate
• Mutation-Based FuzzingFuzzing that creates test inputs by randomly modifying valid sample inputs.Intermediate
• Negative TestingTesting how software behaves with invalid, unexpected or malicious input and conditions.Foundational
• NERC CIPMandatory North American Electric Reliability Corporation Critical Infrastructure Protection standards for the bulk electric system.Advanced
• NIST SP 800-115NIST's Technical Guide to Information Security Testing and Assessment, covering review, target identification and vulnerability validation techniques.Intermediate
• NIST SP 800-82NIST's Guide to Operational Technology Security, providing recommendations for securing ICS and other OT systems.Intermediate
• NISTIR 8259NIST's foundational guidance on cybersecurity activities and capabilities that IoT device manufacturers should provide.Advanced
• Non-Disclosure Agreement (NDA)A legally binding contract that obligates parties to keep shared confidential information secret.Foundational
• NoSQL InjectionInjection against NoSQL databases such as MongoDB, where crafted input alters query operators or logic.Intermediate
• Null Pointer DereferenceAccessing memory through a pointer whose value is null, typically causing a crash and denial of service.Intermediate
• OAuth Redirect URI ValidationRequiring an exact match between the redirect URI in an OAuth request and the URIs registered for the client.Advanced
• Off-by-One ErrorA boundary error where a loop or calculation uses one too many or too few iterations, often overwriting a single byte past a buffer.Advanced
• OPC Unified Architecture (OPC UA)A platform-independent, service-oriented industrial interoperability standard (IEC 62541) with built-in security features.Advanced
• Open RedirectA flaw where an application redirects users to a URL supplied in a parameter without validation.Foundational
• Open Source License ComplianceEnsuring that use of open-source components follows the obligations of their licenses.Intermediate
• Open Source Security Foundation (OpenSSF)A Linux Foundation project that improves the security of open-source software through tools, standards and best practices.Intermediate
• Open Source Security Testing Methodology Manual (OSSTMM)A peer-reviewed security testing methodology from ISECOM focused on measurable, repeatable operational security testing.Intermediate
• Open-Source Intelligence (OSINT)Intelligence collected from publicly available sources such as websites, social media, public records and search engines.Foundational
• OpenSSF ScorecardAn automated tool that rates open-source projects on security practices such as branch protection, code review, signed releases and dependency updates.Advanced
• Operational Technology (OT)Hardware and software that monitor and control physical devices, processes and infrastructure, such as in manufacturing, utilities and transportation.Foundational
• OS Command Injection PreventionDefenses that prevent user input from being executed as operating system commands.Intermediate
• OSS-FuzzGoogle's free continuous fuzzing service for critical open-source projects.Advanced
• Out-of-Band Application Security Testing (OAST)Testing that detects blind vulnerabilities by observing callbacks, such as DNS or HTTP requests, from the target to a tester-controlled server.Advanced
• Out-of-Bounds ReadReading memory outside the bounds of an allocated buffer, which can leak sensitive data or crash a program.Advanced
• Output EncodingConverting untrusted data into a safe representation for the specific context where it is output, such as HTML, JavaScript, URL or SQL.Foundational
• OWASP AmassAn OWASP project tool for in-depth attack surface mapping and subdomain discovery.Intermediate
• OWASP API Security Top 10OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.Foundational
• OWASP Application Security Verification Standard (ASVS)An OWASP standard listing testable security requirements for web applications and services at three verification levels.Intermediate
• OWASP Cheat Sheet SeriesA collection of concise OWASP guides giving developers specific defensive guidance on individual security topics.Foundational
• OWASP DevSecOps Maturity Model (DSOMM)An OWASP model that defines security activities for DevOps pipelines and rates their implementation across maturity levels.Advanced
• OWASP IoT Top 10OWASP's 2018 list of the top security issues for Internet of Things devices and ecosystems.Foundational
• OWASP Mobile Application Security Testing Guide (MASTG)OWASP's comprehensive manual of techniques and test cases for verifying mobile apps against MASVS.Intermediate
