セキュリティ用語集

信頼されている相手になりすまし、認証情報・金銭・機密情報を盗み取ろうとする欺瞞的なメッセージです。

特定の個人・組織を狙い、調査した情報を用いて精巧に作り込まれた標的型フィッシングです。

経営層や取引先になりすまし、送金・口座変更・情報漏えいを誘導するソーシャルエンジニアリング攻撃です。添付やリンクを使わず、権限・緊急性・信頼を悪用します。

信頼している取引先のアカウントが乗っ取られ、請求書の振込先口座がすり替えられるサプライチェーン型のBECです。

QRコードの裏に悪意あるリンクを隠し、URLフィルターを回避するフィッシング手法です。

SMS(スミッシング)や音声通話(ビッシング)を利用したフィッシングで、メール攻撃と組み合わされることもあります。

送信者アドレスや表示名を偽装し、正規の送信者に見せかける手法です。

実際の送信アドレスは異なるまま、表示名だけを経営層やブランド名になりすます手法です。

正規ドメインに酷似した偽装ドメインです(例: rnとm、0とoの見間違い)。

窃取した認証情報で正規のアカウントを乗っ取り、組織内部から攻撃を仕掛けることです。

偽のログインページなどを使ってユーザー名・パスワードを収集する行為です。

パッチやシグネチャがまだ存在しない、新種の脆弱性・攻撃です。

An attack that uses large language models to mass-produce highly natural, personalized phishing emails free of grammatical errors.

A phishing technique using fake customer-support accounts on social media to approach complaining users and steal their information.

A technique that lures victims into running malware themselves using enticing bait such as infected USB drives or free downloads.

A technique that mimics a well-known brand's logo, design, and domain to deceive users with emails or sites that look authentic.

A common BEC variant in which an attacker impersonates a CEO or top executive to instruct finance staff to make urgent wire transfers.

A phishing technique that copies a legitimate previously delivered email and resends it with attachments or links swapped for malicious ones.

A phishing technique that tricks users into granting permissions to a malicious OAuth app, enabling data access without stealing passwords.

An attack where adversaries monitor an ongoing business email conversation and inject themselves to alter payment details or commit fraud.

An attack using AI-generated fake audio or video to impersonate executives in calls or voice messages to induce wire transfers or data leaks.

An attack where adversaries steal credentials to seize a legitimate email account and abuse it for internal impersonation or fraud.

A common BEC social-engineering scam that impersonates an executive to urgently ask an employee to buy gift cards and send the codes.

An attack using visually identical Unicode characters (e.g., Cyrillic 'a' vs Latin 'a') to create fraudulent domains that look legitimate.

A general class of attacks that masquerade as trusted persons, brands, or organizations so victims believe requests are legitimate.

A BEC-style financial fraud that sends fake or altered invoices to redirect payments to attacker-controlled accounts.

An attack vector delivering malware or malicious macros hidden in email attachments such as documents or archives that infect upon opening.

Spam email carrying malicious attachments or links, sent in bulk and serving as a primary vector for malware infections.

A BEC scam that impersonates an employee to ask HR or payroll to change direct-deposit details, diverting wages to an attacker's account.

An attack that redirects users to fraudulent websites via DNS poisoning or host-file manipulation even when they enter a legitimate address.

A cybercrime business model that sells phishing infrastructure, kits, and hosting as a subscription service, lowering the barrier to attacks.

A pre-built package bundling fake login pages and collection scripts so non-experts can quickly deploy phishing sites.

A social-engineering technique where an attacker fabricates a plausible scenario or false identity to gain a victim's trust and extract information.

A social-engineering technique that offers a service or benefit, such as fake tech support, in exchange for credentials or access.

An email attack that inserts malicious links or attachments into an existing reply chain from a compromised account so recipients open them without suspicion.

An extortion scam email that threatens to release supposed compromising sexual material unless the victim pays money such as Bitcoin.

