{ "terms": [ { "id": "phishing", "term_en": "Phishing", "term_zh": "網路釣魚", "definitions": { "brief": "透過偽造信件或網站騙取敏感資訊的攻擊手法", "standard": "網路釣魚是一種社交工程攻擊，攻擊者偽裝成可信賴的實體，\n透過電子郵件、即時通訊或假網站誘騙受害者\n提供帳號密碼、信用卡號等敏感資訊。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "電子郵件", "詐騙" ], "related_terms": [ "spear_phishing", "whaling", "bec" ], "aliases": { "zh": [ "釣魚攻擊", "網釣" ] } }, { "id": "spear_phishing", "term_en": "Spear Phishing", "term_zh": "魚叉式釣魚", "definitions": { "brief": "針對特定個人或組織的客製化釣魚攻擊", "standard": "魚叉式釣魚是高度客製化的釣魚攻擊，攻擊者事先研究目標，\n製作針對性的釣魚內容，使其更具可信度和欺騙性，\n常用於 APT 攻擊的初始入侵階段。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "針對性攻擊", "APT" ], "related_terms": [ "phishing", "apt", "whaling" ], "aliases": { "zh": [ "針對式釣魚", "定向釣魚" ] } }, { "id": "whaling", "term_en": "Whaling", "term_zh": "捕鯨攻擊", "definitions": { "brief": "針對高階主管的釣魚攻擊", "standard": "捕鯨攻擊專門針對企業高階主管（如 CEO、CFO），\n利用其較高的權限和決策能力，達成大額詐騙或取得機敏資訊。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "高階主管", "BEC" ], "related_terms": [ "spear_phishing", "bec" ], "aliases": {} }, { "id": "vishing", "term_en": "Vishing", "term_zh": "語音釣魚", "definitions": { "brief": "透過電話進行的釣魚詐騙攻擊", "standard": "語音釣魚透過電話進行社交工程攻擊，\n攻擊者假冒銀行、政府機關等身分，\n誘騙受害者提供敏感資訊或進行轉帳。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "電話詐騙" ], "related_terms": [ "phishing", "smishing" ], "aliases": {} }, { "id": "smishing", "term_en": "Smishing", "term_zh": "簡訊釣魚", "definitions": { "brief": "透過簡訊進行的釣魚攻擊", "standard": "簡訊釣魚透過手機簡訊發送惡意連結或詐騙訊息，\n誘導受害者點擊連結、下載惡意程式或提供個資。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "簡訊", "行動裝置" ], "related_terms": [ "phishing", "vishing" ], "aliases": {} }, { "id": "bec", "term_en": "BEC", "term_zh": "商業電子郵件詐騙", "definitions": { "brief": "冒充企業主管或合作夥伴進行詐騙的攻擊", "standard": "商業電子郵件詐騙是針對企業的詐騙攻擊，\n攻擊者冒充 CEO、供應商或合作夥伴，\n誘騙財務人員進行大額匯款或洩露機密資訊。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "詐騙", "財務" ], "related_terms": [ "spear_phishing", "whaling" ], "aliases": {} }, { "id": "social_engineering", "term_en": "Social Engineering", "term_zh": "社交工程", "definitions": { "brief": "利用人性弱點操縱受害者的攻擊手法", "standard": "社交工程是透過心理操縱而非技術手段來欺騙受害者的攻擊方式，\n利用信任、恐懼、好奇心等人性弱點，誘使目標執行特定行動或洩露資訊。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "心理操縱", "人因安全" ], "related_terms": [ "phishing", "pretexting" ], "aliases": {} }, { "id": "ddos", "term_en": "DDoS", "term_zh": "分散式阻斷服務攻擊", "definitions": { "brief": "利用大量流量癱瘓目標服務的攻擊", "standard": "分散式阻斷服務攻擊透過控制大量電腦或 IoT 裝置，\n同時向目標發送大量請求，使其無法正常提供服務。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "可用性", "殭屍網路", "流量攻擊" ], "related_terms": [ "botnet", "dos" ], "aliases": {} }, { "id": "mitm", "term_en": "MITM", "term_zh": "中間人攻擊", "definitions": { "brief": "攻擊者攔截並可能篡改雙方通訊的攻擊", "standard": "中間人攻擊中，攻擊者秘密攔截通訊雙方的資料傳輸，\n可以竊聽、篡改或注入惡意內容，雙方通常不知情。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "網路攻擊", "竊聽", "篡改" ], "related_terms": [ "arp_spoofing", "ssl_stripping" ], "aliases": { "en": [ "Man-in-the-Middle", "MITM Attack" ] } }, { "id": "dns_spoofing", "term_en": "DNS Spoofing", "term_zh": "DNS 欺騙", "definitions": { "brief": "竄改 DNS 回應將使用者導向惡意網站", "standard": "DNS 欺騙透過竄改 DNS 查詢回應，\n將使用者導向攻擊者控制的惡意網站，\n常用於釣魚攻擊或惡意程式散播。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "DNS", "網路攻擊" ], "related_terms": [ "dns_hijacking", "pharming" ], "aliases": { "zh": [ "DNS 劫持" ] } }, { "id": "credential_stuffing", "term_en": "Credential Stuffing", "term_zh": "憑證填充攻擊", "definitions": { "brief": "使用外洩帳密批量嘗試登入其他服務", "standard": "憑證填充攻擊使用從其他網站外洩的帳號密碼組合，\n自動化嘗試登入目標服務，利用使用者重複使用密碼的習慣。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "暴力破解", "帳號安全", "自動化" ], "related_terms": [ "brute_force", "password_spraying" ], "aliases": {} }, { "id": "brute_force", "term_en": "Brute Force", "term_zh": "暴力破解", "definitions": { "brief": "透過嘗試所有可能組合來破解密碼的攻擊", "standard": "暴力破解透過系統性地嘗試所有可能的密碼組合，\n直到找到正確密碼為止。現代多使用字典檔或規則產生器加速。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "密碼攻擊", "自動化" ], "related_terms": [ "credential_stuffing", "password_spraying" ], "aliases": {} }, { "id": "supply_chain_attack", "term_en": "Supply Chain Attack", "term_zh": "供應鏈攻擊", "definitions": { "brief": "透過入侵軟體供應商來攻擊最終用戶的手法", "standard": "供應鏈攻擊針對軟體開發或發布流程中的弱點，\n將惡意程式植入合法軟體更新中，\n透過正常更新機制散播給所有使用者。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "進階攻擊", "軟體安全", "第三方風險" ], "related_terms": [ "apt", "backdoor" ], "aliases": {} }, { "id": "watering_hole", "term_en": "Watering Hole Attack", "term_zh": "水坑攻擊", "definitions": { "brief": "入侵目標常訪問的網站來感染受害者", "standard": "水坑攻擊先分析目標群體常訪問的網站，\n入侵這些網站並植入惡意程式，\n當目標訪問時即遭感染，常見於 APT 攻擊。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "APT", "網站入侵", "針對性" ], "related_terms": [ "apt", "drive_by_download" ], "aliases": {} }, { "id": "zero_day", "term_en": "Zero-Day", "term_zh": "零日漏洞", "definitions": { "brief": "尚未有修補程式的漏洞", "standard": "零日漏洞是指廠商尚未知曉或尚未發布修補程式的安全漏洞，\n攻擊者可利用此類漏洞進行攻擊，防禦方幾乎沒有防護時間。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "漏洞", "高價值", "APT" ], "related_terms": [ "exploit", "vulnerability" ], "aliases": { "en": [ "0-day", "Zero Day" ], "zh": [ "0day 漏洞" ] } }, { "id": "lateral_movement", "term_en": "Lateral Movement", "term_zh": "橫向移動", "definitions": { "brief": "攻擊者在網路內部從一台主機移動到另一台的行為", "standard": "橫向移動是攻擊者取得內網立足點後，\n利用竊取的憑證或漏洞存取其他系統，\n逐步接近最終目標的過程。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "後滲透", "內網", "APT" ], "related_terms": [ "privilege_escalation", "credential_theft" ], "aliases": {} }, { "id": "privilege_escalation", "term_en": "Privilege Escalation", "term_zh": "權限提升", "definitions": { "brief": "攻擊者取得更高系統權限的技術", "standard": "權限提升是攻擊者從低權限帳號取得更高權限（如管理員或 root）的過程，\n分為本地權限提升和垂直權限提升。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "後滲透", "權限", "系統" ], "related_terms": [ "lateral_movement", "lpe" ], "aliases": {} }, { "id": "data_exfiltration", "term_en": "Data Exfiltration", "term_zh": "資料外洩", "definitions": { "brief": "攻擊者將竊取的資料傳送出目標網路", "standard": "資料外洩是攻擊者將竊取的機密資料傳送到外部伺服器的過程，\n可能使用 HTTP、DNS、加密通道等方式規避偵測。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "後滲透", "資料竊取", "APT" ], "related_terms": [ "c2", "data_breach" ], "aliases": {} }, { "id": "persistence", "term_en": "Persistence", "term_zh": "持久化", "definitions": { "brief": "攻擊者維持對受害系統長期存取權的技術", "standard": "持久化是攻擊者確保即使系統重啟或被部分清除後，\n仍能保持對受害系統存取權的技術，\n常用方法包括修改開機程式、植入後門等。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "後滲透", "APT", "後門" ], "related_terms": [ "backdoor", "rootkit" ], "aliases": {} }, { "id": "drive_by_download", "term_en": "Drive-by Download", "term_zh": "路過式下載", "definitions": { "brief": "使用者僅瀏覽網頁即被自動下載惡意程式", "standard": "路過式下載攻擊利用瀏覽器或外掛程式漏洞，\n使用者只需瀏覽惡意或被入侵的網頁，\n即會在不知情的情況下自動下載並執行惡意程式。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "網頁攻擊", "漏洞利用", "惡意程式" ], "related_terms": [ "watering_hole", "exploit_kit" ], "aliases": {} }, { "id": "typosquatting", "term_en": "Typosquatting", "term_zh": "網域名稱搶註", "definitions": { "brief": "註冊與知名網站相似的網域來欺騙使用者", "standard": "網域名稱搶註是註冊與合法網站名稱相似的網域（如拼寫錯誤），\n當使用者輸入錯誤網址時會進入攻擊者網站，\n可能遭受釣魚攻擊或下載惡意程式。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "網域", "釣魚", "冒充" ], "related_terms": [ "phishing", "domain_hijacking" ], "aliases": { "en": [ "URL Hijacking", "Domain Squatting" ], "zh": [ "網址劫持", "域名搶註" ] } }, { "id": "session_hijacking", "term_en": "Session Hijacking", "term_zh": "會話劫持", "definitions": { "brief": "竊取使用者的會話令牌以冒充其身分", "standard": "會話劫持是攻擊者竊取使用者的 Session ID 或 Cookie，\n藉此接管使用者的登入狀態，無需帳密即可存取帳戶，\n常透過 XSS、網路竊聽或惡意程式取得。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "網頁攻擊", "身分冒充", "Cookie" ], "related_terms": [ "xss", "mitm", "csrf" ], "aliases": {} }, { "id": "cryptojacking", "term_en": "Cryptojacking", "term_zh": "挖礦劫持", "definitions": { "brief": "未經授權使用他人電腦資源挖掘加密貨幣", "standard": "挖礦劫持是攻擊者在受害者電腦或網頁中植入挖礦程式，\n未經同意使用其運算資源挖掘加密貨幣，\n導致系統效能下降和電費增加。\n" }, "category": "attack_types", "subcategory": "malware", "tags": [ "加密貨幣", "資源竊取", "惡意程式" ], "related_terms": [ "cryptominer", "malware" ], "aliases": { "zh": [ "加密貨幣劫持" ] } }, { "id": "formjacking", "term_en": "Formjacking", "term_zh": "表單劫持", "definitions": { "brief": "在網站表單中注入惡意程式碼竊取輸入資料", "standard": "表單劫持是攻擊者在電商網站的付款表單中注入惡意 JavaScript，\n當使用者輸入信用卡資訊時，資料會被同時傳送給攻擊者，\n類似數位版的 ATM 側錄器。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "網頁攻擊", "信用卡", "JavaScript" ], "related_terms": [ "xss", "magecart" ], "aliases": { "zh": [ "網頁側錄" ] } }, { "id": "password_spraying", "term_en": "Password Spraying", "term_zh": "密碼噴灑", "definitions": { "brief": "用少量常見密碼嘗試大量帳號的攻擊", "standard": "密碼噴灑與傳統暴力破解相反，使用少量常見密碼（如 Password123）\n嘗試大量帳號，藉此避免觸發帳號鎖定機制。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "密碼攻擊", "帳號安全", "暴力破解" ], "related_terms": [ "brute_force", "credential_stuffing" ], "aliases": {} }, { "id": "kerberoasting", "term_en": "Kerberoasting", "term_zh": "Kerberos 烤肉攻擊", "definitions": { "brief": "利用 Kerberos 協定竊取服務帳號密碼的攻擊", "standard": "Kerberoasting 是針對 Active Directory 環境的攻擊技術，\n攻擊者請求服務票證後離線破解，取得服務帳號密碼，\n常用於內網滲透和權限提升。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "Active Directory", "Kerberos", "內網滲透" ], "related_terms": [ "lateral_movement", "privilege_escalation" ], "aliases": {} }, { "id": "living_off_the_land", "term_en": "Living off the Land", "term_zh": "就地取材攻擊", "definitions": { "brief": "利用系統內建工具進行攻擊以規避偵測", "standard": "就地取材攻擊使用作業系統內建的合法工具（如 PowerShell、WMI），\n執行惡意行為，因不需外部惡意程式，\n較難被傳統防毒軟體偵測。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "規避偵測", "APT", "無檔案" ], "related_terms": [ "fileless_attack", "lolbas" ], "aliases": { "en": [ "LOLBins", "LOTL" ] } }, { "id": "fileless_attack", "term_en": "Fileless Attack", "term_zh": "無檔案攻擊", "definitions": { "brief": "不在硬碟留下惡意檔案的攻擊手法", "standard": "無檔案攻擊僅在記憶體中執行惡意程式碼，\n不在硬碟寫入惡意檔案，透過 PowerShell、WMI 或\n注入合法程序來執行，大幅增加偵測難度。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "規避偵測", "APT", "記憶體" ], "related_terms": [ "living_off_the_land", "memory_injection" ], "aliases": { "zh": [ "無文件攻擊" ] } }, { "id": "arp_spoofing", "term_en": "ARP Spoofing", "term_zh": "ARP 欺騙", "definitions": { "brief": "偽造 ARP 回應來攔截網路流量", "standard": "ARP 欺騙透過發送偽造的 ARP 訊息，\n將攻擊者的 MAC 位址與目標 IP 綁定，\n使網路流量經過攻擊者設備，實現中間人攻擊。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "網路攻擊", "區域網路", "竊聽" ], "related_terms": [ "mitm", "dns_spoofing" ], "aliases": { "zh": [ "ARP 毒化" ] } }, { "id": "replay_attack", "term_en": "Replay Attack", "term_zh": "重放攻擊", "definitions": { "brief": "截取並重新發送合法通訊資料進行攻擊", "standard": "重放攻擊是攻擊者截取網路中的合法認證資料或交易訊息，\n之後重新發送這些資料來偽造身分或重複執行交易。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "網路攻擊", "認證", "竊聽" ], "related_terms": [ "mitm", "session_hijacking" ], "aliases": {} }, { "id": "clickjacking", "term_en": "Clickjacking", "term_zh": "點擊劫持", "definitions": { "brief": "誘騙使用者點擊隱藏的惡意元素", "standard": "點擊劫持透過將惡意頁面以透明層覆蓋在合法網頁上，\n使用者以為點擊合法元素，實際上是在操作惡意頁面。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "網頁攻擊", "UI 欺騙", "iframe" ], "related_terms": [ "xss", "csrf" ], "aliases": { "en": [ "UI Redressing" ] } }, { "id": "sim_swapping", "term_en": "SIM Swapping", "term_zh": "SIM 卡交換攻擊", "definitions": { "brief": "詐騙電信業者將受害者手機號碼轉移至攻擊者 SIM 卡", "standard": "SIM 卡交換攻擊是攻擊者透過社交工程詐騙電信客服，\n將受害者的手機號碼轉移到自己的 SIM 卡上，\n藉此接收受害者的簡訊驗證碼，繞過 MFA 保護。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "MFA 繞過", "電信詐騙" ], "related_terms": [ "mfa", "smishing" ], "aliases": { "zh": [ "SIM 劫持", "換卡攻擊" ] } }, { "id": "mfa_fatigue", "term_en": "MFA Fatigue", "term_zh": "MFA 疲勞攻擊", "definitions": { "brief": "反覆發送 MFA 推播通知直到受害者誤按允許", "standard": "MFA 疲勞攻擊是攻擊者在取得使用者帳密後，\n持續觸發 MFA 推播通知，直到受害者因疲勞或誤操作而按下允許，\n又稱為「推播轟炸」或「MFA 推播垃圾攻擊」。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "MFA 繞過", "社交工程", "帳號入侵" ], "related_terms": [ "mfa", "credential_stuffing" ], "aliases": { "en": [ "MFA Bombing", "Push Bombing", "MFA Push Spam" ], "zh": [ "MFA 推播轟炸" ] } }, { "id": "quishing", "term_en": "Quishing", "term_zh": "QR 碼釣魚", "definitions": { "brief": "利用惡意 QR 碼進行的釣魚攻擊", "standard": "QR 碼釣魚是將惡意連結嵌入 QR 碼中，\n誘騙使用者掃描後進入釣魚網站或下載惡意程式，\n常見於偽造停車繳費、餐廳菜單等場景。