Appsec
A policy specifying which content sources are allowed to be loaded on a web page
What is a Content Security Policy?
This is a security risk where attackers manipulate API keys or tokens to gain unauthorized access to APIs.
What is Token/Key Abuse or Hijacking?
Developed during World War II, this electromechanical rotor cipher machine was used by the Germans for encrypting and decrypting secret messages and was famously cracked by Allied codebreakers.
What is the Enigma Machine?
A process by which a server determines if the client has permission to use a resource or access a file.
What is authorization?
This webapp attack is this an example of what type of attack
SELECT * FROM users WHERE username = '' OR '1'='1'; --' AND password = 'input_password';
SQL Injection
Often used in continuous integration/continuous deployment (CI/CD) pipelines, this tool helps in identifying dependencies with known vulnerabilities.
What is a software composition analysis tool?
This approach limits the number of API requests a user can make in a given time frame to prevent abuse and overloading of the API.
What is Rate Limiting?
These two researchers had a form of public-key cryptography named after them.
Who is Whitfield Diffie and Martin Hellman?
Fun fact- Ralph Merkel is also one of the inventors of PK cryptography. He also invented cryptographic hashing (Merkle–Damgård construction) .
This is a suite of protocols designed for securing network communications by authenticating and encrypting each IP packet of a communication session.
What is IPSec (Internet Protocol Security)?
Type of webapp attack that tricks a user's browser into performing unintended actions on a site that user is authenticated to.
What is Cross Site Request Forgery?
Practical Byzantine Fault Tolerance (pBFT) is used to provide this type of algorithm in distributed computing and blockchain.
What is Consensus?
A security policy often applied to APIs to restrict their accessibility to certain known and trusted domains or web pages.
What is CORS (Cross-Origin Resource Sharing)?
Starting in the late 1950's, hobbyists realized they could manipulate telephone audio signals to generate free long distance phone calls. This type of activity is called
What is Phreaking?
This term refers to watching for and capturing data packets passing through network traffic.
Sniffing
This type of attack can involve a group of computers or resources targeting a system with traffic to overwhelm it and make it unavailable to its intended users.
What is a DDoS (Distributed Denial of Service) attack?
This cryptographic algorithm is based on the difficulty of factoring large integers and is widely used for secure data transmission.
What is RSA (Rivest–Shamir–Adleman)?
This occurs when an attacker exploits poorly secured APIs to access or modify resources on behalf of another user without their consent.
What is Privilege Escalation?
Adopted in 2002, this U.S. law aims to protect investors by improving the accuracy and reliability of corporate disclosures.
What is the Sarbanes-Oxley Act (SOX)?
This advanced security technology uses algorithms to analyze the behavior of code in a sandbox environment, helping to identify and mitigate zero-day exploits.
What is Behavioral Analysis or Heuristic Analysis?
In this attack, an unauthorized user gains access to a operating system’s protected files and data by exploiting insufficient security validation or encoding.
What is a Path Traversal Attack?
This security vulnerability occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
What is an XML External Entity (XXE) Injection?
A protocol that extends OAuth 2.0 with additional capabilities for identity management and security, commonly used in modern API architectures.
What is OpenID Connect?
This author wrote the 1952 seminal paper "The Education of a Computer" which specified a set of facts to which a compiler needed access in order to generate code correctly.
Admiral Grace Hopper
This advanced persistent threat (APT) group, allegedly associated with the Russian government, has been active since the mid-2000s.
Who are Fancy Bear or APT28?
This attack attempts to exhaust network resources by sending a flood of incomplete connection requests.
What is a SYN Flood?