A phishing attack delivered via SMS text messages using malicious links or fraudulent prompts to deceive users.

The manipulation of human psychology and trust, rather than technical vulnerabilities, to induce information disclosure or security bypass.

Unsolicited bulk email sent without recipient consent, often abused as a vector for phishing or malware distribution.

An attack that floods a victim's inbox with massive email volume in a short time to bury legitimate security or fraud-alert notifications, often as a precursor to follow-on scams.

A physical social-engineering technique of following an authorized person into a restricted area without credentials, also known as piggybacking.

An attack that replies into an existing conversation thread from a compromised mailbox to insert malicious content while exploiting established trust.

Registering misspelled variants of popular domains to capture users who make typing errors and redirect them to malicious sites.

A technique abusing open-redirect vulnerabilities on trusted sites so links appear legitimate but forward victims to malicious destinations.

A social-engineering attack that uses phone or voice calls to deceive victims into divulging personal or financial information.

A fraud technique where AI clones a target's voice from short samples to impersonate family or superiors and demand urgent money transfers.

A targeted attack that compromises websites frequently visited by a target group to infect their visitors.

An Office or PDF document manipulated with macros, exploits, or embedded objects to execute malware merely upon opening.

A form of spear phishing that targets high-profile executives such as CEOs or CFOs to exploit their authority and access to funds.

送信ドメインがどのメールサーバーから送信できるかをDNSで宣言する認証方式です。

メールに暗号署名を付与し、改ざんの有無を検証する認証方式です。

SPF/DKIMの結果をポリシー(拒否/隔離)として強制し、レポートを受け取る標準規格です。

メールが中継サーバーを経由する際、認証結果を保持・再署名して引き継ぐチェーン方式です。

ドメインの受信メールサーバーを指すDNSレコードで、インライン型ゲートウェイはこれを書き換えます。

A standard that displays a brand's verified logo next to authenticated messages in the inbox for domains passing DMARC, with the logo validated via DNS and a Verified Mark Certificate.

A protocol that binds TLS certificates or public keys to DNS names using DNSSEC-protected TLSA records, enabling verification of server certificates for protocols such as SMTP without relying solely on CAs.

An identifier used to distinguish among multiple DKIM keys for a domain; the corresponding public key is published at the DNS location selector._domainkey.domain.

A periodic XML report sent by receiving servers to a domain owner, summarizing statistics on SPF, DKIM, and DMARC authentication results for the domain's mail.

The core DMARC requirement that the domain authenticated by SPF or DKIM match the domain in the message's From header, evaluated in strict or relaxed mode.

Extensions that add digital signatures to DNS responses to provide data integrity and origin authentication, preventing DNS spoofing and cache poisoning and underpinning DANE.

A TLS property using ephemeral per-session keys so that even if a long-term private key is later compromised, previously recorded encrypted traffic cannot be decrypted.

A mechanism letting a domain publish, over HTTPS, a policy requiring TLS encryption and certificate validation for inbound SMTP connections, defending against downgrade and man-in-the-middle attacks.

An open standard for email encryption derived from PGP (RFC 4880 and successors) that defines message and key formats so implementations like GnuPG can interoperate.

A public-key cryptography program for encrypting and signing email and files, using a web-of-trust model to validate keys.

The envelope sender (MAIL FROM) address of an email, where bounce messages are returned, and whose domain is the basis for SPF verification and DMARC alignment.

A standard for end-to-end signing and encryption of email messages using X.509 certificate-based public-key cryptography, providing message integrity, authentication, and confidentiality.

The standard internet protocol for transmitting email between mail servers and from clients to servers; plaintext by default, it is secured with STARTTLS or SMTPS.

A method of encrypting SMTP with TLS from the start of the connection (implicit TLS, typically port 465), encrypting from the outset rather than via the opportunistic upgrade of STARTTLS.

