An attack sending oversized ICMP echo request packets exceeding maximum size limits to crash target systems. Ping of Death exploits buffer overflow vulnerabilities in how systems handle malformed network packets.

A reconnaissance technique sending ICMP echo requests to identify active hosts on a network. Ping scans reveal which IP addresses respond, providing attackers with targets for subsequent vulnerability assessment.

An automated attack scanning ranges of IP addresses with ICMP echo requests to map active systems. Ping sweeps enable rapid network reconnaissance, identifying potential targets across entire subnets.

A data link protocol establishing direct connections between two network nodes over serial interfaces. PPP encapsulates network layer packets for transmission over phone lines, DSL, and other point-to-point connections.

A VPN protocol creating encrypted tunnels through public networks to extend private networks securely. PPTP is now considered obsolete due to known vulnerabilities and should be replaced with more secure alternatives.

A routing protocol technique advertising unreachable routes with infinite metrics to prevent routing loops. Poison reverse helps networks converge faster by explicitly communicating that certain paths are unavailable.

A database security feature maintaining multiple records with identical keys at different classification levels. Polyinstantiation prevents inference attacks by allowing different users to see different data for the same query.

Malware techniques modifying code structure while maintaining functionality to evade signature-based detection. Polymorphic malware generates unique variants with each infection, requiring behavioral analysis rather than signature matching.

A numbered endpoint identifying specific network services or applications on a host system. Ports range from 0-65535, with well-known services using standardized numbers like 80 for HTTP and 443 for HTTPS.

Monitoring and capturing network traffic to analyze data packets passing through communication channels. Packet sniffing supports legitimate troubleshooting and security analysis but enables attackers to intercept sensitive information on unsecured networks.

An intelligence-gathering assault where attackers monitor systems and intercept data without modifying resources or operations. Passive attacks eavesdrop on communications to collect information for later exploitation while remaining undetected.

A secret string of characters authenticating user identity to grant system or account access. Strong passwords combine length, complexity, and uniqueness, though multi-factor authentication provides significantly better protection.

Software that generates, stores, and automatically enters complex passwords for multiple accounts. Password managers eliminate reused credentials and weak passwords, improving security while simplifying authentication across numerous services.

An attack technique trying commonly used passwords against many accounts rather than many passwords against one account. Password spraying avoids account lockouts while exploiting weak credential hygiene across user populations.

The systematic process of identifying, acquiring, testing, and deploying software updates to address vulnerabilities and bugs. Effective patch management reduces exposure windows attackers exploit between vulnerability disclosure and remediation.

The Payment Card Industry Data Security Standard mandating security controls for organizations handling credit card transactions. PCI DSS requires encryption, access controls, network segmentation, and regular security testing to protect cardholder data.

Authorized simulated attacks against systems to identify exploitable vulnerabilities before malicious actors discover them. Penetration testing uses real-world attack techniques to validate security controls and prioritize remediation efforts.

Data that identifies specific individuals either directly or through inference, including names, addresses, social security numbers, and biometrics. PII requires protection to prevent identity theft and comply with privacy regulations.

An attack redirecting users from legitimate websites to malicious copies by corrupting DNS records or modifying local host files. Pharming enables credential theft and malware distribution without requiring user interaction.

Social engineering attacks using fraudulent communications impersonating trusted entities to trick recipients into revealing credentials, financial information, or installing malware. Phishing remains the most common initial attack vector.

Canada's Personal Information Protection and Electronic Documents Act governing how private sector organizations collect, use, and disclose personal information. PIPEDA requires consent, transparency, and accountability for data handling practices.

Unencrypted data readable without decryption keys or special processing. Plaintext represents information before encryption or after decryption, vulnerable to interception when transmitted or stored without protection.

Cloud computing model providing development platforms with infrastructure, runtime environments, and tools managed by providers. PaaS enables application deployment without managing underlying servers, though security remains a shared responsibility.

Individual security tools addressing specific threats or functions rather than comprehensive protection. Point solutions create management complexity and coverage gaps when layered without integration or unified visibility.

Individual security tools addressing specific threats or functions rather than comprehensive protection. Point solutions create management complexity and coverage gaps when layered without integration or unified visibility.

Systematically probing network ports to identify open services and potential vulnerabilities. Administrators use port scanning for security audits while attackers use it for reconnaissance before exploitation attempts.

Observable indicators suggesting an attacker may be preparing to launch an incident. Precursors include reconnaissance activities, vulnerability scanning, and social engineering attempts preceding actual attacks.

Activities building capabilities to prevent, detect, respond to, and recover from security incidents. Preparedness includes developing response plans, training teams, maintaining backup systems, and establishing communication procedures.

Protection of personal information from unauthorized access and ensuring individuals control how their data is collected, used, and shared. Privacy requirements vary by jurisdiction but increasingly mandate transparency and consent.

The secret component of an asymmetric cryptographic key pair that must remain confidential to the owner. Private keys decrypt messages encrypted with corresponding public keys and create digital signatures.

The freely distributable component of an asymmetric cryptographic key pair that can be widely published. Public keys encrypt messages only the corresponding private key can decrypt and verify digital signatures.

Cryptographic systems using mathematically linked key pairs where public keys encrypt data that private keys decrypt. Public key cryptography enables secure communication without prior shared secrets.

Framework of policies, procedures, and technologies for managing digital certificates and public-private key pairs. PKI enables encrypted communications, digital signatures, and authentication across potentially untrusted networks.