AppSec Glossary

Definitions for application security and software supply chain practitioners.

Browse by category

Browse A-Z

Showing 248 terms

B

Breach and Attack Simulation

Broken Access Control

Broken Authentication

Broken Function Level Authorization

Broken Object Level Authorization

Brute Force Attack

Bug Bounty Programs

Build Provenance

Business Logic Attacks

Business Logic Vulnerabilities

D

Data Access Auditing

Data Classification

Data Loss Prevention

Data Minimization

Data Protection

Defense in Depth

Dependency Confusion

Dependency Management

Dependency Pinning

Dependency Scanning

Deserialization Attacks

Detection Engineering

Developer Security Training

Development Security and Operations

Directory Traversal

Drift Detection

Dynamic Application Security Testing

E

Encryption Key Rotation

Encryption at Rest

Encryption in Transit

Environment Isolation

Ephemeral Workloads

Exploit Chaining

Exploit Prediction Scoring System

Exposure Management

Exposure Validation

F

False Negatives

False Positives

Fine-Grained Authorization

Function-as-a-Service Security

G

GraphQL Introspection Abuse

GraphQL Security

H

HTTP Request Smuggling

Hallucination Exploitation

Host Header Injection

I

IDE Security Plugins

Identity Federation

Identity Threat Detection and Response

Identity and Access Management

Immutable Infrastructure

Indicators of Attack

Indicators of Compromise

Infrastructure as Code Security

Injection Attacks

Insecure Deserialization

Instance Metadata Attacks

Interactive Application Security Testing

J

Just-Enough Access

Just-in-Time Access

K

Known Exploited Vulnerabilities

Kubernetes Security

L

Large Language Model Security

Lateral Movement

Least Privilege

M

Machine Identity Management

Maintainer Account Takeover

Malicious Packages

Man-in-the-Middle Attack

Membership Inference Attacks

Memory Corruption

Microsegmentation

Model Inversion Attacks

Model Supply Chain Security

Multi-Factor Authentication

N

Network Segmentation

O

OWASP API Security Top 10

Output Filtering

P

Package Integrity

Parameter Pollution

Password Spraying

Penetration Testing

Personally Identifiable Information

Pipeline Security

Policy Enforcement

Pre-commit Hooks

Privacy by Design

Privilege Escalation

Privileged Access Management

Prompt Injection

Provenance Attestation

R

Race Conditions

Rate Limit Bypass

Reachability Analysis

Remote Code Execution

Reproducible Builds

Responsible Disclosure

Retrieval Augmented Generation Security

Risk Acceptance

Risk Prioritization

Risk-Based Vulnerability Management

Role-Based Access Control

Runtime Application Self-Protection

Runtime Detection

Runtime Security

T

Threat Detection

Threat Intelligence Feeds

Threat Modeling

Threat Surface Management

Token-Based Authentication

V

Vulnerability Exploitability eXchange

Vulnerability Management

Vulnerability Scanning

W

Web Application Firewall

Web Cache Deception

Workload Identity

Workload Identity Federation

Workload Security

Z

Zero Trust Architecture

a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.