A DNS TXT record listing a domain's authorized sending mail servers, beginning with v=spf1 and composed of mechanisms like include, a, mx, ip4 and qualifiers such as -all.

A command that opportunistically upgrades an existing plaintext protocol connection to a TLS-encrypted one, used in SMTP, IMAP, and POP3 to secure the transport while keeping standard ports.

A standard that lets domains using MTA-STS or DANE receive daily aggregate reports from sending mail servers about TLS negotiation successes and failures.

A digital certificate issued by an authority that verifies a brand's trademark rights to a logo, used in BIMI to display a validated logo in the inbox.

MXレコードの手前に配置し、配送前にメールをフィルタリングする従来型のインライン方式です。

M365/Workspaceに API 経由で連携し、配送後にスキャン・是正を行う現代的な方式です(MX変更不要)。

すべてのメールのコピーをセキュリティシステムに転送し、業務を止めずに監視・監査を行う仕組みです。

疑わしい添付ファイルやリンクを隔離環境で実行し、悪性の挙動を観察する動的解析手法です。

添付ファイルからマクロなどの能動的な要素を除去し、安全な形に再構成して配送する仕組みです。

データをその管轄区域の法律・管理下に留めることで、オンプレミスやリージョン内配備によって実現します。

Collateral spam in which bounce messages or auto-replies to spam with forged sender addresses flood innocent third parties.

A security control that inserts a warning banner at the top of messages from outside the organization to raise user awareness.

A core ICES capability that automatically retracts or removes messages already delivered to inboxes once they are found malicious, via API (clawback).

A mail server control that limits SMTP connection or send rates per source IP or domain to mitigate spam, abuse, and overload.

An availability and disaster-recovery capability ensuring users can send and receive email even during a primary mail system outage.

A technology that inspects outbound email content to detect, block, or encrypt unauthorized transmission of sensitive data.

A gateway solution that automatically encrypts outbound email according to policy to protect sensitive information.

A feature that holds suspected spam, malware, or phishing email in a separate quarantine area instead of the inbox for admin or user review.

A technology that detonates suspicious attachments or URLs in an isolated virtual environment to dynamically analyze malicious behavior.

A capability that temporarily stores mail on a backup server when the destination is down and re-delivers it after recovery to prevent loss.

A technique that temporarily rejects email from unknown senders, relying on legitimate MTAs to retry, thereby filtering out spambots.

An email retrieval protocol that keeps messages on the server and allows synchronized access across multiple devices.

The two email security deployment models: inline, which sits in the mail flow to block in transit, versus API-based, which integrates with mailbox APIs to act post-delivery.

A queue within an MTA that temporarily holds email that cannot be delivered immediately and manages retries.

Software that delivers email received from an MTA into the recipient's mailbox.

A server that receives outgoing mail from clients, applies authentication and policy checks, and hands it to an MTA, typically over port 587.

Software that transfers and routes email between mail servers using SMTP.

Client software that lets users compose, read, and manage email, commonly known as an email client.

An email retrieval protocol that downloads messages from the server to a local client, typically removing them from the server.

A reputation-based blocklist of IP addresses known to send spam, queried via DNS to reject mail.

A filtering technique that uses reputation scores based on the historical behavior of sending IPs or domains to block or allow mail.

A designated external relay server through which a mail server routes all outbound email instead of delivering directly to destinations.

The process by which one mail server forwards email through another, which if misconfigured can be abused as an open relay.

An attack technique that exploits differing interpretations of message-end sequences between sending and receiving servers to inject spoofed email.

Encrypting an SMTP connection via the STARTTLS command to protect message content in transit.

An SMTP submission port using implicit TLS where encryption applies from the start of the connection.

The standard SMTP submission port used by authenticated clients to submit mail, distinct from port 25 used for relaying.

A protection that re-evaluates a link's safety at the moment a user clicks it, catching URLs weaponized after delivery.

