Security Glossary

Access management is a cyber security control used by organisations and businesses to control and monitor user access to systems, applications, and cloud-based services. It ensures that only authorised individuals can access certain resources based on its identity, role, and organisation’s policy. It helps in protecting sensitive assets by verifying identities via authentication and granting permissions. It is a key component of Identity and Access Management (IAM). Common tools used in access management are Multi-Factor Authentication (MFA), Single Sign-On (SSO), and Identity as a Service (IDaaS). Effective access management enhances security, regulatory compliance, operational efficiency, and reduces cyber risks.

Account takeover (ATO) is a type of cyberattack in which an attacker tries to control your digital account (banking or other) by gaining unauthorised access to steal sensitive personal information (email, account, social media, passwords, etc.), impersonate or commit financial fraud. This can be executed by methods like phishing, credential stuffing, malware, or session hijacking. This is a common attack in the financial, e-commerce sector and mobile apps. You can identify an ATO attack if there is a login from an unusual geographic location, multiple failed login attempts, an unknown change to the password or details, receipt of login or password reset OTP, or a high-volume transaction, etc. To prevent account takeover, awareness and proper account management is very important. Secondly, multi-factor authentication makes it harder for attackers to bypass security. Behavioural monitoring, sandboxing, and integrating runtime application self-protection in the app are helpful security techniques to prevent account takeover attacks.

Advanced Encryption Standard (AES) or Rijndael, established by the National Institute of Standards and Technology (NIST) in 2001, is a symmetric block cipher algorithm widely adopted to secure sensitive data. AES encrypts data in fixed-size 128 bits blocks using key lengths of 128, 192, or 256 bits. It is considered highly secure and is commonly used in banking systems, secure communications, and mobile applications for data encryption. AES in Cybersecurity:

• It used a fixed-size block of data using the same key for both encryption and decryption.
• The number of rounds depends on the key size: 10 rounds for 128-bit, 12 for 192-bit and 14 for 256-bit keys. 14 rounds are usually for highly sensitive information, and AES makes it highly complex.
• Each round has some steps of encryption and decryption, including SubBytes (substitution), ShiftRows (permutation), MixColumns (mixing), and AddRoundKey (key XORing).
• It is efficient for both hardware and software.

Advanced obfuscation is a technique used to make application code more complex and difficult to analyse or reverse engineer. It transforms readable code into a functionally equivalent form, but makes it harder for attackers to interpret. These codes function normally but are unreadable to humans and automated scanners. Techniques used in advanced obfuscation:

• Control flow obfuscation.
• String/data encryption.
• Packing and encoding.
• Code virtualisation and dynamic loading.

Advanced obfuscation protects intellectual property and sensitive logic within applications. However, it must be implemented carefully, as poorly configured obfuscation can impact performance or application stability. Bugsmirror Shield is an advanced code obfuscation tool that transforms or encrypts code into such a form which becomes hard for attackers to decipher or decrypt it.

Advanced Persistent Threat (APT) is a prolonged cyberattack in which attackers conduct a well-researched, long-term, targeted campaign to steal data or sabotage mobile apps. This attack involves highly skilled attackers who infiltrate a system and remain undetected for extended periods. APTs require well-funded groups and highly technical groups seeking sensitive information, intellectual property, or strategic advantage. These attacks use multiple techniques, including phishing, zero-day exploits, and lateral movement within networks. These threats are difficult to detect and need a comprehensive security solution to prevent them. To detect it, keep an eye on unauthorised logins, unexpected and unusual network traffic, the presence of unknown files and data, etc. Continuous monitoring, network segmentation, and threat intelligence are essential to mitigate APTs.

Advanced root detection refers to a multi-layered technique used to identify whether a mobile device or a system is rooted or compromised. This is an important technique for the security of apps handling sensitive data, as rooted environments weaken built-in platform security controls and increase exposure to runtime attacks. Rooted devices bypass standard operating system restrictions, increasing the risk of tampering, data extraction, and malware execution. Key components of advanced root detection include searching for su binaries, identifying hooking frameworks such as Frida or Xposed, verifying device integrity, and using native libraries (e.g., C/C++) to detect rooted environments. Advanced root detection alone can be bypassed by using tools like Magsik (a root-hiding tool), native code hooking to evade detection algorithms, and mimicking a stock or secure environment, thus a comprehensive runtime solution like Bugsmirror Defender is necessary for business apps.

Adware (Advertising-supported software) is a type of malicious or unwanted software that displays or downloads advertisements on a user’s device without consent to generate revenue. This can be displayed in the form of pop-ups, banners, or browser ads. Key Aspects of Adware: These ads are random- basically just annoying, and the main goal is to generate revenue for developers by forcing users to watch ads often by hijacking a website, changing the homepage or redirecting users to an ad page. However, they contain malware and track user behaviour, collect personal information, and inject intrusive code, as they may compromise privacy and degrade system performance. There are three types of adware: Browser, Deceptive, and Malicious. They are not completely malware, but are considered PUP (Potentially Unwanted Program). Using anti-malware software and ad blockers can help prevent adware.