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "釣魚", "QR 碼", "行動裝置" ], "related_terms": [ "phishing", "smishing" ], "aliases": {} }, { "id": "aitm", "term_en": "AiTM", "term_zh": "中間人對手攻擊", "definitions": { "brief": "即時攔截並轉發驗證流程的進階中間人攻擊", "standard": "中間人對手攻擊是進階的中間人攻擊，\n攻擊者在受害者與合法網站之間即時轉發請求，\n可以竊取 Session Cookie 繞過 MFA 保護。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "MFA 繞過", "Session 劫持", "代理" ], "related_terms": [ "mitm", "session_hijacking", "phishing" ], "aliases": { "en": [ "Adversary in the Middle" ] } }, { "id": "dll_hijacking", "term_en": "DLL Hijacking", "term_zh": "DLL 劫持", "definitions": { "brief": "利用 Windows DLL 載入機制執行惡意程式碼", "standard": "DLL 劫持利用 Windows 搜尋 DLL 的順序漏洞，\n將惡意 DLL 放置在程式搜尋路徑中，\n使程式載入惡意 DLL 而非合法 DLL。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "Windows", "持久化", "權限提升" ], "related_terms": [ "persistence", "privilege_escalation" ], "aliases": { "en": [ "DLL Search Order Hijacking", "DLL Side-Loading" ] } }, { "id": "pass_the_hash", "term_en": "Pass-the-Hash", "term_zh": "雜湊傳遞攻擊", "definitions": { "brief": "使用竊取的密碼雜湊值進行身分驗證", "standard": "雜湊傳遞攻擊使用竊取的密碼雜湊值進行 NTLM 驗證，\n無需知道明文密碼即可冒充使用者存取網路資源，\n是 Active Directory 環境中常見的橫向移動技術。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "Active Directory", "橫向移動", "憑證攻擊" ], "related_terms": [ "lateral_movement", "mimikatz", "pass_the_ticket" ], "aliases": { "en": [ "PtH" ] } }, { "id": "pass_the_ticket", "term_en": "Pass-the-Ticket", "term_zh": "票證傳遞攻擊", "definitions": { "brief": "使用竊取的 Kerberos 票證進行身分驗證", "standard": "票證傳遞攻擊使用竊取的 Kerberos 票證（TGT 或服務票證）\n冒充使用者存取網路資源，無需知道密碼或雜湊值。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "Active Directory", "Kerberos", "橫向移動" ], "related_terms": [ "pass_the_hash", "golden_ticket", "kerberoasting" ], "aliases": { "en": [ "PtT" ] } }, { "id": "golden_ticket", "term_en": "Golden Ticket", "term_zh": "黃金票證攻擊", "definitions": { "brief": "偽造 Kerberos TGT 取得網域完全控制權", "standard": "黃金票證攻擊利用竊取的 KRBTGT 帳號雜湊值，\n偽造任意使用者的 Kerberos TGT，\n取得 Active Directory 網域的完全控制權。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "Active Directory", "Kerberos", "網域控制" ], "related_terms": [ "silver_ticket", "pass_the_ticket", "dcsync" ], "aliases": {} }, { "id": "silver_ticket", "term_en": "Silver Ticket", "term_zh": "白銀票證攻擊", "definitions": { "brief": "偽造 Kerberos 服務票證存取特定服務", "standard": "白銀票證攻擊利用竊取的服務帳號雜湊值，\n偽造該服務的 Kerberos 服務票證，\n可存取特定服務而不需接觸網域控制器。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "Active Directory", "Kerberos", "服務存取" ], "related_terms": [ "golden_ticket", "kerberoasting" ], "aliases": {} }, { "id": "dcsync", "term_en": "DCSync", "term_zh": "DCSync 攻擊", "definitions": { "brief": "模擬網域控制器複製取得使用者憑證", "standard": "DCSync 攻擊利用網域複製協定（MS-DRSR），\n假冒網域控制器向真正的 DC 請求密碼資料複製，\n可取得包括 KRBTGT 在內的所有使用者密碼雜湊。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "Active Directory", "憑證竊取", "網域控制" ], "related_terms": [ "golden_ticket", "mimikatz" ], "aliases": {} }, { "id": "dns_tunneling", "term_en": "DNS Tunneling", "term_zh": "DNS 隧道", "definitions": { "brief": "利用 DNS 協定隱蔽傳輸資料", "standard": "DNS 隧道將資料編碼在 DNS 查詢和回應中，\n因 DNS 流量通常不受嚴格審查，\n攻擊者可藉此進行 C2 通訊或資料外洩。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "C2", "規避偵測", "資料外洩" ], "related_terms": [ "c2", "data_exfiltration" ], "aliases": {} }, { "id": "double_extortion", "term_en": "Double Extortion", "term_zh": "雙重勒索", "definitions": { "brief": "同時加密資料和威脅公開外洩資料的勒索策略", "standard": "雙重勒索是現代勒索軟體常用的策略，\n除了加密受害者資料外，還先竊取資料並威脅公開，\n即使受害者有備份也會面臨資料外洩的壓力。\n" }, "category": "attack_types", "subcategory": "ransomware_tactic", "tags": [ "勒索軟體", "資料外洩", "勒索策略" ], "related_terms": [ "ransomware", "data_exfiltration", "triple_extortion" ], "aliases": {} }, { "id": "triple_extortion", "term_en": "Triple Extortion", "term_zh": "三重勒索", "definitions": { "brief": "在雙重勒索基礎上增加第三層壓力的勒索策略", "standard": "三重勒索在雙重勒索基礎上增加額外威脅，\n如對受害者發動 DDoS 攻擊、騷擾客戶或員工、\n或威脅向主管機關檢舉，進一步施壓。\n" }, "category": "attack_types", "subcategory": "ransomware_tactic", "tags": [ "勒索軟體", "DDoS", "勒索策略" ], "related_terms": [ "double_extortion", "ransomware", "ddos" ], "aliases": {} }, { "id": "callback_phishing", "term_en": "Callback Phishing", "term_zh": "回撥式釣魚", "definitions": { "brief": "誘騙受害者主動撥打假客服電話的釣魚攻擊", "standard": "回撥式釣魚透過郵件假冒訂閱通知或發票，\n誘騙受害者撥打假客服電話取消訂閱，\n電話中引導安裝遠端存取軟體或提供機密資訊。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "釣魚", "社交工程", "電話詐騙" ], "related_terms": [ "vishing", "phishing", "bec" ], "aliases": { "en": [ "TOAD", "Telephone-Oriented Attack Delivery" ] } }, { "id": "seo_poisoning", "term_en": "SEO Poisoning", "term_zh": "搜尋引擎毒化", "definitions": { "brief": "操縱搜尋引擎排名將使用者導向惡意網站", "standard": "搜尋引擎毒化是攻擊者使用 SEO 技術，\n讓惡意網站在特定關鍵字搜尋結果中排名靠前，\n誘騙使用者點擊後感染惡意程式或進入釣魚網站。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "搜尋引擎", "惡意廣告", "惡意程式" ], "related_terms": [ "malvertising", "drive_by_download" ], "aliases": {} }, { "id": "dos", "term_en": "DoS", "term_zh": "阻斷服務攻擊", "definitions": { "brief": "癱瘓目標系統使其無法提供正常服務的攻擊", "standard": "阻斷服務攻擊透過大量請求或利用漏洞，\n耗盡目標系統資源使其無法回應正常請求，\n分散式阻斷服務（DDoS）使用多個來源發動攻擊。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "可用性", "流量攻擊", "網路攻擊" ], "related_terms": [ "ddos", "botnet" ], "aliases": {} }, { "id": "credential_theft", "term_en": "Credential Theft", "term_zh": "憑證竊取", "definitions": { "brief": "竊取使用者帳號密碼等驗證資訊的攻擊", "standard": "憑證竊取是指透過各種手法取得使用者的帳號密碼，\n包括釣魚、鍵盤側錄、記憶體擷取等方式，\n竊取的憑證可用於進一步滲透或橫向移動。\n" }, "category": "attack_types", "subcategory": "post_exploitation", "tags": [ "憑證竊取", "後滲透", "橫向移動" ], "related_terms": [ "mimikatz", "phishing", "lateral_movement" ], "aliases": {} }, { "id": "data_breach", "term_en": "Data Breach", "term_zh": "資料外洩事件", "definitions": { "brief": "敏感資料被未授權存取或洩露的安全事件", "standard": "資料外洩是指機密或敏感資料被未授權存取、複製或傳輸，\n可能因駭客攻擊、內部威脅或意外洩露造成，\n可能導致法規裁罰、聲譽損失和財務損失。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "資料外洩", "隱私", "合規" ], "related_terms": [ "data_exfiltration", "gdpr", "ccpa" ], "aliases": {} }, { "id": "malvertising", "term_en": "Malvertising", "term_zh": "惡意廣告", "definitions": { "brief": "透過線上廣告散播惡意程式的攻擊手法", "standard": "惡意廣告是指攻擊者在合法廣告網路中植入惡意廣告，\n使用者瀏覽含有惡意廣告的網頁時可能被感染，\n無需點擊即可透過漏洞利用進行攻擊。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "惡意廣告", "廣告", "路過式下載" ], "related_terms": [ "drive_by_download", "exploit_kit" ], "aliases": {} }, { "id": "pretexting", "term_en": "Pretexting", "term_zh": "藉口攻擊", "definitions": { "brief": "編造虛假情境騙取資訊的社交工程手法", "standard": "藉口攻擊是攻擊者編造可信的虛假情境或身分，\n如假冒 IT 人員、銀行客服、同事等，\n誘騙受害者提供敏感資訊或執行特定操作。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "社交工程", "冒充", "詐騙" ], "related_terms": [ "social_engineering", "phishing", "vishing" ], "aliases": {} }, { "id": "pharming", "term_en": "Pharming", "term_zh": "網域嫁接攻擊", "definitions": { "brief": "將使用者導向假冒網站的攻擊手法", "standard": "網域嫁接透過篡改 DNS 設定或本機 hosts 檔案，\n將使用者在輸入正確網址時導向攻擊者控制的假冒網站，\n比傳統釣魚更難察覺。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "DNS", "網頁攻擊", "詐騙" ], "related_terms": [ "dns_spoofing", "phishing", "dns_hijacking" ], "aliases": {} }, { "id": "dns_hijacking", "term_en": "DNS Hijacking", "term_zh": "DNS 劫持", "definitions": { "brief": "篡改 DNS 查詢結果將流量導向惡意伺服器", "standard": "DNS 劫持是攻擊者透過入侵 DNS 伺服器、\n修改網域註冊資訊或攻擊路由器等方式，\n將特定網域的 DNS 解析結果指向攻擊者控制的 IP。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "DNS", "網路攻擊", "流量劫持" ], "related_terms": [ "dns_spoofing", "pharming" ], "aliases": {} }, { "id": "domain_hijacking", "term_en": "Domain Hijacking", "term_zh": "網域劫持", "definitions": { "brief": "非法取得網域控制權的攻擊", "standard": "網域劫持是攻擊者透過社交工程、\n入侵網域註冊商帳號或利用過期網域，\n非法取得網域的控制權，可進一步發動釣魚或散播惡意程式。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "網域", "帳號入侵", "社交工程" ], "related_terms": [ "typosquatting", "dns_hijacking" ], "aliases": {} }, { "id": "http_response_splitting", "term_en": "HTTP Response Splitting", "term_zh": "HTTP 回應分割", "definitions": { "brief": "在 HTTP 回應中注入惡意標頭的攻擊", "standard": "HTTP 回應分割是透過注入換行字元，\n在 HTTP 回應中插入額外的標頭或內容，\n可用於執行快取毒化、跨站腳本或釣魚攻擊。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "網頁攻擊", "HTTP", "標頭注入" ], "related_terms": [ "crlf_injection", "xss" ], "aliases": {} }, { "id": "memory_injection", "term_en": "Memory Injection", "term_zh": "記憶體注入", "definitions": { "brief": "將惡意程式碼注入執行中程序記憶體的攻擊", "standard": "記憶體注入是將惡意程式碼注入其他程序的記憶體空間，\n在目標程序的上下文中執行，\n常用於規避安全軟體偵測和執行惡意行為。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "記憶體", "程式碼執行", "規避偵測" ], "related_terms": [ "process_injection", "fileless_attack" ], "aliases": {} }, { "id": "defacement", "term_en": "Website Defacement", "term_zh": "網站置換攻擊", "definitions": { "brief": "篡改網站外觀內容的攻擊行為", "standard": "網站置換是攻擊者入侵網站後篡改其內容，\n通常用於宣傳政治訊息、展示駭客技術或損害聲譽，\n是駭客行動主義者常用的攻擊方式。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "網站入侵", "政治動機", "社會運動" ], "related_terms": [ "hacktivist", "sql_injection" ], "aliases": {} }, { "id": "ssl_stripping", "term_en": "SSL Stripping", "term_zh": "SSL 剝離攻擊", "definitions": { "brief": "將加密連線降級為明文連線的中間人攻擊", "standard": "SSL 剝離是攻擊者作為中間人，\n攔截受害者的 HTTPS 請求並改為 HTTP 明文傳輸，\n同時維持與目標伺服器的加密連線以竊取敏感資訊。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "中間人攻擊", "加密", "竊聽" ], "related_terms": [ "mitm", "tls" ], "aliases": {} }, { "id": "obfuscation", "term_en": "Obfuscation", "term_zh": "程式碼混淆", "definitions": { "brief": "故意讓程式碼難以理解以規避偵測的技術", "standard": "程式碼混淆是將程式碼轉換成難以閱讀和分析的形式，\n惡意程式常用此技術規避安全軟體偵測和逆向工程，\n包括字串加密、控制流程扁平化等技術。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "規避偵測", "惡意程式", "程式碼分析" ], "related_terms": [ "stealth", "packer" ], "aliases": {} }, { "id": "process_injection", "term_en": "Process Injection", "term_zh": "行程注入", "definitions": { "brief": "將惡意程式碼注入其他執行中行程的技術", "standard": "行程注入是將惡意程式碼注入合法行程的記憶體空間執行，\n讓惡意行為看似來自合法程式，\n常見技術包括 DLL 注入、行程鏤空等。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "記憶體", "規避偵測", "後滲透" ], "related_terms": [ "memory_injection", "dll_hijacking" ], "aliases": {} }, { "id": "tailgating", "term_en": "Tailgating", "term_zh": "尾隨攻擊", "definitions": { "brief": "跟隨授權人員進入受限區域的物理安全攻擊", "standard": "尾隨攻擊是一種物理安全威脅，攻擊者緊跟在授權人員身後，\n趁門禁開啟時一起進入受限區域，無需自行驗證身分。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "物理安全", "社交工程", "門禁" ], "related_terms": [ "social_engineering", "piggybacking" ], "aliases": { "zh": [ "尾隨入侵" ] } }, { "id": "piggybacking", "term_en": "Piggybacking", "term_zh": "搭便車攻擊", "definitions": { "brief": "經授權人員同意進入受限區域的物理安全攻擊", "standard": "搭便車攻擊與尾隨類似，但攻擊者取得授權人員的同意，\n例如假裝是訪客、維修人員或送貨員，讓人幫忙開門。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "物理安全", "社交工程", "冒充" ], "related_terms": [ "tailgating", "social_engineering" ], "aliases": {} }, { "id": "shoulder_surfing", "term_en": "Shoulder Surfing", "term_zh": "肩窺攻擊", "definitions": { "brief": "透過偷看他人螢幕或鍵盤竊取資訊", "standard": "肩窺攻擊是攻擊者在公共場所偷看他人輸入密碼、PIN 碼，\n或瀏覽機密文件的行為，是低技術但有效的資訊竊取方式。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "物理安全", "密碼竊取", "觀察" ], "related_terms": [ "credential_theft", "social_engineering" ], "aliases": {} }, { "id": "dumpster_diving", "term_en": "Dumpster Diving", "term_zh": "翻垃圾攻擊", "definitions": { "brief": "從廢棄物中搜尋敏感資訊的攻擊手法", "standard": "翻垃圾攻擊是從組織丟棄的垃圾中搜尋有價值的資訊，\n如未妥善銷毀的文件、硬碟或其他包含敏感資料的物品。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "物理安全", "資訊蒐集", "偵察" ], "related_terms": [ "reconnaissance", "social_engineering" ], "aliases": {} }, { "id": "baiting", "term_en": "Baiting", "term_zh": "誘餌攻擊", "definitions": { "brief": "利用好奇心誘使受害者使用惡意裝置", "standard": "誘餌攻擊是將帶有惡意程式的 USB 隨身碟或光碟，\n放置在目標可能會發現的地方，利用好奇心誘使其插入電腦。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "USB", "好奇心", "惡意程式" ], "related_terms": [ "social_engineering", "malware" ], "aliases": {} }, { "id": "rainbow_table_attack", "term_en": "Rainbow Table Attack", "term_zh": "彩虹表攻擊", "definitions": { "brief": "使用預先計算的雜湊值表破解密碼", "standard": "彩虹表攻擊使用預先計算好的雜湊值與明文對照表，\n快速反查密碼雜湊值對應的原始密碼，\n現代系統透過加鹽(salt)來防禦此攻擊。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "密碼破解", "雜湊", "預計算" ], "related_terms": [ "brute_force", "hash" ], "aliases": {} }, { "id": "dictionary_attack", "term_en": "Dictionary Attack", "term_zh": "字典攻擊", "definitions": { "brief": "使用常見密碼清單嘗試破解的攻擊", "standard": "字典攻擊使用預先建立的常見密碼清單進行嘗試，\n比純暴力破解更有效率，因為許多使用者使用常見或簡單的密碼。