Security Glossary

Patch management is a process of identifying, acquiring, testing, and deploying software updates (patches) to fix vulnerabilities, bugs or security weaknesses in systems and applications. Unpatched software can cause cyberattacks. Timely patch management helps close known security gaps before attackers can exploit them. Patch management works by monitoring vulnerabilities, testing updates for stability, and prioritising fixes based on their urgency. In mobile apps, patch management ensures the updation of app frameworks and third-party libraries, reducing the risk of exploitation. Organisations often use automated patch management systems for quick and consistent patching.

Penetration testing is a process by which experts simulate real-world attacks to identify exploitable vulnerabilities. It is performed by ethical hackers to reveal weaknesses before a malicious actor. Penetrating testing includes API testing, data storage and runtime protection testing. There are three types of penetration testing:

• Black box: In this case, the infrastructure is completely unknown to testers, and they don't have access to it.
• White Box: In this scenario, testers have full knowledge and access to the system.
• Grey Box: This is a hybrid approach with limited knowledge of the device, and they simulate insider threats.

A comprehensive test report helps in identifying gaps, risk severity, technical insights, and remedies to prevent them. Regular penetrating testing is essential to strengthen the overall security posture and compliance.

Phishing is a type of cyber fraud where attackers use psychological tactics to trick users into revealing sensitive information such as passwords, OTP, or banking credentials. In this attack, attackers impersonate reputable institutions via email, text or phone to steal sensitive data. Phishing is executed by following common tactics:

• Using disguised or misspelt URLs.
• Claiming your account has been compromised or suspended to force immediate action.
• Make fake email addresses or websites that look identical to genuine ones.
• Nowadays, attackers also use AI voice generators, chatbots and malicious QR codes.

To protect yourself from phishing, always check URLs and links before opening, check spelling and grammatical errors, verify sources before submitting sensitive information, and implement MFA (multi-factor authentication).