Security Glossary

Access control is a mechanism that restricts who can access specific resources or perform certain actions within a system. It verifies user identification, authentication and grants permission accordingly to protect sensitive data and prevent breaches. Common models include Role-Based Access Control (RBAC) and Attribute-based Access Control (ABAC). Weak access control leads to data breaches and privilege escalation attacks. Key components of access control:

• Authentication: Verifies users’ authentication (such as passwords, multi-factor authentication, and biometric scans).
• Authorisation: It is the process of defining and enforcing permissions to specific users for specific data access and actions.
• Access: Allowing or denying entry to data or a system based on policies.
• Management: Adding/removing user permissions and maintaining access policies.
• Audit: Monitoring access logs to ensure compliance and detect unauthorised access.

Access management is a cyber security control used by organisations and businesses to control and monitor user access to systems, applications, and cloud-based services. It ensures that only authorised individuals can access certain resources based on its identity, role, and organisation’s policy. It helps in protecting sensitive assets by verifying identities via authentication and granting permissions. It is a key component of Identity and Access Management (IAM). Common tools used in access management are Multi-Factor Authentication (MFA), Single Sign-On (SSO), and Identity as a Service (IDaaS). Effective access management enhances security, regulatory compliance, operational efficiency, and reduces cyber risks.

Accessibility service is a feature of the Android system that assists users with disabilities to use mobile phones and apps by allowing the apps to observe and interact with user interface elements. This provides auditory, haptic, and visual feedback. Besides its benefits to disabled people, this feature can be abused by malicious applications to capture screen content, log keystrokes, or perform unauthorised actions. To prevent accessibility service risks, users shouldn’t grant accessibility permissions to unknown apps; the app must block unauthorised access and adopt security models into the development lifecycle of the app.

Account takeover (ATO) is a type of cyberattack in which an attacker tries to control your digital account (banking or other) by gaining unauthorised access to steal sensitive personal information (email, account, social media, passwords, etc.), impersonate or commit financial fraud. This can be executed by methods like phishing, credential stuffing, malware, or session hijacking. This is a common attack in the financial, e-commerce sector and mobile apps. You can identify an ATO attack if there is a login from an unusual geographic location, multiple failed login attempts, an unknown change to the password or details, receipt of login or password reset OTP, or a high-volume transaction, etc. To prevent account takeover, awareness and proper account management is very important. Secondly, multi-factor authentication makes it harder for attackers to bypass security. Behavioural monitoring, sandboxing, and integrating runtime application self-protection in the app are helpful security techniques to prevent account takeover attacks.

Advanced Encryption Standard (AES) or Rijndael, established by the National Institute of Standards and Technology (NIST) in 2001, is a symmetric block cipher algorithm widely adopted to secure sensitive data. AES encrypts data in fixed-size 128 bits blocks using key lengths of 128, 192, or 256 bits. It is considered highly secure and is commonly used in banking systems, secure communications, and mobile applications for data encryption. AES in Cybersecurity:

• It used a fixed-size block of data using the same key for both encryption and decryption.
• The number of rounds depends on the key size: 10 rounds for 128-bit, 12 for 192-bit and 14 for 256-bit keys. 14 rounds are usually for highly sensitive information, and AES makes it highly complex.
• Each round has some steps of encryption and decryption, including SubBytes (substitution), ShiftRows (permutation), MixColumns (mixing), and AddRoundKey (key XORing).
• It is efficient for both hardware and software.

Advanced obfuscation is a technique used to make application code more complex and difficult to analyse or reverse engineer. It transforms readable code into a functionally equivalent form, but makes it harder for attackers to interpret. These codes function normally but are unreadable to humans and automated scanners. Techniques used in advanced obfuscation:

• Control flow obfuscation.
• String/data encryption.
• Packing and encoding.
• Code virtualisation and dynamic loading.

Advanced obfuscation protects intellectual property and sensitive logic within applications. However, it must be implemented carefully, as poorly configured obfuscation can impact performance or application stability. Bugsmirror Shield is an advanced code obfuscation tool that transforms or encrypts code into such a form which becomes hard for attackers to decipher or decrypt it.

Advanced Persistent Threat (APT) is a prolonged cyberattack in which attackers conduct a well-researched, long-term, targeted campaign to steal data or sabotage mobile apps. This attack involves highly skilled attackers who infiltrate a system and remain undetected for extended periods. APTs require well-funded groups and highly technical groups seeking sensitive information, intellectual property, or strategic advantage. These attacks use multiple techniques, including phishing, zero-day exploits, and lateral movement within networks. These threats are difficult to detect and need a comprehensive security solution to prevent them. To detect it, keep an eye on unauthorised logins, unexpected and unusual network traffic, the presence of unknown files and data, etc. Continuous monitoring, network segmentation, and threat intelligence are essential to mitigate APTs.

