Security glossary
The web security vocabulary, defined clearly.
A short, alphabetical reference for the acronyms that show up in audits, pull-request reviews, and customer security questionnaires. No jargon for jargon's sake.
A to Z
54 terms every web team should recognise.
Each definition is a few sentences at most. Where a term has a longer explainer, the heading links to it.
- Agentic Pentesting
- Penetration testing done by AI agents that decide their own next step. Specialist agents test different areas of the app in parallel, read each response and chain requests the way a human tester would. People set the scope and review the results.
- Brute Force Attack
- Guessing credentials, tokens, or keys by trying every combination until one works. Defended with rate limiting, account lockouts, strong password hashing, and multi-factor authentication on sensitive logins.
- Clickjacking
- An attack that loads your site in a transparent iframe over a decoy page so users click buttons they cannot see. Blocked by X-Frame-Options or CSP's frame-ancestors directive.
- Continuous Pentesting
- Penetration testing that reruns against the same web app or API continuously on a schedule, instead of once a year. Each run is compared with the last one, so new and regressed issues show up between releases.
- CORSCross-Origin Resource Sharing
- HTTP headers that tell a browser whether JavaScript on origin A can read responses from origin B. Misconfigured CORS (wildcard with credentials, reflecting any Origin) leaks data across sites.
- Credential Stuffing
- Replaying username and password pairs leaked from other breaches against your login endpoint. Mitigated with multi-factor authentication, breached-password checks, and rate limits on failed attempts per account and IP.
- CSPContent Security Policy
- A response header that restricts which scripts, styles, frames, and connections a page can load. A strong CSP is one of the best defence-in-depth layers against XSS, behind output encoding.
- CSRFCross-Site Request Forgery
- An attack where a malicious site triggers state-changing requests in a target app the victim is already logged into. Mitigated with SameSite cookies, anti-CSRF tokens, and Origin checks.
- CVECommon Vulnerabilities and Exposures
- A public catalogue of disclosed software vulnerabilities, each with a stable identifier (CVE-YYYY-NNNN, with four or more digits at the end). Used by scanners, advisories, and patch notes so everyone refers to the same bug.
- CVSSCommon Vulnerability Scoring System
- A 0 to 10 severity score for vulnerabilities, built from base, threat, and environmental metrics in CVSS v4.0. Useful as a starting point, but real risk also depends on exposure and exploitability in your app.
- DASTDynamic Application Security Testing
- Testing a running application from the outside, the way an attacker would. Barrion's passive monitoring reads what your live app exposes without touching state, and its AI pentest does the active testing.
- DDoSDistributed Denial of Service
- Flooding a target with traffic from many sources to exhaust bandwidth, connections, or CPU. Mitigated with upstream scrubbing services, anycast networks, and strict rate limiting at the edge.
- Defense in Depth
- Layering multiple independent controls so no single failure exposes the system. A WAF, secure code, network segmentation, and audit logging together survive any one of them being bypassed.
- DKIMDomainKeys Identified Mail
- An email authentication standard that signs outbound messages with a key published in DNS. Receivers verify the signature to confirm the message wasn't forged or modified in transit.
- DMARCDomain-based Message Authentication, Reporting & Conformance
- Builds on SPF and DKIM. Tells receivers what to do with messages that fail authentication (none, quarantine, reject) and where to send aggregate reports.
- DNSSECDNS Security Extensions
- Cryptographic signatures on DNS records so resolvers can verify answers haven't been tampered with. Defeats DNS cache poisoning and many spoofing routes.
- HSTSHTTP Strict Transport Security
- A response header that forces browsers to use HTTPS for your domain for a set duration. Stops SSL-stripping downgrade attacks and accidental http:// links.
- HTTPS
- HTTP layered over TLS. Encrypts the connection, authenticates the server with a certificate, and protects integrity. The baseline for any production web app.
- IDORInsecure Direct Object Reference
- An access control bug where an app trusts a user-supplied identifier (an order ID, a file path) without checking ownership. Often exploitable by incrementing a number in a URL.
