Tech Glossary — Page 2

An API security vulnerability where applications fail to verify that users have permission to access specific data objects, allowing attackers to access unauthorized records by manipulating identifiers.

BRICKSTORM is a Go backdoor that China-nexus actors deploy on VMware vCenter servers. It masquerades as vCenter processes and talks to its operators over WebSockets inside TLS.

Applying a fix developed for the current version of software to an older, still-supported release branch. Security fixes are usually backported for a limited set of branches; bugs removed incidentally by refactoring in a new release are not, and remain in the old branch.

Software installed on a server that reads its files, databases, and mailboxes and copies them to a backup destination. Because it must read everything, it runs with the highest privileges on the host and holds credentials to backup storage, making it a high-value target.

A social engineering attack that uses a false promise or enticing offer to lure victims into a trap, such as leaving infected USB drives or offering free downloads.

Maximum data transfer rate of a network connection, measured in Mbps or Gbps.

A Git repository with no working tree; the repository root is itself the Git directory containing objects, refs, config, and hooks. Hosting servers use bare repositories, so a file written to a path like hooks/ inside one lands in Git's control plane rather than in project files.

A credential presented in an HTTP Authorization header that grants access to whoever holds it, with no proof of identity beyond possession. Services must validate the token on every request; a code path that accepts any bearer value, as in CVE-2026-59822, is an authentication bypass.

A statistical profile of how a user, client or credential normally behaves, such as request volume, hit ratio, active hours and repeat rate, used to flag deviations that indicate compromise or abuse.

Using physical characteristics like fingerprints or facial recognition to verify identity.

A numeric password that unlocks a BitLocker-encrypted Windows drive when normal unlock fails. Organizations often back these keys up to Active Directory, which makes read access to them a high-value target.

The full set of systems, data, and access an attacker can reach after compromising a given asset. Ranking assets by blast radius rather than by how exposed they are pushes high-reach systems like a firewall management console to the top of the priority list.

A network of internet-connected devices compromised and controlled by an operator, used for denial-of-service attacks, proxying malicious traffic, credential stuffing or spam. Edge routers are prized botnet hosts because they are numerous, always on, directly reachable and rarely inspected by their owners.

Branch protection is a source-hosting setting that restricts who can push to, merge into or rewrite a branch, often requiring reviews or status checks. Owner-level accounts can usually override it.

A break-glass account is an emergency admin account kept for when normal access paths fail. Its password is vaulted, every use triggers an alert, and each login is reviewed afterwards.

A protocol that enables the transfer of cryptocurrency assets and data between different blockchain networks, often used to move funds across chains.

A policy allowing employees to use their personal devices to access corporate resources and applications.

An attack technique where an attacker who already has admin access loads a legitimately signed but flawed kernel driver, then abuses the driver's bug to run code in the Windows kernel. Used to disable security tools or hide implants.

Broken Object Property Level Authorization is an API weakness in which the server fails to check whether a user may read or change specific properties of an object they can reach. OWASP lists it as API3 in its 2023 API Security Top 10.

Brotli is a lossless compression format developed by Google and standardized as RFC 7932, widely used to compress HTTP responses. Its decoder is often bundled inside runtimes, proxies and language packages rather than shared from the operating system.

Browser fingerprinting is the practice of identifying or classifying a visitor from attributes their browser exposes, such as settings, fonts and automation flags. Skimming scripts use it to tell shoppers apart from automated security scanners.

An attack method that tries every possible password combination until finding the correct one.

A vulnerability where a program writes data beyond the boundaries of allocated memory, potentially overwriting adjacent memory and allowing attackers to execute malicious code.

A vendor-run program that pays external researchers for responsibly disclosed vulnerabilities, usually through a platform such as HackerOne. Many critical fixes, including GitLab's September 2026 patch release, originate from bug bounty reports.

A site-level supervisory system that monitors and controls a building's mechanical and electrical equipment, such as HVAC, refrigeration, lighting and access control. BMS controllers are often installed and remotely managed by contractors, which makes them a common blind spot in security inventories.

A sophisticated scam targeting businesses that conduct wire transfers, where attackers compromise or impersonate executive email accounts to authorize fraudulent payments.

Control and Provisioning of Wireless Access Points, a standard protocol that lets a controller manage remote wireless access points. On FortiOS the cw_acd daemon speaks CAPWAP, and enabling the Security Fabric service makes an interface listen for it on UDP ports 5246 to 5249.

A legacy mechanism where a web server runs an external program to handle a request and returns its output as the response. Embedded devices such as switches and routers still use CGI programs for their web management interfaces, making them a frequent source of pre-authentication bugs.

An automated sequence of build, test, and deployment jobs triggered by changes to a code repository. Pipelines run with stored credentials to registries, cloud accounts, and servers, which makes the platform that orchestrates them a high-value target.

The U.S. federal agency responsible for cybersecurity and infrastructure protection, which maintains the Known Exploited Vulnerabilities catalog.

The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines.

A standardized identifier for publicly known security vulnerabilities, maintained by MITRE Corporation.

A CVE Numbering Authority is an organization authorized to assign CVE IDs and publish CVE records for vulnerabilities within its scope. Its CVSS score can differ from the rating the affected vendor publishes.

A numerical score (0-10) indicating vulnerability severity, where higher scores represent more critical security risks.

A hybrid social engineering attack where phishing emails instruct victims to call a phone number, leading to vishing attacks that bypass email security controls.

Reducing an input such as a URL path to a single normal form, by decoding escapes, collapsing duplicate separators and resolving relative segments, before any security decision is made about it. Canonicalizing once and then matching prevents the parser disagreements that produce encoding-based authorization bypasses.

An attack that records a valid authentication exchange and re-sends it to gain access, exploiting the fact that the captured token is not bound to a single session or destination. Classified as CWE-294.

A documented record of who handled a piece of evidence, when, and how, from the moment it was collected until it is presented. Disk images and logs taken from a compromised device without chain-of-custody records may be unusable in legal or regulatory proceedings.

A fingerprint of a TLS session attached to an authentication token so the server can confirm the token arrived over the same channel it was issued on. It is the mechanism Extended Protection uses to stop relay.

A social engineering technique that tricks users into running commands or completing actions on their computers, typically disguised as fixing an error or completing a verification step.