Tauseef FayyazA to Z
Glossary
Every concept in this sheet, plus the smaller terms it uses. Select a concept to open its card.
A
- Authentication and authorisation
- Authentication proves who you are; authorisation decides what you are allowed to do once the system knows who you are.
- Authorised testing and the law
- In most countries, accessing or testing a computer system without the owner's permission is a crime, whatever your intention.
C
- CIA triad
- The three properties security protects: confidentiality (only the right people can read it), integrity (nobody can change it unnoticed) and availability (it works when needed).
- CVSS
- An open standard from FIRST that scores a vulnerability from 0 to 10 using factors such as how it is reached, the privileges needed and its impact.
D
- Defence in depth
- Using several independent layers of control, such as MFA, patching, network rules, monitoring and backups, so one failure does not mean a breach.
H
- Hashing
- A one-way function that turns data into a fixed-size fingerprint.
I
- Intentionally vulnerable apps
- Applications built with documented weaknesses so people can learn to find, fix and detect them legally, such as OWASP Juice Shop.
- Isolated lab network
- A hypervisor network mode, such as host-only or internal, that lets lab machines talk to each other but not to your home network or the internet.
L
- Lab notes
- One page per exercise recording date, goal, steps, observations, meaning, and how the issue is prevented or detected, with captioned screenshots.
- Least privilege
- Giving each person, service and process only the access it needs to do its job, and only for as long as it needs it.
M
- Multi-factor authentication
- Requiring two or more kinds of proof to sign in: something you know, something you have or something you are.
N
- Networking basics for security
- IP addresses and subnets, TCP and UDP, ports, DNS, HTTP and HTTPS, and what firewalls and proxies do: the path every connection takes.
P
- Practice platform rules
- Each platform's rules on what you may test (only the machines it gives you), what is banned (attacking the platform or other users) and what you may publish.
R
- Risk, threat and vulnerability
- A vulnerability is a weakness, a threat is someone or something that could exploit it, and risk combines how likely that is with how bad the outcome would be.
- Running targets in containers
- Starting practice apps and tools as containers, with ports published only on 127.0.0.1 so only your own machine can reach them.
S
- Scripting for security
- Small scripts that read logs, filter and count events, or query a system, written in Python, Bash or PowerShell.
- Snapshot
- A saved state of a virtual machine that you can return to in seconds.
- Symmetric and asymmetric encryption
- Symmetric encryption uses one shared key and is fast.
T
- TLS
- The protocol that encrypts and authenticates connections such as HTTPS.
V
- Virtual machine
- A complete computer running as software inside your own, managed by a hypervisor such as VirtualBox, VMware Workstation or Hyper-V.