Glossary.

An account takeover (ATO) is a form of cyberattack in which an attacker takes control of another person’s account without authorization. This can be achieved through various methods, such as phishing, social engineering, exploiting security vulnerabilities, or using stolen credentials available through data leaks or on the darknet.

Anycast is a routing scheme in which a single IP address is applied to several geographically distributed servers. Data packets sent to this IP address reach the nearest or most suitable server. The purpose of this routing scheme improves the efficiency and reliability of data transmission by reducing latency, distributing the load across multiple servers, and increasing resilience. Anycast is often used in services such as DNS , Content Delivery Networks (CDNs) , and for DDoS protection .

An API (Application Programming Interface) is a programming interface that enables software applications to communicate and exchange data with each other. APIs define a set of rules and protocols that developers can use to make an application’s functions and data accessible to other applications without exposing the internal details of the implementation. APIs are crucial for the integration and interoperability of software applications, as they provide a standardized way to access and use services, libraries or operating systems.

An API attack refers to any hostile or attempted hostile usage of an API (Application Programming Interface). Attackers exploit vulnerabilities in API endpoints to gain unauthorized access, compromise data, disrupt services, or perform other malicious activities.

An API gateway is an interface between clients (such as web or mobile applications) and backend microservices. It acts as the single point of contact for clients, receiving their API calls and directing each request to the appropriate backend service.

API security refers to the measures and techniques implemented to protect APIs (Application Programming Interfaces) from malicious attacks, misuse, and other security threats. This includes protecting the interfaces through which software applications communicate with each other and exchange data, as well as ensuring the integrity, confidentiality and availability of the data and services provided by the APIs.

An application layer DDoS attack is a type of distributed denial of service (DDoS) attack that aims to disrupt the services of a web application or server by overloading the application layer ( layer 7 of the OSI model ) resources.

The Address Resolution Protocol (ARP) is a network protocol that allows IP addresses to be mapped onto corresponding physical MAC addresses. In local area networks (LANs), ARP helps translate IP addresses into the MAC addresses of devices, such as computers or routers, so that data packets can be sent to the correct hardware.

Artificial intelligence (AI) refers to the field of computer science that deals with the creation of machines or software capable of performing tasks that typically require human intelligence . This includes skills such as learning, reasoning, problem solving, perception, and language comprehension.

In recent years, the volume and severity of Distributed Denial of Service (DDoS) attacks have risen exponentially. The potential business consequences of a successful attack are huge — even existential. And many organizations are simply unprepared to cope with modern DDoS attacks.

In IT security, an attack vector refers to a method or path used by an attacker to gain unauthorized access to a computer system or network. The aim of such an attack can be to steal sensitive data or to damage or control the system. Attack vectors can be diverse and range from phishing emails and software vulnerabilities to infected websites or external data carriers.

Auto Scaling is the automatic increase or decrease of computational resources that are available for assignment to workloads.

A backbone on the Internet refers to the central network of high-speed connections and routers that connect the various parts of the Internet. Metaphorically speaking, it is the “backbone” that is responsible for data traffic between distant locations.

Every organization understands the threat posed by DDoS attacks. It is 2020, after all. DDoS flooding attacks against big name brands have made media headlines for more than two decades. However, what many organizations don’t yet understand is that not all bot attacks originate from botnets .

The Banking Supervision Requirements for IT (BAIT) were developed by the German Federal Financial Supervisory Authority (BaFin) to ensure that information technology in banks and other financial institutions is secure and reliable.

The Border Gateway Protocol (BGP) is the standard routing protocol used to route data packets on the Internet. It enables Internet Service Providers (ISPs) and other large networks to communicate efficiently with each other and exchange routing information to determine the best possible paths for data traffic through the immense network of connected systems on the Internet.

Big data refers to extremely large and diverse collections of structured, unstructured and semi-structured data that are growing continuously and exponentially. These data volumes are so extensive and complex that they cannot be processed effectively using traditional data processing methods. The requirements are special technologies and analytical approaches to gain valuable insights and enable well-founded decisions.

Blockchain is a distributed database or ledger technology that provides a secure and immutable record of transactions . Each record or “block” of information is cryptographically linked to the previous block, creating a chain of blocks – hence the name “blockchain”.

In recent years, organizations worldwide and across all industries have been forced to develop and maintain increasingly tight controls to protect web-based assets against cyber threats.