- JWTJSON Web Token
- A signed (and optionally encrypted) token format used for stateless authentication. Easy to misuse: pin the algorithm, validate the signature, check expiry, and never accept the alg=none header.
- MITMMan-in-the-Middle
- An attacker sits between client and server, reading or modifying traffic. TLS with certificate validation defeats it on the network. On hostile Wi-Fi, HSTS and certificate pinning add further protection.
- MITRE ATT&CK
- A public knowledge base of adversary tactics and techniques observed in real intrusions. Defenders use it to map detection coverage, run purple-team exercises, and describe incidents in shared language.
- Mixed Content
- An HTTPS page that loads sub-resources (scripts, images, iframes) over plain HTTP. Browsers block active mixed content and auto-upgrade passive content to HTTPS, blocking it if that fails. Breaks the trust HTTPS is supposed to provide.
- OWASPOpen Worldwide Application Security Project
- A non-profit community that publishes free application-security resources, including the OWASP Top 10, ASVS, and the Web Security Testing Guide. Vendor-neutral and widely cited in audits.
- Path Traversal
- Tricking a file-handling endpoint into reading or writing outside its intended directory by sending ../ sequences or absolute paths. Mitigated by validating against an allow-list and resolving paths before checks.
- PCI DSSPayment Card Industry Data Security Standard
- The compliance regime for anyone storing, processing, or transmitting cardholder data. Requirements 6 and 11 cover secure development and continuous vulnerability management.
- Penetration Testing
- A scoped, time-boxed engagement where testers actively try to exploit an app, network, or device. Produces a report of confirmed findings, severity, and remediation, required by PCI DSS and often requested for SOC 2. Rerun on a schedule, it becomes continuous pentesting.
- Permissions-Policy
- A response header that allow-lists which browser features (camera, microphone, geolocation, payment) a page and its iframes can use. Replaces the older Feature-Policy header.
- Phishing
- Social-engineering attacks that trick users into handing over credentials, tokens, or money, usually via spoofed email or lookalike domains. SPF, DKIM, DMARC, and phishing-resistant MFA cut the blast radius.
- Principle of Least Privilege
- Every user, service, and process gets only the permissions it needs to do its job, and nothing more. Limits the damage of stolen credentials, buggy code, and insider mistakes.
- Privilege Escalation
- Turning limited access into broader access, either vertically (user becomes admin) or horizontally (user A reads user B's data). Often chained with another bug to complete a breach.
- Proof-Backed Pentesting
- A pentest where findings are reproduced before they're reported, each with the request and response that confirmed it. Findings that can't be reproduced are dropped or labelled as unverified.
- Rate Limiting
- Capping how often a client can hit an endpoint within a time window. Blunts brute force, credential stuffing, scraping, and accidental traffic spikes from buggy clients.
- Referrer-Policy
- Controls how much of the Referer URL the browser sends on outbound requests. Tight policies (no-referrer, strict-origin-when-cross-origin) avoid leaking session tokens or internal paths.
- Same-Origin Policy
- The browser rule that scripts loaded from one origin (scheme, host, port) cannot read responses from another. The foundation that CORS, postMessage, and cookies all sit on top of.
- SAMLSecurity Assertion Markup Language
- An XML-based standard for SSO between an identity provider and a service provider. The lingua franca of enterprise single sign-on, alongside OIDC.
- SASTStatic Application Security Testing
- Analysing source code (or compiled artefacts) without running it, to find bugs like injection, hardcoded secrets, or unsafe APIs. Complementary to DAST, which tests the running application from the outside.
- Secrets Management
- Keeping API keys, database passwords, and signing keys out of source code and CI logs, and rotating them when staff or services change. Use a vault, scoped tokens, and short lifetimes.
- SIEMSecurity Information and Event Management
- A platform that collects logs from apps, servers, and network gear, correlates them, and raises alerts on suspicious patterns. The hub most SOC teams investigate incidents from.
- SOC 2Service Organization Control 2
- An AICPA audit framework (System and Organization Controls) for service organizations covering security, availability, processing integrity, confidentiality, and privacy. CC7.1 covers detecting vulnerabilities and configuration changes.
