Glossary

A

AI SAST

This is an AI-powered static application security testing  used by Fluid Attacks in its Continuous Hacking  Advanced plan . AI SAST quickly and accurately assesses an application’s source code through multi-file analysis to understand its context and detect high-risk security vulnerabilities that simple scanners often overlook.

B

Black box

The black box is a service where the pentester does not have access to source code or information on the project’s infrastructure, having only access to IPs and URLs associated with environments where the project is deployed.

C

CI/CD pipeline

A CI/CD pipeline is a series of organized steps or tasks that, mainly in an automated way, allow the successful and fast release of a new software version. Among the activities that take place are the compilation of the source code, the distribution of packages, the execution of quality and security tests and the deployment to different environments.

Cloud security posture management (CSPM)

CSPM  is a set of practices for monitoring and managing security configurations and compliance with standards across cloud resources. It assesses IaC scripts, container images and cloud environments and services to identify misconfigurations, policy violations and other security issues.

Continuous deployment (CD)

The CD is a process that follows the CI. When merged, the different code changes made by developers shape a software product that can be deployed in a test or production environment. Automated procedures are executed to build the product, verify that it meets acceptance requirements and perform a proper deployment at the expected time, often directly to the end users.

Continuous integration (CI)

The CI is a practice in which a development team constantly uploads changes, either additions or removals, to a central repository. Automated procedures are run each time to validate that the modifications made to the code meet predefined requirements and to ensure that they integrate smoothly into the software.

CVSS

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to the risks. Scores are calculated based on a formula that depends on several metrics that approximate the ease and impact of exploitation. Scores range from 0 to 10, with 10 being the most severe.

CVSSF

The CVSSF  is a metric generated by Fluid Attacks by modifying the CVSS metric, which shows the level of risk exposure represented by the vulnerabilities in your system.

D

Dynamic application security testing (DAST)

DAST  is a security testing technique for detecting security vulnerabilities in an application. It assesses the running software without accessing its source code by using various attack vectors in search of unexpected behavior and weaknesses related to its deployment configuration, data and business logic. This technique is used in Fluid Attacks’ Continuous Hacking .

F

False negative

A false negative is an erroneous report indicating that a vulnerability does not exist or is absent. For information on how to report one, refer to the page False negatives .

False positive

A false positive is an erroneous alert indicating that a vulnerability is present. For information on how to report one, refer to the page False positives .

H

Health Check

Health Check is part of Fluid Attacks’ Continuous Hacking solution and consists of performing PTaaS , secure code review and reverse engineering  on the software the client developed before purchasing the Advanced plan.

M

Mailmap

Mailmap  is a table on Fluid Attacks’ platform that organizes and unifies the different email addresses and names employed by the authors or contributors.

P

Penetration testing as a service (PTaaS)

PTaaS  is a cybersecurity assessment method in which skilled human testers (aka ethical hackers or pentesters) actively and continuously simulate real-world cyberattacks on infrastructure, applications, and other IT systems. PTaaS primarily aims to identify and exploit vulnerabilities that are out of reach for automated tools, combining them, even, to find out how big an impact they can have in the evaluated application’s security. This technique is used in Fluid Attacks’ Continuous Hacking .

R

Reachability

Reachability is a characteristic verified by SAST  in which the known vulnerable functions of your application’s direct dependencies are effectively called by your application, thus generating a higher risk of the vulnerability being exploited in the context of your application. The report that a dependency vulnerability is reachable cuts through the noise of potential vulnerabilities and highlights the ones that need immediate attention.

Reverse engineering (RE)

RE  is an outside-in process of deconstructing software for analyzing and understanding its design, structure and functionality in depth. In RE, experts (aka reverse engineers), helped by tools , unravel the source code and its components and functions to discover how that specific technology works and whether it has security issues. This technique is used in Fluid Attacks’ Continuous Hacking .

S

Secure code review (SCR)

SCR is the systematic inspection of source code by human reviewers to identify security flaws and ensure adherence to security standards. This expert analysis often uncovers severe and complex vulnerabilities beyond the capabilities of automated tools alone. This technique is used in Fluid Attacks’ Continuous Hacking .

Software bill of materials (SBOM)

An SBOM is a comprehensive inventory of all components and dependencies, as well as their associated metadata, that make up a software application. Therefore, SBOMs provide insights into a software product’s composition and potential vulnerabilities inherited from third-party code.

Software composition analysis (SCA)

SCA  is a technique for identifying and analyzing third-party components and dependencies in software. Regarding security, SCA assesses libraries, frameworks, and packages to determine their versions and detect vulnerabilities, conflicting licenses and other software quality issues. This technique is used in Fluid Attacks’ Continuous Hacking .

Static application security testing (SAST)

SAST  is a security testing technique for identifying security vulnerabilities in an application’s source code. It examines the non-running code to look for programming patterns, misconfigurations and insecure practices that attackers could exploit. This technique is used in Fluid Attacks’ Continuous Hacking .

T

Target of Evaluation (ToE)

The ToE is the product or system that will be the subject of Fluid Attacks’ security testing. It is mainly defined by adding Git repositories and environments in the Scope section of a group on the Fluid Attacks platform.

W

White box

The white box is a service where the pentester has all the information privileges such as Git repositories, credentials, source code and environments.