Bot mitigation is a vital part of securing web assets like websites, applications, and APIs against threat actors. Hostile bots wage a variety of attacks, from data scraping and account takeovers to distributed denial-of-service (DDoS) attacks .

Over the last few years, bot traffic has become a massive headache for organizations across all industries. While bots themselves are nothing new, bot traffic volume and sophistication have risen drastically as hackers sought ways to scale their malicious activities. In this article, we’ll explain the difference between good and bad bots, explore the risks they pose, and cover the steps you can take to protect your business website and web applications.

When you think about cyberattacks, you probably imagine a hooded hacker sitting in a darkened room and typing furiously on their keyboard. However, this isn’t the reality of most cyberattacks.

In the field of IT security, a brute force attack means cracking a password using trial and error. Although it can involve some level of calculation, it basically consists of trying thousands of possible variants to break password protection.

The Federal Office for Information Security (BSI) is a German federal authority responsible for security in information technology. It was founded in 1991 in response to the growing importance of information technology and the associated security risks.

CAPTCHA is a popular security mechanism that is often used to protect against spam on websites. Almost everyone has had to deal with such verification.

In IT, the term Carpet Bombing refers to an overload attack (DDoS) in which an enormous number of small requests overload a system. The problem: Due to the small requests, usual protection mechanisms often detect the danger only when it is long too late.

A CISO (Chief Information Security Officer) is responsible for the development and implementation of an information security strategy within an organization. The main role of a CISO is to protect the confidentiality, integrity, and availability of information by implementing and monitoring policies, procedures, and technical solutions.

Have you heard of client fingerprinting? As privacy and security become increasingly important, it is crucial to understand the different techniques used to identify and track users on the Internet. This is exactly where such technology comes into play.

As the digital transformation progresses and awareness of environmental issues grows, companies, governments and private individuals are focusing on climate neutrality. The concept of climate neutrality is becoming an essential objective in the fight against global warming.

The Cloud Act , short for “Clarifying Lawful Overseas Use of Data Act” , is a US law that was passed in March 2018. It regulates the access of US authorities to data stored by electronic communication services, even if this data is stored on servers outside of the USA.

Cloud computing refers to a technology in which various IT services are provided and used via the Internet, for example, storage space, computing power, and software. Instead of operating these services locally on their own servers or computers, users can access the resources and applications of cloud providers via the Internet.

The increasing shift of IT infrastructure to the cloud requires a special focus on security measures. Cloud security refers to strategies, technologies and processes that aim to protect data, applications and systems in cloud environments from threats and unauthorized access.

A CNAPP (cloud-native application protection platform) is a comprehensive security solution designed specifically to protect cloud-native applications. The term was coined by Gartner to address the growing need for security in the cloud . CNAPPs combine multiple security functions into an integrated platform, making it easier for organizations to secure their cloud environments and effectively manage threats.

In recent years, there’s been plenty of hype surrounding CDNs. Once the exclusive domain of huge digital service providers like Facebook, Google, and Netflix, CDNs are now available to any organization (or even individual) that wants one.

A Content Security Policy (CSP) is a security measure used to protect web applications from various types of attacks, in particular cross-site scripting (XSS) and data injections. A CSP allows website operators to define specific policies that control what content may be loaded and executed from their website. This is achieved by specifying permitted sources for scripts, styles, images, and other resources.

Cyber attacks have become an omnipresent threat in the age of the Internet and digital identities. One method gaining popularity and poses significant risks for online users is so-called “credential stuffing”.

Cross-site scripting (XSS) describes a security vulnerability that occurs in web applications when an attacker successfully inserts malicious code (usually in the form of scripts) into web pages that other users see and execute.

Crypto mining, also known as cryptic mining or cryptocurrency mining, is the process of validating and adding new transactions to a blockchain network and generating new units of a cryptocurrency. It involves using powerful computer hardware to solve complex mathematical problems, which verify and secure the network. Competition now arises among miners to solve these cryptographic puzzles. The first person to find the correct solution is rewarded with a certain amount of cryptocurrency.

Cryptography refers to the science and practice of encrypting and decrypting information. The goal of cryptography is to encrypt data using various methods and techniques so that it is protected from unauthorized access.