• OWASP Mobile Application Security Verification Standard (MASVS)OWASP's standard of security requirements for mobile apps, organized into control groups and verified with the MASTG.Intermediate
• OWASP Mobile Top 10OWASP's list of the ten most critical security risks for mobile applications, last updated in 2024.Foundational
• OWASP Secure Coding PracticesOWASP's technology-agnostic checklist of secure coding practices, originally the Secure Coding Practices Quick Reference Guide.Foundational
• OWASP Threat DragonAn open-source OWASP threat modeling tool for creating diagrams and recording threats using STRIDE, LINDDUN, CIA and other methods.Intermediate
• OWASP Top 10OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.Foundational
• OWASP Top 10 CI/CD Security RisksAn OWASP list of the ten most significant security risks in CI/CD environments.Advanced
• OWASP Top 10 Proactive ControlsOWASP's list of the most important security techniques developers should apply in every project.Intermediate
• OWASP Web Security Testing Guide (WSTG)OWASP's comprehensive guide for testing the security of web applications and services, organized by test category with unique test IDs.Intermediate
• Parameter TamperingModifying request parameters such as prices, quantities, IDs or hidden fields to change application behavior.Foundational
• Passive OT Network MonitoringMonitoring industrial networks by analyzing copies of traffic, without sending packets to fragile control devices.Intermediate
• Passive ReconnaissanceGathering information about a target without directly interacting with its systems.Foundational
• Path Traversal PreventionDefenses that stop user input from accessing files outside an intended directory.Intermediate
• Penetration Test Planning and ScopingThe first phase of a penetration test, defining objectives, targets, constraints, rules of engagement and legal authorization.Foundational
• Penetration Test ReportThe final deliverable of a pen test, documenting methodology, findings, risk ratings, evidence and remediation recommendations.Foundational
• Penetration TestingAn authorized, simulated attack on systems to find and safely exploit vulnerabilities before real attackers do.Foundational
• Penetration Testing as a Service (PTaaS)A delivery model providing penetration testing through a platform that combines on-demand human testing, scanning and real-time findings.Intermediate
• Penetration Testing Execution Standard (PTES)A penetration testing methodology defining seven phases from pre-engagement interactions to reporting.Intermediate
• Penetration Testing PhasesThe typical sequence of a penetration test: planning and scoping, reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting.Foundational
• Permissions-PolicyAn HTTP header that controls which browser features, such as camera, microphone or geolocation, a page and its embedded frames may use.Intermediate
• Phishing SimulationAn authorized fake phishing campaign used to measure and improve user resistance to email-based attacks.Foundational
• Physical Penetration TestingTesting the effectiveness of physical security controls by attempting unauthorized entry to facilities.Intermediate
• PivotingUsing a compromised system as a relay to reach other networks or hosts that are not directly accessible to the tester or attacker.Intermediate
• Pointer Authentication (PAC)An ARM architecture feature that signs pointers such as return addresses with a cryptographic code and verifies them before use.Advanced
• Poisoned Pipeline Execution (PPE)A CI/CD risk in which an attacker who can modify pipeline configuration or build scripts gets malicious commands executed by the build system.Advanced
• Post-Engagement CleanupRemoving all tools, accounts, shells, files and configuration changes introduced during testing.Foundational
• Post-ExploitationThe pentest phase after initial compromise that assesses what an attacker could achieve, such as privilege escalation, lateral movement and data access.Intermediate
• postMessage Origin ValidationChecking the origin of messages received through the browser's window.postMessage API before acting on them.Advanced
• PretextingCreating a fabricated scenario or identity to persuade a target to disclose information or take an action.Foundational
• Privileged ContainerA container run with all host capabilities and device access, effectively removing isolation from the host.Intermediate
• Process for Attack Simulation and Threat Analysis (PASTA)A seven-stage, risk-centric threat modeling methodology that aligns technical threats with business objectives.Intermediate
