// GLOSSARY

Offensive security glossary

There is no shortage of cybersecurity glossaries; this one differs in one thing: the entries are written by people who use these techniques on engagements. Each term therefore says what it means in a real test and, where possible, links to the primary source so the claim can be verified. It’s useful when a report has landed on your desk and you need to understand what it says, or when you’re writing an inquiry and want the scope named correctly. If you care more about how it works in practice than about the definition, browse the services where these terms meet or the articles and write-ups on the blog.

You won’t find prices or effort figures here; the entries explain terms, they don’t sell a service. How much work hides behind each type of test is covered in the breakdown of an engagement into preparation, testing, and the report, and which companies the law regulates and from when has its own page on NIS2 and the Czech Cybersecurity Act.

Penetration testing

Four entries worth reading before you start writing an inquiry. They explain what a penetration test is, how it differs from a scan and from an audit, and what types of tests exist, so you don’t end up with a scan labeled as a test. Useful when someone has told you that you need a pentest and you want to know what to picture.

Penetration test

A penetration test is a controlled attempt to break into an information system, carried out with the owner’s consent and within a scope defined in writing, to find and prove exploitable weaknesses before an attacker does.

Vulnerability scan

A vulnerability scan is an automated check of systems against a database of known flaws that reports findings based on versions and configuration, but neither verifies whether they are exploitable nor chains individual weaknesses into an intrusion.

Security audit

A security audit is a systematic check of whether an information system and its management conform to a chosen framework of rules, typically a standard or an internal policy, and whether records exist showing that the rules are followed.

Types of penetration tests

Types of penetration tests are sorted along three independent axes, not into a single list: by the subject of the test, by the tester’s starting position, and by how much knowledge the tester starts with.

OWASP standards

OWASP publishes several documents that are easy to mix up. Top 10 is a list of risks, WSTG is a testing guide, and ASVS is a catalog of requirements for an application, so a sentence about testing under OWASP can mean three widely different scopes. Read these when you’re comparing proposals, or when you want the brief to say what the testing should follow.

OWASP Top 10

OWASP Top 10 is a list of ten categories of the most serious security risks in web applications, published by the OWASP foundation in irregular editions and built on data from real applications.

The difference between OWASP Top 10 and WSTG

The difference between OWASP Top 10 and WSTG lies in purpose: Top 10 names ten categories of the most common risks in web applications, while WSTG describes the specific procedures for finding those risks in an application.

OWASP WSTG

OWASP WSTG, in full the Web Security Testing Guide, is a methodological guide for testing the security of web applications and APIs that describes, for each area, the specific testing procedures and how they are labeled.

OWASP ASVS

OWASP ASVS, in full the Application Security Verification Standard, is a catalog of security requirements for web applications and APIs, split into three levels according to how sensitive the data is that the application processes.

Methodologies and frameworks

This is where the frameworks live that a test is run by and documented against afterward. PTES describes the phases of an engagement, MITRE ATT&CK names the attacker’s techniques, the choice between black, gray, and white box decides how much the tester knows at the start, and ISO 27001 decides which of it an auditor will want to see. Tester certifications belong here too, meaning the question of what the acronym in a vendor’s proposal actually documents. Their practical effect is mainly on scope and on whether the deliverable holds up as evidence.

Black box, gray box, and white box

Black box, gray box, and white box are three levels of knowledge a tester starts with: from no information at all, through user accounts and documentation, to access to the source code.

ISO/IEC 27001

ISO/IEC 27001 is the international standard for an information security management system that companies certify against, and it requires the management of technical vulnerabilities as well as verification that the controls in place actually work.

PTES

PTES (Penetration Testing Execution Standard) is an open standard that describes how a penetration test runs, in seven phases from agreeing on the scope through information gathering and exploitation to the report.

MITRE ATT&CK

MITRE ATT&CK is a public knowledge base of the tactics and techniques attackers really use in campaigns, organized by the goals of an attack and extended with ways to detect them and reduce their impact.

Penetration tester certification

A penetration tester certification is proof that a person passed an exam set by one of the issuers. The exams differ fundamentally in format, though: some require the candidate to actually break into a prepared environment, others are a multiple-choice test.

Terms from practice

Terms you run into in a report or in an incident notice. CVE names a specific vulnerability, CVSS assigns it a severity, and the remediation priority is built from that. The other entries mainly cover what happens around an attack, from the roles in a security exercise and the forms of phishing to reconnaissance before an attack, credentials that have already leaked, and the control of an attack that is under way. Useful when you’re reading a test deliverable and need to know what a given abbreviation or term means.

CVSS

CVSS (Common Vulnerability Scoring System) is an open standard for scoring the severity of a vulnerability on a scale of 0 to 10, describing how easily the flaw can be exploited and what it causes.

CVE

CVE (Common Vulnerabilities and Exposures) is the standard identifier of one specific, publicly known vulnerability in a specific product, which lets the vendor, the scanner, and the tester refer to the same flaw by the same name.

Red team, blue team, and purple team

Red team, blue team, and purple team are three roles in a security exercise: the red team plays the attacker, the blue team defends and detects, and the purple team connects the two sides and turns the attack into detection rules.

Phishing, spear phishing, vishing, and smishing

Phishing is a fraudulent message that poses as a trusted sender and asks you for data, money, or the opening of an attachment. Spear phishing is its targeted version, vishing arrives by phone, and smishing by text message.

OSINT

OSINT is the gathering and evaluation of information from publicly available sources. In a penetration test and in a red team operation it is the first phase: the public footprint of a company yields a list of targets and a believable entry scenario.

Breach intelligence

Breach intelligence is the monitoring and evaluation of data that has already leaked, meaning emails, passwords, and company details from leak databases and the dark web, so a company knows which of its credentials are publicly available before someone abuses them.

Assume breach

Assume breach is a way of briefing a security test that skips the break-in from outside: the tester starts with access to a compromised workstation or account and finds out where an attacker gets from there and what stops them.

C2

C2, short for command and control, is the communication channel an attacker uses to control the access they gained inside a network: it carries commands in and results out. MITRE ATT&CK lists it as the Command and Control tactic.

// NEXT STEP

Test your company before hackers do.

Tell us what you want tested. We’ll get back to you and schedule a call to pin down scope, timing, and price.

Free consultation Browse services