Cybersecurity Library

Cyberattacks are attempts to compromise digital systems, disrupt services or gain unauthorized access to information. They can target people, applications, networks and the organizations that depend on them.

Subdomain takeover is a loss of control over content or a service reached through an organization’s hostname, often because DNS still points to a provider resource that has been abandoned and can be reclaimed. A dangling record is a warning condition; reclaimability determines whether the suspected path is usable.

DNS attacks target the integrity or availability of name resolution. Understanding where an answer came from—registrar, authoritative server, recursive resolver or cache—is essential to distinguishing an unauthorized change from a normal difference in resolution.

DNS hijacking changes where a name resolves by taking control of a relevant management or resolution path. The investigation must identify which layer was changed, recover control and assess what happened while the altered destination was in use.

DNS cache poisoning occurs when a resolver stores incorrect DNS information and reuses it for later queries. The authoritative zone may remain correct, so investigating only the domain owner’s control panel can miss the affected layer.

DNSSEC allows a validating resolver to check the authenticity and integrity of signed DNS data. It is a chain-of-trust mechanism with operational dependencies, not encryption and not a substitute for protecting DNS administrators.

Web application attacks exploit mistakes in how an application interprets input, establishes identity and permits actions. Understanding the trust boundary is more useful than treating every unusual HTTP response as a vulnerability.

Broken access control occurs when a system permits an identity to access data or perform an action beyond its authorization. Being signed in is not the same as being allowed to access a particular object, tenant or administrative function.

SQL injection occurs when untrusted data changes the intended structure or meaning of a database query. The central defensive distinction is between passing a value as data and constructing executable query syntax from that value.

Cross-site scripting occurs when untrusted content is interpreted as executable browser behavior within a trusted application’s context. Preventing it requires safe rendering at the exact point where data becomes HTML, an attribute, a URL or script-related content.

Social engineering manipulates trust or decision-making to obtain access, information or an action. Phishing is a delivery method that uses deceptive messages or interactions, often impersonating a familiar person, service or workflow.

Business email compromise targets a trusted business process, often to redirect money or sensitive information. It can use a compromised mailbox, impersonation or a deceptive domain, and may contain no malware at all.

Credential attacks seek to obtain or misuse the material used to establish identity. Stolen passwords, guessed passwords, session tokens and recovery channels create different paths, so a useful investigation identifies which credential and which trust boundary were involved.

Credential stuffing attempts to use username-and-password pairs obtained from another source against a target service. Its defining feature is credential reuse, rather than guessing a new password for each account.

Password spraying tries a small set of candidate passwords across many identities. The important defensive pattern is the relationship between attempts across accounts, rather than a large number of failures against only one user.

Malware is software used for unauthorized or harmful purposes. Ransomware is one form of malicious activity associated with denying access and extortion, but a malware incident can also involve theft, remote control or persistent unauthorized access without encryption.

Ransomware incidents combine a technical intrusion with pressure on an organization’s ability to operate or control its information. Recovery requires understanding access, containment, data exposure and restoration; restoring files alone does not answer all four.

A distributed denial-of-service attack uses traffic or requests from multiple sources to interfere with a service’s availability. Understanding the constrained resource is essential: network capacity, connection handling and application work fail in different ways.

Supply chain attacks compromise a trusted dependency or delivery relationship to affect another organization. The dependency may be software, a build process, a service provider or an administrative connection; each creates a different trust boundary.

An external attack surface is the collection of internet-reachable systems, identities and relationships through which an organization can be observed, contacted or attacked. Managing it means understanding what exists, who controls it, what changed and which exposures matter.

Asset discovery turns scattered observations into an accountable inventory. A good discovery process explains why an asset is associated with the organization, how fresh that evidence is and what remains unverified.

Passive discovery uses information already published or collected by others to identify possible assets. Its strength is broad visibility without directly probing every candidate; its limitation is that historical association is easily mistaken for present ownership.

Active discovery obtains current observations by interacting with approved systems. Reliable results depend on precise scope, controlled methods and an understanding of what the observed response does—and does not—establish.

Ownership is the link between a technical observation and an accountable organization or team. Scope defines what an assessment is allowed to do. Confusing the two creates both investigation errors and gaps in responsibility.

An exposed service accepts connections from an external network. The security question is whether that access is intentional, appropriately restricted and supported by maintained software and accountable ownership.

TLS protects a connection in transit and supports authentication of the peer. Certificate and configuration weaknesses must be evaluated at the actual client-facing endpoint, with a clear distinction between connection security, service identity and application security.

Certificate validation asks whether a peer’s certificate is acceptable for the identity the client intended to contact. A certificate can be validly issued yet still be wrong for a particular hostname, connection or trust policy.

Certificate lifecycle management covers discovery, ownership, issuance, deployment, renewal, replacement and retirement. The most common operational mistake is treating successful issuance as proof that every public endpoint is now serving the intended certificate.

Certificate Transparency provides a public record of certificate activity. Compare that history with current DNS and endpoint observations to investigate changes in your domain footprint.

These four signals answer different questions. CVE names a disclosed vulnerability; CVSS describes severity; EPSS estimates near-term exploitation probability in the wild; KEV records known exploitation. None independently establishes the risk to a specific asset.

A Common Vulnerabilities and Exposures identifier gives people and tools a shared name for a vulnerability. The identifier is a reference point; determining whether it applies to your service requires product, version, configuration and evidence review.

The Common Vulnerability Scoring System expresses vulnerability severity under explicit assumptions. A useful CVSS assessment includes the version, vector and source—not only a prominent number between zero and ten.

The Exploit Prediction Scoring System estimates the probability that a published vulnerability will be exploited in the wild during the next 30 days. It is a dated forecast about vulnerability exploitation, not a probability that your particular organization will be breached.

CISA’s Known Exploited Vulnerabilities catalog identifies vulnerabilities with evidence of exploitation. Inclusion is an important threat signal, but local applicability and exposure still determine what the organization needs to do.

Vulnerability prioritization decides what to address first by combining applicability, exposure, exploitation evidence and business consequences. A defensible decision explains both the chosen action and the uncertainty that could change it.

Remediation validation checks that a change corrected the condition identified in a finding. A closed ticket, a successful deployment and an unreachable endpoint are different pieces of evidence; none should be substituted automatically for a verified security outcome.

Security evidence is useful when another reviewer can understand what was observed, where it came from and which conclusion it supports. Raw data, interpretation and uncertainty should remain distinguishable throughout discovery, investigation and remediation.

Precise language makes security findings easier to investigate and act on. These concepts describe different parts of a security situation: who might act, how they could reach a target, what weakness exists and what is exposed.

A threat actor is a person, group or organization capable of actions that can harm systems, information or operations. Identifying a particular actor is an attribution question; responding to harmful behavior does not require that attribution to be complete.

An attack vector is a route or method through which an actor can attempt to reach a target or produce an unauthorized effect. Describing the vector precisely connects an abstract weakness to the access conditions that matter in a real environment.

A vulnerability is a weakness that a threat could exploit. Establishing one in a particular system requires evidence of the affected condition; evaluating its risk requires additional context about access, controls and consequences.

Exposure describes a condition that makes an asset, function or information accessible to a potential threat. It can be intentional, unnecessary or uncertain. The useful assessment asks what is reachable, by whom and under which controls.