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "密碼破解", "字典", "自動化" ], "related_terms": [ "brute_force", "password_spraying" ], "aliases": {} }, { "id": "birthday_attack", "term_en": "Birthday Attack", "term_zh": "生日攻擊", "definitions": { "brief": "利用機率論攻擊雜湊函數的碰撞攻擊", "standard": "生日攻擊基於生日悖論原理，在有限的樣本空間中，\n找到兩個不同輸入產生相同雜湊值(碰撞)的機率遠高於預期，\n可用於偽造數位簽章或憑證。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "密碼學", "雜湊碰撞", "數學" ], "related_terms": [ "hash", "digital_signature" ], "aliases": {} }, { "id": "evil_twin", "term_en": "Evil Twin", "term_zh": "邪惡雙胞胎攻擊", "definitions": { "brief": "設置假冒 Wi-Fi 熱點誘騙使用者連接", "standard": "邪惡雙胞胎是攻擊者設置與合法 Wi-Fi 名稱相同的假冒熱點，\n誘騙使用者連接後可攔截所有網路流量、竊取憑證或注入惡意內容。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "Wi-Fi", "中間人攻擊", "無線安全" ], "related_terms": [ "mitm", "rogue_ap" ], "aliases": { "zh": [ "惡魔雙胞胎" ] } }, { "id": "rogue_ap", "term_en": "Rogue Access Point", "term_zh": "惡意存取點", "definitions": { "brief": "未經授權設置在網路中的無線存取點", "standard": "惡意存取點是未經授權連接到企業網路的無線設備，\n可能是員工私自架設或攻擊者蓄意安裝，\n可繞過網路安全控制或作為攻擊跳板。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "Wi-Fi", "無線安全", "內部威脅" ], "related_terms": [ "evil_twin" ], "aliases": {} }, { "id": "bluejacking", "term_en": "Bluejacking", "term_zh": "藍牙劫持", "definitions": { "brief": "透過藍牙向附近裝置發送未經請求的訊息", "standard": "藍牙劫持是透過藍牙功能向附近裝置發送訊息或名片的行為，\n通常用於惡作劇，但也可能用於社交工程或散播惡意連結。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "藍牙", "無線安全", "行動裝置" ], "related_terms": [ "bluesnarfing" ], "aliases": {} }, { "id": "bluesnarfing", "term_en": "Bluesnarfing", "term_zh": "藍牙竊取", "definitions": { "brief": "透過藍牙漏洞竊取裝置資料的攻擊", "standard": "藍牙竊取利用藍牙協定漏洞，未經授權存取受害者裝置，\n可竊取聯絡人、訊息、照片等敏感資料。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "藍牙", "無線安全", "資料竊取" ], "related_terms": [ "bluejacking" ], "aliases": {} }, { "id": "war_driving", "term_en": "War Driving", "term_zh": "戰爭駕駛", "definitions": { "brief": "駕車尋找無線網路漏洞的偵察活動", "standard": "戰爭駕駛是攻擊者駕車在城市中移動，\n使用筆電和天線搜尋未加密或安全性不足的 Wi-Fi 網路，\n記錄其位置供後續攻擊使用。\n" }, "category": "attack_types", "subcategory": "network_attack", "tags": [ "Wi-Fi", "偵察", "無線安全" ], "related_terms": [ "reconnaissance", "rogue_ap" ], "aliases": {} }, { "id": "sql_truncation", "term_en": "SQL Truncation Attack", "term_zh": "SQL 截斷攻擊", "definitions": { "brief": "利用資料庫欄位長度限制的攻擊", "standard": "SQL 截斷攻擊利用資料庫欄位的最大長度限制，\n輸入超過限制的資料使其被截斷，\n可能導致繞過唯一性檢查或覆蓋既有帳號。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "SQL", "資料庫", "身分冒充" ], "related_terms": [ "sql_injection" ], "aliases": {} }, { "id": "subdomain_enumeration", "term_en": "Subdomain Enumeration", "term_zh": "子網域列舉", "definitions": { "brief": "搜尋目標所有子網域的偵察技術", "standard": "子網域列舉是資訊蒐集階段的技術，\n透過 DNS 查詢、暴力猜測或搜尋引擎，\n找出目標組織所有的子網域，發現潛在攻擊面。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "偵察", "DNS", "資訊蒐集" ], "related_terms": [ "reconnaissance", "subdomain_takeover" ], "aliases": {} }, { "id": "reconnaissance", "term_en": "Reconnaissance", "term_zh": "偵察", "definitions": { "brief": "攻擊前蒐集目標資訊的活動", "standard": "偵察是攻擊者在發動攻擊前蒐集目標資訊的階段，\n包括被動偵察（不直接接觸目標）和主動偵察（直接探測），\n目的是了解目標的弱點和攻擊面。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "資訊蒐集", "攻擊前置", "OSINT" ], "related_terms": [ "subdomain_enumeration", "osint" ], "aliases": {} }, { "id": "osint", "term_en": "OSINT", "term_zh": "開源情報", "definitions": { "brief": "從公開來源蒐集的情報資訊", "standard": "開源情報是從公開可取得的來源蒐集和分析的資訊，\n包括社群媒體、新聞、政府公告、網站等，\n可用於攻擊偵察或防禦性威脅情報。\n" }, "category": "attack_types", "subcategory": "advanced_attack", "tags": [ "情報蒐集", "偵察", "公開資訊" ], "related_terms": [ "reconnaissance", "threat_intelligence" ], "aliases": {} }, { "id": "spim", "term_en": "SPIM", "term_zh": "即時通訊垃圾訊息", "definitions": { "brief": "透過即時通訊軟體發送的垃圾訊息", "standard": "即時通訊垃圾訊息是透過 LINE、WhatsApp、Facebook Messenger 等\n即時通訊軟體發送的未經請求訊息，\n常包含釣魚連結、詐騙廣告或惡意程式。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "垃圾訊息", "即時通訊", "詐騙" ], "related_terms": [ "phishing", "smishing" ], "aliases": {} }, { "id": "juice_jacking", "term_en": "Juice Jacking", "term_zh": "充電劫持", "definitions": { "brief": "透過惡意公用充電站竊取資料的攻擊", "standard": "充電劫持是在公共 USB 充電站植入惡意程式，\n當使用者連接手機充電時，透過 USB 資料線竊取資料，\n或在裝置上安裝惡意程式。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "USB", "行動裝置", "資料竊取" ], "related_terms": [ "baiting", "malware" ], "aliases": {} }, { "id": "adversarial_ai", "term_en": "Adversarial AI Attack", "term_zh": "對抗性 AI 攻擊", "definitions": { "brief": "透過精心設計的輸入欺騙 AI 模型做出錯誤判斷", "standard": "對抗性 AI 攻擊是透過在輸入資料中加入人類難以察覺的微小擾動，\n使機器學習模型產生錯誤輸出的攻擊技術，\n廣泛應用於欺騙影像辨識、語音識別及自動駕駛系統。\n" }, "category": "attack_types", "subcategory": "ai_attack", "tags": [ "AI", "機器學習", "模型欺騙" ], "related_terms": [ "prompt_injection" ], "aliases": {} }, { "id": "prompt_injection", "term_en": "Prompt Injection", "term_zh": "提示注入", "definitions": { "brief": "透過惡意輸入操控 AI 語言模型執行非預期指令", "standard": "提示注入是針對大型語言模型（LLM）的攻擊技術，\n攻擊者將惡意指令嵌入輸入提示中，\n使模型忽略原始系統指令並執行攻擊者設計的行為，\n如洩漏系統提示或繞過安全限制。\n" }, "category": "attack_types", "subcategory": "ai_attack", "tags": [ "AI", "LLM", "提示工程" ], "related_terms": [ "adversarial_ai" ], "aliases": {} }, { "id": "deepfake_attack", "term_en": "Deepfake Attack", "term_zh": "深偽攻擊", "definitions": { "brief": "利用 AI 生成假冒音訊或影片進行詐騙的攻擊", "standard": "深偽攻擊使用生成對抗網路（GAN）或深度學習技術，\n合成高度逼真的假冒影片或音訊，\n常用於商業電子郵件詐騙（BEC）、政治操弄或身份偽造。\n" }, "category": "attack_types", "subcategory": "social_engineering", "tags": [ "AI", "深偽", "詐騙", "身份偽造" ], "related_terms": [ "social_engineering", "bec" ], "aliases": {} }, { "id": "cache_poisoning", "term_en": "Cache Poisoning", "term_zh": "快取投毒", "definitions": { "brief": "將惡意資料注入快取系統影響後續請求的攻擊", "standard": "快取投毒攻擊透過操控 HTTP 標頭或請求參數，\n將惡意回應存入快取伺服器，\n使後續存取相同資源的使用者收到攻擊者控制的惡意內容，\n常與 DNS 投毒或 Web 快取欺騙結合使用。\n" }, "category": "attack_types", "subcategory": "web_attack", "tags": [ "快取", "HTTP", "Web 攻擊" ], "related_terms": [ "dns_poisoning", "web_cache_deception" ], "aliases": {} }, { "id": "gdpr", "term_en": "GDPR", "term_zh": "歐盟一般資料保護規則", "definitions": { "brief": "歐盟個人資料保護與隱私法規", "standard": "歐盟一般資料保護規則是歐盟針對個人資料保護與隱私制定的法規，\n適用於處理歐盟居民個人資料的所有組織，\n違規者可被處以最高年營業額 4% 的罰款。\n" }, "category": "compliance", "subcategory": "data_protection", "tags": [ "隱私", "資料保護", "歐盟" ], "related_terms": [ "pii", "data_breach" ], "aliases": {} }, { "id": "pdpa", "term_en": "PDPA", "term_zh": "個人資料保護法", "definitions": { "brief": "規範個人資料蒐集、處理、利用的法規", "standard": "個人資料保護法規範公務機關與非公務機關對個人資料的蒐集、處理及利用，\n保障人民隱私權益，促進個人資料的合理利用。\n台灣於 2012 年施行個人資料保護法。\n" }, "category": "compliance", "subcategory": "data_protection", "tags": [ "隱私", "資料保護", "台灣" ], "related_terms": [ "gdpr", "pii" ], "aliases": {} }, { "id": "pci_dss", "term_en": "PCI-DSS", "term_zh": "支付卡產業資料安全標準", "definitions": { "brief": "保護支付卡資料的安全標準", "standard": "PCI-DSS 是由主要信用卡組織制定的資訊安全標準，\n適用於處理、儲存或傳輸持卡人資料的所有組織，\n包含 12 項核心安全要求。\n" }, "category": "compliance", "subcategory": "industry_standard", "tags": [ "支付安全", "信用卡" ], "related_terms": [ "encryption", "access_control" ], "aliases": {} }, { "id": "hipaa", "term_en": "HIPAA", "term_zh": "美國健康保險可攜性與責任法案", "definitions": { "brief": "美國保護醫療資訊隱私與安全的法規", "standard": "HIPAA 是美國聯邦法律，規範受保護健康資訊（PHI）的使用和揭露，\n要求醫療機構實施適當的安全措施保護病患資料。\n" }, "category": "compliance", "subcategory": "industry_standard", "tags": [ "醫療", "健康資訊", "美國" ], "related_terms": [ "phi", "data_breach" ], "aliases": {} }, { "id": "sox", "term_en": "SOX", "term_zh": "沙賓法案", "definitions": { "brief": "美國企業財務報告與內控的合規要求", "standard": "沙賓法案是美國聯邦法律，要求上市公司建立內部控制機制，\n確保財務報告的準確性與完整性，\n對 IT 系統的存取控制與稽核追蹤有明確要求。\n" }, "category": "compliance", "subcategory": "financial_compliance", "tags": [ "財務", "內控", "稽核" ], "related_terms": [ "access_control", "audit_log" ], "aliases": {} }, { "id": "ccpa", "term_en": "CCPA", "term_zh": "加州消費者隱私法", "definitions": { "brief": "美國加州的消費者隱私保護法規", "standard": "加州消費者隱私法賦予加州居民對其個人資料的權利，\n包括知情權、刪除權、拒絕出售權等，\n適用於符合特定門檻的企業，違規可處民事罰款。\n" }, "category": "compliance", "subcategory": "data_protection", "tags": [ "隱私", "資料保護", "美國" ], "related_terms": [ "gdpr", "cpra" ], "aliases": {} }, { "id": "iso_27001", "term_en": "ISO 27001", "term_zh": "ISO 27001 資訊安全管理系統", "definitions": { "brief": "國際公認的資訊安全管理系統標準", "standard": "ISO 27001 是國際標準化組織制定的資訊安全管理系統（ISMS）標準，\n提供建立、實施、維護和持續改善資安管理的框架，\n組織可通過第三方認證證明其資安能力。\n" }, "category": "compliance", "subcategory": "security_framework", "tags": [ "ISO", "ISMS", "認證" ], "related_terms": [ "iso_27002", "risk_management" ], "aliases": {} }, { "id": "nist_csf", "term_en": "NIST CSF", "term_zh": "NIST 網路安全框架", "definitions": { "brief": "美國國家標準與技術研究院的網路安全框架", "standard": "NIST 網路安全框架提供管理和降低網路安全風險的指引，\n包含識別、保護、偵測、回應、復原五大功能，\n2024 年發布 2.0 版本新增治理功能。\n" }, "category": "compliance", "subcategory": "security_framework", "tags": [ "NIST", "框架", "美國" ], "related_terms": [ "nist_sp_800_53", "risk_management" ], "aliases": {} }, { "id": "nist_sp_800_53", "term_en": "NIST SP 800-53", "term_zh": "NIST SP 800-53 安全控制措施", "definitions": { "brief": "美國聯邦系統安全控制措施指引", "standard": "NIST SP 800-53 提供聯邦資訊系統的安全和隱私控制措施目錄，\n涵蓋存取控制、稽核、風險評估等 20 個控制家族，\n是美國政府機關和承包商必須遵循的標準。\n" }, "category": "compliance", "subcategory": "security_framework", "tags": [ "NIST", "控制措施", "美國政府" ], "related_terms": [ "nist_csf", "fedramp" ], "aliases": {} }, { "id": "cis_controls", "term_en": "CIS Controls", "term_zh": "CIS 關鍵安全控制措施", "definitions": { "brief": "優先排序的網路安全最佳實務清單", "standard": "CIS 關鍵安全控制措施是一組優先排序的安全行動指南，\n幫助組織防禦最常見的網路攻擊，\n最新第 8 版包含 18 項控制措施，分為三個實施群組。\n" }, "category": "compliance", "subcategory": "security_framework", "tags": [ "最佳實務", "控制措施", "優先排序" ], "related_terms": [ "nist_csf", "iso_27001" ], "aliases": { "en": [ "CIS Top 18", "CIS CSC" ] } }, { "id": "psd2", "term_en": "PSD2", "term_zh": "歐盟支付服務指令 2", "definitions": { "brief": "歐盟規範支付服務和開放銀行的法規", "standard": "PSD2 是歐盟針對電子支付服務的法規，\n要求銀行開放 API 給第三方支付服務提供商，\n並強制實施強客戶驗證（SCA）提升支付安全。\n" }, "category": "compliance", "subcategory": "financial_compliance", "tags": [ "支付安全", "開放銀行", "歐盟" ], "related_terms": [ "mfa", "api_security" ], "aliases": {} }, { "id": "fedramp", "term_en": "FedRAMP", "term_zh": "聯邦風險與授權管理計畫", "definitions": { "brief": "美國政府雲端服務安全評估與授權計畫", "standard": "FedRAMP 是美國政府對雲端服務供應商的安全評估、授權和持續監控計畫，\n雲端服務必須通過 FedRAMP 授權才能被聯邦機關採用。\n" }, "category": "compliance", "subcategory": "cloud_compliance", "tags": [ "雲端", "美國政府", "認證" ], "related_terms": [ "nist_sp_800_53", "cspm" ], "aliases": {} }, { "id": "soc2", "term_en": "SOC 2", "term_zh": "SOC 2 報告", "definitions": { "brief": "服務組織資安控制的獨立審計報告", "standard": "SOC 2 是由會計師事務所出具的審計報告，\n評估服務組織在安全性、可用性、處理完整性、機密性和隱私方面的控制，\n是 SaaS 和雲端服務供應商常見的合規要求。\n" }, "category": "compliance", "subcategory": "audit_report", "tags": [ "審計", "雲端", "信任服務準則" ], "related_terms": [ "iso_27001" ], "aliases": {} }, { "id": "cpra", "term_en": "CPRA", "term_zh": "加州隱私權法", "definitions": { "brief": "擴展 CCPA 的加州隱私保護法規", "standard": "加州隱私權法是 2020 年通過的加州公投提案，\n擴展 CCPA 的保護範圍，新增敏感個人資訊分類、\n限制資料保留和設立加州隱私保護局。\n" }, "category": "compliance", "subcategory": "data_protection", "tags": [ "隱私", "資料保護", "美國" ], "related_terms": [ "ccpa", "gdpr" ], "aliases": {} }, { "id": "dora_eu", "term_en": "DORA", "term_zh": "歐盟數位作業韌性法", "definitions": { "brief": "歐盟金融業數位作業韌性與 ICT 風險管理法規", "standard": "歐盟數位作業韌性法（DORA）是 2023 年生效的歐盟法規，\n要求銀行、保險公司和投資公司等金融機構\n強化 ICT 風險管理、事件報告、韌性測試和第三方風險管控，\n於 2025 年 1 月 17 日起強制執行。\n" }, "category": "compliance", "subcategory": "financial_regulation", "tags": [ "歐盟", "金融業", "ICT 風險", "韌性" ], "related_terms": [ "nis2", "tiber_eu" ], "aliases": {} }, { "id": "appi", "term_en": "APPI", "term_zh": "日本個人資訊保護法", "definitions": { "brief": "日本規範個人資訊蒐集與處理的隱私保護法律", "standard": "日本個人資訊保護法（APPI）是日本規範個人資訊處理的基本法律，\n2022 年修正版強化個人資訊外洩通報義務、\n跨境資料傳輸規範和假名化資料保護，\n適用於蒐集、使用或提供個人資訊的企業和組織。