A mail flow policy rule that evaluates conditions on email and automatically applies actions such as blocking, redirecting, adding headers, or encryption.

A technique that rewrites links in email to point to a security proxy so their safety is checked in real time at click time.

セキュリティイベント・ログを集約し相関分析するプラットフォームです(Splunk、Sentinelなど)。

アラートへの対応を自動化・オーケストレーションする仕組みです。

侵害を示唆する痕跡です(悪性IP・ドメイン・ハッシュ値など)。

危険と判定されたメールを受信箱から隔離(移動・保留)する是正措置です。

パスワードに加えて追加の認証要素を要求し、アカウント乗っ取りを軽減する仕組みです。

A targeted adversary that uses sophisticated techniques to maintain stealthy, long-term access. It is often associated with nation-state actors.

The desensitization of analysts caused by an overwhelming volume of alerts, leading to missed critical threats. It is a major challenge in SOC operations.

A chronological record of activities and changes within a system. It is essential for accountability and post-incident investigation.

A defensive team responsible for protecting assets and detecting and responding to attacks. They are the core staff of SOC operations.

The mandatory process of informing regulators and affected individuals when a data breach occurs. It is required under regulations such as GDPR and data protection laws.

The documented chronological handling of digital evidence to ensure its integrity. It is essential for legal admissibility.

The communication channel and infrastructure attackers use to remotely control compromised systems. It is used for data exfiltration and issuing further commands.

A specialized organization that receives, coordinates, and responds to security incidents. They operate at national, sector, and organizational levels.

A dedicated team responsible for handling security incidents within an organization. It performs detection, analysis, recovery, and post-incident activities.

A model defined by Lockheed Martin describing the stages of a cyberattack. It breaks an attack into seven phases from reconnaissance to actions on objectives.

The unauthorized transfer of data from inside an organization to an external destination. It is often the ultimate goal of an attack.

A field combining forensic investigation with incident response. It simultaneously determines root cause and drives rapid remediation.

The discipline of collecting, preserving, and analyzing digital evidence to determine the cause and course of an incident. It emphasizes legal admissibility.

A solution that continuously monitors endpoint activity to detect, investigate, and respond to threats. It uses behavioral analysis to identify advanced attacks.

An alert that incorrectly flags benign activity as a threat. Excessive false positives cause analyst fatigue and alert dismissal.

The European Union's regulation on personal data protection and processing. It includes breach notification obligations and strong penalties.

An integrated approach to managing an organization's governance, risk management, and regulatory compliance. It aligns security decisions with business objectives.

The structured process of detecting, containing, eradicating, and recovering from security incidents. Its goal is to minimize damage and restore normal operations.

Indicators that reveal an attacker's intent and behavioral patterns. They focus on detecting an attack in progress before compromise completes.

An international standard for information security management systems (ISMS). It requires risk-based controls and continual improvement.

A technique where an attacker expands access from a compromised system to others within the network. It is used to reach target assets.

The practice of collecting, storing, analyzing, and retaining system and application logs. It underpins detection, forensics, and compliance.

The average time taken to detect a security incident after it occurs. It is a key metric for SOC detection performance.

The average time taken to respond to and remediate an incident after detection. It measures response efficiency.

A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It serves as a common framework for detection and defense.

A solution that analyzes network traffic to detect and respond to anomalous behavior and threats. It excels at identifying lateral movement and stealthy attacks.

A cybersecurity management framework from the U.S. NIST organized around Identify, Protect, Detect, Respond, and Recover functions. It provides a common language for risk management.

A security standard that organizations handling payment card data must comply with. It governs the storage, transmission, and processing of cardholder data.

Techniques that allow an attacker to maintain access across reboots or credential changes. It is one of the key tactics in MITRE ATT&CK.

A standardized set of procedures for responding to a specific type of incident. It forms the basis for SOAR automation.

An attack technique for gaining higher privileges from a lower-privileged context. It is a key step toward system control and persistence.

