資安詞彙表

冒充可信任對象以竊取憑證、金錢或機敏資料的詐騙訊息。

針對特定個人或組織，運用蒐集而來的詳細資訊精心設計的目標式網路釣魚攻擊。

冒充高階主管或往來廠商的社交工程詐騙，誘騙受害者匯款、變更帳戶或外洩資料；此類攻擊通常不含連結或附件，而是濫用職權、急迫感與信任關係達成目的。

一種供應鏈型的 BEC 攻擊，攻擊者入侵受信任廠商的帳號，藉此竄改發票上的付款帳戶資訊。

將惡意連結隱藏於 QR Code 之中，藉此繞過網址過濾機制的網路釣魚手法。

透過簡訊（Smishing）或電話語音（Vishing）進行的網路釣魚攻擊，經常與電子郵件攻擊搭配使用。

偽造寄件者地址或顯示名稱，使郵件看起來像來自合法寄件者的手法。

只偽造顯示名稱（例如高階主管或品牌名稱），但實際寄件地址並不相同的冒充手法。

外觀與正常網域極為相似的偽冒網域（例如以 rn 混淆 m、以 0 混淆 o），藉此矇騙使用者的視覺判斷。

利用竊取的憑證掌控真實帳號，並從內部發動攻擊的手法。

通常透過假冒的登入頁面，蒐集使用者帳號與密碼的行為。

尚未有修補程式或特徵碼可辨識的全新漏洞或攻擊手法。

An attack that uses large language models to mass-produce highly natural, personalized phishing emails free of grammatical errors.

A phishing technique using fake customer-support accounts on social media to approach complaining users and steal their information.

A technique that lures victims into running malware themselves using enticing bait such as infected USB drives or free downloads.

A technique that mimics a well-known brand's logo, design, and domain to deceive users with emails or sites that look authentic.

A common BEC variant in which an attacker impersonates a CEO or top executive to instruct finance staff to make urgent wire transfers.

A phishing technique that copies a legitimate previously delivered email and resends it with attachments or links swapped for malicious ones.

A phishing technique that tricks users into granting permissions to a malicious OAuth app, enabling data access without stealing passwords.

An attack where adversaries monitor an ongoing business email conversation and inject themselves to alter payment details or commit fraud.

An attack using AI-generated fake audio or video to impersonate executives in calls or voice messages to induce wire transfers or data leaks.

An attack where adversaries steal credentials to seize a legitimate email account and abuse it for internal impersonation or fraud.

A common BEC social-engineering scam that impersonates an executive to urgently ask an employee to buy gift cards and send the codes.

An attack using visually identical Unicode characters (e.g., Cyrillic 'a' vs Latin 'a') to create fraudulent domains that look legitimate.

A general class of attacks that masquerade as trusted persons, brands, or organizations so victims believe requests are legitimate.

A BEC-style financial fraud that sends fake or altered invoices to redirect payments to attacker-controlled accounts.

An attack vector delivering malware or malicious macros hidden in email attachments such as documents or archives that infect upon opening.

Spam email carrying malicious attachments or links, sent in bulk and serving as a primary vector for malware infections.

A BEC scam that impersonates an employee to ask HR or payroll to change direct-deposit details, diverting wages to an attacker's account.

An attack that redirects users to fraudulent websites via DNS poisoning or host-file manipulation even when they enter a legitimate address.

A cybercrime business model that sells phishing infrastructure, kits, and hosting as a subscription service, lowering the barrier to attacks.

A pre-built package bundling fake login pages and collection scripts so non-experts can quickly deploy phishing sites.

A social-engineering technique where an attacker fabricates a plausible scenario or false identity to gain a victim's trust and extract information.

A social-engineering technique that offers a service or benefit, such as fake tech support, in exchange for credentials or access.

An email attack that inserts malicious links or attachments into an existing reply chain from a compromised account so recipients open them without suspicion.