\n" }, "category": "compliance", "subcategory": "data_protection", "tags": [ "日本", "隱私", "個人資料", "亞太" ], "related_terms": [ "gdpr", "pdpa" ], "aliases": {} }, { "id": "tw_cyber_security_act", "term_en": "Taiwan Cyber Security Management Act", "term_zh": "台灣資通安全管理法", "definitions": { "brief": "台灣規範政府機關與關鍵基礎設施資安義務的法律", "standard": "台灣資通安全管理法（2018 年施行）規範政府機關和關鍵基礎設施提供者\n的資安責任義務，包含資安長設置、資安計畫訂定、\n事件通報時效和資安稽核等要求，\n由數位發展部資安署負責推動執行。\n" }, "category": "compliance", "subcategory": "national_regulation", "tags": [ "台灣", "政府機關", "關鍵基礎設施", "資安義務" ], "related_terms": [ "nis2", "pdpa" ], "aliases": {} }, { "id": "nis2", "term_en": "NIS2", "term_zh": "歐盟 NIS2 指令", "definitions": { "brief": "歐盟強化網路與資訊系統安全的第二版指令", "standard": "NIS2 指令是歐盟 2022 年通過的網路與資訊安全指令，\n擴大適用範圍至更多產業（能源、交通、醫療、數位基礎設施等），\n要求強化資安風險管理措施、事件通報義務和供應鏈安全，\n成員國須於 2024 年 10 月 17 日前完成國內法轉換。\n" }, "category": "compliance", "subcategory": "eu_regulation", "tags": [ "歐盟", "網路安全", "關鍵基礎設施", "供應鏈" ], "related_terms": [ "dora_eu", "gdpr" ], "aliases": {} }, { "id": "mitre_attack", "term_en": "MITRE ATT&CK", "term_zh": "MITRE ATT&CK 框架", "definitions": { "brief": "描述網路攻擊戰術與技術的知識庫", "standard": "MITRE ATT&CK 是一個全球可存取的知識庫，\n記錄了真實世界觀察到的網路攻擊者戰術和技術，\n廣泛用於威脅建模、偵測和防禦策略。\n" }, "category": "frameworks", "subcategory": "threat_framework", "tags": [ "威脅情報", "戰術技術" ], "related_terms": [ "ttp", "kill_chain" ], "aliases": {} }, { "id": "kill_chain", "term_en": "Cyber Kill Chain", "term_zh": "網路殺傷鏈", "definitions": { "brief": "描述網路攻擊各階段的框架模型", "standard": "網路殺傷鏈由 Lockheed Martin 提出，將網路攻擊分為七個階段：\n偵查、武器化、投遞、利用、安裝、命令與控制、達成目標。\n" }, "category": "frameworks", "subcategory": "threat_framework", "tags": [ "攻擊模型", "防禦策略" ], "related_terms": [ "mitre_attack", "ttp" ], "aliases": {} }, { "id": "owasp_top10", "term_en": "OWASP Top 10", "term_zh": "OWASP 十大風險", "definitions": { "brief": "網頁應用程式十大安全風險排名", "standard": "OWASP 十大風險是由 OWASP 基金會定期更新的清單，\n列出網頁應用程式最常見和最嚴重的安全風險，\n是網頁安全的重要參考標準。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "網頁安全", "風險排名" ], "related_terms": [], "aliases": {} }, { "id": "cvss", "term_en": "CVSS", "term_zh": "通用漏洞評分系統", "definitions": { "brief": "評估漏洞嚴重程度的標準化計分系統", "standard": "CVSS 提供一種標準化的方式來評估漏洞的嚴重程度，\n分數從 0 到 10，目前廣泛使用的是 CVSS v3.x 和 v4.0。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "漏洞評估", "風險量化" ], "related_terms": [ "cve", "vulnerability" ], "aliases": {} }, { "id": "cve", "term_en": "CVE", "term_zh": "通用漏洞揭露", "definitions": { "brief": "公開已知漏洞的統一編號系統", "standard": "CVE 是由 MITRE 維護的漏洞編號系統，\n為每個公開揭露的漏洞分配唯一識別碼，格式為 CVE-年份-編號。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "漏洞管理", "識別碼" ], "related_terms": [ "cvss", "nvd" ], "aliases": {} }, { "id": "cwe", "term_en": "CWE", "term_zh": "通用弱點列舉", "definitions": { "brief": "軟體和硬體弱點類型的分類系統", "standard": "CWE 是一個社群維護的軟體和硬體安全弱點清單，\n提供弱點的分類和描述，用於識別和預防安全問題。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "弱點分類", "安全開發" ], "related_terms": [ "cve", "owasp_top10" ], "aliases": {} }, { "id": "nvd", "term_en": "NVD", "term_zh": "國家漏洞資料庫", "definitions": { "brief": "美國政府維護的漏洞資料庫", "standard": "NVD 是美國 NIST 維護的漏洞資料庫，\n包含 CVE 漏洞的詳細資訊、CVSS 分數和修復建議。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [], "related_terms": [ "cve", "cvss" ], "aliases": {} }, { "id": "mitre_defend", "term_en": "MITRE D3FEND", "term_zh": "MITRE D3FEND 框架", "definitions": { "brief": "描述網路防禦技術的知識庫", "standard": "MITRE D3FEND 是 MITRE ATT&CK 的防禦對應框架，\n分類和描述各種網路防禦技術，\n幫助防禦者選擇對應特定攻擊技術的防禦措施。\n" }, "category": "frameworks", "subcategory": "threat_framework", "tags": [ "防禦", "對策", "知識庫" ], "related_terms": [ "mitre_attack" ], "aliases": {} }, { "id": "kev", "term_en": "KEV", "term_zh": "已知遭利用漏洞清單", "definitions": { "brief": "CISA 維護的已確認遭實際利用的漏洞清單", "standard": "KEV 是美國 CISA 維護的漏洞清單，\n收錄已確認在野外遭實際利用的漏洞，\n聯邦機構須在期限內修補，也是民間優先修補的參考。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "漏洞", "優先順序", "CISA" ], "related_terms": [ "cve", "cvss" ], "aliases": {} }, { "id": "epss", "term_en": "EPSS", "term_zh": "漏洞利用預測評分系統", "definitions": { "brief": "預測漏洞被利用機率的評分系統", "standard": "EPSS 使用機器學習預測 CVE 漏洞在未來 30 天內被利用的機率，\n幫助組織優先處理最可能被利用的漏洞，\n補充 CVSS 嚴重度評分的不足。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "漏洞", "優先順序", "機器學習" ], "related_terms": [ "cvss", "cve" ], "aliases": {} }, { "id": "stride", "term_en": "STRIDE", "term_zh": "STRIDE 威脅模型", "definitions": { "brief": "Microsoft 提出的威脅分類方法論", "standard": "STRIDE 是 Microsoft 開發的威脅建模方法，\n將威脅分為六類：Spoofing（偽造）、Tampering（竄改）、\nRepudiation（否認）、Information Disclosure（資訊洩露）、\nDenial of Service（阻斷服務）、Elevation of Privilege（權限提升）。\n" }, "category": "frameworks", "subcategory": "threat_framework", "tags": [ "威脅建模", "安全設計", "SDLC" ], "related_terms": [ "dread" ], "aliases": {} }, { "id": "dread", "term_en": "DREAD", "term_zh": "DREAD 風險評估模型", "definitions": { "brief": "量化安全風險的評估方法", "standard": "DREAD 是風險評估模型，評估五個維度：\nDamage（損害）、Reproducibility（可重現性）、\nExploitability（可利用性）、Affected Users（影響用戶）、\nDiscoverability（可發現性）。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "風險評估", "威脅建模" ], "related_terms": [ "stride" ], "aliases": {} }, { "id": "fair", "term_en": "FAIR", "term_zh": "資訊風險因素分析", "definitions": { "brief": "量化資訊安全風險的國際標準", "standard": "FAIR 是一套量化風險分析方法論，\n將風險分解為可測量的因素，以金額估算潛在損失，\n幫助組織做出基於數據的安全投資決策。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "風險量化", "財務", "決策" ], "related_terms": [ "risk_management" ], "aliases": {} }, { "id": "isms", "term_en": "ISMS", "term_zh": "資訊安全管理系統", "definitions": { "brief": "組織管理資訊安全的系統化框架", "standard": "資訊安全管理系統是組織用於管理資訊安全風險的系統化方法，\n包含政策、程序、組織架構和技術控制措施，\nISO 27001 是最廣泛採用的 ISMS 標準。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "管理系統", "政策", "控制" ], "related_terms": [ "iso_27001", "risk_management" ], "aliases": {} }, { "id": "risk_management", "term_en": "Risk Management", "term_zh": "風險管理", "definitions": { "brief": "識別、評估和處理資訊安全風險的流程", "standard": "風險管理是組織識別資訊資產面臨的威脅和漏洞，\n評估風險的可能性和影響，並決定適當處置方式\n（接受、降低、轉移或規避）的持續性流程。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "風險評估", "治理", "決策" ], "related_terms": [ "fair", "nist_csf", "isms" ], "aliases": {} }, { "id": "critical_infrastructure", "term_en": "Critical Infrastructure", "term_zh": "關鍵基礎設施", "definitions": { "brief": "對國家運作至關重要的實體和虛擬系統", "standard": "關鍵基礎設施是指對國家安全、經濟、公共衛生至關重要的系統，\n包括能源、交通、金融、醫療、通訊等 16 個領域，\n是國家級網路攻擊的主要目標。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "國家安全", "關鍵基礎設施", "能源" ], "related_terms": [ "ics", "scada", "ot" ], "aliases": {} }, { "id": "responsible_disclosure", "term_en": "Responsible Disclosure", "term_zh": "負責任揭露", "definitions": { "brief": "通知廠商漏洞並給予修補時間的揭露方式", "standard": "負責任揭露是安全研究人員發現漏洞後，\n先私下通知廠商並給予合理時間修補，\n之後才公開漏洞資訊的做法，又稱協調式揭露。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "漏洞", "研究", "揭露" ], "related_terms": [ "poc", "cve" ], "aliases": { "en": [ "Coordinated Disclosure" ] } }, { "id": "data_classification", "term_en": "Data Classification", "term_zh": "資料分類", "definitions": { "brief": "依據敏感度將資料分級的管理方法", "standard": "資料分類是依據資料的機密性、敏感度和重要性進行分級，\n如公開、內部、機密、絕密等級別，\n是資料保護和存取控制的基礎。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "資料保護", "分類", "政策" ], "related_terms": [ "dlp", "pii" ], "aliases": {} }, { "id": "cia_triad", "term_en": "CIA Triad", "term_zh": "CIA 三要素", "definitions": { "brief": "資訊安全的三大核心原則：機密性、完整性、可用性", "standard": "CIA 三要素是資訊安全的基礎模型：\n機密性（Confidentiality）確保資料僅授權者可存取；\n完整性（Integrity）確保資料未被未授權修改；\n可用性（Availability）確保授權者可在需要時存取資料。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "基礎概念", "安全原則", "核心" ], "related_terms": [ "confidentiality", "integrity", "availability" ], "aliases": { "en": [ "CIA Model", "Security Triad" ], "zh": [ "機密性完整性可用性", "資安三要素" ] } }, { "id": "attack_surface", "term_en": "Attack Surface", "term_zh": "攻擊面", "definitions": { "brief": "系統中可能被攻擊者利用的所有潛在入口點", "standard": "攻擊面是指系統、網路或組織中所有可能被攻擊者利用的入口點，\n包括暴露的服務、API、使用者介面、第三方整合等。\n攻擊面越大，潛在風險越高。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "風險評估", "基礎概念", "資產管理" ], "related_terms": [ "asm", "easm", "vulnerability_management" ], "aliases": { "zh": [ "攻擊表面" ] } }, { "id": "defense_in_depth", "term_en": "Defense in Depth", "term_zh": "縱深防禦", "definitions": { "brief": "部署多層安全控制以保護資產的策略", "standard": "縱深防禦是一種資安策略，在多個層次部署安全控制措施，\n即使單一層被突破，其他層仍能提供保護。\n概念源自軍事防禦理論。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "安全策略", "基礎概念", "架構" ], "related_terms": [ "zero_trust", "security_control" ], "aliases": { "en": [ "DiD", "Layered Security" ], "zh": [ "多層防禦", "深度防禦" ] } }, { "id": "security_control", "term_en": "Security Control", "term_zh": "安全控制措施", "definitions": { "brief": "用於保護資訊系統的管理、操作或技術措施", "standard": "安全控制措施是組織為保護資訊資產所實施的各種措施，\n分為管理控制（政策）、操作控制（流程）、技術控制（工具）三類，\n也可分為預防、偵測、回應、復原四種功能。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "基礎概念", "合規", "風險管理" ], "related_terms": [ "defense_in_depth", "nist_sp_800_53" ], "aliases": { "en": [ "Control" ], "zh": [ "控制措施", "安全措施" ] } }, { "id": "risk_assessment", "term_en": "Risk Assessment", "term_zh": "風險評估", "definitions": { "brief": "識別、分析和評估資安風險的系統化流程", "standard": "風險評估是識別組織資產面臨的威脅和漏洞，\n分析風險發生的可能性和潛在影響，\n並評估風險等級以決定處置優先順序的過程。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "風險管理", "基礎概念", "合規" ], "related_terms": [ "risk_management", "vulnerability_assessment", "cvss" ], "aliases": { "zh": [ "資安風險評估" ] } }, { "id": "owasp", "term_en": "OWASP", "term_zh": "OWASP 基金會", "definitions": { "brief": "推廣網頁應用程式安全的非營利組織", "standard": "OWASP 是一個致力於提升軟體安全的全球性非營利組織，\n提供免費的工具、文件和社群資源。\n其 OWASP Top 10 是網頁安全的重要參考標準。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "網頁安全", "社群", "標準" ], "related_terms": [ "owasp_top10", "owasp_api_top10" ], "aliases": {} }, { "id": "owasp_api_top10", "term_en": "OWASP API Security Top 10", "term_zh": "OWASP API 安全十大風險", "definitions": { "brief": "API 最常見的十大安全風險排名", "standard": "OWASP API 安全 Top 10 列出 API 最常見和嚴重的安全風險，\n包括物件層級授權失效（BOLA）、驗證失效、\n資源消耗無限制等。2023 年版本是最新版。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "API 安全", "風險排名", "OWASP" ], "related_terms": [ "owasp_top10", "api_security", "bola" ], "aliases": {} }, { "id": "bola", "term_en": "BOLA", "term_zh": "物件層級授權失效", "definitions": { "brief": "API 未正確驗證使用者對物件存取權限的漏洞", "standard": "物件層級授權失效是 OWASP API Top 10 第一名的風險，\n發生在 API 未正確驗證使用者是否有權存取特定物件時，\n攻擊者可透過修改物件 ID 存取他人資料。\n" }, "category": "frameworks", "subcategory": "assessment", "tags": [ "API 安全", "授權", "OWASP" ], "related_terms": [ "owasp_api_top10", "idor", "broken_access_control" ], "aliases": {} }, { "id": "cis_benchmarks", "term_en": "CIS Benchmarks", "term_zh": "CIS 安全基準", "definitions": { "brief": "針對各種系統的安全設定最佳實務指南", "standard": "CIS 安全基準是由網際網路安全中心（CIS）發布的\n系統安全設定指南，涵蓋作業系統、雲端平台、\n應用程式等，是業界廣泛採用的安全強化標準。\n" }, "category": "frameworks", "subcategory": "compliance_framework", "tags": [ "安全基準", "強化", "合規" ], "related_terms": [ "security_baseline", "hardening" ], "aliases": {} }, { "id": "nist_sp_800_171", "term_en": "NIST SP 800-171", "term_zh": "NIST SP 800-171", "definitions": { "brief": "保護非聯邦系統中受控非機密資訊的 NIST 標準", "standard": "NIST SP 800-171 定義保護聯邦受控非機密資訊（CUI）的安全需求，\n適用於儲存、處理或傳輸 CUI 的非聯邦系統，\n是美國國防承包商（CMMC 前身）和政府供應鏈的重要合規要求。\n" }, "category": "frameworks", "subcategory": "nist_framework", "tags": [ "NIST", "CUI", "美國政府", "供應鏈" ], "related_terms": [ "nist_csf", "cmmc" ], "aliases": {} }, { "id": "ptes", "term_en": "PTES", "term_zh": "滲透測試執行標準", "definitions": { "brief": "提供滲透測試完整流程與技術指引的行業標準", "standard": "滲透測試執行標準（PTES）定義滲透測試的七個階段，\n包含前期交涉、情報收集、威脅建模、漏洞分析、\n漏洞利用、後滲透及報告撰寫，\n是業界廣泛參考的滲透測試方法論框架。\n" }, "category": "frameworks", "subcategory": "testing_methodology", "tags": [ "滲透測試", "方法論", "資安評估" ], "related_terms": [ "pentesting", "owasp_testing_guide" ], "aliases": {} }, { "id": "tiber_eu", "term_en": "TIBER-EU", "term_zh": "歐盟威脅情報紅隊演練", "definitions": { "brief": "歐盟央行主導的金融業威脅導向紅隊演練框架", "standard": "TIBER-EU 是歐洲央行（ECB）發布的威脅情報驅動紅隊演練框架，\n要求基於真實威脅情報模擬進階攻擊者對金融機構核心系統的攻擊，\n是歐盟金融業網路韌性測試的主要標準，\n已被多個歐洲國家監管機構採用。\n" }, "category": "frameworks", "subcategory": "testing_methodology", "tags": [ "紅隊", "金融業", "歐盟", "威脅情報" ], "related_terms": [ "red_team", "threat_intelligence", "dora_eu" ], "aliases": {} }, { "id": "owasp_testing_guide", "term_en": "OWASP Testing Guide", "term_zh": "OWASP 測試指南", "definitions": { "brief": "OWASP 提供的完整網頁應用程式安全測試方法論", "standard": "OWASP 測試指南（OTG）是開放網路應用程式安全專案（OWASP）發布的\n網頁應用程式安全測試完整方法論，\n涵蓋資訊收集、設定測試、身份驗證、\n授權、輸入驗證等十餘個測試分類，\n是業界最廣泛採用的網頁應用安全測試參考標準。