Vulnerability Scanning, OSINT, OWASP Top 10, and CI/CD Security

Vocabulary practice flashcards covering vulnerability scanning approaches, open-source intelligence tools, the OWASP Top 10 vulnerabilities, and CI/CD software pipeline security.

Vulnerability Assessment

The internal review process of an organization's security systems designed to identify weaknesses and prevent attacks.

Vulnerability Scanner

Software that automatically compares known vulnerabilities and exposures against the technologies on a network to detect misconfigurations or programming flaws.

Perimeter Layer

The attack surface layer consisting of outward-facing defensive technologies, such as authentication systems that validate user access.

Network Layer

The attack surface layer made up of network technologies, such as network firewalls.

Endpoint Layer

The attack surface layer describing user-accessible devices on a network, including laptops, desktops, and servers.

Application Layer

The attack surface layer involving the software programs that users directly interact with.

Data Layer

The attack surface layer encompassing all information whether it is stored, in transit, or in use.

External Scan

A scan that tests the perimeter layer outside the internal network by analyzing outward-facing systems such as websites and firewalls.

Internal Scan

A scan that examines systems from within an organization's network, such as checking application software for weaknesses in handling user input.

Authenticated Scan

A scan conducted using a real user or administrator service account to verify permissions and uncover vulnerabilities such as broken access controls.

Unauthenticated Scan

A scan that simulates an external attacker without access privileges to verify whether internal resources are properly blocked with access-denied safeguards.

Limited Scan

A targeted scan focusing on specific devices on a network, such as checking a firewall for misconfigurations.

Comprehensive Scan

A scan that analyzes all devices connected to a network, including operating systems, user databases, and servers.

Discovery Scanning

A preliminary scan executed prior to limited or comprehensive scans to map out active computers, devices, and open ports on a network.

Open-Source Intelligence (OSINT)

The collection and analysis of information from publicly available sources to generate usable intelligence for cybersecurity operations.

Information

Raw data or factual points collected about a specific subject before analysis or interpretation takes place.

Intelligence

Actionable insights and knowledge derived from the analysis, interpretation, and integration of raw information to support decision-making.

Information Security (InfoSec)

The practice of keeping data in all states—at rest, in transit, and in use—away from unauthorized users.

VirusTotal

An OSINT service that inspects and analyzes suspicious files, domains, URLs, and IP addresses to detect malicious content.

MITRE ATT&CK

A publicly accessible knowledge base documenting adversary tactics and techniques based on real-world observations.

OSINT Framework

A web-based interface providing a structured collection of OSINT tools indexed for virtually any source or platform.

Have I Been Pwned

An online resource used to search for email accounts and personal data exposed in known security breaches.

OWASP

A nonprofit foundation (Open Worldwide Application Security Project, formerly Open Web Application Security Project) focused on improving software security by sharing tools, resources, and community guidance.

OWASP Top 10

An industry awareness ranking published since 2003 that highlights the web's most targeted and critical vulnerabilities, primarily used to guide new software development.

Broken Access Control

A failure in access restriction mechanisms that permits unauthorized users to access, modify, or destroy data, or to access unauthorized business applications.

Cryptographic Failures

Vulnerabilities occurring when sensitive data (such as PII) is improperly protected due to missing encryption or the use of weak algorithms like MD5.

Injection

A vulnerability where untrusted user input containing malicious code is executed by an application, often through website login forms, granting attackers unauthorized access.

Insecure Design

Flaws stemming from missing or poorly planned security controls during the architectural and developmental phases of software.

Security Misconfiguration

Security settings that are improperly set, poorly maintained, or left at insecure defaults during hardware and software deployment.

Vulnerable and Outdated Components

Security risks introduced when developers integrate unpatched or unmaintained third-party open-source libraries into an application.

Identification and Authentication Failures

A flaw where software fails to correctly confirm a user's identity or permits session management compromises, allowing unauthorized access.

Software and Data Integrity Failures

Flaws that occur when critical code, updates, or patches are applied without adequate review, making systems vulnerable to malicious code insertion.

Supply Chain Attack

A cyber attack where hackers compromise an upstream provider's software updates to infect downstream third parties, as seen in the 2020 SolarWinds incident.

Security Logging and Monitoring Failures

Failures to properly log, monitor, and trace critical system events like login attempts, undermining early threat detection and incident response.

Server-Side Request Forgery (SSRF)

An attack where a threat actor manipulates a vulnerable web application into sending unauthorized requests from the host server to access or alter internal resources.

CI/CD Pipeline Stages

The automated software delivery workflow consisting of Continuous Integration (building, testing, and merging code), Continuous Delivery (automatically releasing vetted code to a repository or staging), and Continuous Deployment (automatically deploying code to production).

Continuous Integration (CI)

The software development practice of frequently merging code changes into a central location, automatically triggering builds and automated tests to catch integration problems early.

Continuous Delivery (CD)

A pipeline practice where tested code is automatically deployed to a staging environment and kept ready for release, awaiting a manual approval step before production.

Continuous Deployment (CD)

A fully automated release process where any code change passing all pipeline testing is immediately deployed to the live production environment without manual intervention.

Dynamic Application Security Testing (DAST)

Automated security tests executed on running software applications in staging environments to detect operational vulnerabilities.

Static Application Security Testing (SAST)

Automated pipeline security scanning that analyzes static source code prior to execution to detect security weaknesses early in development.

Software Composition Analysis (SCA)

Automated security scanning tools that catalog and inspect third-party open-source components and dependencies for known CVEs.

Exposed Secrets

A critical vulnerability where sensitive credentials like API keys, tokens, or passwords are hardcoded directly into source code or pipeline configuration scripts.

DevSecOps

A development methodology that integrates security controls, testing, and practices across every stage of the software development lifecycle, from planning to deployment.

Principle of Least Privilege

A security policy that restricts user, service account, and pipeline permissions exclusively to the resources required to fulfill their specific role.

Secrets Management Tools

Dedicated security applications, such as HashiCorp Vault or AWS Secrets Manager, designed to store, manage, and rotate sensitive credentials securely outside source code.