• PROFINETAn industrial Ethernet standard from PROFIBUS & PROFINET International, widely used with Siemens automation for real-time device communication.Advanced
• Programmable Logic Controller (PLC)A ruggedized industrial computer that reads inputs from sensors and controls outputs to machinery according to a stored program.Foundational
• Proof of Concept (PoC)A demonstration that a vulnerability is real and exploitable, used to validate findings and prioritize remediation.Foundational
• Protocol FuzzingFuzzing network protocol implementations by sending malformed or out-of-sequence messages.Advanced
• Prototype PollutionA JavaScript vulnerability in which attacker input modifies Object.prototype, affecting all objects in the application.Advanced
• Purdue ModelThe Purdue Enterprise Reference Architecture, a layered model that segments industrial networks from physical processes up to enterprise IT.Foundational
• Reachability AnalysisDetermining whether vulnerable code in a dependency is actually called by the application, to prioritize SCA findings.Advanced
• Recon-ngA modular, Metasploit-like command-line framework for web-based OSINT reconnaissance.Intermediate
• ReconnaissanceThe information-gathering phase of an attack or test, identifying targets, technologies and people before exploitation.Foundational
• Referrer-PolicyAn HTTP header controlling how much of the referring URL the browser sends in the Referer header.Intermediate
• Reflected Cross-Site ScriptingXSS in which a malicious script in a request is immediately echoed in the response without proper encoding.Foundational
• Refresh Token RotationIssuing a new refresh token each time one is used and invalidating the previous one, to limit the value of stolen tokens.Advanced
• Regular Expression Denial of Service (ReDoS)A denial of service caused by a regular expression that takes exponential time to evaluate certain inputs due to catastrophic backtracking.Advanced
• RekorSigstore's public, append-only transparency log that records signing events and attestations.Advanced
• Remediation RetestA follow-up test verifying that previously reported vulnerabilities have been properly fixed.Foundational
• Remote Code Execution (RCE)The ability of an attacker to execute arbitrary code on a target system over a network.Foundational
• Remote File Inclusion (RFI)A vulnerability where an application includes and executes a file from a remote URL supplied by the user.Intermediate
• Remote Terminal Unit (RTU)A field device that interfaces sensors and equipment at remote sites with a SCADA master, often over long-distance communications.Intermediate
• Reproducible BuildA build process that produces bit-for-bit identical output from the same source, allowing anyone to verify that a binary matches its source.Advanced
• RepudiationA user or system denying that it performed an action because there is insufficient evidence to prove otherwise.Foundational
• Requirements Traceability Matrix (RTM)A table that maps each requirement to its design elements and test cases to show it is implemented and verified.Intermediate
• Return-Oriented Programming (ROP)A code-reuse exploitation technique that chains short existing instruction sequences ending in return instructions to bypass non-executable memory.Advanced
• Reverse TabnabbingAn attack in which a page opened via a link with target=_blank uses window.opener to redirect the original tab to a phishing page.Advanced
• RFID Badge CloningCopying the data from an access badge's RFID credential to create a working duplicate.Intermediate
• Root and Jailbreak DetectionMobile app checks that determine whether a device has been rooted (Android) or jailbroken (iOS), indicating weakened platform security.Intermediate
• Rules of Engagement (RoE)The document defining how a security test will be conducted: timing, targets, allowed techniques, contacts and limits.Foundational
• Runtime Application Self-Protection (RASP)Security technology embedded in an application's runtime that detects and blocks attacks in real time using application context.Intermediate
• Runtime Container SecurityMonitoring running containers and hosts for anomalous or malicious behavior such as unexpected processes, file changes or network connections.Advanced
• Safe HarborA commitment in a disclosure policy not to pursue legal action against researchers acting in good faith within the stated rules.Intermediate
• Safety Instrumented System (SIS)An independent control system that brings an industrial process to a safe state when dangerous conditions are detected.Advanced
