Word Notes
Word Notes is a cybersecurity podcast from N2K Networks that presents a fun and informative audio glossary of cybersecurity terms. Each episode breaks down key concepts and jargon in the field, making complex topics accessible to a broad audience. The show aims to educate listeners about the language of cybersecurity in an engaging, easy-to-understand format.
Episodes
iCloud keychain (noun)
Please enjoy this encore of Word Notes.
A cloud based sensitive information management system that allows users access across multiple devices.
CyberWire Glossary link: https://thecyberwire.com/glossary/icloud-keychain
Audio reference link: Ellen’s Tips For iOS, 2022. How To Master iCloud Keychain to Keep Your Passwords Safe and Secure [Video]. YouTube. https://www.
spam (noun)
Please enjoy this encore of Word Notes.
Unsolicited, unwanted, and sometimes malicious electronic messages indiscriminately transmitted to a large number of people.
CyberWire Glossary link: https://thecyberwire.com/glossary/spam
Audio reference link: zumpzump, 2007. Monty Python - Spam [Video]. YouTube. URL https://www.youtube.com/watch?v=anwy2MPT5RE.
Learn more about your ad choices. Visi
CISA (noun)
Please enjoy this encore of Word Notes.
A US Department of Homeland Security agency tasked with supporting cyber and physical security for US critical infrastructure.
CyberWire Glossary link: https://thecyberwire.com/glossary/cybersecurity-and-infrastructure-security-agency
Audio reference link: CISA, 2021. CISA Director Jen Easterly’s Keynote at Black Hat
dumpster diving (noun)
Please enjoy this encore of Word Notes.
The act of searching through an organization's trash for discarded sensitive material.
CyberWire Glossary link: https://thecyberwire.com/glossary/dumpster-diving
Audio reference link: “Better Call Saul jimmy digs in the Sandpiper trash scene,” uploaded by Robert Bowersock, 18 September 2022.
Learn more about your ad choices. Visit megaphone.fm/
SEO poisoning (noun)
Please enjoy this encore of Word Notes.
The manipulation of search engine optimization, SEO, to promote malicious sites in search engine results.
CyberWire Glossary link: https://thecyberwire.com/glossary/search-engine-optimization-poisoning
Audio reference link: Brown, B.E., 2021. The Ending Of The Waldo Moment Explained [Video]. YouTube. URL https://www.youtube.com/watch?v=HsWja44-EMg.
L
catfish (noun)
Please enjoy this encore of Word Notes.
The practice of crafting a fake online persona for malicious purposes.
CyberWire Glossary link: https://thecyberwire.com/glossary/catfish
Audio reference link: netbunny, 2013. Catfish - The Movie - Ending Scene [Movie Scene]. YouTube. URL https://www.youtube.com/watch?v=qR_NIN6zy0U
Learn more about your ad choices. Visit megaphone.fm/ad
passkey (noun)
Please enjoy this encore of Word Notes.
A passwordless authentication protocol based on the FIDO2 standard.
CyberWire Glossary link: https://thecyberwire.com/glossary/passkey
Audio reference link: Summers, J., 2023. Google Passkeys Have Arrived (here’s how to use them) [All Things Secured Channel]. YouTube. URL https://www.youtube.com/watch?v=oFO7JgUx-bU.
Learn more about your ad choices.
QR code phishing (noun)
Enjoy this encore of Word Notes.
A type of phishing attack that uses QR codes as the lure.
CyberWire Glossary link: https://thecyberwire.com/glossary/qr-code-phishing
Audio reference link: KNR, 2018. Batman The Dark Knight Joker bomb blast by phone calls scene [Video]. YouTube. URL https://www.youtube.com/watch?v=qB_fXfzB4z0.
Learn more about your ad choices. Visit megaphone
attribution (noun)
Please enjoy this encore of Word Notes.
Definition one: The recognition of a set of repeatable attack patterns across the intrusion kill chain.
Definition two: Determining the responsibility for offensive cyber operations.
CyberWire Glossary link: https://thecyberwire.com/glossary/attribution
Audio reference link: Nunnikhoven, M., 2018. Cybersecurity Basics #9 - Attack Attribution [Video].
spearphishing (noun)
Please enjoy this encore of Word Notes.
A type of cyber attack where an attacker sends a targeted and personalized email or other form of communication to a specific individual or a small group of individuals with the intention of tricking them into divulging sensitive information, such as a password, or convincing them to click a malicious link that will enable the attacker to take control of t
resiliency (noun)
Please enjoy this encore of Word Notes.