An exercise that has offensive (red team) and defensive (blue team) collaborate to improve detection and response. It integrates feedback from both sides.

An offensive team that emulates real adversaries to test an organization's defenses. It exposes gaps in detection and response.

A step-by-step guide documenting operational tasks or response procedures. It ensures consistency and repeatability.

A centralized team and facility that continuously monitors, detects, and responds to security events. It combines analysts, processes, and technology to manage threats.

A generic, vendor-agnostic format for log-based detection rules. It allows a rule to be written once and converted for multiple SIEM platforms.

An AICPA audit report attesting to a service organization's adherence to trust principles such as security, availability, and confidentiality. It is widely used by SaaS firms to demonstrate trustworthiness.

A standardized language for representing structured cyber threat intelligence. It supports consistent sharing of threat information.

A standard protocol used by network devices and systems to send log messages. It is widely used for centralized log collection.

A discussion-based exercise that walks through a hypothetical incident scenario. It surfaces gaps in procedures and communication beforehand.

A concept describing adversary behavior at the levels of tactics, techniques, and procedures. It serves as the basis for threat analysis and detection.

A transport protocol for exchanging STIX-based threat intelligence. It enables automated sharing of threat information.

An individual or group responsible for causing a security incident. They are classified by motivation, capability, and resources.

A rule defining specific malicious patterns or conditions that trigger alerts. It is the basic unit of SIEM and EDR detection logic.

The proactive, hypothesis-driven search for threats that evade existing detection tools. Analysts actively look for signs of compromise.

Collected and analyzed information about threat actors and attacks. It supports defensive decision-making and proactive response.

Technology that learns baselines of normal user and entity behavior to detect anomalies. It is effective at spotting insider threats and account takeover.

A solution that unifies detection and response across endpoints, network, cloud, and email layers. It provides visibility beyond isolated security silos.

A tool and rule language for identifying and classifying malware based on patterns. It is widely used in malware hunting and forensics.

大規模言語モデル(LLM)と、自前でホスティング可能な小型モデル(sLLM)です。意図分類に利用されます。

連続値・密な演算をベースとする標準的なニューラルネットワークです。トランスフォーマー型LLMもここに含まれます(現行の検知エンジン)。

離散的なスパイクで動作する第3世代のニューラルネットワークです。超低消費電力・ストリーミング処理に強みがあります(研究段階)。

外部の知識(脅威インテリジェンス)を検索し、モデルの判断の根拠として補強する手法です。

複数の専門エージェントが手がかりを組み合わせて意図を判断する、アナリストのような自動化の仕組みです。

An input subtly perturbed to be misclassified by a model while appearing normal to humans. A core threat in ML security.

The study of attacks that deceive or subvert machine learning models, and the defenses against them.

An autonomous LLM-based system that invokes tools and reasons over multiple steps to accomplish goals.

The research field of steering AI systems' goals and behavior toward human intent and values. Central to safe LLM operation.

A technique for identifying data or behavior that deviates from normal patterns. Central to intrusion and fraud detection.

A neural network technique that weights the most relevant parts of an input sequence. A key component of the Transformer.

An attack that implants a hidden function in a model so it behaves maliciously only when a specific trigger is present.

A model that assigns inputs to one of a set of predefined categories. Used for spam/ham and malicious/benign decisions.

An evaluation table that cross-tabulates a classifier's predictions versus true labels, showing TP, FP, TN, and FN.

An attack that injects malicious samples into training data to manipulate a model's performance or behavior.

A subfield of machine learning using multi-layer neural networks to learn complex representations. Applied to image- and text-based threat detection.

A dense vector representation that captures the semantic meaning of words or documents. Forms the basis of similarity search and RAG.

Techniques and a field for making AI model predictions interpretable to humans. Important for trusting detection outcomes.

The harmonic mean of precision and recall, summarizing classification performance in a single value.