• Saltzer and Schroeder Design PrinciplesEight classic secure design principles from 1975 that underpin modern secure software design.Intermediate
• Same-Origin Policy (SOP)A browser security model that restricts scripts on one origin from reading data from another origin.Foundational
• SameSite Cookie AttributeA cookie attribute (Strict, Lax or None) controlling whether a cookie is sent with cross-site requests, mitigating CSRF.Intermediate
• SAST False Positive ManagementProcesses for triaging, suppressing and tuning static analysis results so developers trust and act on findings.Intermediate
• SBOM Minimum ElementsThe baseline data fields an SBOM must contain, defined by the U.S. NTIA in 2021 and updated by CISA.Advanced
• ScopeThe defined boundaries of an engagement: which assets, locations, techniques and time frames are included or excluded.Foundational
• Scope CreepUncontrolled growth of an engagement's scope beyond what was originally agreed.Foundational
• Screen Capture ProtectionMobile controls that prevent sensitive screens from appearing in screenshots, screen recordings or the app switcher.Advanced
• SeccompA Linux kernel feature that restricts which system calls a process may make, reducing kernel attack surface for containers.Advanced
• Second-Order SQL InjectionSQL injection in which malicious input is stored safely first and later used unsafely in another query.Advanced
• Secure Code ReviewManual examination of source code to find security flaws, often focused on high-risk components and guided by checklists and tool output.Foundational
• Secure Coding StandardAn organization's documented rules for writing code that avoids known vulnerability classes.Foundational
• Secure Cookie AttributeA cookie flag that instructs browsers to send the cookie only over HTTPS connections.Foundational
• Secure Error HandlingHandling errors and exceptions so the application fails securely, reveals minimal information and logs useful detail internally.Foundational
• Secure Firmware UpdateA device update mechanism that delivers firmware authenticated by digital signature, protected in transit and resistant to rollback.Intermediate
• Secure Remote Access for OTControlled, monitored remote connectivity for vendors and engineers into industrial environments.Intermediate
• Secure Software Development Attestation FormA CISA form in which software producers attest that they follow key secure development practices derived from NIST SSDF.Advanced
• Secure Software Development Framework (SSDF)NIST SP 800-218, a set of high-level secure software development practices grouped into Prepare, Protect, Produce and Respond categories.Intermediate
• Secure Software Development Life Cycle (SSDLC)A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.Foundational
• Security ChampionA developer or engineer embedded in a product team who acts as the team's security advocate and liaison to the security group.Foundational
• Security DebtAccumulated unresolved security flaws and deferred security work in software, which increase risk over time.Foundational
• Security GateA checkpoint in the SDLC or CI/CD pipeline where defined security criteria must be met before work proceeds.Foundational
• Security Logging and Monitoring FailuresOWASP Top 10 category for insufficient logging, detection, alerting and response that allows breaches to go unnoticed.Foundational
• Security MisconfigurationOWASP Top 10 category for insecure default, incomplete or ad hoc configurations across the application stack.Foundational
• Security Regression TestingRe-running security tests after changes to confirm that previously fixed vulnerabilities have not returned.Foundational
• Security RequirementsStatements of what security properties and controls software must provide, defined early in the SDLC alongside functional requirements.Foundational
• Security Test CaseA documented test that verifies a specific security requirement or control behaves as intended.Foundational
• Security User StoryAn agile user story written to capture a security requirement, often from the viewpoint of a defender or attacker.Foundational
• security.txtA standard file (RFC 9116) placed at /.well-known/security.txt that tells researchers how to report security vulnerabilities to an organization.Intermediate
• Segmentation TestingTesting that verifies network segmentation controls actually isolate sensitive zones from other networks.Intermediate
• SEI CERT Coding StandardsLanguage-specific secure coding rules from Carnegie Mellon's Software Engineering Institute for C, C++, Java, Perl and Android.Intermediate