An extortion scam email that threatens to release supposed compromising sexual material unless the victim pays money such as Bitcoin.

A phishing attack delivered via SMS text messages using malicious links or fraudulent prompts to deceive users.

The manipulation of human psychology and trust, rather than technical vulnerabilities, to induce information disclosure or security bypass.

Unsolicited bulk email sent without recipient consent, often abused as a vector for phishing or malware distribution.

An attack that floods a victim's inbox with massive email volume in a short time to bury legitimate security or fraud-alert notifications, often as a precursor to follow-on scams.

A physical social-engineering technique of following an authorized person into a restricted area without credentials, also known as piggybacking.

An attack that replies into an existing conversation thread from a compromised mailbox to insert malicious content while exploiting established trust.

Registering misspelled variants of popular domains to capture users who make typing errors and redirect them to malicious sites.

A technique abusing open-redirect vulnerabilities on trusted sites so links appear legitimate but forward victims to malicious destinations.

A social-engineering attack that uses phone or voice calls to deceive victims into divulging personal or financial information.

A fraud technique where AI clones a target's voice from short samples to impersonate family or superiors and demand urgent money transfers.

A targeted attack that compromises websites frequently visited by a target group to infect their visitors.

An Office or PDF document manipulated with macros, exploits, or embedded objects to execute malware merely upon opening.

A form of spear phishing that targets high-profile executives such as CEOs or CFOs to exploit their authority and access to funds.

透過 DNS 紀錄宣告哪些郵件伺服器可代表該網域寄送郵件的驗證機制。

為郵件加上加密簽章，用以驗證郵件內容未遭竄改的驗證機制。

依 SPF／DKIM 驗證結果強制執行政策（拒絕／隔離）並產生報告的機制層。

在郵件經過中繼或轉寄伺服器時，保存並重新簽署驗證結果的驗證鏈機制。

指向該網域收信伺服器的 DNS 紀錄；導入行內（inline）閘道時會需要變更此紀錄。

A standard that displays a brand's verified logo next to authenticated messages in the inbox for domains passing DMARC, with the logo validated via DNS and a Verified Mark Certificate.

A protocol that binds TLS certificates or public keys to DNS names using DNSSEC-protected TLSA records, enabling verification of server certificates for protocols such as SMTP without relying solely on CAs.

An identifier used to distinguish among multiple DKIM keys for a domain; the corresponding public key is published at the DNS location selector._domainkey.domain.

A periodic XML report sent by receiving servers to a domain owner, summarizing statistics on SPF, DKIM, and DMARC authentication results for the domain's mail.

The core DMARC requirement that the domain authenticated by SPF or DKIM match the domain in the message's From header, evaluated in strict or relaxed mode.

Extensions that add digital signatures to DNS responses to provide data integrity and origin authentication, preventing DNS spoofing and cache poisoning and underpinning DANE.

A TLS property using ephemeral per-session keys so that even if a long-term private key is later compromised, previously recorded encrypted traffic cannot be decrypted.

A mechanism letting a domain publish, over HTTPS, a policy requiring TLS encryption and certificate validation for inbound SMTP connections, defending against downgrade and man-in-the-middle attacks.

An open standard for email encryption derived from PGP (RFC 4880 and successors) that defines message and key formats so implementations like GnuPG can interoperate.

A public-key cryptography program for encrypting and signing email and files, using a web-of-trust model to validate keys.

The envelope sender (MAIL FROM) address of an email, where bounce messages are returned, and whose domain is the basis for SPF verification and DMARC alignment.

A standard for end-to-end signing and encryption of email messages using X.509 certificate-based public-key cryptography, providing message integrity, authentication, and confidentiality.

The standard internet protocol for transmitting email between mail servers and from clients to servers; plaintext by default, it is secured with STARTTLS or SMTPS.