- SPFSender Policy Framework
- A TXT record in DNS listing the mail servers allowed to send for your domain. Receivers can treat mail from anywhere else as failing SPF. Pairs with DKIM and DMARC.
- SQL Injection
- Injecting attacker-controlled SQL into a query because user input was concatenated into the statement. Mitigated with parameterised queries or an ORM, never string concatenation, plus least-privilege database accounts.
- SSRFServer-Side Request Forgery
- Tricking a server into making outbound HTTP requests it shouldn't, typically to internal-only services or cloud metadata endpoints (169.254.169.254). A staple of cloud breaches.
- Subdomain Takeover
- A dangling CNAME or NS record points at a third-party service (Heroku, S3, GitHub Pages) you no longer own. Anyone who registers the underlying resource controls your subdomain.
- Threat Modeling
- Sitting down before you ship and asking what can go wrong, who would do it, and what you will do about it. STRIDE and attack trees are the usual structures.
- Time to ProofTTP
- The time from authorising a pentest's scope to the first critical or high finding reproduced with evidence. It measures how fast a test produces something a team can act on, not how long the engagement lasts.
- TLSTransport Layer Security
- The cryptographic protocol underneath HTTPS. Modern deployments should serve TLS 1.2 and 1.3 only, disable export ciphers and RC4, and keep certificates valid and well before expiry.
- WAFWeb Application Firewall
- A filter (often cloud-based) that inspects HTTP requests and blocks known attack patterns before they reach your origin. Useful, but not a substitute for fixing the underlying bug.
- X-Frame-Options
- A legacy response header (DENY or SAMEORIGIN) that stops other sites from embedding yours in an iframe. Defeats clickjacking. CSP's frame-ancestors directive is the modern equivalent.
- XSSCross-Site Scripting
- Injecting attacker-controlled JavaScript into a page so it runs in someone else's session. Mitigated by output encoding, a strict CSP, and avoiding innerHTML on untrusted data.
- XXEXML External Entity
- An XML parser bug where external entity references let an attacker read local files, hit internal services, or trigger denial of service. Fixed by disabling DTDs and external entities in the parser.
- Zero-Day Vulnerability
- A flaw exploited in the wild before the vendor has a patch available. Defenders rely on virtual patching at the WAF, behavioural detection, and quick rollouts once a fix lands.
- Zero Trust
- An architecture that assumes the network is hostile and authenticates every request on identity, device posture, and context, rather than trusting anything because it sits behind a firewall.
FAQ
Glossary, explained.
Why does Barrion publish a security glossary?
Most security tooling assumes you already know the vocabulary. We don't. The terms here are the ones our findings and reports use, so engineers shipping their first fix can read the definition, the why, and the remediation in one place.
Which of these does Barrion actually check?
All of the configuration-level items (TLS, HSTS, HTTPS, CSP, CORS, X-Frame-Options, Referrer-Policy, Permissions-Policy, mixed content, SPF, DKIM, DMARC, DNSSEC, subdomain takeover candidates) are monitored on a schedule by the passive scan. Code-level patterns (XSS, SQL injection, IDOR, SSRF) are covered by the AI pentesting product, which tests for them against the running application and checks each finding before reporting it. Confirmed findings come with the request and response behind them. Reports export as PDF or CSV evidence you can hand to an auditor.
Where can I read more about a specific term?
Many entries link to a longer /learn page with what the check is, why it matters, and how Barrion checks it. If a term doesn't have a link yet, the definition here is enough to use in a code review or a customer security questionnaire.
How often do these definitions change?
The underlying standards (CSP, TLS, DMARC) evolve slowly, on the order of years. We refresh the glossary whenever a major spec update lands, when browser behaviour shifts (for example, the move from Feature-Policy to Permissions-Policy), or when a term shows up in enough customer questions to warrant clarification.
See these terms applied to your app.
Run a free passive scan to see which of these headers, certificates and DNS records need attention. For XSS, SQL injection, IDOR and SSRF, an AI pentest tests your app for them.