The rate at which actual negatives are incorrectly classified as positive. Directly linked to alert fatigue in detection systems.

The process of transforming and selecting raw data into features suitable for a model. Greatly impacts detection performance.

The process of further training a pre-trained model on task- or domain-specific data. Used to specialize security classifiers.

A neural architecture where a generator and discriminator compete during training. Used to create deepfakes and synthetic attack data.

An ensemble technique that sequentially combines weak learners to reduce error. Used in detection models such as XGBoost.

Safety controls that inspect and constrain LLM inputs/outputs to block harmful or policy-violating content.

The phenomenon where an LLM plausibly generates false or unsupported content. Treated as a reliability threat.

A technique that bypasses safety guardrails to make an LLM produce prohibited content. Carried out through prompt manipulation.

A branch of AI where systems learn patterns from data to make predictions or classifications without explicit programming. Widely used in security for spam and malware detection.

A privacy attack that infers whether a specific data point was part of a model's training set.

An open protocol that standardizes how LLM applications connect to external tools and data sources.

An attack that manipulates inputs at inference time to evade a detection model. Common in malware detection bypass.

An attack that replicates a target model's functionality or parameters through repeated query-response probing.

A privacy attack that reconstructs sensitive training inputs by analyzing a model's outputs.

A probabilistic classifier based on Bayes' theorem assuming feature independence. A standard for early spam filtering.

The AI field enabling computers to understand and generate human language. Applied to phishing text analysis.

A computational model of interconnected nodes inspired by biological neurons. Forms the basis of pattern recognition and anomaly detection.

When a model fits the training data too closely and fails to generalize to new data.

An OWASP list cataloging the ten most critical security risks for large language model applications.

Precision is the fraction of positive predictions that are correct; recall is the fraction of actual positives detected. Key evaluation metrics.

A machine learning algorithm that ensembles many decision trees for prediction. Frequently used for malicious traffic classification.

An adversarial evaluation that deliberately probes an AI model for vulnerabilities and harmful outputs.

Learning an action policy by optimizing for reward signals. Researched for automated defense and penetration simulation.

A reinforcement learning method that aligns models using human preference feedback as reward. Used to suppress harmful LLM outputs.

The area under the true-positive-rate vs false-positive-rate curve across thresholds, measuring classifier performance.

Learning an input-output mapping from labeled data. Used for label-based detection such as spam/ham classification.

A classification algorithm that finds a hyperplane maximizing the margin between classes. Used in classic spam filters.

The preprocessing step of splitting text into smaller units called tokens for model input.

A machine learning approach that reuses knowledge learned on one task for a related task. Useful in data-scarce security domains.

A neural network architecture based on the self-attention mechanism, the core of modern LLMs. Excels at processing sequential data.

Learning structure or patterns from unlabeled data. Used in clustering-based anomaly detection.

A database that stores embedding vectors and performs approximate nearest-neighbor search. Used in RAG and semantic search.