The ability to continuously deliver the intended outcome despite adverse cyber events.
CyberWire Glossary link: https://thecyberwire.com/glossary/resiliency
Audio reference link: Cameron, J., 1984. The Terminator [Movie]. IMDb. URL www.imdb.com/title/tt0088247/.
Clip Nation, 2012. The Arnold Schwarzenegger “I’ll Be Back” Sup
Security Operations Center (SOC) (noun)
Please enjoy this encore of Word Notes.
A centralized facility or team responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents within an organization.
CyberWire Glossary link: https://thecyberwire.com/glossary/security-operations-center
Audio reference link: AT&T Tech Channel, 2012. A tour of AT&T’s Network Operations Center (1979) [Video]. YouTube. URL w
hunt forward operations (noun)
Please enjoy this encore of Career Notes.
Defensive cyber operations carried out by U.S. Cyber Command's Cyber National Mission Force, CNMF at the request of allied nations.
CyberWire Glossary link: https://thecyberwire.com/glossary/hunt-forward-operation
Audio reference link: Paul Nakasone, G., 2022. Vanderbilt Summit Keynote [Video]. YouTube. URL www.youtube.com/watch?v=Axg4s9l9wi0.
Lear
Cyber gravity (noun)
The invisible force that governs the movement of data across networks.
Audio reference link: “Things to Come 1936 - HG Wells.” YouTube, YouTube, 28 Sept. 2011, https://www.youtube.com/watch?v=atwfWEKz00U.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Artificial Intelligence (AI) (noun)
Please enjoy this encore of Word Notes.
The ability of computers to execute tasks typically associated with human intelligence, including natural language processing, problem solving, and pattern recognition.
CyberWire Glossary link: https://thecyberwire.com/glossary/ai
Audio reference link: Staff, 2016. Alan Turing - The Imitation Game - Can Machines Think? [YouTube Video]. Learn Understand
Certification (noun)
Please enjoy this encore of Word Notes.
A credential demonstrating an individual's knowledge in the field of cybersecurity, usually obtained by passing an exam or series of exams.
CyberWire Glossary link: https://thecyberwire.com/glossary/certification
Audio reference link: Bombal, D., 2022. Are certifications important in Cybersecurity? [Video]. YouTube. URL www.youtube.com/watch?v=Zdgf_Wr8
Network slicing (noun)
Please enjoy this encore of Word Notes.
A technique used to create virtual networks within a shared physical network infrastructure.
CyberWire Glossary link: https://thecyberwire.com/glossary/network-slicing
Audio reference link: Whitehead, D.N., 2021. 5G Smart Networks Part 1: Network Slicing [Video]. YouTube. URL www.youtube.com/watch?v=dCt3rYODZ7g.
Learn more about your ad choices. Visi
Device trust (noun)
The process of verifying that a device is known, secure, and uncompromised before allowing it to connect to a network or access resources.
CyberWire Glossary link: https://thecyberwire.com/glossary/device-trust
Audio reference link: “Favorite Scene of Alan Rickman from Die Hard.” YouTube, YouTube, 14 Jan. 2016, https://www.youtube.com/watch?v=mklnXM3LIXo.
Learn more about your ad choices. V
ZTNA (noun)
Please enjoy this encore of Word Notes.
A technology set design to support the cybersecurity first principle strategy of zero trust, that limits device people and software component access to only designated authorized resources and nothing more.
CyberWire Glossary link: https://thecyberwire.com/glossary/zero-trust-network-access
Audio reference link: “Zero Trust Explained by John Kindervag.
GDPR (noun)
A data privacy legal framework that applies to all countries in the European Union, regulating the transmission, storage, and use of personal data associated with residents of the EU.
CyberWire Glossary link: https://thecyberwire.com/glossary/general-data-protection-regulation
Audio reference link: “Mr. Robot Predicts JPM Coin!” YouTube, YouTube, 14 Feb. 2019, https://www.youtube.com/watch?v
ChatGPT (noun)
Please enjoy this encore of Word Notes.
A conversational language model developed by the company OpenAI.
CyberWire Glossary link: https://thecyberwire.com/glossary/chatgpt
Audio reference link: jeongphill. “Movie - Her, First Meet OS1 (Operation System One, Os One, OS1).” YouTube, YouTube, 29 June 2014, https://www.youtube.com/watch?v=GV01B5kVsC0.
