Glossary of Terms
Represents all the points (entry points) where an unauthorized user (attacker) can try to enter data to or extract data from an environment or system. Minimizing ASA is a key secure design principle.
A web security vulnerability where authentication and session management functions are implemented incorrectly, allowing attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users' identities.
A trial-and-error method used to obtain information such as a user password or PIN. In an authentication context, it involves systematically checking all possible passwords or keys until the correct one is found.
A secure design principle stating that every access request to any system resource must be fully authenticated and authorized every single time, without exception. No access decisions should rely on cached permissions.
A type of cyberattack where stolen account credentials (usernames/passwords) typically obtained from a data breach are used to gain unauthorized access to user accounts through large-scale automated login requests directed against a web application.
A type of web security vulnerability that allows an attacker to inject malicious scripts (usually JavaScript) into content from otherwise trusted websites, which are then executed in the victim's browser. Can be used to steal session tokens, deface websites, or redirect users.
An extension of DevOps principles that integrates security practices within the DevOps process ("shifting security left"). Security as Code (SaC) is a key enabler.
A secure design principle dictating that systems should default to a secure state when an error or failure occurs, rather than exposing vulnerabilities or sensitive information. Error messages should be generic and not leak internal details.
A network security device (hardware or software) that monitors and filters incoming and outgoing network traffic based on predetermined security rules, establishing a barrier between a trusted internal network and untrusted external networks.
A fundamental security principle requiring that users, programs, or processes are granted only the minimum levels of access – or permissions – necessary to perform their required functions.
A secure design principle focused on reducing the number of potential entry points for attackers by limiting code, services, open ports, APIs, and features to only what is essential.
An advanced type of firewall that goes beyond traditional packet filtering and stateful inspection by incorporating features like application awareness, intrusion prevention (IPS), and deep packet inspection (DPI).
The simplest type of firewall (First Generation). It inspects individual packets based on information in the network/transport layer headers (IP addresses, ports, protocols) and allows or blocks them based on static rules.
Acts as an intermediary (gateway) between internal users and external servers (or vice versa). It inspects traffic at the application layer and can provide more granular control and caching. (Third Generation concept).
A type of proxy server that sits in front of web servers and forwards client (e.g., web browser) requests to those web servers. Often used for load balancing, caching, SSL encryption/decryption, and security (as in WAFs).
An approach to software development that seeks to design software from the beginning to be secure, embedding security measures early in the lifecycle rather than adding them later.
A secure design principle mandating that the default configuration of a system should be the most secure configuration possible, minimizing risk for users who do not change settings.
The practice of codifying and automating security controls, policies, and processes within the software development lifecycle, often as part of a DevSecOps approach. Uses scripts, templates, and automated tools.
A security principle that prevents any single individual or component from having excessive privileges that could lead to misuse or error. Involves dividing tasks and associated privileges among multiple users or systems.
An attack technique that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable session ID.
An attack where an attacker takes over a valid user session to gain unauthorized access to a system or service. This often involves stealing or predicting a valid session token.
A code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g., to dump database contents). Often occurs via user input fields.
A process that integrates security practices and considerations into each phase of the traditional software development lifecycle (planning, design, coding, testing, deployment, maintenance) to build more secure applications from the outset.
A firewall technology (Second Generation) that monitors the state of active network connections (e.g., TCP streams) and uses this context to determine which network packets should be allowed through the firewall. More advanced than packet filtering.
A specific type of firewall that filters, monitors, and blocks HTTP/S traffic to and from a web application. It sits in front of web apps (often as a reverse proxy) and protects against application-layer attacks like XSS, SQL injection, and cookie poisoning.
)
)
)
)
)
)
)