データを暗号化して身代金を要求するマルウェアです。RaaSはこれをサブスクリプション形式で販売する犯罪エコシステムを指します。

リアルタイムのプロキシでログインセッショントークンを奪い取り、MFAまで回避するフィッシング手法です(急増中)。

MFAの承認プッシュ通知を繰り返し送りつけ、ユーザーが不注意に承認してしまうよう仕向ける攻撃です。

AIで合成した音声・映像です。経営層の声や顔を偽造し、BECやビッシングを高度化させます。

AIモデルに隠れた指示を注入し、意図と異なる動作を引き起こす攻撃です(LLM時代の新種の脅威)。

承認されていないAIツールに従業員が機密情報を入力してしまうことで生じる情報漏えいリスクです。

「決して信頼せず、常に検証する」— ネットワーク上の位置ではなく、アイデンティティと文脈でアクセスを制御するモデルです。

信頼している協力会社・ソフトウェア・アップデート経路を侵害し、多数を一度に狙う攻撃です。

エンドポイント(EDR)、およびメール・クラウド・ネットワークまで拡張した(XDR)検知・対応ソリューションです。

機密情報の外部流出(メール・アップロードなど)を検知・遮断する統制です。

内部者(悪意によるものか不注意によるものかを問わず)による情報漏えい・被害です。乗っ取られたアカウントも内部者のように振る舞います。

フィッシングや中間者攻撃に耐性のある認証方式です(パスキー、FIDO2セキュリティキー)。パスワードレスへの方向性を示します。

侵入して得たアクセス権限を、ランサムウェア集団など他の攻撃者に販売する犯罪の専門分業層です。

外部に露出している資産・ドメイン・サービスを継続的に発見・管理し、攻撃経路を減らす活動です。

A sophisticated, prolonged, and stealthy intrusion by a well-resourced adversary to achieve specific goals. Often conducted by nation-state groups.

A network of compromised devices remotely controlled by an attacker. It is used for DDoS, spam, and cryptomining.

An attack that systematically tries all possible passwords or key combinations to break authentication. Weak passwords are especially vulnerable.

A security broker that sits between users and cloud services to enforce policy and provide visibility. It helps control shadow IT.

An attack that automatically tries leaked username-password pairs against other services to hijack accounts. It exploits password reuse.

A tool that continuously assesses and remediates misconfigurations and compliance gaps in cloud environments. It reduces risk from improper configuration.

An attack that tricks an authenticated user into executing unintended requests. It performs actions using the victim's privileges.

An attack that floods a target service with traffic from many devices to disrupt it. It undermines availability.

An encryption method where only the sender and recipient can decrypt the message. Even intermediary servers cannot read the content.

A security device or software that allows or blocks network traffic based on defined rules. It protects internal networks from external threats.

A framework for identifying users and managing their access to resources. It encompasses authentication and authorization.

Security systems that detect (IDS) or actively block (IPS) malicious activity on networks or hosts. They operate on signatures or anomaly detection.

A tool that secretly records a user's keystrokes. It is used to steal passwords and sensitive information.

A technique that abuses legitimate tools already present on a system, such as PowerShell, to evade detection. It operates without dropping extra malware.

A general term for malicious software designed to harm or gain unauthorized access to systems. It includes viruses, worms, and trojans.

An attack where the adversary intercepts or alters communication between two parties. Unencrypted communications are especially vulnerable.

An authorization protocol that lets users delegate limited access to third-party apps without sharing passwords. It operates using tokens.

A security discipline that controls, monitors, and audits access by high-privilege accounts. It mitigates misuse and credential theft.

Cryptographic algorithms designed to resist attacks by quantum computers. Standardization is underway to replace classical public-key schemes.

An asymmetric cryptography scheme using a public-private key pair for encryption and digital signatures. It enables secure communication without prior key exchange.

A stealthy malicious toolset that hides deep in a system to maintain privileged access and evade detection. It conceals activity at the OS level.

An architecture that delivers networking and security functions as a unified cloud service. It combines SD-WAN with zero-trust security.

Malware that covertly monitors activity and exfiltrates collected information. It steals keystrokes, screens, and credentials.

An attack that injects malicious SQL statements into input to manipulate a database. It can lead to data exfiltration or tampering.

An authentication scheme that lets users access multiple applications with a single login. It improves usability and credential management.

A standard protocol that encrypts network communication and provides integrity and authentication. It underpins HTTPS and succeeds SSL.

Malware disguised as legitimate software to trick users into running it. It is used to install backdoors or steal data.

A technology that creates an encrypted tunnel over public networks for secure communication. It is used for remote access and privacy.

Malware that self-replicates and spreads across networks without user interaction. Its rapid propagation can cause widespread damage.

An attack that injects malicious scripts into web pages to run in other users' browsers. It is used for session hijacking and more.