\n" }, "category": "frameworks", "subcategory": "testing_methodology", "tags": [ "OWASP", "Web 安全", "測試", "方法論" ], "related_terms": [ "owasp_top10", "pentesting", "ptes" ], "aliases": {} }, { "id": "malware", "term_en": "Malware", "term_zh": "惡意程式", "definitions": { "brief": "設計用來損害系統或竊取資料的軟體總稱", "standard": "惡意程式是所有惡意軟體的統稱，包括病毒、蠕蟲、特洛伊木馬、\n勒索軟體等，目的是入侵、破壞系統或竊取資料。\n" }, "category": "malware", "subcategory": "", "tags": [ "總稱" ], "related_terms": [ "ransomware", "trojan", "virus" ], "aliases": {} }, { "id": "ransomware", "term_en": "Ransomware", "term_zh": "勒索軟體", "definitions": { "brief": "加密受害者資料並要求贖金的惡意程式", "standard": "勒索軟體會加密受害者的檔案或鎖定系統，\n要求支付贖金（通常為加密貨幣）才能取得解密金鑰。\n現代勒索軟體常採取「雙重勒索」策略，同時威脅公開資料。\n" }, "category": "malware", "subcategory": "", "tags": [ "加密", "勒索", "金錢動機" ], "related_terms": [ "raas", "ransomware_group" ], "aliases": {} }, { "id": "raas", "term_en": "RaaS", "term_zh": "勒索軟體即服務", "definitions": { "brief": "將勒索軟體以服務形式提供給其他犯罪者的商業模式", "standard": "RaaS 是一種犯罪商業模式，勒索軟體開發者將工具和基礎設施\n提供給「加盟者」使用，並分享贖金收益。\n" }, "category": "malware", "subcategory": "", "tags": [ "商業模式", "犯罪服務" ], "related_terms": [ "ransomware", "ransomware_group" ], "aliases": {} }, { "id": "trojan", "term_en": "Trojan", "term_zh": "特洛伊木馬程式", "definitions": { "brief": "偽裝成正常軟體的惡意程式", "standard": "特洛伊木馬程式偽裝成合法軟體誘騙使用者執行，\n一旦執行便會在系統上執行惡意行為，如開啟後門、竊取資料等。\n" }, "category": "malware", "subcategory": "", "tags": [ "偽裝", "社交工程" ], "related_terms": [ "backdoor", "rat" ], "aliases": {} }, { "id": "rat", "term_en": "RAT", "term_zh": "遠端存取木馬", "definitions": { "brief": "允許攻擊者遠端控制受感染系統的惡意程式", "standard": "遠端存取木馬讓攻擊者可以遠端完全控制受感染的電腦，\n包括監視螢幕、存取檔案、錄製鍵盤輸入等。\n" }, "category": "malware", "subcategory": "", "tags": [ "遠端控制", "監控" ], "related_terms": [ "trojan", "c2" ], "aliases": {} }, { "id": "backdoor", "term_en": "Backdoor", "term_zh": "後門", "definitions": { "brief": "繞過正常驗證機制的隱藏存取方式", "standard": "後門是攻擊者在系統上建立的隱藏存取管道，\n用於繞過正常驗證機制持續存取受害系統。\n" }, "category": "malware", "subcategory": "", "tags": [ "持久化", "隱藏存取" ], "related_terms": [ "persistence", "rat" ], "aliases": {} }, { "id": "rootkit", "term_en": "Rootkit", "term_zh": "根套件", "definitions": { "brief": "隱藏惡意活動並維持特權存取的工具集", "standard": "根套件是一組工具，用於在系統上維持特權存取並隱藏惡意活動，\n可以修改作業系統核心以躲避偵測。\n" }, "category": "malware", "subcategory": "", "tags": [ "隱藏", "核心層" ], "related_terms": [ "bootkit", "stealth" ], "aliases": {} }, { "id": "worm", "term_en": "Worm", "term_zh": "蠕蟲", "definitions": { "brief": "能自我複製並在網路上傳播的惡意程式", "standard": "蠕蟲是能夠自我複製的惡意程式，不需要附著在其他程式上，\n可透過網路漏洞或社交工程自動傳播。\n" }, "category": "malware", "subcategory": "", "tags": [ "自我複製", "網路傳播" ], "related_terms": [ "virus", "wannacry" ], "aliases": {} }, { "id": "virus", "term_en": "Virus", "term_zh": "電腦病毒", "definitions": { "brief": "附著在其他程式上並能自我複製的惡意程式", "standard": "電腦病毒是需要附著在宿主程式上的惡意程式，\n當宿主程式被執行時，病毒會複製並傳播到其他程式。\n" }, "category": "malware", "subcategory": "", "tags": [ "自我複製", "宿主依賴" ], "related_terms": [ "worm", "malware" ], "aliases": {} }, { "id": "keylogger", "term_en": "Keylogger", "term_zh": "鍵盤側錄器", "definitions": { "brief": "記錄使用者鍵盤輸入的惡意程式", "standard": "鍵盤側錄器記錄使用者的所有鍵盤輸入，\n包括密碼、信用卡號碼和私人訊息，\n可以是軟體形式或植入於鍵盤的硬體裝置。\n" }, "category": "malware", "subcategory": "", "tags": [ "監控", "憑證竊取" ], "related_terms": [ "infostealer", "spyware" ], "aliases": {} }, { "id": "infostealer", "term_en": "Infostealer", "term_zh": "資訊竊取程式", "definitions": { "brief": "專門竊取敏感資訊的惡意程式", "standard": "資訊竊取程式專門從受感染系統竊取敏感資訊，\n如瀏覽器儲存的密碼、加密貨幣錢包、Cookie 等。\n" }, "category": "malware", "subcategory": "", "tags": [ "憑證竊取", "資料竊取" ], "related_terms": [ "keylogger", "credential_theft" ], "aliases": {} }, { "id": "cryptominer", "term_en": "Cryptominer", "term_zh": "挖礦程式", "definitions": { "brief": "未經授權使用受害者運算資源挖掘加密貨幣的程式", "standard": "挖礦程式未經使用者同意在系統上執行加密貨幣挖掘，\n消耗大量 CPU/GPU 資源，導致系統效能下降和電費增加，\n常透過網頁腳本或惡意軟體感染。\n" }, "category": "malware", "subcategory": "", "tags": [ "加密貨幣", "資源濫用" ], "related_terms": [ "cryptojacking" ], "aliases": { "zh": [ "挖礦惡意程式" ] } }, { "id": "spyware", "term_en": "Spyware", "term_zh": "間諜軟體", "definitions": { "brief": "秘密監控使用者活動並回傳資訊的惡意程式", "standard": "間諜軟體在使用者不知情的情況下監控其活動，\n收集瀏覽習慣、位置資訊、通訊內容等，\n並將資料傳送給攻擊者用於監控或獲利。\n" }, "category": "malware", "subcategory": "", "tags": [ "監控", "隱私" ], "related_terms": [ "keylogger", "stalkerware" ], "aliases": {} }, { "id": "adware", "term_en": "Adware", "term_zh": "廣告軟體", "definitions": { "brief": "強制顯示廣告或收集使用者資料用於廣告的軟體", "standard": "廣告軟體會在使用者的裝置上顯示彈出式廣告或橫幅，\n常與免費軟體捆綁安裝，雖通常不如其他惡意程式有害，\n但會降低系統效能並侵犯隱私。\n" }, "category": "malware", "subcategory": "", "tags": [ "廣告", "PUP" ], "related_terms": [], "aliases": {} }, { "id": "loader", "term_en": "Loader", "term_zh": "載入器", "definitions": { "brief": "用於下載並執行其他惡意程式的工具", "standard": "載入器是一種輕量級惡意程式，主要功能是在受感染系統上\n下載並執行其他惡意程式（如勒索軟體、RAT），常作為攻擊鏈的第一階段。\n" }, "category": "malware", "subcategory": "", "tags": [ "攻擊鏈", "下載器" ], "related_terms": [ "dropper", "stager" ], "aliases": {} }, { "id": "dropper", "term_en": "Dropper", "term_zh": "投放器", "definitions": { "brief": "將內嵌的惡意程式釋放到系統的程式", "standard": "投放器是將其他惡意程式嵌入自身，執行時將惡意酬載釋放到受害系統，\n與載入器不同的是不需要從外部下載。\n" }, "category": "malware", "subcategory": "", "tags": [ "攻擊鏈", "惡意酬載" ], "related_terms": [ "loader", "payload" ], "aliases": {} }, { "id": "wiper", "term_en": "Wiper", "term_zh": "資料抹除程式", "definitions": { "brief": "專門破壞或刪除資料的惡意程式", "standard": "資料抹除程式的目的是永久破壞受害者的資料，與勒索軟體不同，\n它不以金錢為目的，常見於國家級網路攻擊。\n" }, "category": "malware", "subcategory": "", "tags": [ "破壞性", "國家級攻擊", "APT" ], "related_terms": [ "ransomware" ], "aliases": {} }, { "id": "webshell", "term_en": "Webshell", "term_zh": "網頁後門", "definitions": { "brief": "植入網站伺服器的惡意腳本，提供遠端存取", "standard": "網頁後門是攻擊者植入網站伺服器的惡意腳本（如 PHP、ASP），\n可透過瀏覽器遠端執行系統命令，常用於維持持久存取。\n" }, "category": "malware", "subcategory": "", "tags": [ "網頁攻擊", "持久化", "後門" ], "related_terms": [ "backdoor", "persistence" ], "aliases": { "zh": [ "Web Shell" ] } }, { "id": "exploit_kit", "term_en": "Exploit Kit", "term_zh": "漏洞利用套件", "definitions": { "brief": "自動化利用瀏覽器漏洞感染訪客的工具包", "standard": "漏洞利用套件是一組自動化工具，可偵測訪客瀏覽器和外掛的漏洞，\n並自動投放惡意程式，常透過惡意廣告或被入侵網站散播。\n" }, "category": "malware", "subcategory": "", "tags": [ "自動化", "瀏覽器漏洞", "路過式下載" ], "related_terms": [ "drive_by_download", "malvertising" ], "aliases": {} }, { "id": "lockbit", "term_en": "LockBit", "term_zh": "LockBit 勒索軟體", "definitions": { "brief": "全球最活躍的 RaaS 勒索軟體家族之一", "standard": "LockBit 是採用 RaaS 模式的勒索軟體，以加密速度快著稱，\n曾推出 LockBit 2.0、3.0 等版本，是近年最多產的勒索軟體之一。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "RaaS", "雙重勒索" ], "related_terms": [ "ransomware", "raas" ], "aliases": {} }, { "id": "blackcat", "term_en": "BlackCat", "term_zh": "BlackCat 勒索軟體", "definitions": { "brief": "使用 Rust 語言開發的進階勒索軟體", "standard": "BlackCat（又名 ALPHV）是首個使用 Rust 語言開發的主流勒索軟體，\n具有跨平台能力，支援 Windows 和 Linux，採用三重勒索策略。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "RaaS", "Rust" ], "related_terms": [ "ransomware", "raas" ], "aliases": { "en": [ "ALPHV" ] } }, { "id": "clop", "term_en": "Clop", "term_zh": "Clop 勒索軟體", "definitions": { "brief": "以大規模資料外洩著稱的勒索軟體組織", "standard": "Clop 勒索軟體以針對企業的大規模攻擊聞名，\n曾利用 MOVEit 等零日漏洞入侵數百家組織。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "零日漏洞", "大規模攻擊" ], "related_terms": [ "ransomware", "zero_day" ], "aliases": {} }, { "id": "play", "term_en": "Play", "term_zh": "Play 勒索軟體", "definitions": { "brief": "近年快速崛起的勒索軟體家族", "standard": "Play 勒索軟體於 2022 年出現，以 .play 副檔名著稱，\n攻擊手法包括利用 Exchange 漏洞和合法工具，\n受害者涵蓋政府機關和多種產業。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "RaaS" ], "related_terms": [ "ransomware" ], "aliases": {} }, { "id": "black_basta", "term_en": "Black Basta", "term_zh": "Black Basta 勒索軟體", "definitions": { "brief": "疑似由 Conti 成員組成的勒索軟體組織", "standard": "Black Basta 於 2022 年出現，被認為與已解散的 Conti 勒索軟體有關聯，\n主要針對企業進行雙重勒索攻擊。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "RaaS", "Conti" ], "related_terms": [ "ransomware", "conti" ], "aliases": {} }, { "id": "conti", "term_en": "Conti", "term_zh": "Conti 勒索軟體", "definitions": { "brief": "曾經最具破壞力的勒索軟體組織之一", "standard": "Conti 是 2020-2022 年間最活躍的勒索軟體之一，\n因俄烏戰爭期間內部聊天記錄外洩而解散，成員分散至其他組織。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "RaaS", "已解散" ], "related_terms": [ "ransomware", "black_basta" ], "aliases": {} }, { "id": "revil", "term_en": "REvil", "term_zh": "REvil 勒索軟體", "definitions": { "brief": "曾發動多起重大攻擊的勒索軟體組織", "standard": "REvil（又名 Sodinokibi）曾攻擊 Kaseya、JBS 等大型企業，\n要求高額贖金，後遭執法機構打擊而解散。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "RaaS", "已解散" ], "related_terms": [ "ransomware", "raas" ], "aliases": { "en": [ "Sodinokibi" ] } }, { "id": "emotet", "term_en": "Emotet", "term_zh": "Emotet 惡意程式", "definitions": { "brief": "被稱為「最危險惡意程式」的模組化殭屍網路", "standard": "Emotet 最初是銀行木馬，後演變為惡意程式散播平台，\n透過惡意郵件大規模散播，為其他惡意程式（如 TrickBot、勒索軟體）開路。\n" }, "category": "malware", "subcategory": "botnet", "tags": [ "殭屍網路", "銀行木馬", "垃圾郵件" ], "related_terms": [ "trickbot", "qakbot" ], "aliases": {} }, { "id": "trickbot", "term_en": "TrickBot", "term_zh": "TrickBot 惡意程式", "definitions": { "brief": "多功能模組化惡意程式和殭屍網路", "standard": "TrickBot 是高度模組化的惡意程式，具備銀行木馬、\n憑證竊取、橫向移動等功能，常與勒索軟體合作。\n" }, "category": "malware", "subcategory": "botnet", "tags": [ "殭屍網路", "模組化", "銀行木馬" ], "related_terms": [ "emotet", "conti" ], "aliases": {} }, { "id": "qakbot", "term_en": "QakBot", "term_zh": "QakBot 惡意程式", "definitions": { "brief": "歷史悠久的銀行木馬和惡意程式載入器", "standard": "QakBot（又名 QBot）最初是銀行木馬，\n現主要作為惡意程式載入器，為勒索軟體等提供初始存取。\n" }, "category": "malware", "subcategory": "botnet", "tags": [ "殭屍網路", "銀行木馬", "載入器" ], "related_terms": [ "emotet", "loader" ], "aliases": { "en": [ "QBot", "Pinkslipbot" ] } }, { "id": "cobalt_strike", "term_en": "Cobalt Strike", "term_zh": "Cobalt Strike", "definitions": { "brief": "被威脅行為者廣泛濫用的商業滲透測試工具", "standard": "Cobalt Strike 原是合法的紅隊滲透測試工具，\n但被竊版後被大量攻擊者濫用於實際攻擊，\n其 Beacon 元件是最常見的攻擊酬載之一。\n" }, "category": "malware", "subcategory": "c2_framework", "tags": [ "C2", "紅隊工具", "濫用" ], "related_terms": [ "c2", "beacon" ], "aliases": {} }, { "id": "mimikatz", "term_en": "Mimikatz", "term_zh": "Mimikatz", "definitions": { "brief": "用於從 Windows 記憶體提取憑證的工具", "standard": "Mimikatz 是可從 Windows 記憶體中提取明文密碼、雜湊值、\nKerberos 票證的工具，被攻擊者廣泛用於橫向移動。\n" }, "category": "malware", "subcategory": "hacking_tool", "tags": [ "憑證竊取", "Windows", "駭客工具" ], "related_terms": [ "lateral_movement", "credential_theft" ], "aliases": {} }, { "id": "bootkit", "term_en": "Bootkit", "term_zh": "開機套件", "definitions": { "brief": "感染系統開機程序以維持持久化的惡意程式", "standard": "開機套件是一種進階惡意程式，感染 MBR、VBR 或 UEFI 韌體，\n在作業系統啟動前載入，可繞過大多數安全軟體偵測。\n" }, "category": "malware", "subcategory": "", "tags": [ "持久化", "韌體", "核心層" ], "related_terms": [ "rootkit", "uefi_malware" ], "aliases": {} }, { "id": "banking_trojan", "term_en": "Banking Trojan", "term_zh": "銀行木馬", "definitions": { "brief": "專門竊取網路銀行憑證和金融資訊的木馬", "standard": "銀行木馬是專門針對網路銀行使用者的惡意程式，\n可攔截網銀登入憑證、注入假頁面、操控交易內容。\n" }, "category": "malware", "subcategory": "", "tags": [ "金融詐騙", "憑證竊取", "網頁注入" ], "related_terms": [ "trojan", "infostealer" ], "aliases": {} }, { "id": "screen_locker", "term_en": "Screen Locker", "term_zh": "螢幕鎖定程式", "definitions": { "brief": "鎖定使用者螢幕並要求付費解鎖的惡意程式", "standard": "螢幕鎖定程式是早期勒索軟體的形式，不加密檔案，\n而是鎖定使用者桌面，顯示假冒執法機構的警告要求付款。\n" }, "category": "malware", "subcategory": "", "tags": [ "勒索", "桌面鎖定" ], "related_terms": [ "ransomware", "scareware" ], "aliases": {} }, { "id": "scareware", "term_en": "Scareware", "term_zh": "恐嚇軟體", "definitions": { "brief": "透過虛假安全警告誘騙使用者付費的軟體", "standard": "恐嚇軟體顯示虛假的病毒感染或系統問題警告，\n誘騙使用者購買假的安全軟體或支付「清理」費用。\n" }, "category": "malware", "subcategory": "", "tags": [ "詐騙", "社交工程", "假安全軟體" ], "related_terms": [ "adware" ], "aliases": {} }, { "id": "fileless_malware", "term_en": "Fileless Malware", "term_zh": "無檔案惡意程式", "definitions": { "brief": "不在硬碟上留下痕跡的惡意程式", "standard": "無檔案惡意程式僅存在於記憶體中執行，\n利用合法系統工具如 PowerShell、WMI 進行攻擊，\n大幅增加偵測和鑑識難度。