Word Notes

Latest Episodes:

Log4j vulnerability (noun) Jan 11, 2022

Show notes

An open source Java-based software tool available from the Apache Software Foundation designed to log security and performance information.

CyberWire Glossary link: https://thecyberwire.com/glossary/log4j

Audio reference link: “CISA Director: The LOG4J Security Flaw Is the ‘Most Serious’ She’s Seen in Her Career,” by Eamon Javers (CNBC) and Jen Easterly (Cybersecurity and Infrastructure Security Director) YouTube, 20 December 20 2021.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP broken access control (noun) Jan 04, 2022

Show notes

Software users are allowed access to data or functionality contrary to the defined zero trust policy by bypassing or manipulating the installed security controls.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: zero trust (noun) Dec 28, 2021

Show notes

A security philosophy that assumes adversaries have already penetrated the digital environment and tries to reduce the potential impact by limiting access by people, devices, and software to only the resources essential to perform their function and nothing more.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP security misconfiguration (noun) Dec 21, 2021

Show notes

The state of a web application when it's vulnerable to attack due to an insecure configuration.

CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-security-misconfiguration

Audio reference link: “What Is the Elvish Word for Friend?” Quora, 2021.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP insecure design (noun) Dec 14, 2021

Show notes

A broad OWASP Top 10 software development category representing missing, ineffective, or unforeseen security measures.

CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-insecure-design

Audio reference link: “Oceans Eleven Problem Constraints Assumptions.” by Steve Jones, YouTube, 4 November 2015.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP injection (noun) Dec 07, 2021

Show notes

A broad class of attack vectors, where an attacker supplies input to an applications command interpreter that results in unanticipated functionality.

CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-injection

Audio reference link: “APPSEC Cali 2018 - Taking on the King: Killing Injection Vulnerabilities” YouTube Video. YouTube, March 19, 2018.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP cryptographic failures (noun) Nov 30, 2021

Show notes

Code that fails to protect sensitive information.

CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-cryptographic-failure

Audio reference link: Vandana Verma. “OWASP Spotlight - Project 10 - Top10.” YouTube Video. YouTube, January 4, 2021.

Learn more about your ad choices. Visit megaphone.fm/adchoices

account takeover prevention (noun) Nov 23, 2021

Show notes

The prevention of the first part of an intrusion kill chain model exploitation technique, where the hacker steals valid logging credentials from a targeted victim.

CyberWire Glossary link: https://thecyberwire.com/glossary/account-takeover-prevention

Learn more about your ad choices. Visit megaphone.fm/adchoices

threat hunting (noun) Nov 16, 2021

Show notes

The process of proactively searching through networks to detect and isolate security threats, rather than relying on security solutions or services to detect those threats.

CyberWire Glossary link: https://thecyberwire.com/glossary/threat-hunting

Audio reference link: “My ‘Aha!" Moment - Methods, Tips, & Lessons Learned in Threat Hunting - sans Thir Summit 2019.” YouTube, YouTube, 25 Feb. 2020.

Learn more about your ad choices. Visit megaphone.fm/adchoices

vulnerability management (noun) Nov 09, 2021

Show notes

The continuous practice of identifying classifying, prioritizing, remediating, and mitigating software vulnerabilities within this.

CyberWire Glossary link: https://thecyberwire.com/glossary/vulnerability-management

Audio reference link: “Vulnerability Scanning - Comptia Security+ sy0-501 - 1.5.” YouTube, YouTube, 11 Nov. 2017,

Learn more about your ad choices. Visit megaphone.fm/adchoices