Learn more about your ad choices. Visit
Man-in-the-Middle (noun)
A cyber attack technique where adversaries intercept communications between two parties in order to collect useful information or to sabotage or corrupt the communication in some manner.
CyberWire Glossary link: https://thecyberwire.com/glossary/man-in-the-middle-attack
Learn more about your ad choices. Visit megaphone.fm/adchoices
NIST (Noun)
Please enjoy this encore of Word Notes.
A branch of the US Department of Commerce whose stated mission is to “promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.”
CyberWire Glossary link: https://thecyberwire.com/glossary/national-institute-of-standards-and-tec
CIRT (noun)
Please enjoy this encore of Word Notes.
A team responsible for responding to and managing cybersecurity incidents involving computer systems and networks in order to minimize the damage and to restore normal operations as quickly as possible.
CyberWire Glossary link: https://thecyberwire.com/glossary/cirt
Audio reference link: Avery, B., 2017. 24 TV May 05 Season4 [WWW Document]. YouTube. URL
PUP (noun)
Please enjoy this encore of Word Notes.
A software program installed unintentionally by a user that typically performs tasks not asked for by the installer.
CyberWire Glossary link: https://thecyberwire.com/glossary/potentially-unwanted-program
Audio reference link: Butler, S., 2022. Potentially Unwanted Programs (PUPS) EXPLAINED [Video]. YouTube. URL https://www.youtube.com/watch?v=5L429I
Ransomware (noun)
Malware that disables a system in exchange for a ransom, usually by encrypting the system's data until the user pays for the decryption key.
CyberWire Glossary link: https://thecyberwire.com/glossary/ransomware
Audio reference link: https://watch.amazon.com/detail?gti=amzn1.dv.gti.d6a9f744-47b0-ac70-aa56-b31fd0f58482&territory=US&ref_=share_ios_season&r=web
Learn more about your ad choices. V
Service Set Identifier (SSID) (noun)
Please enjoy this encore of Word Notes.
The name of a wireless access point.
CyberWire Glossary link.
Audio reference link: SSID Management - CompTIA Security+ SY0-401: 1.5, Professor Messer, uploaded August 3rd, 2014.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Advanced Encryption Standard (AES) (noun)
Please enjoy this encore of Word Notes.
A U.S. Government specification for data encryption using an asymmetric key algorithm.
CyberWire Glossary link: https://thecyberwire.com/glossary/advanced-encryption-standard
Audio reference link: papadoc73. “Claude Debussy: Clair De Lune.” YouTube, YouTube, 6 Oct. 2008.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Data Loss Protection (DLP) (noun)
A set of tools designed to safeguard data while in use in motion and at rest.
CyberWire Glossary link: https://thecyberwire.com/glossary/data-loss-prevention
Audio reference link: HistoryHeard. “Data Loss Prevention - CompTIA Security+ SY0-501 - 2.1,” Professor Messer, uploaded 20 November 2017
Learn more about your ad choices. Visit megaphone.fm/adchoices
Domain Naming System (DNS) (noun)
Please enjoy this encore of Word Notes.
A system that translates text-based URLs to their underlying numerical IP addresses.
CyberWire Glossary link: https://thecyberwire.com/glossary/domain-name-system-dns
Audio reference link: HistoryHeard. “History Heard: Paul Mockapetris.” YouTube, YouTube, 5 Apr. 2009.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Pretexting (noun)
Please enjoy this encore of Word Notes.
A social engineering technique in which a threat actor poses as a trusted person or entity in order to trick the victim into disclosing information or performing an action that benefits the attacker.
CyberWire Glossary link: https://thecyberwire.com/glossary/pretexting
Audio reference link: “Batch Pin Hurt Charlize Theron Skin | the Italian Job (2003)
Web Application Firewall (noun)
Please enjoy this encore of Word Notes.
A layer seven firewall designed to block threats at the application layer of the open system interconnection model, the OSI model.
CyberWire Glossary link: https://thecyberwire.com/glossary/web-application-firewall
Audio reference link: “VCF East 9.1 - Ches' Computer Security Adventures - Bill Cheswick.” YouTube, 29 Dec. 2015, https://youtu.be/trR1cu
COBIT (noun)
Please enjoy this encore of Word Notes.