A method of encrypting SMTP with TLS from the start of the connection (implicit TLS, typically port 465), encrypting from the outset rather than via the opportunistic upgrade of STARTTLS.

A DNS TXT record listing a domain's authorized sending mail servers, beginning with v=spf1 and composed of mechanisms like include, a, mx, ip4 and qualifiers such as -all.

A command that opportunistically upgrades an existing plaintext protocol connection to a TLS-encrypted one, used in SMTP, IMAP, and POP3 to secure the transport while keeping standard ports.

A standard that lets domains using MTA-STS or DANE receive daily aggregate reports from sending mail servers about TLS negotiation successes and failures.

A digital certificate issued by an authority that verifies a brand's trademark rights to a logo, used in BIMI to display a validated logo in the inbox.

部署於 MX 之前，於郵件送達前進行過濾的傳統行內式（inline）防護架構。

透過 API 整合 M365／Workspace，於郵件送達後進行掃描與修復的現代化防護方式，無需變更 MX 紀錄。

將所有郵件副本傳送至資安系統，以進行不影響郵件流程的監控與稽核。

在隔離環境中執行可疑檔案或連結，藉此觀察其惡意行為的動態分析技術。

移除附件中的可執行內容（如巨集等），並重新建構出安全版本的技術。

使資料始終處於所屬管轄權的法律與控制之下，通常透過地端（on-prem）或本地（in-region）部署方式達成。

Collateral spam in which bounce messages or auto-replies to spam with forged sender addresses flood innocent third parties.

A security control that inserts a warning banner at the top of messages from outside the organization to raise user awareness.

A core ICES capability that automatically retracts or removes messages already delivered to inboxes once they are found malicious, via API (clawback).

A mail server control that limits SMTP connection or send rates per source IP or domain to mitigate spam, abuse, and overload.

An availability and disaster-recovery capability ensuring users can send and receive email even during a primary mail system outage.

A technology that inspects outbound email content to detect, block, or encrypt unauthorized transmission of sensitive data.

A gateway solution that automatically encrypts outbound email according to policy to protect sensitive information.

A feature that holds suspected spam, malware, or phishing email in a separate quarantine area instead of the inbox for admin or user review.

A technology that detonates suspicious attachments or URLs in an isolated virtual environment to dynamically analyze malicious behavior.

A capability that temporarily stores mail on a backup server when the destination is down and re-delivers it after recovery to prevent loss.

A technique that temporarily rejects email from unknown senders, relying on legitimate MTAs to retry, thereby filtering out spambots.

An email retrieval protocol that keeps messages on the server and allows synchronized access across multiple devices.

The two email security deployment models: inline, which sits in the mail flow to block in transit, versus API-based, which integrates with mailbox APIs to act post-delivery.

A queue within an MTA that temporarily holds email that cannot be delivered immediately and manages retries.

Software that delivers email received from an MTA into the recipient's mailbox.

A server that receives outgoing mail from clients, applies authentication and policy checks, and hands it to an MTA, typically over port 587.

Software that transfers and routes email between mail servers using SMTP.

Client software that lets users compose, read, and manage email, commonly known as an email client.

An email retrieval protocol that downloads messages from the server to a local client, typically removing them from the server.

A reputation-based blocklist of IP addresses known to send spam, queried via DNS to reject mail.

A filtering technique that uses reputation scores based on the historical behavior of sending IPs or domains to block or allow mail.

A designated external relay server through which a mail server routes all outbound email instead of delivering directly to destinations.

The process by which one mail server forwards email through another, which if misconfigured can be abused as an open relay.

An attack technique that exploits differing interpretations of message-end sequences between sending and receiving servers to inject spoofed email.

Encrypting an SMTP connection via the STARTTLS command to protect message content in transit.

An SMTP submission port using implicit TLS where encryption applies from the start of the connection.

The standard SMTP submission port used by authenticated clients to submit mail, distinct from port 25 used for relaying.

