Search results for:

Code or technique that abuses a flaw the vendor does not know about, with no patch yet — the attack happens before the flaw is disclosed and fixed.

The maximum acceptable data loss measured in time after a failure — it sets how often backups and replication must run in a disaster recovery plan.

Three cloud service models that differ in how much the provider manages: IaaS gives you infrastructure, PaaS a developer environment, and SaaS a ready-to-use app.

A category of tools that continuously check SaaS app settings via API and flag misconfigurations, overly broad permissions, and risky OAuth integrations.

Specialized infrastructure to which traffic is diverted during a DDoS attack (via BGP/DNS) to filter out malicious packets and send only clean traffic back to the origin.

An architecture model that converges networking (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS) into one cloud-delivered service, with identity-based, Zero Trust access.

An Active Directory attack technique: the attacker forges a Kerberos service ticket (TGS) with a service account hash and bypasses the domain controller to reach a single service.

A machine-readable list of all components, libraries and dependencies that make up software, with their versions, origin and licenses. The basis for managing supply-chain risk.

Open OASIS standard for describing cyber threats in JSON: typed objects (SDO/SCO/SRO) and their relationships, used to exchange threat intelligence.

The maximum time to restore a system or process after a failure or incident before downtime starts to do harm. Set in the BIA and complemented by RPO.

Tactics, Techniques, and Procedures — a description of how an attacker operates across three levels (goal, method, execution), used in MITRE ATT&CK, threat hunting, and attribution.

Hosts, applications, or conversations that generate the most network traffic; identified from flow data such as NetFlow, IPFIX, and sFlow.

The time from sending a packet to getting confirmation that it arrived. The basic measure of network latency, given in milliseconds.

Open OASIS standard for automatically exchanging cyber threat intelligence (CTI) over REST/HTTPS; delivers STIX data using collections (pull) and channels (push).

A data-driven method for finding the fundamental cause of a problem or incident, not just its symptoms, so the problem does not come back.

EU Regulation 2016/679 on personal data protection, in force since 25 May 2018. Sets out processing principles, lawful bases, people's rights and security obligations.

A standard and protocol for sending system event messages from devices and applications to a central collector; each entry encodes the source (facility) and importance (severity).

The amount of data actually transferred across a network per unit of time (bps); lower than a link's theoretical capacity because of overhead, latency, and packet loss.

Logical Layer 2 split of a network into separate broadcast domains, regardless of where devices physically sit; frames are tagged per IEEE 802.1Q, and traffic between VLANs needs Layer 3 routing.

Continuous measurement of network performance, availability, and quality — latency, packet loss, jitter, throughput — using SNMP, flow data, packets, and synthetic tests.

How a Cisco ASA firewall sends traffic data, based on NetFlow v9 and event-driven: records are created when a flow is set up, torn down, or denied.

A way for applications to exchange data over HTTP in the REST style: each resource has its own address, you use GET/POST/PUT/DELETE methods, and the server keeps no session.

Attack (MITRE ATT&CK T1496) in which an adversary uses a compromised system's compute, bandwidth, or services for their own tasks — from cryptojacking to LLMjacking.

When some sent packets never reach their destination; measured as a percentage, it triggers TCP retransmissions and degrades VoIP and video quality.

A network attack in which requests carrying the victim's spoofed IP are sent to reflector servers so their replies flood the target — the basis of DRDoS attacks.

Mechanism that caps how many requests a single client may send within a time window; once exceeded, requests are rejected (HTTP 429) or delayed, protecting availability and curbing abuse.

A UDP-based transport protocol with built-in TLS 1.3 encryption. It sets up the connection and encryption in one step, carries many streams at once, and survives network changes; the basis of HTTP/3.

A device or program that watches network traffic at a given point and forwards flows, metadata, or full packets to monitoring (NPM) and threat-detection (NDR) systems.

Tools and processes that protect and monitor accounts with elevated permissions: a password vault, least privilege, just-in-time access and session recording.

Payment card data security standard (PCI SSC): 12 requirements across 6 goals, protecting cardholder data at merchants and service providers. Current version: v4.0.1.

An OWASP Foundation list of the ten most serious types of web application security risks, used as a reference point for secure coding and testing.

Three ways to run IT infrastructure, differing in who owns the hardware, how costs are counted (CAPEX/OPEX), how much control you keep, scaling, and how security responsibility is divided.

Collecting and analyzing network traffic data (full content, session, transaction, alert) to detect and respond to intrusions, on the assumption that prevention sometimes fails.

A center where a team watches over networks, servers, and services around the clock — keeping them available and performing well, and handling outages.

A voluntary, risk-based NIST framework that organizes cybersecurity around outcomes. In version 2.0 (2024) it has six functions: Govern, Identify, Protect, Detect, Respond and Recover.

A device inserted into a network cable that makes a faithful copy of all traffic and passes it to monitoring tools without affecting the live network.

An appliance or software that collects a copy of traffic from TAPs and SPAN ports, filters it, and distributes it to monitoring and security tools.

