Glossary
Application security terms, defined plainly
About this page
Definitions of the security terms used across this site — penetration testing, VAPT, BOLA, IDOR, OWASP MASVS and ASVS, threat modelling, STRIDE, CVSS, SAST and DAST — written so a non-specialist can use them correctly in a scoping conversation.
- Penetration test
- An authorised, simulated attack on a system performed by a person, intended to prove which weaknesses are exploitable and what an attacker reaches through them.
- Vulnerability assessment
- A largely automated review that lists known weaknesses across a system without proving whether each one can be exploited in context.
- VAPT
- Vulnerability Assessment and Penetration Testing: a combined engagement pairing broad automated coverage with narrow manual exploitation, commonly required by Indian compliance frameworks.
- BOLA
- Broken Object Level Authorisation: an API flaw where an authenticated user can access another user's records by changing an identifier, because ownership is never checked server side.
- IDOR
- Insecure Direct Object Reference: the web-application name for the same flaw as BOLA — a reference to an object that is not validated against the requester's permissions.
- OWASP MASVS
- The Mobile Application Security Verification Standard: OWASP's control set defining what a secure Android or iOS application must do, at two verification levels plus a resilience set.
- OWASP ASVS
- The Application Security Verification Standard: OWASP's catalogue of web application security requirements, used to define and evidence test coverage at a chosen level.
- Threat modelling
- A structured design-stage analysis that maps data flows and trust boundaries, enumerates how components can be abused, and ranks the controls worth building.
- STRIDE
- A threat classification covering Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege, applied element by element during threat modelling.
- CVSS
- The Common Vulnerability Scoring System: a standard method for rating vulnerability severity from 0 to 10, based on exploitability and impact characteristics.
- CWE
- Common Weakness Enumeration: a catalogue of software weakness types used to classify the underlying cause of a finding rather than its instance.
- Certificate pinning
- A mobile and client-side control that accepts only a specific certificate or public key for a host, preventing interception by a locally installed trusted certificate.
- Mass assignment
- A flaw where an endpoint binds an entire request body to a data model, letting an attacker set privileged fields such as role or balance that the client never displays.
- SAST
- Static Application Security Testing: analysis of source code without executing it, useful for coverage and pattern detection, and requiring human triage to be usable.
- DAST
- Dynamic Application Security Testing: automated testing of a running application from the outside, effective for known issue classes and blind to business-logic flaws.
- Retest
- A short verification engagement confirming that reported findings were actually closed by the fixes deployed, producing the report version shared with customers and auditors.
- Rules of engagement
- The written agreement fixing what may be tested, when, by which methods, and who to contact — the document that makes a penetration test lawful and safe.
- Attestation letter
- A short signed statement confirming that a named system was tested on a given date to a stated methodology, shareable with customers who may not receive the full report.
Want this tested properly?
Scope and a fixed quote within two working days. First consultation is free.