A protection that re-evaluates a link's safety at the moment a user clicks it, catching URLs weaponized after delivery.

A mail flow policy rule that evaluates conditions on email and automatically applies actions such as blocking, redirecting, adding headers, or encryption.

A technique that rewrites links in email to point to a security proxy so their safety is checked in real time at click time.

彙整並關聯分析資安事件與日誌資料的平台（如 Splunk、Sentinel 等）。

將事件應變作業自動化與流程化整合的機制。

顯示遭受入侵跡象的鑑識線索（如惡意 IP、網域、檔案雜湊值等）。

將判定為高風險的郵件移出或攔阻於收件匣之外的補救措施。

要求在密碼之外提供額外的驗證因子，以降低帳號遭盜用風險的驗證機制。

A targeted adversary that uses sophisticated techniques to maintain stealthy, long-term access. It is often associated with nation-state actors.

The desensitization of analysts caused by an overwhelming volume of alerts, leading to missed critical threats. It is a major challenge in SOC operations.

A chronological record of activities and changes within a system. It is essential for accountability and post-incident investigation.

A defensive team responsible for protecting assets and detecting and responding to attacks. They are the core staff of SOC operations.

The mandatory process of informing regulators and affected individuals when a data breach occurs. It is required under regulations such as GDPR and data protection laws.

The documented chronological handling of digital evidence to ensure its integrity. It is essential for legal admissibility.

The communication channel and infrastructure attackers use to remotely control compromised systems. It is used for data exfiltration and issuing further commands.

A specialized organization that receives, coordinates, and responds to security incidents. They operate at national, sector, and organizational levels.

A dedicated team responsible for handling security incidents within an organization. It performs detection, analysis, recovery, and post-incident activities.

A model defined by Lockheed Martin describing the stages of a cyberattack. It breaks an attack into seven phases from reconnaissance to actions on objectives.

The unauthorized transfer of data from inside an organization to an external destination. It is often the ultimate goal of an attack.

A field combining forensic investigation with incident response. It simultaneously determines root cause and drives rapid remediation.

The discipline of collecting, preserving, and analyzing digital evidence to determine the cause and course of an incident. It emphasizes legal admissibility.

A solution that continuously monitors endpoint activity to detect, investigate, and respond to threats. It uses behavioral analysis to identify advanced attacks.

An alert that incorrectly flags benign activity as a threat. Excessive false positives cause analyst fatigue and alert dismissal.

The European Union's regulation on personal data protection and processing. It includes breach notification obligations and strong penalties.

An integrated approach to managing an organization's governance, risk management, and regulatory compliance. It aligns security decisions with business objectives.

The structured process of detecting, containing, eradicating, and recovering from security incidents. Its goal is to minimize damage and restore normal operations.

Indicators that reveal an attacker's intent and behavioral patterns. They focus on detecting an attack in progress before compromise completes.

An international standard for information security management systems (ISMS). It requires risk-based controls and continual improvement.

A technique where an attacker expands access from a compromised system to others within the network. It is used to reach target assets.

The practice of collecting, storing, analyzing, and retaining system and application logs. It underpins detection, forensics, and compliance.

The average time taken to detect a security incident after it occurs. It is a key metric for SOC detection performance.

The average time taken to respond to and remediate an incident after detection. It measures response efficiency.

A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It serves as a common framework for detection and defense.

A solution that analyzes network traffic to detect and respond to anomalous behavior and threats. It excels at identifying lateral movement and stealthy attacks.

A cybersecurity management framework from the U.S. NIST organized around Identify, Protect, Detect, Respond, and Recover functions. It provides a common language for risk management.

A security standard that organizations handling payment card data must comply with. It governs the storage, transmission, and processing of cardholder data.

Techniques that allow an attacker to maintain access across reboots or credential changes. It is one of the key tactics in MITRE ATT&CK.

A standardized set of procedures for responding to a specific type of incident. It forms the basis for SOAR automation.