• SemgrepAn open-source, pattern-based static analysis tool that scans code for bugs and security issues using rules that resemble source code.Intermediate
• Separation of PrivilegeRequire more than one condition, key or party to grant access to sensitive functions.Intermediate
• Server-Side Template Injection (SSTI)A vulnerability where user input is embedded into a server-side template as template code rather than data, potentially leading to remote code execution.Advanced
• Session FixationAn attack in which the attacker sets a victim's session ID before login and then uses it after the victim authenticates.Intermediate
• Session ID in URLPassing session tokens in URL query strings or paths, which exposes them in logs, history and Referer headers.Foundational
• Session InvalidationDestroying a session on the server so its identifier can no longer be used, such as at logout or password change.Foundational
• Session ManagementThe secure creation, maintenance and termination of user sessions after authentication.Foundational
• Session TimeoutAutomatic expiration of a session after inactivity (idle timeout) or after a maximum lifetime (absolute timeout).Foundational
• Session Token EntropyThe unpredictability of a session identifier, which must be high enough that guessing a valid one is infeasible.Intermediate
• Shadow APIAn API endpoint that is undocumented or unknown to the security team and therefore unmanaged.Intermediate
• Shadow StackA hardware- or software-protected copy of return addresses used to detect tampering with the regular call stack.Advanced
• ShodanA search engine that indexes internet-connected devices and their service banners.Foundational
• SigstoreAn open-source project (OpenSSF) providing free tooling and public infrastructure for signing and verifying software artifacts.Advanced
• SLSA Build LevelsThe graded levels of the SLSA Build track that describe increasing guarantees about how an artifact was built.Advanced
• Social Engineering Penetration TestingAssessing human susceptibility to manipulation through phishing, vishing, pretexting and physical impersonation.Foundational
• Social-Engineer Toolkit (SET)An open-source Python framework by TrustedSec for social engineering attacks such as credential harvesting and malicious payload delivery.Intermediate
• Software and Data Integrity FailuresOWASP Top 10 category for code and infrastructure that do not protect against integrity violations, such as untrusted updates and insecure deserialization.Intermediate
• Software Assurance (SwA)The level of confidence that software is free from vulnerabilities and functions as intended throughout its life cycle.Foundational
• Software Assurance Maturity Model (SAMM)OWASP's open framework for assessing and improving an organization's software security posture across five business functions.Intermediate
• Software Package Data Exchange (SPDX)An open standard (ISO/IEC 5962:2021) from the Linux Foundation for communicating SBOM information, including components, licenses and relationships.Intermediate
• Software Security Group (SSG)The central team responsible for an organization's software security initiative.Advanced
• Software Supply Chain FailuresOWASP Top 10 2025 category (A03) for compromises or weaknesses in dependencies, build systems and distribution infrastructure.Intermediate
• Software Supply Chain SecurityProtecting the integrity, provenance and security of all code, dependencies, tools and processes used to build and deliver software.Intermediate
• SolarWinds Supply Chain AttackThe 2020 compromise in which attackers inserted the SUNBURST backdoor into SolarWinds Orion builds, which were signed and distributed to about 18,000 customers.Foundational
• SonarQubeA code quality and security platform (from SonarSource) that performs static analysis for bugs, code smells, vulnerabilities and security hotspots.Intermediate
• SpiderFootAn automated OSINT tool that queries over 200 data sources to map a target's attack surface.Intermediate
• SpoofingPretending to be another user, system or component in order to gain its access or trust.Foundational
• SQL Injection PreventionThe set of defenses that stop SQL injection, led by parameterized queries and supported by validation and least privilege.Foundational
• SSRF PreventionDefenses that stop an application from being used to send requests to unintended internal or external destinations.Intermediate
• Stack CanaryA random value placed before the return address on the stack and checked before a function returns, detecting stack buffer overflows.Intermediate