An IT governance framework developed by ISACA.
CyberWire Glossary link: https://thecyberwire.com/glossary/cobit
Audio reference link: isacappc. “How Do You Explain Cobit to Your Dad – or Your CEO?” YouTube, YouTube, 24 Aug. 2016, https://www.youtube.com/watch?v=EYATVkddIyw.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Security Service Edge (SSE) (noun)
Please enjoy this encore of Word Notes.
A security architecture that incorporates the cloud shared responsibility model, a vendor provided security stack, and network peering with one or more of the big content providers and their associated fiber networks.
CyberWire Glossary link: https://thecyberwire.com/glossary/security-service-edge
Audio reference link: Netskope (2022). What is Securit
Domain spoofing (noun)
Please enjoy this encore of Word Notes.
A social engineering tactic in which hackers build a malicious domain to mimic a legitimate one.
CyberWire Glossary link: https://thecyberwire.com/glossary/domain-spoofing
Audio reference link: “Mission Impossible Fallout - Hospital Scene.” YouTube, YouTube, 8 Oct. 2018,
Learn more about your ad choices. Visit megaphone.fm/adchoices
Secure Web Gateway (noun)
Please enjoy this encore of Word Notes.
A layer seven firewall that sits in line at the boundary between the internet and an organization's network perimeter that allows security policy enforcement and can perform certain prevention and detection tasks.
CyberWire Glossary link: https://thecyberwire.com/glossary/secure-web-gateway
Audio reference link: Vintage Computer Federation (2015). VCF
Indicators of Compromise (noun)
Please enjoy this encore of Word Notes.
Digital evidence that a system or network has been breached.
CyberWire Glossary link: https://thecyberwire.com/glossary/indicator-of-compromise
Audio reference link: ”Suicide or Murder? | The Blind Banker | Sherlock,” uploaded by Sherlock, 18 October 2015
Learn more about your ad choices. Visit megaphone.fm/adchoices
Intrusion Detection System (noun)
Please enjoy this encore of Word Notes.
A system that monitors for malicious or unwanted activity, and either raises alerts when such activity is detected or blocks the traffic from passing to the target.
CyberWire Glossary link: https://thecyberwire.com/glossary/intrusion-detection-system
Audio reference link: “Network Intrusion Detection and Prevention - CompTIA Security+ SY0-501 - 2.1,”
MFA prompt bombing (noun)
Please enjoy this encore of Word Notes.
Hackers bypass, multifactor authentication schemes by sending a blizzard of spamming login attempts until the accounts owner accepts the MFA prompt out of desperation to make the spamming stop.
CyberWire Glossary link: https://thecyberwire.com/glossary/mfa-prompt-bombing
Audio reference link: movieclips. “Sneakers (2/9) Movie Clip - Defeating the Key
Apple Lockdown Mode (noun)
Please enjoy this encore of Word Notes.
An optional security mode for macOS and iOS that reduces the attack surface of the operating system by disabling certain commonly attacked features.
CyberWire Glossary link: https://thecyberwire.com/glossary/apple-lockdown-mode
Audio reference link: “How NSO Group’s Pegasus Spyware Was Found on Jamal Khashoggi’s Fiancée’s Phone,” FRONTLINE, YouTube,
Simulated Phishing (noun)
While our team is out on winter break, please enjoy this episode of Word Notes.
A security awareness training technique in which authorized, but fake phishing emails are sent to employees in order to measure and improve their resistance to real phishing attacks.
CyberWire Glossary link: https://thecyberwire.com/glossary/simulated-phishing
Audio reference link: “Blackhat (2014) - Hacking the
Sideloading (noun)
Please enjoy this encore of Word Notes.
The process of installing applications on a device without the use of official software distribution channels.
CyberWire Glossary link: https://thecyberwire.com/glossary/sideloading
Learn more about your ad choices. Visit megaphone.fm/adchoices
Microsegmentation (noun)
Please enjoy this encore of Word Notes.
A zero trust security technique that isolates application workloads from each other, allowing each one to be protected individually.
CyberWire Glossary link: https://thecyberwire.com/glossary/microsegmentation
Audio reference link: “Micro-Segmentation Masterpieces,” PJ Kirner, Illumio CTO and Co-Founder, Tech Field Day, YouTube, 13 December 2020.
Lea
Homograph phishing (noun)
Please enjoy this encore of Word Notes.