A cyberattack is a targeted attempt to penetrate computer systems, networks, or digital devices with the intention of stealing, damaging, manipulating, or compromising data. These attacks are often carried out by hackers, cybercriminals, state actors, or other malicious parties to achieve various goals.

By definition, cyber security refers to all measures required to protect the digital layers of a company. This includes computers, mobile devices, servers, other electronic systems and important data. Cyber security is implemented to stop attacks that are intent on damaging these essential systems.

In today’s digital landscape, where data is the lifeblood of every organization, protecting that data is of the utmost importance. To tackle this effectively, data loss prevention (DLP) is a critical component of a comprehensive cybersecurity strategy.

A DDoS (Distributed Denial of Service) attack attempts to overwhelm an Internet-connected asset with the aim of making it unavailable to legitimate users. It does this by exhausting a finite resource — usually the sheer volume of traffic an asset is capable of handling — over a prolonged period, making normal use impossible.

Deep learning is a subfield of machine learning and thus also of artificial intelligence (AI) . It involves the use of artificial neural networks that are designed to process information in a way that resembles the human brain.

The word “DevOps” is a combination of “development” and “operations.” However, the word has a broader meaning than just a combination of these two concepts.

DevSecOps (stands for Development, Security and Operations) is the addition of security to DevOps. It is an overall process to ensure that security is “baked in” to the entire software development cycle.

Disaster recovery (DR) describes the ability of a company to get back to working order after a serious incident. Above all, this includes restoring access to IT systems and continuing business operations. It is a process that aims to minimize data loss, reduce downtime, and ensure business continuity.

A DNS amplification attack is a type of Distributed Denial of Service (DDoS) attack in which an attacker exploits vulnerabilities in the Domain Name System (DNS) to amplify traffic and flood a targeted system with an overload of requests. The goal is to overload the system with massive traffic and make it unavailable.

DNS cache poisoning , also known as DNS spoofing , is a form of cyberattack in which an attacker injects data into the DNS resolver cache to trick the resolver into returning a false IP address . When users then want to visit a website, they are redirected to a fraudulent page instead.

A DNS flood attack is a form of Distributed Denial-of-Service (DDoS) attack that targets the Domain Name System (DNS) . It works by flooding a DNS server with an extremely high number of queries to overload it, which disrupts its normal operation. The goal is to block legitimate user queries and affect the accessibility of websites or online services.

A DNS server (Domain Name System server) is an important part of the Internet that serves to convert human-friendly domain names into the corresponding IP addresses used by computers and networks to identify and communicate with each other.

DNS tunneling is a technique that abuses the Domain Name System (DNS) to transfer data via DNS queries and responses. It is often used by attackers to sneak network traffic past firewalls or other security measures by manipulating regular DNS queries to include data that is not normally transmitted via DNS.

A domain , also known as a domain name in the context of the Internet, is a unique address that is used to identify a website. It allows users to easily find and access a website without having to memorize complex IP addresses (Internet Protocol addresses), which consist of a series of numbers.

The Digital Operational Resilience Act (DORA) is a European Union regulation aimed at strengthening the security and resilience of information and communication technology in the financial sector. DORA came into force on January 16, 2023, and will be applied from January 17, 2025.

The three terms DDoS, DoS and RDoS look very similar at first glance and also have many things in common, but despite all this they should be evaluated completely differently.

“Doxing” (also spelled “doxxing”) is the practice of collecting personal and private information about an individual without their consent and publishing it on the Internet. This typically includes names, addresses, phone numbers, email addresses, workplace details, social media profiles, and other personal information.

Edge computing is a computing paradigm that aims to bring data processing as close as possible to the source of data generation (i.e., the “edge” of the network). This approach aims to reduce latency, optimize bandwidth usage, and improve responsiveness in real-time applications.

Failover is a key technology for minimizing these risks and ensuring business continuity. In our technology-driven world, the constant availability of systems and services is crucial. Outages can lead to significant financial losses, damage to reputation, and customer dissatisfaction – it’s crucial to prevent a situation like this.

In web application security, an ideal security system would correctly evaluate all incoming traffic. All legitimate traffic would be allowed, and all hostile traffic would be blocked. Unfortunately, in the real world, errors sometimes occur. One of the critical aspects in threat identification is the distinction between two types of errors: a false positive and a false negative.

