Tech Glossary — Page 6

Malware that harvests credentials, session cookies, tokens and other secrets from an infected machine and sells or dumps them. Leaked developer tokens from infostealer logs are a common way accounts get hijacked.

An access control list applied on network devices in front of infrastructure systems that permits only the specific management and control-plane traffic those systems need and drops everything else. Because it is enforced outside the protected appliance, it mitigates vulnerabilities in the appliance's own software until a patch is applied.

A criminal who specialises in breaking into networks, typically via VPN flaws, stolen credentials or exposed services, and then sells that access to ransomware crews or other groups rather than exploiting it themselves.

Insufficient logging is a weakness, tracked as CWE-778, where software fails to record a security-relevant event or records it without the details needed to investigate it.

An integer overflow is a bug where arithmetic produces a value too large for its integer type, so the number wraps to a small or negative value. When that value sizes a buffer or checks a bound, it can lead to memory corruption (CWE-190).

An interface management profile is a PAN-OS setting that controls which management services, such as HTTPS, SSH or ping, a data-plane interface answers and from which source addresses. Attaching one to an internet-facing interface exposes firewall management.

A ransomware technique that encrypts files in chunks with gaps between encrypted regions, dramatically increasing encryption speed while still rendering files unusable.

Network-connected devices beyond traditional computers—smart speakers, cameras, thermostats, etc.

An isolated patch is a standalone security fix that Adobe publishes for a specific Adobe Commerce or Magento Open Source patch level, so merchants can close a vulnerability without a full version upgrade.

A just-in-time compiler translates frequently executed code into native machine code at runtime, using assumptions gathered from earlier executions and guards that fall back to slower paths when an assumption fails. V8's Maglev and Turbofan tiers are JIT compilers; missing or weak guards are a leading source of browser zero-days.

JPCERT/CC is Japan's national computer emergency response team. It coordinates vulnerability disclosure with vendors, publishes security alerts and co-runs the JVN vulnerability database with IPA.

A compact, signed token format with three parts: a header naming the signing algorithm, a payload of identity and authorization claims, and a signature over both. The claims are readable by anyone, so the signature check is the only thing that makes them trustworthy.

JSON:API is a specification for building REST-style APIs that exchange JSON. A Drupal core module implements it, exposing non-internal entity types by default, with read-only mode on unless an administrator enables writes.

JVN is the vulnerability information portal run by JPCERT/CC and IPA. It publishes advisories for products, often from Japanese vendors, in Japanese and English with affected versions and fixes.

A capability that lets running code inspect and invoke classes and methods by name at runtime rather than at compile time. In a script sandbox, reflection is a common escape path because it lets guest code locate dangerous host classes even when they are not directly exposed.

A shared secret that the services of a distributed application use to authenticate to each other when joining a deployment. If the software falls back to a predictable value when no key is set, attackers can forge service credentials. This is the flaw class behind the 2026 Artifactory authentication bypass.

A Jump Client is a persistent remote support agent installed on an endpoint that lets an authorized technician start a session without anyone at the machine accepting it. Whoever controls the support server can use every Jump Client it manages.

A hardened, closely monitored system that serves as the single controlled entry point into a protected network segment. Administrators connect to it first with strong authentication, and all administrative sessions to sensitive infrastructure pass through it and are logged there.

CISA's catalog of vulnerabilities that are actively being exploited in the wild, requiring federal agencies to patch within specific timeframes.

An attack in which any domain user requests Kerberos service tickets for accounts with service principal names, then cracks the tickets offline to recover those service accounts' passwords.

A piece of kernel code (driver, filesystem, protocol or crypto component) that is loaded into a running Linux kernel on demand rather than compiled in. Blocking a vulnerable module from loading is a common stopgap mitigation until a patched kernel can be booted.

A Linux kernel feature that performs TLS record encryption and decryption inside the kernel after a userspace library completes the handshake, enabling zero-copy sends and NIC offload at the cost of running the record parser in ring 0.

A VPN feature that blocks all internet traffic if the VPN connection drops, preventing data leaks.

Verifying identity by asking for facts the legitimate person is expected to know, such as a national ID number, address or date of birth. It fails once those facts are widely stored or leaked, because knowledge cannot be revoked or rebound.

Microsoft's mechanism for giving each domain-joined computer a unique, rotating local administrator password stored in Active Directory. Whoever can read those attributes can sign in as local admin on the machines in scope.

A protocol for querying and modifying directory services such as Active Directory. Appliances and applications use it to look up users and groups, typically binding with a stored service-account credential.

A reverse proxy that sits between applications and model providers, holding the real provider API keys, issuing virtual keys to applications, and enforcing budgets, routing and logging. It is a credential concentrator: compromising one gateway can expose every provider relationship an organization has.

The Windows process that enforces logon policy and holds credential material for logged-on users in memory. Attackers dump its memory to recover password hashes and tickets, making LSASS access a key post-exploitation indicator.

The delay between sending a request and receiving a response, measured in milliseconds (ping).

Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal.

A design principle that grants each user, role, or process only the permissions it needs to do its job and no more. Applied to session roles in a remote-access tool, least privilege means a role that never moves files should not carry file-transfer permission.

Older authentication protocols (POP, IMAP, SMTP AUTH, older Office clients) that don't support modern security features like MFA, making them prime targets for credential attacks.

An attack in which a low-privileged user substitutes a symbolic link, junction or hard link for a path a privileged process is about to use, so the privileged file operation acts on an attacker-chosen target. It is a common route from local code execution to SYSTEM.

Fine-grained privileges (such as CAP_NET_ADMIN for network configuration) that split the traditional all-or-nothing root power into separate units a process can hold. Container runtimes and network daemons are often granted individual capabilities that expose kernel attack surface.

Applying a security fix to running software on an appliance or server without a full upgrade or reboot, often delivered automatically by the vendor. It shortens the exposure window but typically covers only supported releases and does not replace the full fixed release.

An attack technique where adversaries use legitimate, pre-installed system tools (like PowerShell, WMI, or certutil) rather than custom malware, making detection more difficult.

A vulnerability where an application uses attacker-influenced input to choose which local file to load, and in languages like PHP the load statement executes any code in that file. Unlike a plain file read, inclusion turns the target file into running code, which is how it can escalate to remote code execution.

Local privilege escalation is a flaw that lets someone who can already run code on a system, usually as a low-privileged user or service, raise their rights to administrator or root on that same system.

The loopback interface is the virtual network interface a host uses to talk to itself, addressed as 127.0.0.1 in IPv4. Services often trust loopback requests, so a flaw that forges them can bypass authentication.

A unique hardware identifier assigned to every network interface.