The use of similar-looking characters in a phishing URL to spoof a legitimate site.
CyberWire Glossary link: https://thecyberwire.com/glossary/homograph-phishing
Audio reference link: “Mission Impossible III 2006 Masking 01,” uploaded by DISGUISE MASK, 28 July 2018.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Anti-cheat software (noun)
Please enjoy this encore of Word Notes.
Software designed to prevent cheating in video games.
CyberWire Glossary link: https://thecyberwire.com/glossary/anti-cheat-software
Audio reference link: “The BIG Problem with Anti-Cheat,” by Techquickie, YouTube, 5 June 2020
Learn more about your ad choices. Visit megaphone.fm/adchoices
Pseudoransomware (noun)
Please enjoy this encore of Word Notes.
Malware, in the guise of ransomware, that destroys data rather than encrypts.
CyberWire Glossary link: https://thecyberwire.com/glossary/pseudoransomware
Audio reference link: “Some Men Just Want to Watch the World Burn | the Dark Knight,” by YouTube, 2 November 2019.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Trusted Platform Module (TPM) (noun)
Please enjoy this encore of Word Notes.
A browser configuration control that prevents accessing resources within a private network.
CyberWire Glossary link: https://thecyberwire.com/glossary/trusted-platform-module
Audio reference link: “TPM (Trusted Platform Module) - Computerphile,” Computerphile, 23 July 2021
Learn more about your ad choices. Visit megaphone.fm/adchoices
Private Network Access (PNA) (noun)
Please enjoy this encore of Word Notes.
A browser configuration control that prevents accessing resources within a private network.
CyberWire Glossary link.
Audio reference link: “Chrome Limits Access to Private Networks,” by Daniel Lowrie, ITProTV, YouTube, 19 January 2022.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Web 3.0 (noun)
Please enjoy this encore of Word Notes.
The potential next evolution of the worldwide web that decentralizes interaction between users and content away from the big silicon valley social media platforms like Twitter, Facebook, and YouTube, and towards peer-to-peer interaction using blockchain as the underlying technology.
CyberWire Glossary link: https://thecyberwire.com/glossary/web-30
Aud
Identity access management (IAM) (noun)
Please enjoy this encore of Word Notes.
A set of solutions for ensuring that the right users can only access the appropriate resources.
CyberWire Glossary link: https://thecyberwire.com/glossary/identity-and-access-management
Audio reference link: “The Wrath of Khan (1982) ‘Kirk’s Response,’” by Russell, YouTube, 16 May 2017.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Policy Orchestration (noun)
Please enjoy this encore of Word Notes.
The deployment of rules to the security stack across all data islands, cloud, SaaS applications, data centers, and mobile devices designed to manifest an organization's cybersecurity first principle strategies of zero trust, intrusion kill chain prevention, resilience, and risk forecasting.
CyberWire Glossary link: https://thecyberwire.com/glossary/poli
Abstraction layer (noun)
Please enjoy this encore of Word Notes.
A process of hiding the complexity of a system by providing an interface that eases its manipulation.
CyberWire Glossary link: https://thecyberwire.com/glossary/abstraction-layer
Audio reference link: “What Is Abstraction in Computer Science,” by Codexpanse, YouTube, 29 October 2018.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Identity Fabric (noun)
Please enjoy this encore of Word Notes.
A set of services for managing identity and access management, or IAM across all of an organization's data islands.
CyberWire Glossary link: https://thecyberwire.com/glossary/identity-fabric
Audio reference link: “Leadership Compass Identity Fabrics - Analyst Chat 126,” by KuppingerCole, YouTube, 30 May 2022.
Learn more about your ad choices. Visit m
Intrusion Kill Chain (noun)
Please enjoy this encore of Word Notes.
A cybersecurity first principle strategy focused on disrupting known adversary activity at one of several phases of an attack sequence.
CyberWire Glossary link: https://thecyberwire.com/glossary/intrusion-kill-chain
Audio reference link: "Cybersecurity Days: A Network Defender's Future," by Rick Howard, Integrated Cyber Conference, Integrated Adaptiv
Identity Orchestration (noun)
Please enjoy this encore of Word Notes.
A subset of security orchestration, the management of identities across an organization's set of digital islands.
CyberWire Glossary link: https://thecyberwire.com/glossary/identity-orchestration
Learn more about your ad choices. Visit megaphone.fm/adchoices
Diamond Model (noun)
Please enjoy this encore of Word Notes.