Advanced root detection refers to a multi-layered technique used to identify whether a mobile device or a system is rooted or compromised. This is an important technique for the security of apps handling sensitive data, as rooted environments weaken built-in platform security controls and increase exposure to runtime attacks. Rooted devices bypass standard operating system restrictions, increasing the risk of tampering, data extraction, and malware execution. Key components of advanced root detection include searching for su binaries, identifying hooking frameworks such as Frida or Xposed, verifying device integrity, and using native libraries (e.g., C/C++) to detect rooted environments. Advanced root detection alone can be bypassed by using tools like Magsik (a root-hiding tool), native code hooking to evade detection algorithms, and mimicking a stock or secure environment, thus a comprehensive runtime solution like Bugsmirror Defender is necessary for business apps.

Adware (Advertising-supported software) is a type of malicious or unwanted software that displays or downloads advertisements on a user’s device without consent to generate revenue. This can be displayed in the form of pop-ups, banners, or browser ads. Key Aspects of Adware: These ads are random- basically just annoying, and the main goal is to generate revenue for developers by forcing users to watch ads often by hijacking a website, changing the homepage or redirecting users to an ad page. However, they contain malware and track user behaviour, collect personal information, and inject intrusive code, as they may compromise privacy and degrade system performance. There are three types of adware: Browser, Deceptive, and Malicious. They are not completely malware, but are considered PUP (Potentially Unwanted Program). Using anti-malware software and ad blockers can help prevent adware.

Aggressive profiling is a process of preventing potential attacks by gathering and analysing data about attackers, network threats, and user behaviour. Advanced techniques like artificial intelligence, machine learning, and psychological analysis are used to identify possible threats and user behaviour. In cybersecurity and privacy contexts, aggressive profiling can raise serious concerns when organisations collect more data than necessary or track users without proper consent. This profiling may include device fingerprints, browsing patterns, location tracking, and behavioural analytics. While aggressive profiling can improve personalisation and fraud detection, excessive data aggregation increases the risk of data breaches and regulatory violations. Its key components include tracking identifiers, analytics scripts, and behavioural monitoring systems that analyse user activity patterns over time.

Agile, in cybersecurity, is a project management and software development methodology that embeds security practices directly into the development lifecycle through iterative sprints. It allows faster threat detection, continuous feedback and response to emerging threats. Key aspects of Agile:

• Security is integrated into every stage.
• Iterative testing.
• Promote DevSecOps.
• Automated security tool in the CI/CD pipeline.
• Adaptable to different frameworks and faster results.

In cybersecurity, Agile practices enable security testing and vulnerability management to be integrated continuously throughout the development lifecycle. Instead of addressing security at the end of development, Agile encourages frequent testing, rapid patching, and adaptive threat response. Agile works through short development cycles called sprints, continuous feedback loops, and cross-functional teamwork. Key characteristics include incremental releases, continuous integration, DevSecOps practices, and proactive risk mitigation within evolving software environments.

AI-Driven security refers to the use of artificial intelligence and machine learning to detect, prevent, and respond to cyber threats in real-time. It is faster than manual detection and reduces reliance on humans for threat identification. AI systems analyse large volumes of data to identify suspicious patterns, anomalies, and emerging attack techniques faster than traditional rule-based systems. This approach enhances threat detection, malware classification, and fraud prevention. AI-driven security works through behavioural analysis, predictive modelling, and automated threat response. Key components include machine learning algorithms, anomaly detection engines, data training models, and real-time monitoring systems that continuously adapt to new threats.

An allowlist (also known as a whitelist) is a cybersecurity control mechanism that permits only pre-approved entities to access a system or execute actions. The purpose of the Allowlist is to reduce the attack surface by preventing unauthorised execution. Instead of blocking known threats, allowlisting follows a “default deny” approach where only trusted applications, IP addresses, or users are allowed. Allowlist works by maintaining a verified database of approved entities. Its key characteristics are the following:

• Strict access policies.
• Application control mechanisms.
• Reduced exposure to unknown malware.
• Improve compliance and best practices.

The challenge that comes with an allowlist is high maintenance requirements, which cause productivity issues.

Android is an open-source mobile operating system developed by Google for smartphones, tablets, and other devices. Android’s open ecosystem allows flexibility and customisation, but also introduces security challenges. Due to its global adoption, Android is a frequent target for malware, phishing, and application tampering attacks. Android security operates through sandboxing, application permissions, secure boot processes, and cryptographic signing.