The primary purpose of a web security solution is to detect potential threats, block them automatically, and notify administrators. However, no security system is flawless, and false alarms are an inevitable part of the process. False alarms can occur in web application security in two forms: A false positive alarm and a false negative alarm.

GDPR compliance refers to a set of regulations called the General Data Protection Regulation (GDPR) , which is used in the European Union (EU). The GDPR is a comprehensive data protection law that regulates the processing of personal data to ensures the protection of individuals’ privacy and rights in relation to their sensitive information.

Geo-blocking is a technique used to restrict access to Internet content based on a user’s geographical location . This restriction is made possible by recognizing the user’s IP address , which provides an indication of their geographical location.

GRE (Generic Routing Encapsulation) Tunneling is a network protocol developed by Cisco that transfers data packets between two networks over a public or private connection. It is used to create a tunneling protocol that encapsulates various types of traffic and transports them over the Internet or another network.

A hacker is a person with in-depth knowledge of computer technology . Their skills enable them to understand systems and find security breaches, a process known as hacking.

A honeypot is a security measure used to detect, analyze, and defend against cyberattacks . It is a deliberately vulnerable system or software that is meant to appear attractive to attackers. The goal of a honeypot is to attract attackers and study their methods and techniques without compromising real systems or data.

HTTP status codes are used for communication between web servers and clients to provide information about the status of a request. A HTTP 400 error: Bad Request is an HTTP status code that occurs when the server cannot understand the client’s request due to errors on the client’s side.

The display of an HTTP 403 error informs the user that there was an error with a website request. If your web browser displays a 403: Forbidden code instead of the desired website, something did not go as planned and you are not authorized to visit the page.

One of the most common errors encountered on the Internet is the HTTP 404 error code. It indicates that the desired page or requested file is no longer available. If you make a request in your browser for the desired destination, but it is not available, the server displays a 404 error code.

The display of an HTTP 500 error is not uncommon when surfing the Internet. Many error codes, such as the HTTP 404 error , signal a clear problem and are therefore easy to fix. However, it is somewhat less transparent when an HTTP error 500 is displayed. Here, users cannot always understand where the exact problem lies, as the error message is rather unspecific.

The HTTP 504 error is a common phenomenon in the online world, not only for website visitors but website operators too. While the error message itself is very well known, the causes are not always entirely clear.

The HTTP and HTTPS protocols are important for communication on the Internet and are therefore terms often encountered while browsing the net. But what is the difference between these two protocols? We have all the details.

An HTTP cookie, often simply referred to as a cookie, is a small text file created by a website that is stored on the user’s computer. It contains information, including settings or data, that enables the website to recognize the user on subsequent visits.

Web applications are a central part of business operations for organizations of all sizes. The availability of these applications is therefore crucial, but their ubiquity also means they are repeatedly targeted by cyberthreats. One particularly malicious threat is the HTTP Flood DDoS attack, which aims to overwhelm web servers and applications with a flood of seemingly legitimate requests.

A hybrid cloud is a cloud computing model that combines both private and public cloud environments. This model enables the orchestration, management, and use of IT resources across different cloud environments. The hybrid cloud offers companies the flexibility to move workloads and data between private and public clouds depending on their specific requirements. Importantly, it offers the advantages of both models: the security and control of the private cloud and the scalability and cost efficiency of the public cloud.

An identity provider (IDP) is a service or platform that manages and verifies digital identities. IDPs authenticate users by verifying their credentials and then issue authentication tokens that enable secure access to various applications and systems. IDPs support features such as single sign-on (SSO) , allowing users to log in once to seamlessly access multiple connected services. They play a central role in ensuring IT security, usability and compliance in modern IT environments.

As the name implies, “Immutable Infrastructure” refers to IT infrastructure that does not change. When an organization uses II, it sets up infrastructure parts like servers and Docker containers and doesn’t alter them again.

An Information Security Management System (ISMS) is a systematic approach to managing and protecting sensitive information within an organization. Its purpose is to ensure the confidentiality, integrity and availability of that data through policies, procedures and technical controls.

Infrastructure as Code (IaC) is the provisioning and management of computing infrastructure from machine-readable definition files. IaC not only includes traditional infrastructure such as servers and virtual machines, but also can include other components of modern architectures, such as containers, load balancing , and so on. Any resource which can be described in a definition file (usually in a format such as JSON) can be managed with IaC.

