Access Control List (ACL): A data structure or list that is maintained to track what users or groups have permissions to perform what actions.This is a Windows term.
Attack: A particular instance of an attempted introduction of one or more exploits to a system.
Attacker: Someone who is trying to bypass the security of one or more pieces of software to carry out his or her own agenda.
Back Door: A piece of malicious software that is installed and left running to provide a way for an attacker to regain system access at a later time.
Cracker: Someone who “cracks” through software security, particularly licensing and copy protection. It’s thought to have its roots in “safe cracker.” This term isn’t often used, in part because it’s more narrowly focused and in part because it’s just not as widely known, and the differentiation between a hacker and a cracker is not clear.
Cracking: The act of circumventing the copy protection, licensing, or registration functionality of software.
Daemon: A piece of software running in the background, usually as a process. Sometimes used interchangeably with “demon.”
Denial of Service (DoS): Where legitimate users are prevented from accessing services or resources they would normally be able to access.
Distributed Denial of Service (DDoS): Where legitimate users are prevented from accessing services or resources by a coordinated attack from multiple sources.
Escalation of Privilege: When attackers illegitimately gain more functionality or access than they are authorized to have.
Ethical Hacker: One that performs penetration tests. Sometimes ethical hackers are also called “white hats.”
Exploit: A code, technique, or program that takes advantage of a vulnerability to access an asset.
Firewall: An application or hardware appliance designed to diminish the chances of an attack by limiting specific types of information that can pass into or out of a system or network. It’s a piece of perimeter security.
Hacker: Someone who “hacks” together programs, i.e., writes them in a particularly haphazard or unorganized manner. This wasn’t originally a term that was specific to attackers, but in the last few years it has become an often-used synonym for attackers, especially in the press.
Hijacking: A situation when an attacker takes over control of one side of a two-sided conversation or connection.
Hub: A networking device that repeats the network packets on the physical network layer among many devices.
Information Disclosure: A situation when an attacker is able to access information he or she shouldn’t be able to.
Intrusion Detection System: An application that monitors a system or network and reports if it recognizes that the signs of an attack are present.
Leetspeek: The stereotypical sign of a script kiddie where text is written with numbers substituted for letters. The name comes from “elite.” For example, “leet” is often written as “1337” or “l33t.”
Media Access Control (MAC) Address: Also called the Physical Address, it is physically embedded in every network interface card (NIC) during the manufacturing process. MAC addresses are often treated as unique, although that is not actually guaranteed.
OSI Network Model/OSI Seven Layer Model: The Open Systems Interconnection Reference Model. This is commonly used to explain at what point certain processes are taking place and how information travels.
Personally Identifiable Information (PII): Information that is private to the user or machine. Disclosing PII is a violation of user privacy and can be a part of identity theft problems.
Phishing: Social engineering on a large scale, usually to obtain things like login information, credit card numbers, etc.
Protocal Stack: A system that implements protocol behavior based on a series of the OSI Network Model.
Reverse Engineering: The act of wholly or partially recreating the algorithms or designs used in software. This is usually done without sourcecode access.
Rootkit or Root Kit: A set of tools and scripts that an attacker installs after successfully compromising a system. These are designed to automate additional tasks including installing additional programs like key loggers, remote administration tools, packet sniffers, backdoors, etc. Kernel Rootkits are rootkits that hide themselves within the operating system’s kernel, making them a lot more difficult to detect.
Router:A hardware device that routes traffic between two networks. It can also disguise the traffic from the network behind it to make it appear as if all traffic comes from a single system.
Script kiddie: The somewhat derogatory term for an attacker who primarily downloads and uses exploit code designed and written by others. “Script kiddie” tends to be used to signify a Copy-cat type of attacker that is not particularly skilled or creative on his or her own. A script kiddie is also considered to be young, cocky, and brash.
Social Engineering: The process of tricking or convincing a user into volunteering information the hacker can later use. This is often focused on things that are either finance related or material for identity theft.
Spoofing: Impersonating someone or something else — such as another user or machine — in order to trick software security checks or users.
Switch: A hardware device similar to a hub but which knows the hardware (MAC) addresses of each machine connected to it. This is so it can transmit packets only to the individual machine it is addressed to.
Threat: A possible path to illegitimate access of an asset.
Trojan Horse: A piece of malicious software designed to deceive the victims by appearing to be a benign program that they may wish to use and thus are willing to download or install.
Virus: A piece of malicious software that is capable of spreading itself, typically as part of a piece of software or a file that is shared between users.
Vulnerability: A bug in the software that would allow an attacker to make use of a threat to illegitimately access an asset. All vulnerabilities are threats, but only unmitigated threats are vulnerabilities.
Zero-Day Exploit: A vulnerability that is exploited immediately after its discovery, often before the software company or the security community is aware of the vulnerability.
See proof techniques here
TESTING CONSTRAINTS PART TWO
LIFE CYCLE TESTING
TEST METRICS
Independent Software Testing
Test Process
Testing verification and validation
Functional and structural testing
Static and dynamic testing
V model testing
Eleven steps of V model testing
Structural testing
Execution testing technique
Recovery Testing technique
Operation testing technique
Compliance software testing technique
Security testing technique
Attack: A particular instance of an attempted introduction of one or more exploits to a system.