\n" }, "category": "malware", "subcategory": "", "tags": [ "規避偵測", "記憶體", "進階攻擊" ], "related_terms": [ "fileless_attack", "living_off_the_land" ], "aliases": {} }, { "id": "akira", "term_en": "Akira", "term_zh": "Akira 勒索軟體", "definitions": { "brief": "2023 年出現的快速成長勒索軟體組織", "standard": "Akira 是 2023 年 3 月出現的勒索軟體家族，\n以復古風格的暗網網站著稱，主要針對中小企業，\n透過 VPN 漏洞或竊取憑證入侵。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "RaaS", "雙重勒索" ], "related_terms": [ "ransomware", "raas" ], "aliases": {} }, { "id": "rhysida", "term_en": "Rhysida", "term_zh": "Rhysida 勒索軟體", "definitions": { "brief": "針對教育和醫療機構的勒索軟體組織", "standard": "Rhysida 是 2023 年出現的勒索軟體，\n主要攻擊教育機構、醫院和政府機關，\n曾攻擊大英圖書館造成嚴重服務中斷。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "醫療", "教育" ], "related_terms": [ "ransomware" ], "aliases": {} }, { "id": "bianlian", "term_en": "BianLian", "term_zh": "BianLian 勒索軟體", "definitions": { "brief": "從加密轉向純資料勒索的勒索軟體組織", "standard": "BianLian 是 2022 年出現的勒索軟體組織，\n後來放棄加密轉向純資料外洩勒索策略，\n主要針對醫療、製造、專業服務等產業。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "資料勒索" ], "related_terms": [ "ransomware", "data_exfiltration" ], "aliases": {} }, { "id": "royal", "term_en": "Royal", "term_zh": "Royal 勒索軟體", "definitions": { "brief": "由前 Conti 成員組成的高調勒索軟體", "standard": "Royal 勒索軟體於 2022 年出現，據信由前 Conti 成員組成，\n不採用 RaaS 模式，主要針對美國企業進行攻擊。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "Conti" ], "related_terms": [ "ransomware", "conti", "blacksuit" ], "aliases": {} }, { "id": "blacksuit", "term_en": "BlackSuit", "term_zh": "BlackSuit 勒索軟體", "definitions": { "brief": "Royal 勒索軟體的更名後繼者", "standard": "BlackSuit 是 Royal 勒索軟體的更名版本，\n於 2023 年出現，繼承 Royal 的攻擊手法和基礎設施。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "Royal" ], "related_terms": [ "ransomware", "royal" ], "aliases": {} }, { "id": "hunters_international", "term_en": "Hunters International", "term_zh": "Hunters International 勒索軟體", "definitions": { "brief": "接手 Hive 程式碼的新興勒索軟體組織", "standard": "Hunters International 於 2023 年出現，\n使用與 Hive 勒索軟體相似的程式碼，\n但宣稱不是 Hive 的更名而是獨立取得程式碼。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "Hive" ], "related_terms": [ "ransomware" ], "aliases": {} }, { "id": "lumma_stealer", "term_en": "Lumma Stealer", "term_zh": "Lumma 資訊竊取程式", "definitions": { "brief": "以 MaaS 模式販售的資訊竊取惡意程式", "standard": "Lumma Stealer 是 2022 年出現的資訊竊取程式，\n以惡意程式即服務（MaaS）模式販售，\n可竊取瀏覽器資料、加密貨幣錢包、憑證等。\n" }, "category": "malware", "subcategory": "infostealer", "tags": [ "資訊竊取", "MaaS", "憑證" ], "related_terms": [ "infostealer", "redline_stealer" ], "aliases": {} }, { "id": "redline_stealer", "term_en": "RedLine Stealer", "term_zh": "RedLine 資訊竊取程式", "definitions": { "brief": "最廣泛使用的資訊竊取惡意程式之一", "standard": "RedLine Stealer 是活躍的資訊竊取程式，\n可竊取瀏覽器儲存的密碼、Cookie、信用卡資訊、\n加密貨幣錢包及系統資訊，常透過惡意廣告散播。\n" }, "category": "malware", "subcategory": "infostealer", "tags": [ "資訊竊取", "憑證", "加密貨幣" ], "related_terms": [ "infostealer", "lumma_stealer" ], "aliases": {} }, { "id": "raccoon_stealer", "term_en": "Raccoon Stealer", "term_zh": "Raccoon 資訊竊取程式", "definitions": { "brief": "功能豐富的商業化資訊竊取程式", "standard": "Raccoon Stealer 是功能齊全的 MaaS 資訊竊取程式，\n可竊取 60 多種應用程式的資料，\n2022 年推出 2.0 版本後持續活躍。\n" }, "category": "malware", "subcategory": "infostealer", "tags": [ "資訊竊取", "MaaS" ], "related_terms": [ "infostealer" ], "aliases": {} }, { "id": "vidar", "term_en": "Vidar", "term_zh": "Vidar 資訊竊取程式", "definitions": { "brief": "常透過惡意廣告散播的資訊竊取程式", "standard": "Vidar 是基於 Arkei 程式碼的資訊竊取程式，\n可竊取瀏覽器資料、加密貨幣錢包、FTP 憑證等，\n常透過惡意 Google 廣告散播。\n" }, "category": "malware", "subcategory": "infostealer", "tags": [ "資訊竊取", "惡意廣告" ], "related_terms": [ "infostealer", "malvertising" ], "aliases": {} }, { "id": "pikabot", "term_en": "PikaBot", "term_zh": "PikaBot 惡意程式", "definitions": { "brief": "取代 QakBot 的新型載入器惡意程式", "standard": "PikaBot 是 2023 年出現的模組化惡意程式載入器，\n在 QakBot 遭執法打擊後填補市場空缺，\n可執行任意命令並載入其他惡意程式。\n" }, "category": "malware", "subcategory": "loader", "tags": [ "載入器", "殭屍網路" ], "related_terms": [ "loader", "qakbot" ], "aliases": {} }, { "id": "darkgate", "term_en": "DarkGate", "term_zh": "DarkGate 惡意程式", "definitions": { "brief": "功能豐富的商業化載入器和 RAT", "standard": "DarkGate 是功能齊全的惡意程式載入器，\n具備 RAT、資訊竊取、加密貨幣挖礦等功能，\n透過釣魚郵件和惡意廣告散播。\n" }, "category": "malware", "subcategory": "loader", "tags": [ "載入器", "RAT", "多功能" ], "related_terms": [ "loader", "rat" ], "aliases": {} }, { "id": "asyncrat", "term_en": "AsyncRAT", "term_zh": "AsyncRAT 遠端存取木馬", "definitions": { "brief": "開源的 .NET 遠端存取木馬", "standard": "AsyncRAT 是開源的遠端存取木馬，\n提供螢幕監控、鍵盤側錄、檔案管理等功能，\n因原始碼公開而被大量修改和使用。\n" }, "category": "malware", "subcategory": "rat", "tags": [ "RAT", ".NET", "開源" ], "related_terms": [ "rat" ], "aliases": {} }, { "id": "remcos", "term_en": "Remcos", "term_zh": "Remcos 遠端控制工具", "definitions": { "brief": "被廣泛濫用的商業遠端控制工具", "standard": "Remcos 原為合法的遠端管理工具，\n但被攻擊者廣泛濫用於惡意目的，\n透過釣魚郵件散播，具備完整的遠端控制功能。\n" }, "category": "malware", "subcategory": "rat", "tags": [ "RAT", "商業工具", "濫用" ], "related_terms": [ "rat", "cobalt_strike" ], "aliases": {} }, { "id": "icedid", "term_en": "IcedID", "term_zh": "IcedID 惡意程式", "definitions": { "brief": "從銀行木馬演變為惡意程式載入器", "standard": "IcedID（又名 BokBot）最初是銀行木馬，\n後演變為專門投放勒索軟體等惡意程式的載入器，\n是多個勒索軟體攻擊的入侵媒介。\n" }, "category": "malware", "subcategory": "loader", "tags": [ "載入器", "銀行木馬", "勒索軟體" ], "related_terms": [ "loader", "banking_trojan" ], "aliases": { "en": [ "BokBot" ] } }, { "id": "bumblebee", "term_en": "Bumblebee", "term_zh": "Bumblebee 惡意程式", "definitions": { "brief": "與多個勒索軟體組織合作的載入器", "standard": "Bumblebee 是 2022 年出現的惡意程式載入器，\n據信由前 Conti 成員開發，用於投放勒索軟體，\n透過釣魚郵件和惡意 ISO 檔案散播。\n" }, "category": "malware", "subcategory": "loader", "tags": [ "載入器", "Conti", "勒索軟體" ], "related_terms": [ "loader", "conti" ], "aliases": {} }, { "id": "fog", "term_en": "Fog", "term_zh": "Fog 勒索軟體", "definitions": { "brief": "2024 年出現針對教育和娛樂產業的勒索軟體", "standard": "Fog 是 2024 年出現的勒索軟體家族，\n主要攻擊美國教育機構和娛樂產業，\n透過竊取的 VPN 憑證入侵，加密速度快。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "教育", "VPN" ], "related_terms": [ "ransomware" ], "aliases": {} }, { "id": "meduza", "term_en": "Meduza Stealer", "term_zh": "Meduza 資訊竊取程式", "definitions": { "brief": "2023 年出現的多功能資訊竊取程式", "standard": "Meduza Stealer 是功能豐富的資訊竊取程式，\n可竊取瀏覽器資料、加密貨幣錢包、密碼管理器和系統資訊，\n以 MaaS 模式在地下論壇販售。\n" }, "category": "malware", "subcategory": "infostealer", "tags": [ "資訊竊取", "MaaS", "加密貨幣" ], "related_terms": [ "infostealer", "lumma_stealer" ], "aliases": {} }, { "id": "wannacry", "term_en": "WannaCry", "term_zh": "WannaCry 勒索蠕蟲", "definitions": { "brief": "2017 年大規模爆發的勒索軟體蠕蟲", "standard": "WannaCry 是 2017 年 5 月爆發的勒索軟體蠕蟲，\n利用 EternalBlue 漏洞自動傳播，\n在全球造成數十萬台電腦感染，被認為與北韓有關。\n" }, "category": "malware", "subcategory": "ransomware_family", "tags": [ "勒索軟體", "蠕蟲", "北韓", "EternalBlue" ], "related_terms": [ "ransomware", "worm", "lazarus" ], "aliases": {} }, { "id": "notpetya", "term_en": "NotPetya", "term_zh": "NotPetya 破壞性蠕蟲", "definitions": { "brief": "偽裝成勒索軟體的破壞性惡意程式", "standard": "NotPetya 於 2017 年爆發，表面上是勒索軟體，\n實際上是設計來破壞資料的擦除器，\n主要針對烏克蘭，被認為是俄羅斯發動的破壞性攻擊。\n" }, "category": "malware", "subcategory": "worm", "tags": [ "擦除器", "俄羅斯", "烏克蘭", "破壞性攻擊" ], "related_terms": [ "wiper", "sandworm", "wannacry" ], "aliases": {} }, { "id": "plugx", "term_en": "PlugX", "term_zh": "PlugX 遠端存取木馬", "definitions": { "brief": "中國 APT 組織常用的遠端存取木馬", "standard": "PlugX 是模組化的遠端存取木馬，\n自 2008 年以來被多個中國 APT 組織使用，\n具有側載技術、模組化架構等特點。\n" }, "category": "malware", "subcategory": "rat", "tags": [ "RAT", "中國", "APT", "模組化" ], "related_terms": [ "rat", "mustang_panda", "apt41" ], "aliases": {} }, { "id": "beacon", "term_en": "Beacon", "term_zh": "Beacon 植入程式", "definitions": { "brief": "Cobalt Strike 框架的植入程式元件", "standard": "Beacon 是 Cobalt Strike 滲透測試框架的植入程式，\n提供 C2 通訊、後滲透操作等功能，\n因功能強大被攻擊者廣泛濫用。\n" }, "category": "malware", "subcategory": "trojan", "tags": [ "C2", "紅隊工具", "商業工具" ], "related_terms": [ "cobalt_strike", "c2", "rat" ], "aliases": {} }, { "id": "magecart", "term_en": "Magecart", "term_zh": "Magecart 竊卡攻擊", "definitions": { "brief": "針對電商網站竊取信用卡資訊的攻擊", "standard": "Magecart 是多個網路犯罪集團的總稱，\n專門在電商網站注入惡意 JavaScript 竊取客戶信用卡資訊，\n又稱為網頁側錄或 formjacking。\n" }, "category": "malware", "subcategory": "other", "tags": [ "信用卡", "網頁攻擊", "JavaScript" ], "related_terms": [ "formjacking", "skimmer" ], "aliases": {} }, { "id": "stalkerware", "term_en": "Stalkerware", "term_zh": "跟蹤軟體", "definitions": { "brief": "用於監控他人裝置的間諜軟體", "standard": "跟蹤軟體是一種間諜軟體，\n通常由親密伴侶或家人安裝來監控受害者，\n可追蹤位置、讀取訊息、監聽通話，是家庭暴力的工具。\n" }, "category": "malware", "subcategory": "spyware", "tags": [ "間諜軟體", "隱私", "行動裝置" ], "related_terms": [ "spyware" ], "aliases": { "zh": [ "追蹤軟體", "監控軟體" ] } }, { "id": "uefi_malware", "term_en": "UEFI Malware", "term_zh": "UEFI 惡意程式", "definitions": { "brief": "感染 UEFI 韌體的持久性惡意程式", "standard": "UEFI 惡意程式感染系統的 UEFI 韌體，\n在作業系統啟動前執行，\n極難偵測和移除，可在重灌系統後持續存在。\n" }, "category": "malware", "subcategory": "rootkit", "tags": [ "韌體", "持久化", "rootkit" ], "related_terms": [ "bootkit", "rootkit" ], "aliases": {} }, { "id": "skimmer", "term_en": "Skimmer", "term_zh": "側錄程式", "definitions": { "brief": "竊取支付卡資訊的惡意程式", "standard": "側錄程式是用於竊取信用卡或支付卡資訊的惡意程式，\n可以是實體設備（ATM 側錄器）或網頁注入程式碼，\nMagecart 是著名的網頁側錄攻擊。\n" }, "category": "malware", "subcategory": "other", "tags": [ "信用卡", "支付安全", "網頁攻擊" ], "related_terms": [ "magecart", "formjacking" ], "aliases": { "zh": [ "卡片側錄器" ] } }, { "id": "packer", "term_en": "Packer", "term_zh": "加殼程式", "definitions": { "brief": "壓縮和加密惡意程式以規避偵測的工具", "standard": "加殼程式用於壓縮、加密或混淆惡意程式，\n使其難以被防毒軟體偵測和逆向工程分析，\n常見的加殼工具包括 UPX、Themida 等。\n" }, "category": "malware", "subcategory": "other", "tags": [ "規避偵測", "混淆", "惡意程式" ], "related_terms": [ "obfuscation" ], "aliases": {} }, { "id": "crypter", "term_en": "Crypter", "term_zh": "加密器", "definitions": { "brief": "加密惡意程式以規避防毒偵測的工具", "standard": "加密器是專門用於加密惡意程式的工具，\n使惡意程式的特徵碼無法被防毒軟體識別，\n在地下市場中 FUD（完全無法偵測）加密器是熱門商品。\n" }, "category": "malware", "subcategory": "other", "tags": [ "規避偵測", "加密", "惡意程式" ], "related_terms": [ "packer", "obfuscation" ], "aliases": {} }, { "id": "xworm", "term_en": "XWorm", "term_zh": "XWorm", "definitions": { "brief": "具備 RAT 與竊密功能的多用途惡意程式", "standard": "XWorm 是 2022 年出現的多功能惡意程式，\n結合遠端存取木馬（RAT）和資訊竊密程式功能，\n可竊取瀏覽器憑證、加密貨幣錢包和鍵盤記錄，\n在地下論壇以低廉價格出售，被多個威脅行為者廣泛採用。\n" }, "category": "malware", "subcategory": "rat", "tags": [ "RAT", "竊密程式", "MaaS" ], "related_terms": [ "stealc", "infostealer" ], "aliases": {} }, { "id": "stealc", "term_en": "StealC", "term_zh": "StealC", "definitions": { "brief": "以訂閱制提供的資訊竊密程式（MaaS 模式）", "standard": "StealC 是 2023 年出現的資訊竊密惡意程式，\n以惡意程式即服務（MaaS）模式在地下論壇販售，\n可竊取瀏覽器密碼、Cookie、加密貨幣錢包和即時通訊軟體資料，\n介面設計仿照 Vidar 和 Raccoon Stealer。\n" }, "category": "malware", "subcategory": "infostealer", "tags": [ "竊密程式", "MaaS", "加密貨幣" ], "related_terms": [ "xworm", "infostealer" ], "aliases": {} }, { "id": "banshee_stealer", "term_en": "Banshee Stealer", "term_zh": "Banshee 竊密程式", "definitions": { "brief": "針對 macOS 的資訊竊密程式，竊取加密貨幣錢包", "standard": "Banshee Stealer 是 2024 年出現的 macOS 平台資訊竊密程式，\n可竊取 Safari 和 Chrome 瀏覽器密碼、\n加密貨幣錢包（如 Exodus、Electrum）及系統資訊，\n以 MaaS 模式販售，每月訂閱費用約 3,000 美元。\n" }, "category": "malware", "subcategory": "infostealer", "tags": [ "macOS", "竊密程式", "加密貨幣", "MaaS" ], "related_terms": [ "stealc", "infostealer" ], "aliases": {} }, { "id": "gh0strat", "term_en": "Gh0stRAT", "term_zh": "Gh0stRAT", "definitions": { "brief": "源自中國廣泛用於 APT 攻擊的遠端存取特洛伊木馬程式", "standard": "Gh0stRAT 是源自中國的開源遠端存取特洛伊木馬程式，\n原始碼外洩後被多個 APT 組織和網路犯罪集團改造使用，\n具備完整的遠端控制、螢幕截圖、鍵盤記錄和檔案管理功能，\n是針對亞洲政府和企業攻擊中最常見的工具之一。\n" }, "category": "malware", "subcategory": "rat", "tags": [ "RAT", "中國", "APT", "開源" ], "related_terms": [ "plugx", "poison_ivy" ], "aliases": {} }, { "id": "snake_malware", "term_en": "Snake", "term_zh": "Snake 惡意程式", "definitions": { "brief": "俄羅斯 Turla 組織開發的高度複雜間諜軟體平台", "standard": "Snake（亦稱 Uroburos）是俄羅斯 Turla APT 組織開發的高度複雜惡意程式平台，\n具備模組化架構和點對點加密通訊能力，\n可在感染主機上建立隱蔽的長期駐留，\n2023 年被美國 FBI 主導的「Medusa 行動」摧毀其基礎設施。