Reference
Showing 40 of 508 terms.
A Cloudflare service in which a lightweight client on a host opens an outbound connection to Cloudflare's edge so the host can be reached from the internet without inbound firewall rules. Legitimate for publishing internal services, it is also abused by intruders as a persistent backdoor that survives console cleanup, as seen in the N-central intrusions.
A commercial adversary-simulation framework whose Beacon implant provides command and control, lateral movement and post-exploitation tooling. Cracked copies are widely used by ransomware operators, so its presence is a strong compromise indicator.
A vulnerability class (CWE-94) in which improperly controlled input is incorporated into code that the application then generates or evaluates, letting an attacker run instructions of their choosing. It is the weakness Microsoft assigned to the SharePoint flaw CVE-2026-65660.
Code signing is the practice of attaching a cryptographic signature to software so users can confirm who published it and that it has not changed since signing. It does not catch malware inserted before the signature is applied.
A hidden authentication mechanism in which a device accepts a password derived from the current date or time, usually intended for vendor support access. Because the algorithm is shared across every unit, anyone who recovers it can log in to the entire installed base, as with CVE-2025-41450 in Danfoss AK-SM 8xxA controllers.
The continuous temperature-controlled path that perishable goods follow from production to sale, including refrigerated transport, warehouses and retail display cases. A break in the cold chain, whether by equipment failure or attack, typically forces the affected stock to be destroyed.
Collabora Online is a browser-based office suite built on LibreOffice that lets users edit documents, spreadsheets and presentations together. Nextcloud integrates it as Nextcloud Office, either through a separate server or a built-in CODE Server app.
A security vulnerability that allows attackers to execute arbitrary operating system commands on the host system through a vulnerable application.
A security measure applied in place of a primary control that cannot be implemented yet, such as network restriction while a patch is unavailable. It reduces risk to an acceptable level without fixing the underlying flaw.
A Microsoft Entra ID feature that evaluates signals about users, devices, and locations to make real-time access decisions.
The unauthorized extraction and theft of system configuration files, which can expose sensitive information including network architecture, security policies, and credentials.
A social engineering attack where victims are tricked into granting malicious applications OAuth permissions, giving attackers persistent access to their accounts.
A PowerShell operating mode that restricts access to sensitive language features such as arbitrary .NET type instantiation and Win32 API calls, blocking common in-memory attack tradecraft while allowing most legitimate administrative scripting to continue.
The client credential pair an API management platform issues to a registered application, used to obtain access tokens as that application. Exporting every registered application's consumer keys and secrets was the goal watchTowr attributed to attackers forging admin tokens against WSO2 gateways.
An HTTP response header (or meta tag) that tells the browser which origins may supply scripts, styles and other resources for a page, with optional violation reporting. CSP restricts where code loads from; it cannot detect a script that was modified at an allowed origin.
Content-Encoding is the HTTP header that names the compression applied to a request or response body, such as gzip or br for Brotli. The receiving side uses it to decide which decoder to run before the application sees the data.
A Microsoft security feature that enables near real-time token revocation and policy enforcement, reducing the window of exposure when user risk changes or sessions are terminated.
Control Plane Security is an Aruba feature that wraps control traffic between access points and controllers in IPsec. Introduced in ArubaOS 5.0, it protects PAPI messages in transit but does not fix flaws in the controller code.
A process in which a researcher privately reports a vulnerability to the vendor and both agree a timeline for a fix before details are published. Disputes arise when exploitation forces disclosure before the vendor has confirmed or patched the flaw.
A file containing the memory contents of a process or system at a point in time, generated on a crash or on demand. In incident response a core dump of an appliance's packet engine preserves injected code, open connections, and session data that a reboot or upgrade would erase.
A credential vault is an encrypted store that holds passwords, keys and secrets so tools can inject them into sessions without users seeing them. A vault on a compromised system exposes every secret it holds.
A security measure that restricts access to your credit report, preventing creditors from viewing it and effectively blocking the opening of new credit accounts in your name.
A service that pools cryptocurrency from multiple users and redistributes it to break the on-chain transaction trail, providing privacy but often used for money laundering.
A mathematical scheme that uses public key cryptography to verify the authenticity and integrity of digital data, ensuring the content has not been altered and was created by the claimed sender.
A cryptographically secure pseudorandom number generator is a random number source whose output cannot be predicted from earlier output, making it suitable for session tokens, keys, reset codes and random file names.
Unauthorized use of a compromised system's CPU or GPU to mine cryptocurrency for the attacker. Typically delivered by an automated dropper after an exploit, it is usually detected through sustained high CPU load rather than through data loss.
A credential-theft technique in which an attacker impersonates a domain controller and asks a real one to replicate account data, including password hashes, over the normal Active Directory replication protocol.
Protocol that automatically assigns IP addresses to devices on a network.
An attack technique that places a malicious DLL alongside a legitimate signed executable so the Windows loader resolves and loads the attacker's library instead of the real one, running malicious code under the trust of the signed program.
A network segment that sits between an internal network and the internet, hosting public-facing services while protecting the internal network from direct exposure.
The internet's phonebook—translates domain names (google.com) to IP addresses.
When your DNS queries bypass the VPN tunnel, potentially exposing your browsing activity.
A variant of TLS designed to run over UDP instead of TCP, adding explicit sequence numbers, handshake retransmission, replay windows, and a stateless cookie exchange so encryption survives packet loss and reordering. VPN gateways use it for low-latency tunnels, and its extra parsing code runs before authentication.
The unauthorized transfer of data from a computer or network, often performed by attackers before deploying ransomware to enable double extortion.
Data masking is the practice of replacing sensitive values in a dataset with realistic but fake ones, so the data stays usable for testing or analytics without exposing the real people it describes.
The part of a network appliance that processes production traffic: VPN listeners, load-balanced virtual servers, packet filtering, mail relay. It parses untrusted input from unauthenticated clients by design, unlike the management plane behind the admin login, which is why most exploited edge-device vulnerabilities live there.
An attack in which criminals steal data and demand payment not to publish or sell it, without encrypting the victim's systems. Groups such as Clop have used zero-days in file transfer platforms to run this model against hundreds of organizations in a single campaign.
Financial services built on blockchain technology that operate without traditional intermediaries like banks, using smart contracts to automate lending, trading, and other transactions.
Passwords, keys, or secrets that ship with software or are silently generated when an operator does not set them. Deployments that never replace these values are open to anyone who reads the documentation or derives the fallback. It is one of the oldest persistent authentication failure classes.
A security strategy using multiple layers of protection so that if one layer fails, other layers continue to provide security.