Infrastructure as a Service (IaaS) is a cloud computing model that provides basic IT infrastructure resources via the internet. IaaS enables companies to rent computing power, storage space, network capacity and other basic IT resources as a service instead of operating and managing their own hardware and infrastructure on site.

The Internet of Things (IoT) is a term used to describe the networking of Internet-enabled, intelligent devices. These devices communicate with each other to automate processes and measure, collect, and analyze data. Although useful for increasing productivity, the interfaces within the machine communication harbor risks for data protection and IT security.

An intrusion detection system (IDS) is a security mechanism that monitors and analyzes a network or system activity to detect suspicious behavior or unauthorized access. The main objective of an IDS is to identify and alert to potential security breaches, including malicious activity or policy violations.

Inventory hoarding , also known as inventory denial, is a critical threat faced by web applications, particularly those offering online purchases or reservations. This attack involves hostile bots manipulating inventory, attempting to render it unavailable to genuine customers. For the site owner, this leads to a variety of detrimental consequences.

An IP address (Internet Protocol Address) is a unique numeric identifier assigned to each device or machine on a computer network. This address is used to identify devices that use the Internet Protocol to allow them to communicate with each other.

To understand IP fragmentation attacks, it is important to understand IP fragmentation first. IP communication is used to exchange data packets on the internet. Between their source and their target, the packets often have to be passed along by various connection technologies and systems.

IP routing is an essential process in computer networks. In short, it is the method by which networks route data packets from a source to their destination within an IP network. It is critical to the proper operation of the Internet and other IP-based networks.

The ISO 27001 certification is an international standard for information security management systems (ISMS). It was developed by the International Organization for Standardization (ISO) in collaboration with the International Electrotechnical Commission (IEC).

IT baseline protection is a framework developed in accordance with BSI specifications (German Federal Office for Information Security). Its purpose is to help organizations achieve an appropriate level of security for their information technology.

Compliance in IT is a fairly complex subject. It refers to the observance of legal, regulatory and industry-specific rules and regulations that affect the handling of information, data, systems and technologies. A major part is ensuring that organizations comply with all relevant laws and regulations to guarantee the integrity, confidentiality, availability and protection of data.

An IT infrastructure refers to the entirety of hardware, software, network components, operating systems, and data storage required to provide and manage IT and telecommunications services in an organization. This structure enables an organization to use IT resources efficiently and support its business processes.

Load balancing is a technique that aims to distribute the workload evenly among multiple resources such as servers, processors or network connections. The main goal is to use the available resources efficiently and optimally to improve the performance, scalability, reliability and availability of systems.

Machine learning is a subfield of artificial intelligence (AI) that deals with the development of algorithms and models. These enable computers to learn from experience and perform tasks without having to be explicitly programmed.

A man-in-the-middle attack (MitM) is a type of cyberattack in which the attacker secretly takes over or intercepts communications between two parties without the parties involved realizing. The attacker gets between the two parties (hence “man in the middle”), intercepts their data transmissions, and uses this position to spy on or even manipulate this data.

The Minimum Requirements for Risk Management (MaRisk) is a regulatory requirement issued by the German Federal Financial Supervisory Authority (BaFin) . These regulations apply to banks, financial service providers, and insurance companies and aim to ensure appropriate and effective risk management.

Mutual TLS (mTLS) is an extension of the TLS protocol that enables mutual authentication between a client and a server. In a typical TLS connection, only the server confirms its identity to the client by presenting a certificate, whereas mTLS requires that the client also proves its identity to the server by presenting a client certificate.

Multi-factor authentication (MFA) is a security measure that requires users to provide two or more pieces of evidence (factors) to confirm their identity before gaining access to an online account, system, or resource.

Cybersecurity is a complex field that requires constant attention; keeping current on a myriad of evolving attack types, selecting and adopting constantly-changing technology, and so on. The need to stay up to date even extends to the choice of a security model, such as a negative security model.

A network port is a virtual point in a computer network where network connections begin and end. It is a software-based construct that is managed by an operating system to uniquely identify processes or network services.

The NIS-2 Directive is a revised version of the European Union’s Network and Information Security Directive (NIS Directive). It was introduced to strengthen the existing cybersecurity framework and increase member states’ resilience to cyberattacks .

