Search: lifecycle — Cyber Encyclopedia

166 terms · 75/46/45

46 rezultata za „lifecycle" · 3 direktna · 43 povezanih

Odbrane

3 direktna pogotka

№ 013
Certificate Management Managing the lifecycle of digital certificates — issuance, renewal, revocation.
odbrana · identity / access
№ 040
DevSecOps … urity into all phases of the software development lifecycle.
odbrana · people
№ 009
Identity & Access Management IAM covers the entire user account lifecycle, from creation at onboarding through role changes to deactivation at offboarding. It includes role assignment, grou …
odbrana · identity / access

↳ Povezano

43 stavke koje koriste „lifecycle"

№ 042
API Abuse API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.
pretnja · applications
№ 020
Access Token Manipulation Token abuse involves stealing or manipulating authentication tokens, session cookies, or access keys to assume the identity of a legitimate user or service. The attacker can use a token without knowing the password.
tehnika · privileges
№ 065
Accidental Data Leak An accidental data leak is not an attack in the classic sense, but the consequences can look the same. Data becomes available to the wrong people through human error, bad configuration, wrong sharing, a public repository, open cloud storage, or mail sent to the wrong address.
pretnja · trust
№ 021
Account Takeover Account takeover is the moment the attacker gains full control of an account — not only access, but the ability to change the password, the recovery mail address, the phone number and the second factor, while the real owner is shut out with no technical way back in on their own. Takeover is rarely the first stage of an attack. It is usually the destination of what came before: phishing, credential stuffing, token theft.
pretnja · identity
№ 043
Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.
pretnja · applications
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.
pretnja · malware
№ 004
Brute Force Brute force as a technique involves the systematic testing of a large number of credential combinations to gain unauthorized access. It includes classic exhaustive testing, dictionary attacks with common passwords, and password spraying.
tehnika · initial access
№ 015
Brute-force attack A brute-force attack breaks into an account by trying to log in over and over: automated tools work through password after password until one takes. It succeeds against short, weak and common passwords, and against systems that put no limit on failed attempts. It is not clever — it is only fast, and it can run for days.
pretnja · identity
№ 028
Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the company believes the request comes from the director, from finance, from a supplier, a lawyer or a partner. The aim is usually money, but it can also be a confidential document, a change of payment details, or an opening for the next phase of the attack.
pretnja · social eng.
№ 075
Cloud IAM misconfiguration Cloud IAM misconfiguration means a user, a service account, an application or a role holds more rights than it needs. In the cloud an identity is not merely a login. An identity is permission to read data, spin up resources, change networks, assume roles and delete backups.
pretnja · cloud
№ 024
Cloud lateral movement In the cloud, identities can assume roles — temporarily take on another identity's rights. It's built for legitimate delegation, but it becomes lateral movement when an attacker who got one identity chains the steps: identity A can become B, B can become C with more rights, C reaches another account. No new password at each step — just inherited delegation.
tehnika · privileges
№ 074
Cloud storage exposure Cloud storage exposure arises when data that ought to be private becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database exports or configuration files.
pretnja · cloud
№ 026
Configuration Abuse Configuration abuse involves exploiting misconfigured systems, services, or security controls. Attackers look for default passwords, overly broad permissions, open ports, and services without authentication.
tehnika · discovery
№ 063
Contractor Abuse Contractor access abuse arises when a consultant, a contractor, an external firm or a temporarily engaged person uses access more widely or for longer than the work requires. The access is often granted legitimately, but afterwards it is not monitored, not narrowed and not withdrawn in time.
pretnja · trust
№ 003
Credential Abuse Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.
tehnika · initial access
№ 057
DNS Poisoning DNS poisoning is an attack in which a user or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the browser and DNS takes them to the wrong web server. On paper the name is the same. In reality the road leads somewhere else.
pretnja · availability
№ 035
Deepfake Attack A deepfake attack uses an artificially generated voice, image or video so that somebody can pose as a real person. In cyber attacks this usually means the director's voice on a call, a colleague's face in a video meeting, or a recording that feels real enough for the victim to accept the request.
pretnja · social eng.
№ 048
Dependency Confusion Dependency confusion is an attack on the process by which software build platforms find and deliver software dependencies. An attacker can publish a package on a public registry with the same name as an organization's internal package, or with the name of another public and valid package, counting on the fetching tool choosing their version over the real one.
pretnja · applications
№ 029
Domain Account Discovery Mapping users, groups, permissions, and Active Directory structure.
tehnika · discovery
№ 068
Evil Twin A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.
pretnja · physical / IoT
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.
tehnika · execution
№ 022
Forge Kerberos Tickets A set of techniques exploiting the Kerberos protocol in Active Directory.
tehnika · privileges
№ 058
