Security
Security terms: encryption, hashing, SSL/TLS, phishing, malware, two-factor authentication and JWT.
27 pages
- Authentication vs Authorizationverifying who a user is (login) vs deciding what they are allowed to access.
- Brute Force Attackguessing passwords or keys by trying many combinations; dictionary attacks, credential stuffing and defences.
- CSP (Content Security Policy)an HTTP header listing the allowed sources of scripts, styles and other content, to stop XSS.
- CSRF (Cross-Site Request Forgery)an attack that makes a logged-in user's browser send unwanted requests, stopped with CSRF tokens and SameSite cookies.
- DDoS Attackflooding a website or service with traffic from many devices to make it unavailable to real users.
- Digital Signaturea cryptographic signature made with a private key that proves who signed content and that it has not changed.
- Encryptionconverting data into unreadable ciphertext with a key so only authorised people can read it — symmetric (AES) or asymmetric (RSA).
- End-to-End Encryption (E2EE)messages encrypted so only the sender and recipient can read them, not the service provider.
- Hashinga one-way function that turns any data into a fixed-length digest, used for integrity checks and password storage.
- IDS and IPS (Intrusion Detection and Prevention)systems that detect (IDS) or actively block (IPS) attacks in network traffic or on hosts.
- JWT (JSON Web Token)a signed, compact token of header, payload and signature, widely used for API authentication.
- Malwaremalicious software such as viruses, worms, trojans and ransomware designed to harm devices or steal data.
- Man-in-the-Middle (MITM) Attackan attacker secretly intercepts communication between two parties to read or change it.
- OAuth 2.0OAuth 2.0: a framework that lets apps access a user's data on another service with limited tokens, without seeing the password.
- OTP (One-Time Password)a code valid for one login or transaction; SMS OTP, TOTP authenticator apps and HOTP.
- Password Saltingadding a unique random value to each password before hashing so identical passwords get different hashes.
- Penetration Testingan authorised simulated attack that finds and exploits weaknesses to show how to fix them; VAPT explained.
- Phishinga scam where attackers impersonate trusted organisations to steal passwords, OTPs or card details.
- PKI (Public Key Infrastructure)certificate authorities and digital certificates that bind public keys to verified owners.
- RBAC (Role-Based Access Control)permissions are given to roles like Admin or Viewer, and users are assigned to roles.
- Social Engineeringmanipulating people into revealing information or bypassing security through deception, urgency and trust.
- SQL Injectionan attack that inserts malicious input into database queries, prevented with parameterised queries.
- SSL/TLSprotocols that encrypt internet communication and verify a website's identity with certificates, used by HTTPS.
- Two-Factor Authentication (2FA)signing in with two different proofs, such as a password plus an OTP or security key.
- XSS (Cross-Site Scripting)an attack that injects malicious JavaScript into a trusted website, prevented by escaping output and CSP.
- Zero Trust Securitya model that verifies every user, device and request with least-privilege access instead of trusting the internal network.
- Zero-Day Vulnerabilitya flaw unknown to the vendor or not yet patched, exploited before a fix is available.