An attack technique for gaining higher privileges from a lower-privileged context. It is a key step toward system control and persistence.

An exercise that has offensive (red team) and defensive (blue team) collaborate to improve detection and response. It integrates feedback from both sides.

An offensive team that emulates real adversaries to test an organization's defenses. It exposes gaps in detection and response.

A step-by-step guide documenting operational tasks or response procedures. It ensures consistency and repeatability.

A centralized team and facility that continuously monitors, detects, and responds to security events. It combines analysts, processes, and technology to manage threats.

A generic, vendor-agnostic format for log-based detection rules. It allows a rule to be written once and converted for multiple SIEM platforms.

An AICPA audit report attesting to a service organization's adherence to trust principles such as security, availability, and confidentiality. It is widely used by SaaS firms to demonstrate trustworthiness.

A standardized language for representing structured cyber threat intelligence. It supports consistent sharing of threat information.

A standard protocol used by network devices and systems to send log messages. It is widely used for centralized log collection.

A discussion-based exercise that walks through a hypothetical incident scenario. It surfaces gaps in procedures and communication beforehand.

A concept describing adversary behavior at the levels of tactics, techniques, and procedures. It serves as the basis for threat analysis and detection.

A transport protocol for exchanging STIX-based threat intelligence. It enables automated sharing of threat information.

An individual or group responsible for causing a security incident. They are classified by motivation, capability, and resources.

A rule defining specific malicious patterns or conditions that trigger alerts. It is the basic unit of SIEM and EDR detection logic.

The proactive, hypothesis-driven search for threats that evade existing detection tools. Analysts actively look for signs of compromise.

Collected and analyzed information about threat actors and attacks. It supports defensive decision-making and proactive response.

Technology that learns baselines of normal user and entity behavior to detect anomalies. It is effective at spotting insider threats and account takeover.

A solution that unifies detection and response across endpoints, network, cloud, and email layers. It provides visibility beyond isolated security silos.

A tool and rule language for identifying and classifying malware based on patterns. It is widely used in malware hunting and forensics.

大型語言模型（LLM）與可自行架設的小型語言模型（sLLM），用於意圖分類判讀。

以連續數值與密集運算為基礎的標準人工神經網路，Transformer 架構的 LLM 即屬此類（目前實際部署的偵測引擎）。

以離散脈衝訊號運作的第三代神經網路，具備超低功耗與適合串流處理的特性（目前仍處於研究階段）。

檢索外部知識（如威脅情資）作為佐證，強化模型判斷依據的技術。

由多個專責代理協同運作、如同資安分析師般整合線索以判斷意圖的自動化技術。

An input subtly perturbed to be misclassified by a model while appearing normal to humans. A core threat in ML security.

The study of attacks that deceive or subvert machine learning models, and the defenses against them.

An autonomous LLM-based system that invokes tools and reasons over multiple steps to accomplish goals.

The research field of steering AI systems' goals and behavior toward human intent and values. Central to safe LLM operation.

A technique for identifying data or behavior that deviates from normal patterns. Central to intrusion and fraud detection.

A neural network technique that weights the most relevant parts of an input sequence. A key component of the Transformer.

An attack that implants a hidden function in a model so it behaves maliciously only when a specific trigger is present.

A model that assigns inputs to one of a set of predefined categories. Used for spam/ham and malicious/benign decisions.

An evaluation table that cross-tabulates a classifier's predictions versus true labels, showing TP, FP, TN, and FN.

An attack that injects malicious samples into training data to manipulate a model's performance or behavior.

A subfield of machine learning using multi-layer neural networks to learn complex representations. Applied to image- and text-based threat detection.

A dense vector representation that captures the semantic meaning of words or documents. Forms the basis of similarity search and RAG.

Techniques and a field for making AI model predictions interpretable to humans. Important for trusting detection outcomes.