Insider Threat An insider threat comes from a person who has, or once had, legitimate access to an organization's systems, data or premises. That can be an employee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized to begin with.
pretnja · trust
№ 022
Kerberoasting Kerberoasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — service accounts — under which most background tasks and services run, such as databases and business applications. Service accounts are set up so that any user can request a ticket for access to a given service. The catch is that the ticket is encrypted with the service account's password.
pretnja · identity
№ 024
MFA Fatigue MFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a confirmation the user has to approve on their phone. So the attacker starts the login over and over, burying the phone in approval requests. The arithmetic is simple: out of irritation, confusion, or the thought that it must be some glitch, the user approves one at some point — and the attacker is through the whole authentication.
pretnja · identity
№ 073
Model theft / extraction Model theft and extraction means an attacker obtains a model an organization trained, bought or adapted to its own needs. That can be direct theft of the files, the weights and the configuration, but also controlled extraction through an API, where the model is queried enough times to build an approximate copy.
pretnja · AI / ML
№ 028
Network Sniffing Passively intercepting network traffic to collect sensitive data.
tehnika · discovery
№ 016
Password spraying Password spraying is brute force turned around. Instead of trying many passwords on one account, the attacker tries common passwords across many accounts. That avoids lockout, because each individual account sees only an attempt or two.
pretnja · identity
№ 031
Pretexting Pretexting is social engineering with a prepared story. The attacker does not simply send a link and wait for a click; they build a scenario in which what they are doing looks normal. They present themselves as a colleague, technical support, an auditor, a bank, a supplier, a courier or an official.
pretnja · social eng.
№ 061
Privilege Misuse Privilege misuse arises when somebody uses rights they genuinely hold for actions they have no business reason to take. Unlike privilege escalation, the attacker or insider here does not have to acquire new authority. The trouble is that the existing authority is enough to do damage.
pretnja · trust
№ 072
Prompt injection Prompt injection exploits the weakness of language models in telling an instruction apart from the content they are processing. When a model reads an email, a document, a page, a ticket or a message, the attacker can put text into that content which reads like an instruction.
pretnja · AI / ML
№ 025
SIM Swapping SIM swapping does not attack the phone but the phone number. The attacker persuades, or bribes, a mobile operator to move the number to a new SIM card, citing a lost phone or a damaged card. They usually come armed with personal details from leaked databases and phishing. The moment the number moves to their card, the real phone loses signal and every call and message goes to the attacker.
pretnja · identity
№ 054
Service Abuse Service abuse uses legitimate functions of a system in an unforeseen way. The attacker does not have to find a classic vulnerability. It is enough to work out how a normal function can be automated, overloaded, or turned against the service and its users.
pretnja · availability
№ 033
Service Abuse Service abuse as a technique involves using legitimate system functionalities in unintended ways to cause damage, gain unauthorized access, or achieve financial gain.
tehnika · exfiltration / impact
№ 019
Session Hijacking When you log in, the service opens a session — a state that remembers you are you, together with everything that goes with it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an identifier, usually held in a browser cookie. Session hijacking is the taking over of a session that is already open. The attacker does not attack the login; they slip into a session that has already passed authentication and carry on operating the service in your name.
pretnja · identity
№ 064
Shadow IT Shadow IT is the use of applications, cloud services, accounts and tools without the knowledge or approval of the IT team. Employees usually do not bring them in to cause a problem but to get the work done faster: a file needs sharing, a team needs a chat, marketing needs a tool, sales needs a PDF now.
pretnja · trust
№ 062
Shared Account Abuse Shared account abuse begins wherever several people use the same username and password. The system then no longer knows who actually did something. It knows only that a particular account was used, which for accountability is the same as knowing nothing.
pretnja · trust
№ 002
Social Engineering Social engineering as a technique involves manipulating human behavior to obtain information, access, or the execution of actions that benefit the attacker. It relies on trust, authority, urgency, or fear.
tehnika · initial access
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.
pretnja · trust
№ 006
Supply Chain Compromise Technique of injecting malicious code into the software supply chain.
tehnika · initial access
№ 059
Third-Party Compromise Third-party compromise happens when the attacker does not go at an organization directly but at a supplier, a partner, a service provider or an external associate who already holds some form of trust and authorized access. Instead of forcing the front door, the attacker looks for a side entrance somebody else has already opened.
pretnja · trust
№ 018
Token Theft A token is proof that you have already logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have already been checked the next time round. The token is sent automatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — without your password and without the second factor, because both have already been approved.
pretnja · identity
№ 044
Zero-Day Exploitation Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.
pretnja · applications