• Stack-Based Buffer OverflowWriting past the end of a buffer allocated on the call stack, which can overwrite the saved return address and hijack execution.Intermediate
• Statement of Work (SOW)A contract document detailing the specific deliverables, timeline, scope and cost of a particular engagement.Foundational
• Static Code Analysis Taint AnalysisA static analysis technique that tracks untrusted data from sources to dangerous sinks to find injection-type flaws.Advanced
• Stored Cross-Site ScriptingXSS in which a malicious script is saved by the application and later served to other users.Foundational
• STRIDEMicrosoft's threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.Foundational
• STRIDE per ElementA threat modeling technique that applies only the STRIDE categories relevant to each DFD element type.Advanced
• Subdomain EnumerationDiscovering subdomains of a target domain to expand the known attack surface.Foundational
• Subdomain TakeoverGaining control of a subdomain whose DNS record points to a deprovisioned external resource, such as a deleted cloud bucket or app.Intermediate
• Subresource Integrity (SRI)A browser feature that verifies scripts or stylesheets loaded from third parties against a cryptographic hash in the HTML tag.Intermediate
• Supervisory Control and Data Acquisition (SCADA)An ICS architecture for monitoring and controlling geographically dispersed assets from a central location.Foundational
• Symbolic Link AttackExploiting a privileged process that follows an attacker-created symbolic link to read or overwrite a protected file.Advanced
• TailgatingGaining physical access by following an authorized person through a secured entrance without their knowledge.Foundational
• TamperingUnauthorized modification of data, code or configuration in transit, at rest or in memory.Foundational
• theHarvesterAn OSINT tool that gathers emails, subdomains, hosts and names from public sources such as search engines and certificate logs.Foundational
• Threat Model Data Flow Diagram (DFD)A diagram of processes, data stores, external entities, data flows and trust boundaries used as the basis for threat modeling.Intermediate
• Threat Modeling as CodeDefining system models and threat rules in code or structured files stored with the application, so threat models are versioned and generated automatically.Advanced
• Threat-Led Penetration Testing (TLPT)An intelligence-driven red team test that emulates the tactics of real threat actors relevant to an organization against live production systems.Advanced
• TIBER-EUThe European Central Bank's framework for Threat Intelligence-Based Ethical Red teaming of financial institutions.Advanced
• Time-of-Check to Time-of-Use (TOCTOU)A race condition in which a resource changes between the time it is checked and the time it is used.Intermediate
• Timing AttackInferring secret information by measuring how long operations take.Advanced
• TrikeA risk-based threat modeling methodology that starts from a requirements model of actors, assets and allowed actions.Advanced
• TRITONICS malware discovered in 2017 that targeted Schneider Electric Triconex safety instrumented systems at a petrochemical plant.Advanced
• TrivyAn open-source security scanner from Aqua Security for container images, file systems, Git repositories, Kubernetes and IaC.Intermediate
• Trusted TypesA browser security API that forces dangerous DOM sinks to accept only typed, policy-approved values, preventing DOM-based XSS.Advanced
• Type JugglingUnexpected behavior from loosely typed comparisons, such as PHP's == operator, that can bypass authentication or checks.Advanced
• U.S. Cyber Trust MarkA voluntary U.S. FCC labeling program indicating that a consumer wireless IoT product meets baseline cybersecurity criteria.Advanced
• Unicode NormalizationConverting equivalent Unicode character sequences to a single standard form (NFC, NFD, NFKC or NFKD) before comparison or validation.Advanced
• Unidirectional GatewayA hardware-enforced network device that allows data to flow in only one direction, typically from OT out to IT.Intermediate
• Unrestricted Access to Sensitive Business FlowsAPI6:2023, exposure of a business flow (such as purchasing or posting) to automated abuse that harms the business, even without a code bug.Intermediate
• Unrestricted File UploadAllowing users to upload files without adequately validating type, content, name and size, which can lead to code execution or stored XSS.Foundational
• Unrestricted Resource ConsumptionAPI4:2023, APIs that do not limit the resources a request or client can consume, enabling denial of service or cost exhaustion.Intermediate