An NTP amplification attack is a form of distributed denial of service (DDoS) attack that uses the Network Time Protocol (NTP) to multiply data. The attacker sends fake requests to unprotected NTP servers , which are sent back to a target with much larger responses, overloading and paralyzing the target’s network.

The term “open source” refers to software or technology where the source code is freely available to the public and can be collaboratively edited, improved, and shared by a community of developers.

On the web today, information can be transmitted to the other side of the globe in a few milliseconds. Most users do not understand how this works, nor do they need to do so. However, some people need to interact with and influence web traffic in one way or another—for example, those who administer web application security for their organization. For them, it is important to understand what happens when a user visits a website, securely uses an API, or performs other related activities.

In the cybersecurity world, threats are often described as targeting a specific layer. But what does that actually mean? The idea of OSI layers is foundational to computer science as a whole, as it explains how data signals travel from one place to another. In this article, we’ll explain what OSI layers are, the most common model used to describe them, and what cyberattacks are used to target each layer.

OWASP stands for “Open Web Application Security Project” and is a global non-profit organization focused on improving web application security. OWASP aims to create awareness for that type of protection and provide knowledge, tools, and resources to improve web application security.

A patch is a software update or small program designed to fix errors (also called “bugs”) in a software application or operating system. Patches are also used to add new features or improve the performance or security of software. As such, they are vital for the continued use of pretty much any piece of software.

In the field of IT security, a penetration test, or pentest for short, is a desired, commissioned test for vulnerabilities in IT infrastructure. As such, it is the legal counterpart to a criminal hack.

Phishing is a cyberattack in which fraudsters use fake communications, such as e-mails, text messages, or websites, to steal personal information from bona fide users. The main goal of phishing is to obtain sensitive information such as usernames, passwords, credit card numbers, social security numbers, or other confidential data.

A Ping flood DDoS attack , also known as an “ICMP flood attack”, is a form of denial of service (DoS) attack in which an attacker attempts to overload a target system by sending a large number of ICMP (Internet Control Message Protocol) packets. This type of attack aims to affect the availability of an online service or computer system by exhausting its resources.

Platform-as-a-Service (PaaS) is a cloud computing model that provides a platform on which developers can develop, run, and manage applications without having to worry about the underlying infrastructure. PaaS provides an environment that includes all the resources required to develop and run applications, including operating systems, databases, development tools, middleware, business services, and infrastructure components.

What is the best approach to web application security? For many years, the negative security model was the basis of all Web Application Firewalls (WAF) . Today, this is being supplanted by the positive security model. Before discussing why this is true, some background information will be helpful.

The Privacy Shield, also known as the EU-US Privacy Shield or EU-US Privacy Shield Framework, was an agreement between the European Union (EU) and the United States (US). It was designed to ensure data privacy and the lawful transfer of personal data of EU citizens to the US.

A private cloud is a type of cloud computing infrastructure that is used exclusively by a single company or organization. It is hosted either internally (on-premises) or by a third-party provider, but with resources that are only available to the specific company rather than being shared by a large number of users.

A proxy is a server that acts as an intermediary between an end device, such as a computer, and the Internet. When a device establishes an Internet connection via a proxy server, the proxy sends the requests to the target server and forwards the responses back to the end device.

A public cloud is a model of cloud computing in which resources, such as computing power, storage and network services, are provided by an external service provider via the Internet to the general public. These resources are usually offered on a pay-as-you-go basis, which means that users only pay for the services and resources they actually use.

Quantum computing is a revolutionary type of computing that uses quantum mechanical principles, such as superposition and entanglement. These computers can perform certain computing tasks much faster or tackle previously impossible jobs.

When cybercriminals combine a DDoS attack with a ransom demand, this is known as a ransom DDoS attack (RDDOS). The damage in such a case can be considerable and should not be taken lightly.

Blackmail by anonymous cybercriminals is an acute threat to companies of all sizes. Hackers also target administrations and government authorities. Only a comprehensive approach to IT security can offer reliable protection against the pervasive danger posed by ransomware.

Distributed denial of service attacks is currently on the agenda throughout Europe. However, due to the current situation, such attacks are no longer only used by criminal elements but are also increasingly abused for politically motivated purposes.

Rate limiting is a defensive strategy for spreading network traffic. It involves setting an upper limit on how often users or applications can perform an action within a defined timeframe. Rate limiting therefore limits the number of requests that can reach web servers. For this reason, the technology is used to protect websites or applications from unintentional or malicious overloading, for example by bots.