The harmonic mean of precision and recall, summarizing classification performance in a single value.

The rate at which actual negatives are incorrectly classified as positive. Directly linked to alert fatigue in detection systems.

The process of transforming and selecting raw data into features suitable for a model. Greatly impacts detection performance.

The process of further training a pre-trained model on task- or domain-specific data. Used to specialize security classifiers.

A neural architecture where a generator and discriminator compete during training. Used to create deepfakes and synthetic attack data.

An ensemble technique that sequentially combines weak learners to reduce error. Used in detection models such as XGBoost.

Safety controls that inspect and constrain LLM inputs/outputs to block harmful or policy-violating content.

The phenomenon where an LLM plausibly generates false or unsupported content. Treated as a reliability threat.

A technique that bypasses safety guardrails to make an LLM produce prohibited content. Carried out through prompt manipulation.

A branch of AI where systems learn patterns from data to make predictions or classifications without explicit programming. Widely used in security for spam and malware detection.

A privacy attack that infers whether a specific data point was part of a model's training set.

An open protocol that standardizes how LLM applications connect to external tools and data sources.

An attack that manipulates inputs at inference time to evade a detection model. Common in malware detection bypass.

An attack that replicates a target model's functionality or parameters through repeated query-response probing.

A privacy attack that reconstructs sensitive training inputs by analyzing a model's outputs.

A probabilistic classifier based on Bayes' theorem assuming feature independence. A standard for early spam filtering.

The AI field enabling computers to understand and generate human language. Applied to phishing text analysis.

A computational model of interconnected nodes inspired by biological neurons. Forms the basis of pattern recognition and anomaly detection.

When a model fits the training data too closely and fails to generalize to new data.

An OWASP list cataloging the ten most critical security risks for large language model applications.

Precision is the fraction of positive predictions that are correct; recall is the fraction of actual positives detected. Key evaluation metrics.

A machine learning algorithm that ensembles many decision trees for prediction. Frequently used for malicious traffic classification.

An adversarial evaluation that deliberately probes an AI model for vulnerabilities and harmful outputs.

Learning an action policy by optimizing for reward signals. Researched for automated defense and penetration simulation.

A reinforcement learning method that aligns models using human preference feedback as reward. Used to suppress harmful LLM outputs.

The area under the true-positive-rate vs false-positive-rate curve across thresholds, measuring classifier performance.

Learning an input-output mapping from labeled data. Used for label-based detection such as spam/ham classification.

A classification algorithm that finds a hyperplane maximizing the margin between classes. Used in classic spam filters.

The preprocessing step of splitting text into smaller units called tokens for model input.

A machine learning approach that reuses knowledge learned on one task for a related task. Useful in data-scarce security domains.

A neural network architecture based on the self-attention mechanism, the core of modern LLMs. Excels at processing sequential data.

Learning structure or patterns from unlabeled data. Used in clustering-based anomaly detection.

A database that stores embedding vectors and performs approximate nearest-neighbor search. Used in RAG and semantic search.