\n" }, "category": "malware", "subcategory": "backdoor", "tags": [ "俄羅斯", "Turla", "間諜軟體", "APT" ], "related_terms": [ "turla", "apt29" ], "aliases": {} }, { "id": "goldmax", "term_en": "GoldMax", "term_zh": "GoldMax", "definitions": { "brief": "APT29 用於 SolarWinds 攻擊的後門程式", "standard": "GoldMax 是 APT29（Midnight Blizzard）在 SolarWinds 供應鏈攻擊中使用的後門程式，\n偽裝成合法網路流量以規避偵測，\n可接受命令執行任意操作，\n與 SUNBURST 等惡意程式組成完整的攻擊工具鏈。\n" }, "category": "malware", "subcategory": "backdoor", "tags": [ "俄羅斯", "APT29", "SolarWinds", "供應鏈攻擊" ], "related_terms": [ "midnight_blizzard", "cozy_bear" ], "aliases": {} }, { "id": "industroyer", "term_en": "Industroyer", "term_zh": "Industroyer", "definitions": { "brief": "攻擊工業控制系統的惡意程式，曾造成烏克蘭停電", "standard": "Industroyer（亦稱 Crashoverride）是針對工業控制系統（ICS）的惡意程式，\n由俄羅斯 Sandworm APT 組織開發，\n2016 年造成烏克蘭基輔大規模停電，\n是已知少數能直接操控工業設備協定的惡意程式之一。\n" }, "category": "malware", "subcategory": "ics_malware", "tags": [ "ICS", "OT", "電力基礎設施", "俄羅斯" ], "related_terms": [ "triton", "stuxnet" ], "aliases": {} }, { "id": "triton", "term_en": "TRITON", "term_zh": "TRITON", "definitions": { "brief": "針對工業安全系統（SIS）的破壞性惡意程式", "standard": "TRITON（亦稱 TRISIS、HatMan）是針對工業安全系統（SIS）的惡意程式，\n2017 年攻擊沙烏地阿拉伯石化廠，\n試圖關閉安全儀控系統以觸發物理破壞，\n被認為是史上第一個專門針對安全儀控系統的惡意程式。\n" }, "category": "malware", "subcategory": "ics_malware", "tags": [ "ICS", "OT", "安全系統", "石化" ], "related_terms": [ "industroyer", "stuxnet" ], "aliases": {} }, { "id": "finfisher", "term_en": "FinFisher", "term_zh": "FinFisher 商業間諜軟體", "definitions": { "brief": "合法販售給政府機關的商業監控間諜軟體", "standard": "FinFisher（亦稱 FinSpy）是由德國公司 FinFisher GmbH 開發的商業間諜軟體，\n以合法名義銷售給各國政府和執法機關，\n具備遠端監控、通話攔截、鍵盤記錄和攝影機啟動等功能，\n因被用於監控異見人士和記者而引發爭議。\n" }, "category": "malware", "subcategory": "spyware", "tags": [ "商業間諜軟體", "政府", "監控", "合法惡意程式" ], "related_terms": [ "pegasus", "stalkerware" ], "aliases": {} }, { "id": "netsupport_rat", "term_en": "NetSupport RAT", "term_zh": "NetSupport RAT", "definitions": { "brief": "由合法遠端管理工具改造的遠端存取特洛伊木馬程式", "standard": "NetSupport RAT 是攻擊者將合法的 NetSupport Manager 遠端管理軟體改造為惡意工具，\n常透過釣魚郵件或惡意廣告傳播，\n建立後可提供攻擊者完整的遠端控制能力，\n因使用合法軟體簽章而常能繞過安全防護。\n" }, "category": "malware", "subcategory": "rat", "tags": [ "RAT", "合法工具濫用", "釣魚郵件" ], "related_terms": [ "lolbins", "gh0strat" ], "aliases": {} }, { "id": "siem", "term_en": "SIEM", "term_zh": "安全資訊與事件管理", "definitions": { "brief": "集中收集、分析安全日誌並偵測威脅的平台", "standard": "SIEM 是一種安全解決方案，集中收集來自網路設備、伺服器、\n應用程式等的日誌資料，透過關聯分析和規則比對偵測可疑活動。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "SOC", "日誌管理", "威脅偵測" ], "related_terms": [ "soc", "soar", "xdr" ], "aliases": {} }, { "id": "soar", "term_en": "SOAR", "term_zh": "安全協作自動化與回應", "definitions": { "brief": "整合安全工具並自動化事件回應流程的平台", "standard": "SOAR 平台整合組織內的多種安全工具，\n透過劇本（Playbook）自動化重複性的事件回應流程，\n減少分析師工作負擔，加速威脅回應速度。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [], "related_terms": [ "siem", "soc" ], "aliases": {} }, { "id": "xdr", "term_en": "XDR", "term_zh": "延伸式偵測與回應", "definitions": { "brief": "跨多種安全層整合偵測與回應能力的解決方案", "standard": "XDR 整合端點、網路、雲端、郵件等多種安全資料來源，\n提供跨環境的威脅偵測、調查和自動化回應能力。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [], "related_terms": [ "edr", "siem", "mdr" ], "aliases": {} }, { "id": "edr", "term_en": "EDR", "term_zh": "端點偵測與回應", "definitions": { "brief": "監控端點設備以偵測和回應威脅的安全解決方案", "standard": "EDR 持續監控端點（電腦、伺服器）的活動，\n收集遙測資料並使用行為分析偵測威脅，\n提供事件調查、威脅獵捕和自動化回應功能。\n" }, "category": "technologies", "subcategory": "endpoint_security", "tags": [], "related_terms": [ "xdr", "antivirus" ], "aliases": {} }, { "id": "firewall", "term_en": "Firewall", "term_zh": "防火牆", "definitions": { "brief": "監控和控制網路流量的安全設備", "standard": "防火牆是網路安全的基本設備，根據預設規則\n監控進出網路的流量，允許或阻擋特定的網路連線。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [], "related_terms": [ "ngfw", "waf" ], "aliases": {} }, { "id": "ngfw", "term_en": "NGFW", "term_zh": "次世代防火牆", "definitions": { "brief": "具備應用程式感知和進階威脅防護的防火牆", "standard": "次世代防火牆除了傳統的封包過濾功能外，\n還整合深度封包檢測、應用程式識別、入侵防禦、\n惡意程式防護等進階功能，提供更全面的網路保護。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [], "related_terms": [ "firewall", "ips" ], "aliases": {} }, { "id": "waf", "term_en": "WAF", "term_zh": "網頁應用程式防火牆", "definitions": { "brief": "保護網頁應用程式免受常見攻擊的安全設備", "standard": "WAF 專門保護網頁應用程式，過濾和監控 HTTP 流量，\n防禦 SQL 注入、XSS、CSRF 等常見網頁攻擊。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [], "related_terms": [ "sql_injection", "xss" ], "aliases": {} }, { "id": "ids", "term_en": "IDS", "term_zh": "入侵偵測系統", "definitions": { "brief": "監控網路或系統活動以偵測惡意行為的系統", "standard": "入侵偵測系統透過特徵比對或異常行為分析，\n偵測網路或主機上的可疑活動並發出警示，\n本身不會阻擋攻擊，僅提供偵測和警告功能。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [], "related_terms": [ "ips", "siem" ], "aliases": {} }, { "id": "ips", "term_en": "IPS", "term_zh": "入侵防禦系統", "definitions": { "brief": "可主動阻擋偵測到的惡意活動的安全系統", "standard": "入侵防禦系統是 IDS 的進階版本，\n除了偵測功能外還能主動阻擋惡意流量，\n通常部署在網路入口處即時阻止攻擊。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [], "related_terms": [ "ids", "ngfw" ], "aliases": {} }, { "id": "vpn", "term_en": "VPN", "term_zh": "虛擬私人網路", "definitions": { "brief": "透過加密通道在公共網路上建立私密連線", "standard": "VPN 透過加密技術在公共網路上建立安全的私密通道，\n保護傳輸中的資料不被竊聽，常用於遠端存取企業網路，\n傳統 VPN 正逐漸被 ZTNA 等現代方案取代。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [], "related_terms": [ "encryption", "ztna" ], "aliases": {} }, { "id": "ztna", "term_en": "ZTNA", "term_zh": "零信任網路存取", "definitions": { "brief": "基於零信任原則的遠端存取解決方案", "standard": "ZTNA 是實現零信任架構的技術，不再信任網路位置，\n而是基於使用者身分、設備狀態和情境動態授予存取權限，\n是 VPN 的現代替代方案。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "零信任", "遠端存取", "VPN 替代" ], "related_terms": [ "zero_trust", "vpn", "sase" ], "aliases": {} }, { "id": "zero_trust", "term_en": "Zero Trust", "term_zh": "零信任", "definitions": { "brief": "永不信任、持續驗證的安全架構理念", "standard": "零信任是一種安全模型，假設威脅可能存在於網路內外任何位置，\n因此不論使用者或裝置位於何處，都需要持續驗證才能存取資源。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "架構", "策略" ], "related_terms": [ "ztna", "mfa" ], "aliases": {} }, { "id": "mfa", "term_en": "MFA", "term_zh": "多因子驗證", "definitions": { "brief": "要求使用者提供兩種以上驗證因子的身分驗證方式", "standard": "多因子驗證要求使用者提供兩種或以上的驗證因子：\n知識因子（密碼）、持有因子（手機）、生物因子（指紋）。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "身分驗證", "帳號安全" ], "related_terms": [ "two_factor_auth", "sso" ], "aliases": { "zh": [ "多重驗證", "雙因子驗證", "2FA" ] } }, { "id": "sso", "term_en": "SSO", "term_zh": "單一登入", "definitions": { "brief": "使用者只需登入一次即可存取多個應用程式", "standard": "單一登入讓使用者只需驗證一次身分，\n即可存取組織內所有已整合的應用程式和服務，\n常見協定包括 SAML、OAuth 和 OpenID Connect。\n" }, "category": "technologies", "subcategory": "identity", "tags": [], "related_terms": [ "mfa", "saml", "oauth" ], "aliases": {} }, { "id": "pam", "term_en": "PAM", "term_zh": "特權存取管理", "definitions": { "brief": "管理和監控特權帳號存取的安全解決方案", "standard": "PAM 解決方案集中管理組織內的特權帳號（如管理員帳號），\n提供密碼保管、存取控制、工作階段錄影等功能。\n" }, "category": "technologies", "subcategory": "identity", "tags": [], "related_terms": [ "privileged_account", "least_privilege" ], "aliases": {} }, { "id": "iam", "term_en": "IAM", "term_zh": "身分與存取管理", "definitions": { "brief": "管理使用者身分和存取權限的框架與解決方案", "standard": "IAM 是管理數位身分和存取權限的系統框架，\n涵蓋使用者生命週期管理、身分驗證、授權、\n存取稽核等功能，確保正確的人存取正確的資源。\n" }, "category": "technologies", "subcategory": "identity", "tags": [], "related_terms": [ "pam", "sso", "mfa" ], "aliases": {} }, { "id": "dlp", "term_en": "DLP", "term_zh": "資料外洩防護", "definitions": { "brief": "防止敏感資料未經授權外流的安全技術", "standard": "DLP 解決方案監控和控制敏感資料的使用與傳輸，\n可偵測並阻止透過電子郵件、雲端儲存、USB 等\n管道外洩機密資訊，是資料保護的重要工具。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [], "related_terms": [ "data_classification", "encryption" ], "aliases": {} }, { "id": "encryption", "term_en": "Encryption", "term_zh": "加密", "definitions": { "brief": "將資料轉換為無法直接讀取的格式以保護機密性", "standard": "加密使用演算法將明文轉換為密文，\n只有擁有正確金鑰者才能解密還原，\n分為對稱式加密（AES）和非對稱式加密（RSA）兩類。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [], "related_terms": [ "aes", "rsa", "tls" ], "aliases": {} }, { "id": "casb", "term_en": "CASB", "term_zh": "雲端存取安全代理", "definitions": { "brief": "在使用者和雲端服務之間執行安全政策的解決方案", "standard": "CASB 作為使用者和雲端服務之間的安全閘道，\n提供可見性、合規性、資料保護和威脅防護功能，\n可發現影子 IT 並控制雲端應用程式的使用。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [], "related_terms": [ "shadow_it", "dlp" ], "aliases": {} }, { "id": "cspm", "term_en": "CSPM", "term_zh": "雲端安全態勢管理", "definitions": { "brief": "持續監控和改善雲端環境安全設定的解決方案", "standard": "CSPM 持續掃描雲端環境中的設定錯誤和合規問題，\n自動偵測暴露的儲存桶、過度授權等風險，\n協助組織維持安全的雲端配置。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [], "related_terms": [ "misconfiguration", "cloud_security" ], "aliases": {} }, { "id": "cwpp", "term_en": "CWPP", "term_zh": "雲端工作負載保護平台", "definitions": { "brief": "保護雲端環境中各類工作負載的安全解決方案", "standard": "CWPP 保護雲端環境中的各種工作負載，\n包括虛擬機器、容器和無伺服器函式，\n提供漏洞管理、惡意程式防護和執行時期保護。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [], "related_terms": [ "container_security", "serverless" ], "aliases": {} }, { "id": "sase", "term_en": "SASE", "term_zh": "安全存取服務邊緣", "definitions": { "brief": "結合網路和安全功能的雲端架構", "standard": "SASE 是一種雲端交付的架構，將 SD-WAN 與多種安全功能\n（如 SWG、CASB、FWaaS、ZTNA）整合，提供統一的安全存取。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "雲端", "零信任", "邊緣" ], "related_terms": [ "ztna", "swg", "casb" ], "aliases": {} }, { "id": "ueba", "term_en": "UEBA", "term_zh": "使用者與實體行為分析", "definitions": { "brief": "透過機器學習分析異常行為的安全技術", "standard": "UEBA 利用機器學習建立使用者和實體的正常行為基線，\n偵測偏離基線的異常行為，可發現內部威脅和帳號入侵。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "機器學習", "異常偵測", "內部威脅" ], "related_terms": [ "siem", "insider_threat" ], "aliases": {} }, { "id": "ndr", "term_en": "NDR", "term_zh": "網路偵測與回應", "definitions": { "brief": "監控網路流量以偵測威脅的安全解決方案", "standard": "NDR 透過分析網路流量、使用機器學習和行為分析，\n偵測網路中的異常活動和威脅，補強端點安全的盲點。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路監控", "威脅偵測", "流量分析" ], "related_terms": [ "edr", "xdr" ], "aliases": {} }, { "id": "asm", "term_en": "ASM", "term_zh": "攻擊面管理", "definitions": { "brief": "持續發現、分析和監控組織暴露資產的流程", "standard": "攻擊面管理持續掃描和發現組織所有對外暴露的資產，\n包括已知和未知的資產，評估其風險並追蹤變化。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "資產管理", "風險評估", "外部曝險" ], "related_terms": [ "vulnerability_management", "easm" ], "aliases": {} }, { "id": "ciem", "term_en": "CIEM", "term_zh": "雲端基礎設施授權管理", "definitions": { "brief": "管理雲端環境中身分和權限的解決方案", "standard": "CIEM 專注於發現和管理雲端環境中過度授權的問題，\n實施最小權限原則，降低因權限過大造成的風險。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [ "雲端", "身分", "權限管理" ], "related_terms": [ "iam", "cspm" ], "aliases": {} }, { "id": "deception", "term_en": "Deception Technology", "term_zh": "欺敵技術", "definitions": { "brief": "使用誘餌和陷阱偵測攻擊者的安全技術", "standard": "欺敵技術在網路中部署假目標（誘餌帳號、蜜罐系統），\n吸引攻擊者觸及，提供早期預警和威脅情報。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "蜜罐", "誘餌", "早期預警" ], "related_terms": [ "honeypot", "threat_intelligence" ], "aliases": { "zh": [ "誘捕技術" ] } }, { "id": "honeypot", "term_en": "Honeypot", "term_zh": "蜜罐", "definitions": { "brief": "故意設置的誘餌系統，用於吸引和研究攻擊者", "standard": "蜜罐是故意設置的脆弱系統，用於吸引攻擊者，\n收集攻擊手法情報，並及早偵測入侵行為。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "誘餌", "威脅情報", "研究" ], "related_terms": [ "deception" ], "aliases": {} }, { "id": "api_security", "term_en": "API Security", "term_zh": "API 安全", "definitions": { "brief": "保護應用程式介面免受攻擊的安全措施", "standard": "API 安全涵蓋認證、授權、速率限制、輸入驗證等措施，\n保護 API 免受資料外洩、濫用和攻擊。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "API", "應用程式安全", "認證" ], "related_terms": [ "oauth", "api_gateway" ], "aliases": {} }, { "id": "pentesting", "term_en": "Penetration Testing", "term_zh": "滲透測試", "definitions": { "brief": "模擬攻擊者手法評估系統安全性的測試", "standard": "滲透測試由專業人員模擬真實攻擊者的手法，\n嘗試發現和利用系統漏洞，評估組織的安全防護能力。\n" }, "category": "technologies", "subcategory": "security_testing", "tags": [ "紅隊", "安全評估", "漏洞" ], "related_terms": [ "red_team", "vulnerability_assessment" ], "aliases": { "en": [ "Pentest" ], "zh": [ "滲透測試", "PT" ] } }, { "id": "sbom", "term_en": "SBOM", "term_zh": "軟體物料清單", "definitions": { "brief": "列出軟體中所有元件和相依套件的清單", "standard": "軟體物料清單是軟體中使用的所有元件、函式庫和相依套件的詳細清單，\n有助於識別供應鏈風險和已知漏洞，是軟體供應鏈安全的重要工具。