Tech Glossary — Page 11

A shared object is a Linux or Unix library file, usually ending in .so, that a program loads at runtime. Code inside it can run as soon as it is loaded, so a writable directory of shared objects is a code execution risk.

A long-running helper process a product starts beside its main daemon to provide a specific function, such as an embedded database, metrics exporter or cluster coordinator. Sidecars often open their own network listeners and carry their own vulnerabilities, so they belong in the product's attack-surface inventory.

A URL that carries a cryptographic signature over its parameters, granting the holder a specific, time-limited action without a login session. The server recomputes the signature to verify the request is authentic and unmodified.

A software release that fixes a security vulnerability without disclosing it at the time, typically described in release notes as generic security or stability fixes. The gap between the fix shipping and the advisory being published is the silent-fix window.

Single-factor authentication is a login that relies on one proof of identity, usually a password. If that one secret is stolen, an attacker can authenticate fully. MITRE tracks the weakness as CWE-308.

A mechanism using proxy patterns that allows the logic of a deployed smart contract to be modified while preserving its address, storage, and assets.

A mid-tier network switch that offers a web management interface, VLANs, SNMP and admin credentials without the full CLI and support ecosystem of enterprise gear. Common in small offices and branch sites, where its management plane is often exposed and its firmware rarely updated.

SMS phishing—a social engineering attack using text messages to trick recipients into clicking malicious links or providing personal information.

The psychological manipulation of people into performing actions or divulging confidential information, exploiting human trust rather than technical vulnerabilities.

A formal, machine-readable inventory of the components and dependencies that make up a piece of software or a deployed system. An accurate SBOM lets an organization quickly answer whether it runs an affected component when a vulnerability is disclosed.

SonicOS is the operating system that runs on SonicWall firewalls, including Gen 7 and Gen 8 hardware and NSv virtual appliances. It provides firewall, routing and SSLVPN services.

A targeted phishing attack directed at specific individuals or organizations, using personalized information to appear more legitimate and increase success rates.

A VPN feature allowing some traffic through the VPN while other traffic uses your regular connection.

A memory-safety bug where input larger than a fixed-size buffer on the call stack overwrites adjacent stack data, including saved return addresses. Attackers use it to redirect execution and run arbitrary code, often without authentication when it sits in a request parser.

A staging directory is a temporary location where software unpacks new files before moving them into place during an update. If the web server can reach it, its contents can be exposed before the update finishes.

A decision model, used by CISA, that prioritizes a vulnerability using factors such as active exploitation status and automatability rather than a single static score. Because those inputs change over time, an SSVC decision can escalate a bug that a fixed CVSS score would leave unchanged.

A malware analysis technique that examines code without executing it, using disassemblers and decompilers to understand program behavior and identify threats.

A username and password baked into software and identical on every installation, also called hardcoded credentials. Because the secret is the same everywhere, once it leaks it works against every device, and no customer-side password policy can mitigate it.

The practice of hiding data inside another file, such as embedding an executable payload within the pixel data of an image, so the malicious content moves as an ordinary file and evades inspection that looks for executable downloads.

A browser feature in which a script or stylesheet tag carries an integrity attribute holding a cryptographic hash of the expected file; the browser refuses to execute the resource if its hash does not match. It pins one exact version, so it breaks when the vendor updates the file.

A superuser is an account with unrestricted rights over a system, able to change any setting, user or data. On multi-tenant platforms the superuser role spans every tenant, so gaining it means control of the whole platform.

A cyberattack that targets an organization by compromising a third-party vendor, supplier, or partner that has access to the target's systems or data.

Synthetic data is artificially generated data that mimics the structure and statistics of a real dataset but contains no real records, which makes it safe to use in test and development systems.

Syslog is the standard protocol and message format systems use to send log events to a local file or a remote collector, usually over UDP or TCP port 514 or TLS.

A Cisco-originated protocol for device administration that authenticates engineers logging into network equipment and authorizes each command they run, with per-session accounting. It is typically served by the same policy server as RADIUS, making that server the authority over who can configure the network.

The starting sequence number a host chooses for a new TCP connection. If ISNs are predictable, an attacker who cannot see the traffic can still forge packets that the receiver accepts as part of an existing connection, enabling spoofing and connection hijacking.

A minimal UDP-based file transfer protocol with no authentication or encryption, used for firmware and configuration transfers on network devices. Attackers abuse it as a second-stage download channel because embedded systems ship with a TFTP client and rarely block outbound use.

A temporary code generated by authenticator apps that changes every 30 seconds.

A physical social engineering technique where an unauthorized person follows an authorized individual into a restricted area, exploiting social courtesy.

A social-engineering attack in which a fake support interaction, such as a phony help-desk call, refund form, or Quick Assist request, tricks a victim into granting remote access or running attacker-supplied software. It is a common initial-access vector for remote-access tool abuse.

The property of a multi-tenant SaaS platform that keeps each customer organization's data and sessions confined to that organization. An isolation failure, such as an SSO login being granted access to every organization a user belongs to, lets one tenant reach into another.

A test environment is a non-production copy of an application and its infrastructure used for testing changes. It often gets weaker controls than production, so any real data it holds is at higher risk.

The potential security threats that arise from an organization's relationships with external vendors, suppliers, and partners who have access to systems or data.

A low-power mesh networking protocol designed for IoT devices, used alongside Matter.

Evidence-based information about an adversary's capabilities, intentions or activity, used to anticipate and prevent attacks rather than react to them. It ranges from tactical indicators such as IP addresses to strategic warnings, like a government notice that an actor plans to target a specific vendor's systems.

Actual amount of data successfully transferred over a connection, often lower than bandwidth.

A system whose compromise gives an attacker control over the identities or infrastructure of every other tier, such as domain controllers, identity providers and, by the same test, a SIEM holding stored credentials. Tier-0 assets get the strictest administrative access rules and the fastest patch window.

A class of race-condition flaw where a program validates a resource, then acts on it a moment later, and an attacker changes the resource in the gap between the two steps. Link-following privilege-escalation bugs such as CVE-2026-81963 exploit this window.

Security measures that bind OAuth tokens to specific devices or sessions, preventing stolen tokens from being replayed on attacker-controlled systems.

A traffic distribution system is software that decides where to send each visitor based on traits such as location, browser or referrer. Malware operators use one to show payloads to real victims and hide them from security scanners.