Word Notes

The flagship product of the controversial Israeli spyware vendor, the NSO Group, use for remotely hacking mobile devices, most notably iPhones, via zero-click exploits.

CyberWire Glossary link: https://thecyberwire.com/glossary/pegasus

Audio reference link:“Cybersecurity beyond the Headlines: A Conversation with Journalist Nicole Perlroth,” Kristen Eichensehr, and Nicole Perlroth, University of Virginia School of Law, YouTube, 14 February 2022

Learn more about your ad choices. Visit megaphone.fm/adchoices

An open source email authentication protocol designed to prevent emails, spoofing in phishing, business email compromise or BEC, and other email-based attacks. 

CyberWire Glossary link: https://thecyberwire.com/glossary/pegasus

Audio reference link:"Global Cyber Alliance's Phil Reitinger talks DMARC adoption" “Global Cyber Alliance’s Phil Reitinger Talks DMARC Adoption.” YouTube Video. YouTube, April 27, 2018

Learn more about your ad choices. Visit megaphone.fm/adchoices

A condition announced by the US Cybersecurity and Infrastructure Security Agency (CISA) to draw attention to a temporary period of high alert, associated with expectation of a connected wave of cyberattacks prompted by either a widespread vulnerability or an unusually active and capable threat actor.

CyberWire Glossary link: https://thecyberwire.com/glossary/shields-up

Audio reference link: “Star Trek II Wrath of Khan - Reliant vs Enterprise; First Clash” YouTube, YouTube, 11 Apr. 2015,  

Learn more about your ad choices. Visit megaphone.fm/adchoices

A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks.

Audio reference link: "OWASPMSP - Pravir Chandra: Software Assurance Maturity Model (OpenSAMM)." by Pravir Chandra, OWASP MSP, 2009.

Learn more about your ad choices. Visit megaphone.fm/adchoices

An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange.

Cyberwire Glossary link: https://thecyberwire.com/glossary/u2f

Audio reference link: “Rise of the Machines: A Cybernetic History,” by Thomas Rid, Published by W. W. Norton Company, 21 November 2017.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops. 

CyberWire Glossary link: https://thecyberwire.com/glossary/bsimm

Audio reference link: “OWASP AppSecUSA 2014 - Keynote: Gary McGraw - BSIMM: A Decade of Software Security.” YouTube Video. YouTube, September 19, 2014.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version. 

Audio reference Link: "The Panama Papers: A Closer Look," Late Night with Seth Meyers, YouTube, 12 April 2016

Learn more about your ad choices. Visit megaphone.fm/adchoices

Code and data repositories that don't protect against unauthorized changes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers. 

Learn more about your ad choices. Visit megaphone.fm/adchoices