A reverse proxy is a type of proxy server that acts as an intermediary between external requests from the Internet and the servers running on an internal network. This is in contrast to a conventional (forward) proxy, which acts on behalf of client users, instead working on behalf of one or more servers.

SASE (Secure Access Service Edge) is a network and security concept coined by Gartner in 2019. It combines network and security functions in a cloud-based architecture to meet the requirements of modern, networked companies. SASE aims to provide flexible, secure and efficient connectivity for users, devices and applications, no matter where they are located.

Scam is an English term that stands for fraud or swindle. It refers to a form of deception in which fraudsters attempt to harm other people through fraudulent actions or exploit them for their own benefit. In terms of IT, scam refers to fraudulent activities that specifically use digital technologies and online platforms to deceive people, steal their personal information or obtain money from them.

A scrubbing center (also called a traffic scrubbing center) is a type of facility or service used in information and network security. It filters out malicious traffic from a network or Internet connection. These centers specialize in monitoring and filtering traffic for malicious activity, such as Distributed Denial of Service (DDoS) attacks, botnet activity, malware propagation and other cyber threats .

Secure DNS infrastructure is an essential component of any cybersecurity program. Unfortunately, DNS exploits get far less media attention than other attacks, so many organizations don’t fully appreciate the threat they pose.

In the complex and constantly evolving world of cybersecurity, it is essential for companies to have a comprehensive overview of their security situation. Security Information and Event Management (SIEM) is the primary technology that provides precisely this transparency.

Single sign-on (SSO) is an authentication technology that allows users to log in once and access multiple applications, services, or systems.

In cybersecurity , skewing refers to the targeted manipulation of data to distort the results of analysis or machine learning models. This type of attack is often referred to as a skewing attack or data poisoning attack and can significantly impair the effectiveness and reliability of models, such as those used to detect anomalies or fraud.

Slowloris is a type of DDoS attack in which the attacker attempts to overload a web server by holding multiple concurrent connections. The attack works by the attacker opening a connection to the server and sending an HTTP request, but intentionally making it incomplete. The server waits for the request to become complete and keeps the connection open as a result.

A Smurf DDoS attack is a form of distributed denial of service (DDoS) attack that floods networks and servers with an enormous number of Internet Control Message Protocol (ICMP) packets . This puts such a strain on the target system that it is no longer able to process regular requests, resulting in websites, online services, or entire networks becoming unavailable.

Software-as-a-Service (SaaS) is a cloud-based software distribution model in which applications are provided as a service via the Internet. Instead of installing copies of the software on individual computers, users access it via a web browser.

Spam refers to unwanted communication, usually in the form of emails sent in bulk, that often contain advertising, phishing attempts, or malware. These messages are typically sent without the consent of the recipient and can also appear in social networks, forums or as text messages.

Spear phishing is a targeted form of phishing in which attackers target specific individuals or organizations. Unlike general phishing attacks, which are widely distributed to a large number of recipients to increase the odds of deceiving someone, spear phishing focuses on carefully selected targets.

The concept of spoofing focuses on the deception of true identity or origin by an attacker to impersonate another person or entity. This deceitful technique can be applied at different levels, such as IP spoofing, email spoofing, or caller ID spoofing.

SQL injection (SQLi) is a type of cyberattack in which an attacker inserts malicious SQL code into a database query to manipulate the underlying database of a web application system.

SSL (Secure Sockets Layer) is a standard security technology that establishes an encrypted connection between a web server and a browser. This connection ensures that all data transmitted between the web server and the browser remains private and secure.

A supply chain attack is a type of cyberattack in which attackers exploit vulnerabilities in a company’s supply chain to gain access to sensitive data, systems or networks. Instead of attacking a target company directly, the attackers focus on its suppliers, service providers or partners, who are often less well protected. This makes it possible to indirectly compromise the actual target.

A SYN flood attack is a form of Denial of Service (DoS) attack in which the attacker attempts to disable a server or network by overloading it with SYN packets. This attack uses a feature of the TCP handshake, the method by which network devices establish a connection for communication.

TCP/IP stands for Transmission Control Protocol/Internet Protocol. The term refers to a suite of communication protocols that enable computers to communicate with each other over a network such as the Internet. It is the basic communication protocol of the Internet and was originally developed by the US Department of Defense in the late 1970s.