Attacker: Someone who is trying to bypass the security of one or more pieces of software to carry out his or her own agenda.
Back Door: A piece of malicious software that is installed and left running to provide a way for an attacker to regain system access at a later time.
Cracker: Someone who “cracks” through software security, particularly licensing and copy protection. It’s thought to have its roots in “safe cracker.” This term isn’t often used, in part because it’s more narrowly focused and in part because it’s just not as widely known, and the differentiation between a hacker and a cracker is not clear.
Cracking: The act of circumventing the copy protection, licensing, or registration functionality of software.
Daemon: A piece of software running in the background, usually as a process. Sometimes used interchangeably with “demon.”
Denial of Service (DoS): Where legitimate users are prevented from accessing services or resources they would normally be able to access.
Distributed Denial of Service (DDoS): Where legitimate users are prevented from accessing services or resources by a coordinated attack from multiple sources.
Escalation of Privilege: When attackers illegitimately gain more functionality or access than they are authorized to have.
Ethical Hacker: One that performs penetration tests. Sometimes ethical hackers are also called “white hats.”
Exploit: A code, technique, or program that takes advantage of a vulnerability to access an asset.
Firewall: An application or hardware appliance designed to diminish the chances of an attack by limiting specific types of information that can pass into or out of a system or network. It’s a piece of perimeter security.
Hacker: Someone who “hacks” together programs, i.e., writes them in a particularly haphazard or unorganized manner. This wasn’t originally a term that was specific to attackers, but in the last few years it has become an often-used synonym for attackers, especially in the press.
Hijacking: A situation when an attacker takes over control of one side of a two-sided conversation or connection.
Hub: A networking device that repeats the network packets on the physical network layer among many devices.
Information Disclosure: A situation when an attacker is able to access information he or she shouldn’t be able to.
Intrusion Detection System: An application that monitors a system or network and reports if it recognizes that the signs of an attack are present.
Leetspeek: The stereotypical sign of a script kiddie where text is written with numbers substituted for letters. The name comes from “elite.” For example, “leet” is often written as “1337” or “l33t.”
Media Access Control (MAC) Address: Also called the Physical Address, it is physically embedded in every network interface card (NIC) during the manufacturing process. MAC addresses are often treated as unique, although that is not actually guaranteed.
OSI Network Model/OSI Seven Layer Model: The Open Systems Interconnection Reference Model. This is commonly used to explain at what point certain processes are taking place and how information travels.
Personally Identifiable Information (PII): Information that is private to the user or machine. Disclosing PII is a violation of user privacy and can be a part of identity theft problems.
Phishing: Social engineering on a large scale, usually to obtain things like login information, credit card numbers, etc.
Protocal Stack: A system that implements protocol behavior based on a series of the OSI Network Model.
Reverse Engineering: The act of wholly or partially recreating the algorithms or designs used in software. This is usually done without sourcecode access.
Rootkit or Root Kit: A set of tools and scripts that an attacker installs after successfully compromising a system. These are designed to automate additional tasks including installing additional programs like key loggers, remote administration tools, packet sniffers, backdoors, etc. Kernel Rootkits are rootkits that hide themselves within the operating system’s kernel, making them a lot more difficult to detect.
Router:A hardware device that routes traffic between two networks. It can also disguise the traffic from the network behind it to make it appear as if all traffic comes from a single system.
Script kiddie: The somewhat derogatory term for an attacker who primarily downloads and uses exploit code designed and written by others. “Script kiddie” tends to be used to signify a Copy-cat type of attacker that is not particularly skilled or creative on his or her own. A script kiddie is also considered to be young, cocky, and brash.
Social Engineering: The process of tricking or convincing a user into volunteering information the hacker can later use. This is often focused on things that are either finance related or material for identity theft.
Spoofing: Impersonating someone or something else — such as another user or machine — in order to trick software security checks or users.
Switch: A hardware device similar to a hub but which knows the hardware (MAC) addresses of each machine connected to it. This is so it can transmit packets only to the individual machine it is addressed to.
Threat: A possible path to illegitimate access of an asset.
Trojan Horse: A piece of malicious software designed to deceive the victims by appearing to be a benign program that they may wish to use and thus are willing to download or install.
Virus: A piece of malicious software that is capable of spreading itself, typically as part of a piece of software or a file that is shared between users.
Vulnerability: A bug in the software that would allow an attacker to make use of a threat to illegitimately access an asset. All vulnerabilities are threats, but only unmitigated threats are vulnerabilities.
Zero-Day Exploit: A vulnerability that is exploited immediately after its discovery, often before the software company or the security community is aware of the vulnerability.
See proof techniques here
TESTING CONSTRAINTS PART TWO
LIFE CYCLE TESTING
TEST METRICS
Independent Software Testing
Test Process
Testing verification and validation
Functional and structural testing
Static and dynamic testing
V model testing
Eleven steps of V model testing
Structural testing
Execution testing technique
Recovery Testing technique
Operation testing technique
Compliance software testing technique
Security testing technique
No comments:
Post a Comment