Android App Bundle is the official publishing format for Android applications used by Google for distributing Android applications through Google Play. It is a file format (.aab) that contains all the compiled code and resources of an app, allowing Google Play to generate and deliver Optimised APKs tailored to each user’s device configuration (such as language, screen size, and architecture). This reduces app download size, thus helping to improve performance. Why does it matter? In mobile app security, integrating app shielding solutions with AAB files offers robust protection to apps from runtime threats such as reverse engineering and tampering. Bugsmirror offers effective solutions for protecting mobile applications from threats like debugging and repackaging, ensuring integrity and secure deployments across production releases.

Android security refers to the set of the practices, technologies, and controls that are followed to protect Android-based devices and applications from cyber threats like unauthorised access, data breaches, tampering, etc. Android is the widely used operating system, making it a major target for attacks, plus it is an open source OS whose codes are available to common people. For android security, techniques like sandboxing, permission controls, secure boot, encryption, and app signing are used. With this, secure coding practices, regular vulnerability testing and runtime protection is also important. For mobile app security, robust android security is crucial for protecting apps from reverse engineering, tampering, malware, insecure environment, data handling etc.

Anomaly detection means identifying unusual behaviours and patterns that deviate from normal system and user activity. This practice helps in detecting unknown or emerging threats whose patterns are different from previous signatures. It used techniques like behavioural analysis, statistical models, or machine learning to establish a baseline and flag deviations such as unusual logins or transactions. In cyber security, it helps in detecting network intrusions, unauthorised access, or insider threats. Anomalies can be point anomalies, collective anomalies, and contextual anomalies.

Anti-emulator techniques are used to detect and prevent apps from running in emulators (virtual environment) instead of real physical devices. Emulators are usually used by testers to test apps in a computer by creating virtual devices without needing multiple physical devices. But it is also used by attackers to replicate mobile or computer devices, increase fraudulent activities ‘like reverse engineering and bypass security control, bypassing logins, etc.) without physical devices and remain hidden in virtual environments. Blocking apps to run in an emulator helps in protecting from risk of large scale frauds and analysis. In mobile applications, anti-emulators help in preventing apps from running in emulators and prevent unauthorised testing, bot-driven attacks, runtime manipulation, etc.

Anti-code injections are technologies, coding practices and security measures that prevent attackers from inserting malicious code into app code. Malicious code injection can allow authorised access, expose sensitive data, and compromise application logic. Anti-code injection requires strict input validation, secure coding practices, prepared queries, and runtime protections to block unauthorised code execution. In mobile applications, anti-code injection safeguards APIs, local processes, and runtime environments from manipulation, ensuring that only trusted code is executed.

Anti-debugging is a security mechanism to detect and prevent debugging tools to analyse application execution. Debugging tools are used by attackers to analyse and inspect app code, bypass controls and unauthorised access to sensitive data. To protect app from debugging, common anti-debugging techniques involves:

• Runtime protection: App must detect and prevent running in debugging environment.
• Code obfuscation: Obfuscating code to make it harder to decrypt and decipher.
• Root detection: Apps must detect rooted or jailbroken devices. This indicates that attackers are trying to modify the app.
• Anti-debugging hardware breakpoint: It is an anti-debugging technique to insert a break point at a certain point in the code which prevents attackers from running the code or reading its content.

Anti-debugging is a security mechanism to detect and prevent debugging tools from analysing application execution. Debugging tools are used by attackers to analyse and inspect app code, bypass controls and unauthorised access to sensitive data. To protect app from debugging, common anti-debugging techniques involves:

• Runtime protection: App must detect and prevent running in debugging environment.
• Code obfuscation: Obfuscating code to make it harder to decrypt and decipher.
• Root detection: Apps must detect rooted or jailbroken devices. This indicates that attackers may be trying to modify the app.
• Anti-debugging hardware breakpoint: It is an anti-debugging technique to insert a break point at a certain point in the code which prevents attackers from running the code or reading its content.

Bugsmirror APILock is an API security testing tool that provides advanced automated APIs scanning. It interacts with applications' workflow, captures live APIs, including hidden and shadow APIs for detailed assessment. APIs are examined thoroughly to ensure that sensitive information may not get exposed or misused. It uses advanced network interception techniques to uncover misconfigurations, access control flaws, and sensitive data leaks. This process helps secure your app's communication layer by detecting hidden flaws and improper data handling that attackers could exploit. Bugsmirror APILock provides detailed and well-structured reports that clearly list discovered API endpoints, identified risks, potential exploit scenarios, and practical remediation steps. It not only points out issues, but also supports the team in resolving them properly and building stronger API security over time.