TLS (Transport Layer Security) is a protocol designed ensure the security of data communication on the Internet. It is used to encrypt and secure data transmission between servers, clients, and other network devices.

The Tor Browser is a free, open-source web browser based on Mozilla Firefox . It was developed to protect the privacy and anonymity of users when surfing the Internet.

The Transmission Control Protocol (TCP) is one of the main protocols of the Internet. It is used to transfer data between computers on a network in a secure and reliable manner. TCP belongs to the so-called transport layer of the OSI model and works together with the Internet Protocol (IP). While IP is responsible for routing data packets between the sender and the recipient, it ensures that the data is transferred reliably.

A Trojan horse is a type of malicious software that masquerades as harmless or useful software in order to sneak onto a computer system undetected. Once installed, it can perform malicious actions such as stealing data, tampering with the system, or installing other malware . Unlike a virus, a Trojan horse does not replicate itself, but instead requires the active consent of the user in order to install.

A UDP flood DDoS attack is a type of denial-of-service (DoS) attack in which a large number of User Datagram Protocol (UDP) packets are sent to random ports on a targeted server. The aim of this attack is to overload the network or the system’s resources so that legitimate requests can no longer be processed.

UEBA (User and Entity Behavior Analytics) is a security solution that uses technologies and methods to monitor and analyze the behavior of users, applications, and devices within a network to detect abnormal activity.

A virtual machine (VM) is a software-based simulation of a computer system. It allows an operating system and associated applications to run in an isolated environment on a physical host computer as if it were a standalone, independent machine. A VM is created and managed by what is known as hypervisor software , which allocates the host’s physical resources (processor, memory, disk, network) to the virtual machine.

A Virtual Private Network (VPN) is a technology that creates an encrypted connection between a device and the internet. It protects data from unauthorized access, hides the IP address, enables anonymous browsing, and bypasses geographical restrictions.

WAAP (Web Application and API Protection) is a security technology designed to protect web applications and API services from various types of threats. These attacks can include exploits that take advantage of specific vulnerabilities, Distributed Denial of Service (DDoS) attacks, malicious bots, and other security compromising activities.

A Wide Area Network (WAN) is a network that covers a large geographical area . It is used to connect various smaller networks, such as Local Area Networks (LANs) or Metro Area Networks (MANs). WANs can span cities, regions, countries or even continents.

A Web application , also known as web app , is a software application that runs on a web server and is accessible via a web browser on the user’s end device. In contrast to traditional desktop applications, which have to be installed locally on the user’s computer, web applications are hosted centrally on a server and made available via the Internet.

A Web Application Firewall (WAF) is a type of firewall that specializes in protecting web applications from various security threats. In contrast to traditional firewalls, which filter and control data traffic at network level, a WAF focuses specifically on the application level and protects web applications from attacks that target vulnerabilities in the application logic.

Web application security is the process of protecting web applications from Internet threats. Traditionally, this is provided by a WAF: a web application firewall .

A web crawler , also known as a spider or a bot , is an automated program or script that systematically visits websites. Its main goal is to collect and index information from these pages. Web crawlers are essential tools for search engines because they help create the database from which search engines generate their search results.

In our digital economy, data is the new gold. To mine this treasure, companies and developers use a powerful technique called scraping . It allows huge amounts of data to be extracted and stored from a wide variety of sources. But what exactly do the often synonymous terms data scraping, web scraping, and content scraping mean?

Whaling is a form of cyberattack in which the attackers impersonate high-ranking executives or other authority figures to obtain sensitive information or money from companies or individuals. Unlike phishing , which is broad-based and targets a large number of people, whaling focuses on specific high-level targets such as CEOs, CFOs, or other key individuals in organizations. The attackers often use personalized information to increase their credibility and trick victims into responding to fraudulent emails or other communication channels.

A zero day exploit is an attack tool that exploits a previously unknown security vulnerability in software or hardware. This vulnerability is not known to the developers and users at the time of the attack, which is why there are no security measures or patches yet. This enables attackers to cause damage unnoticed or gain unauthorized access.

Zero Trust marks a new way of thinking in IT security. With this IT security approach, the focus is on protecting the boundaries of the company. Here, the focus is on verifying the trustworthiness of each individual data flow, because no actor in a network is trusted without reservation.