Branch of digital forensics that captures and analyzes network traffic (PCAP, flow, logs) to determine the source and course of an incident and to preserve evidence.

An architectural model where one software instance serves multiple independent tenants on shared infrastructure, separating their data logically. The basis of SaaS and cloud.

Multi-factor authentication requires at least two independent factors from different categories (knowledge, possession, biometrics) to confirm identity and make account takeover harder.

A network security method that splits an environment into small, isolated zones at the level of single workloads. It controls east–west traffic and limits an attacker's lateral movement.

Latency is the time data takes to travel from sender to receiver across a network, measured in ms as RTT or one-way delay; its components are propagation, serialization, queuing, and processing.

Techniques that build stable TLS client and server fingerprints from cleartext handshake fields (ClientHello/ServerHello), letting you spot an application or malware without decrypting traffic.

Jitter is the uneven pace at which packets arrive (delay variation, in ms). It harms VoIP and video calls, and in security it masks C2 beaconing.

Juniper Networks' method of monitoring IP traffic based on sampling, exporting flow records over UDP to a collector; the equivalent of NetFlow.

An up-to-date, central record of all IT assets (hardware, software, services, accounts) with their descriptions — the basis for managing risk, vulnerabilities, and the attack surface.

International standard telling companies how to protect information properly: a management system (ISMS), a risk-based approach, Annex A controls and certification.

An organized, repeatable process for detecting, analyzing, containing, removing and recovering from security incidents; described as 4 NIST phases or 6 SANS steps (PICERL).

Network-layer protocol that carries error messages and control information about IP packets; the basis for the ping and traceroute tools.

Managing digital identities and controlling access to resources: it combines authentication (who) with authorization (to what) under the principle of least privilege.

A BGP extension that distributes precise traffic filtering rules across the network, each with an action (drop, rate-limit, or redirect); used for accurate DDoS mitigation.

Protocol a browser uses to fetch web resources via request–response (port 80). HTTPS is the same protocol inside a TLS tunnel (port 443): confidentiality, integrity, server identity.

Threat-detection techniques that examine encrypted network traffic without decryption — using TLS metadata, fingerprinting (JA3/JA4), packet sizes and timing, and machine learning.

A data analysis operation: stepping from a general value down to a more detailed level in a hierarchy; in network monitoring from alert, through flows, to packet.

The practice of defining how long an organization keeps data before archiving or permanently deleting it, balancing legal and investigative needs against lower risk.

The system that turns website names (e.g. example.com) into the IP addresses devices use to connect. Known as the "phone book of the internet"; key to how networks work and to security.

A client-server protocol (UDP 67/68) that lets a device automatically get an IP address and network settings (mask, gateway, DNS) via the DORA process, for a lease period.

A set of techniques that detect and block unauthorized leakage of sensitive data at rest, in motion, and in use through classification, content checks, and rule enforcement.

A model that shows a cyberattack as seven consecutive phases — from reconnaissance to actions on objectives — and helps detect and break an attack at each stage.

Unauthorized copying or transfer of data out of an organization's systems, usually the last step of an attack; detected mainly through outbound-traffic and DNS anomaly analysis.

A vulnerability where an application passes user input to the system shell, letting an attacker run arbitrary operating system commands with the process's privileges (CWE-78).

A browser security mechanism set by an HTTP header that limits where a page can load scripts and other resources from, mainly to make XSS attacks harder.

A web application vulnerability in which an attacker makes a logged-in user perform an action unknowingly, because the browser itself adds their session cookie to the request.

Monitoring component that gathers, organizes, and stores telemetry (NetFlow, IPFIX, sFlow, syslog) from exporters; the middle link in the exporter-collector-analyzer chain.

Tools that agentlessly and continuously check cloud configuration (IaaS, PaaS, SaaS), catch setup errors and gaps against standards, and help fix them.

A repository storing IT configuration items (CIs) with their attributes and links; it supports impact analysis, change management and setting the order of patching.

A model in which employees use personal devices for work and to reach company data. Needs controls (MDM/MAM, NAC) and a policy to limit risks and shadow IT.

A statistical picture of normal network, server, and user behavior, used as a reference point for detecting anomalies (NDR/NPM).

The maximum, theoretical rate at which a network link can carry data over time, given in bits per second (Mbps, Gbps). It describes channel capacity, not the throughput actually achieved.

A control layer between users and cloud services (SaaS/PaaS/IaaS) that gives insight into cloud usage, protects data and helps respond to threats.

Sending selected traffic to a Null0 interface where packets are quietly dropped; RTBH automates this over BGP to quickly put out volumetric DDoS attacks.

A DDoS attack in which an adversary spoofs the victim's IP and abuses UDP services (DNS, NTP, Memcached) to reflect traffic many times larger than the requests sent.

Practices and controls protecting APIs against unauthorized access, business logic abuse, and data exposure: authentication, authorization, encryption, and monitoring.