Aggressive profiling is a process of preventing potential attacks by gathering and analysing data about attackers, network threats, and user behaviour. Advanced techniques like artificial intelligence, machine learning, and psychological analysis are used to identify possible threats and user behaviour. In cybersecurity and privacy contexts, aggressive profiling can raise serious concerns when organisations collect more data than necessary or track users without proper consent. This profiling may include device fingerprints, browsing patterns, location tracking, and behavioural analytics. While aggressive profiling can improve personalisation and fraud detection, excessive data aggregation increases the risk of data breaches and regulatory violations. Its key components include tracking identifiers, analytics scripts, and behavioural monitoring systems that analyse user activity patterns over time.

Agile, in cybersecurity, is a project management and software development methodology that embeds security practices directly into the development lifecycle through iterative sprints. It allows faster threat detection, continuous feedback and response to emerging threats. Key aspects of Agile:

• Security is integrated into every stage.
• Iterative testing.
• Promote DevSecOps.
• Automated security tool in the CI/CD pipeline.
• Adaptable to different frameworks and faster results.

In cybersecurity, Agile practices enable security testing and vulnerability management to be integrated continuously throughout the development lifecycle. Instead of addressing security at the end of development, Agile encourages frequent testing, rapid patching, and adaptive threat response. Agile works through short development cycles called sprints, continuous feedback loops, and cross-functional teamwork. Key characteristics include incremental releases, continuous integration, DevSecOps practices, and proactive risk mitigation within evolving software environments.

AI-Driven security refers to the use of artificial intelligence and machine learning to detect, prevent, and respond to cyber threats in real-time. It is faster than manual detection and reduces reliance on humans for threat identification. AI systems analyse large volumes of data to identify suspicious patterns, anomalies, and emerging attack techniques faster than traditional rule-based systems. This approach enhances threat detection, malware classification, and fraud prevention. AI-driven security works through behavioural analysis, predictive modelling, and automated threat response. Key components include machine learning algorithms, anomaly detection engines, data training models, and real-time monitoring systems that continuously adapt to new threats.

An allowlist (also known as a whitelist) is a cybersecurity control mechanism that permits only pre-approved entities to access a system or execute actions. The purpose of the Allowlist is to reduce the attack surface by preventing unauthorised execution. Instead of blocking known threats, allowlisting follows a “default deny” approach where only trusted applications, IP addresses, or users are allowed. Allowlist works by maintaining a verified database of approved entities. Its key characteristics are the following:

• Strict access policies.
• Application control mechanisms.
• Reduced exposure to unknown malware.
• Improve compliance and best practices.

The challenge that comes with an allowlist is high maintenance requirements, which cause productivity issues.

Anomaly detection means identifying unusual behaviours and patterns that deviate from normal system and user activity. This practice helps in detecting unknown or emerging threats whose patterns are different from previous signatures. It used techniques like behavioural analysis, statistical models, or machine learning to establish a baseline and flag deviations such as unusual logins or transactions. In cyber security, it helps in detecting network intrusions, unauthorised access, or insider threats. Anomalies can be point anomalies, collective anomalies, and contextual anomalies.

test glossary

Anti-emulator techniques are used to detect and prevent apps from running in emulators (virtual environment) instead of real physical devices. Emulators are usually used by testers to test apps in a computer by creating virtual devices without needing multiple physical devices. But it is also used by attackers to replicate mobile or computer devices, increase fraudulent activities ‘like reverse engineering and bypass security control, bypassing logins, etc.) without physical devices and remain hidden in virtual environments. Blocking apps to run in an emulator helps in protecting from risk of large scale frauds and analysis. In mobile applications, anti-emulators help in preventing apps from running in emulators and prevent unauthorised testing, bot-driven attacks, runtime manipulation, etc.

Anti-debugging is a security mechanism to detect and prevent debugging tools to analyse application execution. Debugging tools are used by attackers to analyse and inspect app code, bypass controls and unauthorised access to sensitive data. To protect app from debugging, common anti-debugging techniques involves:

• Runtime protection: App must detect and prevent running in debugging environment.
• Code obfuscation: Obfuscating code to make it harder to decrypt and decipher.
• Root detection: Apps must detect rooted or jailbroken devices. This indicates that attackers are trying to modify the app.
• Anti-debugging hardware breakpoint: It is an anti-debugging technique to insert a break point at a certain point in the code which prevents attackers from running the code or reading its content.