將資料加密以勒索贖金的惡意程式；RaaS（勒索軟體即服務）則是將其以訂閱模式販售的犯罪生態系統。

透過即時代理攔截登入工作階段權杖，藉此繞過多因子驗證的網路釣魚手法（案例正快速增加）。

大量發送 MFA 推播請求，誘使使用者在不勝其擾之下誤觸「核准」的攻擊手法。

以 AI 合成的語音或影像，用於冒充高階主管身分，大幅提升 BEC 與電話語音詐騙的殺傷力。

在 AI 模型中植入隱藏指令，誘使其做出違背原意行為的攻擊手法（LLM 時代的新興威脅）。

員工將機敏資訊輸入未經核准的 AI 工具，因而引發資料外洩的風險。

「絕不信任、持續驗證」——以身分與情境（而非網路位置）作為存取控管依據的安全模型。

入侵受信任的廠商、軟體或更新管道，藉此一次性攻擊大量目標的手法。

針對端點的偵測與應變（EDR），並延伸至電子郵件、雲端、網路等範疇的整合式偵測應變方案（XDR）。

偵測並攔阻機敏資料透過電子郵件、上傳等管道外流的控管機制。

由內部人員（惡意或疏忽所致）造成的資訊外洩或損害；遭入侵的帳號其行為模式也如同內部人員一般。

具備抗網路釣魚與中間人攻擊能力的驗證方式（金鑰、FIDO2 安全金鑰），是邁向無密碼化的方向。

入侵企業後，將取得的存取權限轉售給其他攻擊者（如勒索軟體集團）的犯罪專門化角色。

持續發現並管理對外曝露的資產、網域與服務，藉此縮小攻擊路徑的資安維運活動。

A sophisticated, prolonged, and stealthy intrusion by a well-resourced adversary to achieve specific goals. Often conducted by nation-state groups.

A network of compromised devices remotely controlled by an attacker. It is used for DDoS, spam, and cryptomining.

An attack that systematically tries all possible passwords or key combinations to break authentication. Weak passwords are especially vulnerable.

A security broker that sits between users and cloud services to enforce policy and provide visibility. It helps control shadow IT.

An attack that automatically tries leaked username-password pairs against other services to hijack accounts. It exploits password reuse.

A tool that continuously assesses and remediates misconfigurations and compliance gaps in cloud environments. It reduces risk from improper configuration.

An attack that tricks an authenticated user into executing unintended requests. It performs actions using the victim's privileges.

An attack that floods a target service with traffic from many devices to disrupt it. It undermines availability.

An encryption method where only the sender and recipient can decrypt the message. Even intermediary servers cannot read the content.

A security device or software that allows or blocks network traffic based on defined rules. It protects internal networks from external threats.

A framework for identifying users and managing their access to resources. It encompasses authentication and authorization.

Security systems that detect (IDS) or actively block (IPS) malicious activity on networks or hosts. They operate on signatures or anomaly detection.

A tool that secretly records a user's keystrokes. It is used to steal passwords and sensitive information.

A technique that abuses legitimate tools already present on a system, such as PowerShell, to evade detection. It operates without dropping extra malware.

A general term for malicious software designed to harm or gain unauthorized access to systems. It includes viruses, worms, and trojans.

An attack where the adversary intercepts or alters communication between two parties. Unencrypted communications are especially vulnerable.

An authorization protocol that lets users delegate limited access to third-party apps without sharing passwords. It operates using tokens.

A security discipline that controls, monitors, and audits access by high-privilege accounts. It mitigates misuse and credential theft.

Cryptographic algorithms designed to resist attacks by quantum computers. Standardization is underway to replace classical public-key schemes.

An asymmetric cryptography scheme using a public-private key pair for encryption and digital signatures. It enables secure communication without prior key exchange.

A stealthy malicious toolset that hides deep in a system to maintain privileged access and evade detection. It conceals activity at the OS level.

An architecture that delivers networking and security functions as a unified cloud service. It combines SD-WAN with zero-trust security.

Malware that covertly monitors activity and exfiltrates collected information. It steals keystrokes, screens, and credentials.

An attack that injects malicious SQL statements into input to manipulate a database. It can lead to data exfiltration or tampering.

An authentication scheme that lets users access multiple applications with a single login. It improves usability and credential management.

A standard protocol that encrypts network communication and provides integrity and authentication. It underpins HTTPS and succeeds SSL.

Malware disguised as legitimate software to trick users into running it. It is used to install backdoors or steal data.

A technology that creates an encrypted tunnel over public networks for secure communication. It is used for remote access and privacy.

Malware that self-replicates and spreads across networks without user interaction. Its rapid propagation can cause widespread damage.

An attack that injects malicious scripts into web pages to run in other users' browsers. It is used for session hijacking and more.