A cyber threat intelligence analysis model that defines relationship pairs between four core components in the shape of a diamond of adversary playbook activity across the intrusion kill chain: the adversary, their capability, the infrastructure used or attacked, and the victim.
CyberWire Glossary link: https://thecyberwire.com/glossary/diamond-model
MITRE ATT&CK (noun)
Please enjoy this encore of Word Notes.
A knowledge base of adversary tactics, techniques, and procedures established and maintained by the MITRE Corporation.
CyberWire Glossary link: https://thecyberwire.com/glossary/mitre-attck
Audio reference link: “Attack Frameworks - SY0-601 CompTIA Security+ : 4.2,” Professor Messer, YouTube, 29 April 2021.
Learn more about your ad choices. Visit me
DevOps (noun)
Please enjoy this encore of Word Notes.
The set of people, process, technology, and cultural norms that integrates software development and IT operations into a system-of-systems.
CyberWire Glossary link: https://thecyberwire.com/glossary/devops
Audio reference link: "10+ Deploys Per Day: Dev and Ops Cooperation at Flickr," by John Allspaw and Paul Hammond, Velocity 09, 25 July 2009.
Learn
Waterfall Software Development Method (noun)
Please enjoy this encore of Word Notes.
A software development model that relies on a series of sequential steps that flow into each other, like a series of waterfalls.
CyberWire Glossary link: https://thecyberwire.com/glossary/waterfall-software-development
Audio reference link: “Creating Video Games - Agile Software Development,” by Sara Verrilli, MIT OpenCourseWare, YouTube, 10 December
Agile Software Development Method (noun)
Please enjoy this encore of Word Notes.
A software development philosophy that emphasizes incremental delivery, team collaboration, continual planning, and continual learning
CyberWire Glossary link: https://thecyberwire.com/glossary/agile-software-development
Audio reference link: "Velocity 09: John Allspaw and Paul Hammond, "10+ Deploys Pe," John Allspaw and Paul Hammond, 2009 Velocity
Pegasus (noun)
Please enjoy this encore of Word Notes.
The flagship product of the controversial Israeli spyware vendor, the NSO Group, use for remotely hacking mobile devices, most notably iPhones, via zero-click exploits.
CyberWire Glossary link: https://thecyberwire.com/glossary/pegasus
Audio reference link:“Cybersecurity beyond the Headlines: A Conversation with Journalist Nicole Perlroth,” Kristen Ei
Domain-based Message Authentication Reporting Conformance (DMARC) (noun)
Please enjoy this encore of Word Notes.
An open source email authentication protocol designed to prevent emails, spoofing in phishing, business email compromise or BEC, and other email-based attacks.
CyberWire Glossary link: https://thecyberwire.com/glossary/pegasus
Audio reference link:"Global Cyber Alliance's Phil Reitinger talks DMARC adoption" “Global Cyber Alliance’s Phil Reitinger T
Shields Up (noun)
Please enjoy this encore of Word Notes.
A condition announced by the US Cybersecurity and Infrastructure Security Agency (CISA) to draw attention to a temporary period of high alert, associated with expectation of a connected wave of cyberattacks prompted by either a widespread vulnerability or an unusually active and capable threat actor.
CyberWire Glossary link: https://thecyberwire.com/glos
Software Assurance Maturity Model (SAMM) (noun)
Please enjoy this encore of Word Notes.
A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks.
Audio reference link: "OWASPMSP - Pravir Chandra: Software Assurance Maturity Model (OpenSAMM)." by Pravir Chandra, OWASP MSP, 2009.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Universal 2nd Factor (U2F) (noun)
Please enjoy this encore of Word Notes.
An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange.
Cyberwire Glossary link: https://thecyberwire.com/glossary/u2f
Audio reference link: “Rise of the Machines: A Cybernetic History,” by Thomas
adversary group naming (noun)
Please enjoy this encore of Word Notes.
A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.
Learn more about your ad choices. Visit megaphone.fm/adchoices
BSIMM (noun)
Please enjoy this encore of Word Notes.
A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops.
CyberWire Glossary link: https://thecyberwire.com/glossary/bsimm
Audio reference link: “OWASP AppSecUSA 2014 - Keynote: Gary McGraw - BSIMM: A Decade of Software Security.” YouTube Video. Yo
OWASP vulnerable and outdated components (noun)
Please enjoy this encore of Word Notes.
Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version.
Audio reference Link: "The Panama Papers: A Closer Look," Late Night
OWASP software and data integrity failures (noun)
Please enjoy this encore of Word Notes.
Code and data repositories that don't protect against unauthorized changes.
Learn more about your ad choices. Visit megaphone.fm/adchoices
OWASP server-side request forgery (noun)
Please enjoy this encore of Word Notes.
An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers.
Learn more about your ad choices. Visit megaphone.fm/adchoices
OWASP security logging and monitoring failures (noun)
Please enjoy this encore of Word Notes.
The absence of telemetry that could help network defenders detect and respond to hostile attempts to compromise a system.
Learn more about your ad choices. Visit megaphone.fm/adchoices
OWASP identification and authentication failures (noun)
Please enjoy this encore of Word Notes.
Ineffectual confirmation of a user's identity or authentication in session management.
CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-identification-and-authentication-failure
Audio reference link: “Mr. Robot Hack - Password Cracking - Episode 1.” YouTube Video. YouTube, September 21, 2016.
Learn more about your ad choices. Visit me
Log4j vulnerability (noun)
Please enjoy this encore of Word Notes.
An open source Java-based software tool available from the Apache Software Foundation designed to log security and performance information.
CyberWire Glossary link: https://thecyberwire.com/glossary/log4j
Audio reference link: “CISA Director: The LOG4J Security Flaw Is the ‘Most Serious’ She’s Seen in Her Career,” by Eamon Javers (CNBC) and Jen East
OWASP broken access control (noun)
Please enjoy this encore of Word Notes.
Software users are allowed access to data or functionality contrary to the defined zero trust policy by bypassing or manipulating the installed security controls.
Learn more about your ad choices. Visit megaphone.fm/adchoices
OWASP security misconfiguration (noun)
Please enjoy this encore of Word Notes.
The state of a web application when it's vulnerable to attack due to an insecure configuration.
CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-security-misconfiguration
Audio reference link: “What Is the Elvish Word for Friend?” Quora, 2021.
Learn more about your ad choices. Visit megaphone.fm/adchoices
OWASP insecure design (noun)
Please enjoy this encore episode of Word Notes.
A broad OWASP Top 10 software development category representing missing, ineffective, or unforeseen security measures.
CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-insecure-design
Audio reference link: “Oceans Eleven Problem Constraints Assumptions.” by Steve Jones, YouTube, 4 November 2015.
Learn more about your ad choices. Visi
OWASP injection (noun)
Please enjoy this encore of Word Notes.
A broad class of attack vectors, where an attacker supplies input to an applications command interpreter that results in unanticipated functionality.
CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-injection
Audio reference link: “APPSEC Cali 2018 - Taking on the King: Killing Injection Vulnerabilities” YouTube Video. YouTube, March 19, 201
OWASP cryptographic failures (noun)
Please enjoy this encore of Word Notes.
Code that fails to protect sensitive information.
CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-cryptographic-failure
Audio reference link: Vandana Verma. “OWASP Spotlight - Project 10 - Top10.” YouTube Video. YouTube, January 4, 2021.
Learn more about your ad choices. Visit megaphone.fm/adchoices
account takeover prevention (noun)
Enjoy this encore of Word Notes.
The prevention of the first part of an intrusion kill chain model exploitation technique, where the hacker steals valid logging credentials from a targeted victim.
CyberWire Glossary link: https://thecyberwire.com/glossary/account-takeover-prevention
Learn more about your ad choices. Visit megaphone.fm/adchoices
threat hunting (noun)
Please enjoy this encore of Word Notes.
The process of proactively searching through networks to detect and isolate security threats, rather than relying on security solutions or services to detect those threats.
CyberWire Glossary link: https://thecyberwire.com/glossary/threat-hunting
Audio reference link: “My ‘Aha!" Moment - Methods, Tips, & Lessons Learned in Threat Hunting - sans Thir Summit
Recommended
紐約鳥｜New York Aperture
The Swerve Podcast: Obscure Topics | Conspiracy Theories
The Bread and Banter Podcast
The Church of What's Happening Now: The New Testament
Busted Open
Deadline: White House
Crickets Corner
History of the Earthquake and Fire in San Francisco
Fox news
K-Drama Obsessed Mamas | Beyond “Just One More Episode!”
True Crime Classics
The Healer Revolution