An agreed set of rules that lets programs exchange data and run each other's functions through requests and responses, most often via HTTP-based web APIs.

Automatically finding and listing all IT assets — hardware, software, services, and cloud resources — as the basis for visibility and vulnerability management.

Directions of network data flow: North-South crosses the network edge (client–server), while East-West moves horizontally inside, between servers and services.

Learn how passive inventory differs from active scanning and why continuous traffic observation provides a more complete view of the network.

See how flow-based network visibility helps detect lateral movement, C2 beaconing, and other signs of attackers operating inside the network after bypassing the firewall.

Discover how flow-based detection helps uncover hidden threats in OT networks — without agents, active scanning or the risk of disrupting industrial processes.

See how NetFlow helps security teams reconstruct the full attack path, trace lateral movement, identify command-and-control patterns and estimate data exfiltration using historical network evidence.

See what architectural decisions stand behind LinkSense — a lightweight, open-source synthetic monitoring tool based on the agent–server model, Rust and SQLite.

In this article, we explain how to combine NetFlow, retrospective PCAP and packet analysis to identify suspicious communication faster, reconstruct the course of incidents and document response activities more effectively.

During this webinar, we will walk through real-world attack scenarios and show what was visible in the network — before, during and after the incident. You will learn how timing, volume, destinations, session patterns, NetFlow retention and packet access can help detect what traditional tools may miss.

Learn how to uncover silent attacks hidden in seemingly normal network traffic. Discover how traffic analytics, observability, behavioral detection and data correlation can reveal low-and-slow activity, lateral movement and unusual communications—helping security and network teams respond faster.

As NIS2 becomes a key priority for Romanian organizations, visibility and compliance are essential. In this session, we show how to turn regulatory requirements into practical security measures, improve monitoring, and gain greater operational clarity.

Learn how to use Raw Data in Sycope for detailed network traffic analysis and forensic investigation. This video covers data streams, filtering, table customization, Advanced View, graph controls and exporting investigation results.

In this episode of the Sycope Guide series, we take a closer look at the Home & Dashboards section and how it supports everyday work with network monitoring and security analytics. The video walks through the main interface, presenting how information is structured and how dashboards can be used to provide a clear, real-time overview of key metrics and events.

See how LinkSense helps monitor the availability, performance and health of services in distributed environments — without unnecessary complexity or vendor lock-in.

In this article, we look at NIS2 from the perspective of monitoring: what an organization needs to see, what data it must be able to analyze, and why simply having security tools in place does not yet mean operational readiness.

The new Sycope integration with Atlassian Jira allows tickets and incidents to be created directly from network alerts. The Microsoft Power Automate option helps reduce duplicates by adding recurring alerts as comments to existing tickets.

The new Sycope integration with Atlassian Jira allows tickets and incidents to be created directly from network alerts. The Microsoft Power Automate option helps reduce duplicates by adding recurring alerts as comments to existing tickets.

Building on previous releases, Sycope 3.2 focuses on three key areas: enhanced API observability, advanced detection and forensic capabilities, and expanded ecosystem integrations.

The partnership will enhance cybersecurity analytics and network orchestration capabilities for their combined customer base.

A web application firewall monitors and filters traffic to a web application. It blocks suspicious requests to help prevent attacks such as SQL injection and cross-site scripting.

The average time it takes to detect a security threat or incident. It measures how quickly an organization identifies problems so it can respond sooner and reduce damage.

The average time needed to repair a system or recover from an incident after a failure is detected. It measures how quickly operations can be restored and downtime reduced.

A false positive is an incorrect alert that flags a safe email, file, or process as a threat. It matters because it can waste time and interrupt normal work.

A honeypot is a decoy system set up to attract cyberattacks. It helps defenders detect threats and study attacker behavior in a controlled environment.

An indicator of attack is a sign of suspicious activity that may show an attack is in progress or about to happen. It helps security teams detect and stop threats early.

An indicator of compromise is a digital artifact or behavior that may signal a security breach. It helps security teams detect, investigate, and respond to threats quickly.

A network security system that monitors and filters incoming and outgoing traffic based on rules. An NGFW adds deeper inspection of applications and threats to block advanced attacks.

An intrusion prevention system monitors network traffic for suspicious activity and blocks detected attacks automatically. It helps protect systems and data from unauthorized access and other threats.

Endpoint detection and response (EDR) is a security technology that monitors endpoints for suspicious activity. It detects threats, alerts defenders, and can isolate compromised devices.

XDR is a security platform that combines data from multiple sources to detect and investigate threats. It helps automate response and provides centralized visibility across an organization.

Security Orchestration, Automation and Response (SOAR) is a cybersecurity platform that automates and coordinates security tasks. It helps teams detect, investigate, and respond to incidents faster.

A virtual private network that encrypts internet traffic and masks your IP address to improve privacy and security online.

A routing protocol that directs data between different networks on the internet. It helps choose paths for traffic so networks can exchange information efficiently.