• Unsafe Consumption of APIsAPI10:2023, trusting data from third-party APIs more than user input, leading to injection, redirects or data exposure.Intermediate
• Unsafe ReflectionUsing user-controlled input to choose which classes or methods an application loads or invokes via reflection.Advanced
• Use-After-Free (UAF)Using a pointer to memory after it has been freed, which may now hold attacker-controlled data.Advanced
• Username EnumerationDetermining which usernames or emails are valid from differences in an application's responses.Foundational
• Verbose Error MessageAn error message that reveals internal details such as stack traces, queries, file paths or software versions.Foundational
• Verification and Validation (V&V)Verification checks that software is built correctly against its specifications; validation checks that the right software was built for user needs.Intermediate
• Virtual PatchingBlocking exploitation of a known vulnerability with an external control such as a WAF or IPS rule while the code fix is pending.Intermediate
• Visual, Agile and Simple Threat modeling (VAST)A scalable threat modeling methodology that produces separate application and operational threat models for agile enterprises.Advanced
• Vulnerability AssessmentA systematic process of identifying, quantifying and prioritizing vulnerabilities without attempting to exploit them.Foundational
• Vulnerability Disclosure Policy (VDP)A public policy explaining how external parties can report vulnerabilities and what they can expect in return.Foundational
• Vulnerability Remediation SLAA defined maximum time to fix a vulnerability based on its severity or risk rating.Foundational
• Vulnerable and Outdated ComponentsOWASP Top 10 2021 category for using libraries, frameworks or platforms with known vulnerabilities or that are unsupported.Foundational
• Wayback MachineThe Internet Archive's service storing historical snapshots of websites, useful for finding removed content.Foundational
• Weakest LinkA system is only as secure as its weakest component, so defenses should be balanced.Foundational
• WeaponizationThe kill-chain stage where an attacker couples an exploit with a deliverable payload, such as a malicious document.Foundational
• Web Cache DeceptionTricking a cache into storing a victim's private, authenticated page by making it look like a static resource.Advanced
• Web Cache PoisoningCausing a cache to store a malicious response that is then served to other users.Advanced
• WebView SecuritySecure configuration of embedded browser components in mobile apps to prevent XSS escalation and data exposure.Advanced
• White TeamThe group that oversees a red team or cyber exercise, setting rules, refereeing, scoring and ensuring safety.Foundational
• White-Box TestingTesting with full knowledge of the target, including source code, architecture and credentials; called known-environment testing by CompTIA.Foundational
• WHOISA query protocol and database that returns registration details for domain names and IP address blocks.Foundational
• X-Content-Type-OptionsAn HTTP response header whose nosniff value stops browsers from MIME-sniffing a response away from its declared Content-Type.Intermediate
• X-Frame-Options (XFO)A legacy HTTP response header that controls whether a page may be displayed in a frame, used to prevent clickjacking.Foundational
• XML BombA small XML document using nested entity expansion to consume huge amounts of memory and crash the parser.Advanced
• XML External Entity (XXE)A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.Intermediate
• XPath InjectionInjection that modifies XPath queries against XML data by inserting crafted input.Advanced
• XZ Utils BackdoorA 2024 supply chain compromise (CVE-2024-3094) in which a long-term contributor inserted a backdoor into the xz/liblzma compression library.Intermediate
• ZAPAn open-source dynamic application security testing proxy and scanner, formerly OWASP ZAP and now maintained under Checkmarx sponsorship as ZAP by Checkmarx.Intermediate
• Zip BombA small compressed archive that expands to an enormous size to exhaust disk, memory or CPU during decompression.Advanced
• Zip SlipA path traversal vulnerability in archive extraction where entries with ../ in their names are written outside the target directory.Advanced
• Zombie APIA deprecated or retired API version that is still deployed and reachable.Intermediate
• Zones and ConduitsThe IEC 62443 segmentation concept that groups assets with common security requirements into zones and controls communications between them through conduits.Intermediate