\n" }, "category": "technologies", "subcategory": "devsecops", "tags": [ "供應鏈安全", "合規", "漏洞管理" ], "related_terms": [ "supply_chain_attack", "vulnerability_management" ], "aliases": {} }, { "id": "cnapp", "term_en": "CNAPP", "term_zh": "雲原生應用程式保護平台", "definitions": { "brief": "整合多種雲端安全功能的統一平台", "standard": "CNAPP 整合 CSPM、CWPP、CIEM 等雲端安全功能，\n為雲原生應用程式提供從開發到執行時期的完整保護。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [ "雲端", "整合平台", "DevSecOps" ], "related_terms": [ "cspm", "cwpp", "ciem" ], "aliases": {} }, { "id": "dspm", "term_en": "DSPM", "term_zh": "資料安全態勢管理", "definitions": { "brief": "發現和保護雲端環境中敏感資料的解決方案", "standard": "DSPM 自動發現雲端環境中的敏感資料位置，\n評估其曝險風險，並提供資料存取控制和合規建議。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "資料安全", "雲端", "合規" ], "related_terms": [ "dlp", "cspm" ], "aliases": {} }, { "id": "sast", "term_en": "SAST", "term_zh": "靜態應用程式安全測試", "definitions": { "brief": "分析原始碼或二進位碼以發現安全漏洞", "standard": "靜態應用程式安全測試在不執行程式的情況下分析原始碼，\n可在開發早期發現 SQL 注入、XSS 等常見漏洞。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "DevSecOps", "程式碼分析", "漏洞掃描" ], "related_terms": [ "dast", "iast" ], "aliases": {} }, { "id": "dast", "term_en": "DAST", "term_zh": "動態應用程式安全測試", "definitions": { "brief": "在應用程式執行時進行安全測試", "standard": "動態應用程式安全測試透過模擬攻擊測試執行中的應用程式，\n可以發現執行時期才會出現的漏洞，但不需要原始碼。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "DevSecOps", "黑箱測試", "漏洞掃描" ], "related_terms": [ "sast", "iast", "pentesting" ], "aliases": {} }, { "id": "iast", "term_en": "IAST", "term_zh": "互動式應用程式安全測試", "definitions": { "brief": "結合靜態和動態分析的安全測試方法", "standard": "互動式應用程式安全測試結合 SAST 和 DAST 的優點，\n透過在應用程式內部植入代理程式，在執行時分析程式碼行為。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "DevSecOps", "混合測試" ], "related_terms": [ "sast", "dast" ], "aliases": {} }, { "id": "rasp", "term_en": "RASP", "term_zh": "執行時期應用程式自我保護", "definitions": { "brief": "在應用程式內部即時偵測和阻擋攻擊的技術", "standard": "RASP 將安全保護整合到應用程式執行時期，\n可以即時偵測和阻擋攻擊行為，無需修改應用程式碼。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "應用程式安全", "即時防護" ], "related_terms": [ "waf", "iast" ], "aliases": {} }, { "id": "sspm", "term_en": "SSPM", "term_zh": "SaaS 安全態勢管理", "definitions": { "brief": "監控和管理 SaaS 應用程式安全設定的解決方案", "standard": "SSPM 持續監控組織使用的 SaaS 應用程式安全設定，\n偵測設定錯誤、過度授權和合規問題。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [ "SaaS", "設定管理", "合規" ], "related_terms": [ "cspm", "casb" ], "aliases": {} }, { "id": "itdr", "term_en": "ITDR", "term_zh": "身分威脅偵測與回應", "definitions": { "brief": "偵測和回應身分相關安全威脅的解決方案", "standard": "ITDR 專注於偵測針對身分系統的攻擊，\n如憑證竊取、權限提升、帳號接管等，並提供自動化回應。\n" }, "category": "technologies", "subcategory": "identity_security", "tags": [ "身分安全", "威脅偵測", "帳號保護" ], "related_terms": [ "iam", "pam", "edr" ], "aliases": {} }, { "id": "authentication", "term_en": "Authentication", "term_zh": "身分驗證", "definitions": { "brief": "驗證使用者或系統身分的過程", "standard": "身分驗證是確認使用者或系統聲稱身分的過程，\n常見方式包括密碼、生物特徵、數位憑證等，\n是資訊安全的基礎控制措施。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "身分", "存取控制", "安全基礎" ], "related_terms": [ "mfa", "sso", "authorization" ], "aliases": {} }, { "id": "authorization", "term_en": "Authorization", "term_zh": "授權", "definitions": { "brief": "決定使用者可存取哪些資源的過程", "standard": "授權是在身分驗證後，根據使用者的角色或權限，\n決定其可以存取哪些資源和執行哪些操作的過程。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "身分", "存取控制", "權限" ], "related_terms": [ "authentication", "access_control", "rbac" ], "aliases": {} }, { "id": "access_control", "term_en": "Access Control", "term_zh": "存取控制", "definitions": { "brief": "限制對資源存取的安全機制", "standard": "存取控制是管理誰可以存取哪些資源的安全機制，\n包括身分驗證、授權和稽核等功能，\n是資訊安全的核心原則之一。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "安全控制", "權限管理" ], "related_terms": [ "authentication", "authorization", "rbac", "iam" ], "aliases": {} }, { "id": "rbac", "term_en": "RBAC", "term_zh": "角色型存取控制", "definitions": { "brief": "根據使用者角色授予權限的存取控制模型", "standard": "角色型存取控制將權限指派給角色而非個別使用者，\n使用者透過被指派的角色獲得相應權限，\n簡化權限管理並符合最小權限原則。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "存取控制", "權限管理", "角色" ], "related_terms": [ "access_control", "least_privilege" ], "aliases": {} }, { "id": "network_monitoring", "term_en": "Network Monitoring", "term_zh": "網路監控", "definitions": { "brief": "持續監視網路流量和狀態的過程", "standard": "網路監控是持續觀察網路流量、效能和安全事件的過程，\n可偵測異常行為、效能問題和安全威脅，\n是維運和安全團隊的重要工具。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "監控", "流量分析", "威脅偵測" ], "related_terms": [ "ndr", "siem", "ids" ], "aliases": {} }, { "id": "least_privilege", "term_en": "Least Privilege", "term_zh": "最小權限原則", "definitions": { "brief": "僅授予完成任務所需的最低權限", "standard": "最小權限原則是安全設計原則，\n要求使用者、程式和系統僅擁有完成工作所需的最低權限，\n降低因權限過大造成的安全風險。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "安全原則", "存取控制", "零信任" ], "related_terms": [ "pam", "rbac", "zero_trust" ], "aliases": {} }, { "id": "msp", "term_en": "MSP", "term_zh": "託管服務提供商", "definitions": { "brief": "為企業提供 IT 基礎設施和服務管理的外包商", "standard": "託管服務提供商是為企業提供遠端 IT 服務管理的外包商，\n負責監控、維護客戶的 IT 基礎設施，\n因擁有多家客戶的存取權限，常成為供應鏈攻擊的目標。\n" }, "category": "technologies", "subcategory": "service_provider", "tags": [ "外包", "IT 服務", "供應鏈" ], "related_terms": [ "mssp", "supply_chain_attack" ], "aliases": {} }, { "id": "vulnerability_management", "term_en": "Vulnerability Management", "term_zh": "弱點管理", "definitions": { "brief": "持續識別、評估和修復系統弱點的流程", "standard": "弱點管理是持續性的資安流程，包括弱點掃描、\n風險評估、優先排序、修補和驗證等步驟，\n目標是降低組織的攻擊面。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "弱點", "風險管理", "修補" ], "related_terms": [ "patch_management", "asm" ], "aliases": {} }, { "id": "patch_management", "term_en": "Patch Management", "term_zh": "修補程式管理", "definitions": { "brief": "管理和部署軟體更新與安全修補的流程", "standard": "修補程式管理是識別、測試和部署軟體更新的系統化流程，\n確保系統和應用程式的安全漏洞能及時修補，\n是資安防護的基本功。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "更新", "修補", "弱點" ], "related_terms": [ "vulnerability_management" ], "aliases": {} }, { "id": "two_factor_auth", "term_en": "2FA", "term_zh": "雙因素驗證", "definitions": { "brief": "使用兩種不同驗證因素確認身分的安全機制", "standard": "雙因素驗證要求使用者提供兩種不同類型的驗證因素，\n通常結合密碼（知識因素）與手機驗證碼或硬體金鑰（持有因素），\n大幅提升帳號安全性。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "認證", "帳號安全", "身分驗證" ], "related_terms": [ "mfa", "authentication" ], "aliases": { "zh": [ "兩步驟驗證", "雙重驗證" ] } }, { "id": "aes", "term_en": "AES", "term_zh": "進階加密標準", "definitions": { "brief": "目前最廣泛使用的對稱式加密演算法", "standard": "AES 是美國國家標準與技術研究院（NIST）採用的對稱式加密標準，\n支援 128、192、256 位元金鑰長度，\n廣泛應用於資料加密、VPN、無線網路等場景。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "對稱式加密", "NIST" ], "related_terms": [ "encryption", "rsa", "tls" ], "aliases": {} }, { "id": "rsa", "term_en": "RSA", "term_zh": "RSA 加密演算法", "definitions": { "brief": "廣泛使用的非對稱式加密演算法", "standard": "RSA 是最早的公開金鑰加密演算法之一，\n基於大質數分解的數學難題，\n常用於數位簽章、金鑰交換和小量資料加密。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "非對稱式加密", "公開金鑰" ], "related_terms": [ "encryption", "aes", "tls" ], "aliases": {} }, { "id": "tls", "term_en": "TLS", "term_zh": "傳輸層安全協定", "definitions": { "brief": "保護網路通訊安全的加密協定", "standard": "TLS 是用於保護網路通訊的加密協定，\n提供機密性、完整性和身分驗證，\n是 HTTPS、安全郵件等應用的基礎，現行版本為 TLS 1.3。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "加密", "網路通訊", "HTTPS" ], "related_terms": [ "encryption", "ssl_stripping" ], "aliases": { "zh": [ "傳輸層安全性" ], "en": [ "SSL/TLS" ] } }, { "id": "oauth", "term_en": "OAuth", "term_zh": "OAuth 授權協定", "definitions": { "brief": "允許第三方應用程式安全存取使用者資源的授權標準", "standard": "OAuth 是開放授權標準，讓使用者授權第三方應用程式\n存取其在其他服務的資源，而不需分享密碼，\n廣泛用於社群登入和 API 授權，現行版本為 OAuth 2.0。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "授權", "API", "身分驗證" ], "related_terms": [ "saml", "sso", "api_security" ], "aliases": {} }, { "id": "saml", "term_en": "SAML", "term_zh": "SAML 身分驗證協定", "definitions": { "brief": "企業單一登入的身分驗證標準", "standard": "SAML 是基於 XML 的身分驗證協定，\n用於在身分提供者和服務提供者之間交換驗證資訊，\n是企業單一登入（SSO）最常用的標準之一。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "認證", "SSO", "企業" ], "related_terms": [ "sso", "oauth" ], "aliases": {} }, { "id": "antivirus", "term_en": "Antivirus", "term_zh": "防毒軟體", "definitions": { "brief": "偵測和移除惡意程式的安全軟體", "standard": "防毒軟體是端點安全的基礎工具，\n透過特徵碼比對和行為分析偵測病毒、木馬等惡意程式，\n現代解決方案已整合至 EDR 和 XDR 平台。\n" }, "category": "technologies", "subcategory": "endpoint_security", "tags": [ "端點安全", "惡意程式", "即時防護" ], "related_terms": [ "edr", "malware" ], "aliases": { "zh": [ "防病毒軟體", "殺毒軟體" ] } }, { "id": "audit_log", "term_en": "Audit Log", "term_zh": "稽核日誌", "definitions": { "brief": "記錄系統活動和安全事件的日誌", "standard": "稽核日誌記錄使用者操作、系統事件和安全相關活動，\n用於事件調查、合規稽核和異常偵測，\n是資安監控和鑑識分析的重要資料來源。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "日誌管理", "合規", "稽核" ], "related_terms": [ "siem", "soc" ], "aliases": {} }, { "id": "pii", "term_en": "PII", "term_zh": "個人可識別資訊", "definitions": { "brief": "可用於識別特定個人的資料", "standard": "個人可識別資訊是指可單獨或結合其他資訊識別特定個人的資料，\n如姓名、身分證號碼、電話、地址等，\n受到 GDPR、CCPA 等隱私法規保護。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "隱私", "資料保護", "合規" ], "related_terms": [ "gdpr", "ccpa", "data_classification" ], "aliases": {} }, { "id": "phi", "term_en": "PHI", "term_zh": "受保護健康資訊", "definitions": { "brief": "與個人健康狀況相關的受保護資料", "standard": "受保護健康資訊是指與個人健康狀況、醫療服務或付款相關的資訊，\n受到 HIPAA 等醫療資料保護法規規範，\n包括病歷、診斷結果、處方等。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "隱私", "醫療", "健康資訊" ], "related_terms": [ "hipaa", "pii" ], "aliases": {} }, { "id": "api_gateway", "term_en": "API Gateway", "term_zh": "API 閘道", "definitions": { "brief": "管理和保護 API 存取的入口點", "standard": "API 閘道是位於用戶端和後端服務之間的中介層，\n提供身分驗證、速率限制、日誌記錄等功能，\n是微服務架構和 API 安全的關鍵元件。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "API", "微服務", "存取控制" ], "related_terms": [ "api_security", "oauth" ], "aliases": {} }, { "id": "easm", "term_en": "EASM", "term_zh": "外部攻擊面管理", "definitions": { "brief": "持續發現和監控組織對外暴露資產的解決方案", "standard": "外部攻擊面管理持續掃描和監控組織在網際網路上暴露的資產，\n識別未知資產、錯誤配置和潛在弱點，\n是主動式資安防護的重要工具。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "外部曝險", "資產管理", "弱點" ], "related_terms": [ "asm", "vulnerability_management" ], "aliases": {} }, { "id": "privileged_access", "term_en": "Privileged Access", "term_zh": "特權存取", "definitions": { "brief": "具有高度權限的系統存取能力", "standard": "特權存取是指對系統、資料或應用程式具有高度權限的存取能力，\n如系統管理員帳號、root 權限等，\n是攻擊者的主要目標，需要嚴格管控。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "權限管理", "存取控制", "特權" ], "related_terms": [ "pam", "privileged_account" ], "aliases": {} }, { "id": "privileged_account", "term_en": "Privileged Account", "term_zh": "特權帳號", "definitions": { "brief": "具有高度系統權限的帳號", "standard": "特權帳號是指具有管理權限的帳號，\n如 Administrator、root、服務帳號等，\n需要透過 PAM 解決方案進行管理和監控。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "帳號安全", "權限管理", "特權" ], "related_terms": [ "pam", "privileged_access" ], "aliases": {} }, { "id": "shadow_it", "term_en": "Shadow IT", "term_zh": "影子 IT", "definitions": { "brief": "未經 IT 部門核准使用的應用程式和服務", "standard": "影子 IT 是指員工未經 IT 部門核准或不知情下使用的\n雲端服務、應用程式或裝置，\n可能帶來資料外洩和合規風險。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "雲端", "風險管理", "合規" ], "related_terms": [ "casb", "dlp" ], "aliases": {} }, { "id": "stager", "term_en": "Stager", "term_zh": "分階段載入器", "definitions": { "brief": "分階段下載和執行惡意程式的小型載入器", "standard": "分階段載入器是體積小的惡意程式元件，\n先建立通訊並下載完整的惡意酬載，\n常用於規避偵測和減少初始攻擊足跡。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "惡意程式", "載入器", "C2" ], "related_terms": [ "loader", "payload", "c2" ], "aliases": {} }, { "id": "swg", "term_en": "SWG", "term_zh": "安全網頁閘道", "definitions": { "brief": "過濾和控制使用者網頁存取的安全解決方案", "standard": "安全網頁閘道過濾使用者的網頁流量，\n阻擋惡意網站、執行內容過濾、防止資料外洩，\n是網路安全和合規的重要元件。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網頁安全", "內容過濾", "代理" ], "related_terms": [ "casb", "sase" ], "aliases": {} }, { "id": "lolbas", "term_en": "LOLBAS", "term_zh": "就地取材二進位檔", "definitions": { "brief": "攻擊者濫用系統內建工具進行攻擊的技術", "standard": "LOLBAS 是指攻擊者利用作業系統內建的合法工具\n（如 PowerShell、certutil、mshta）執行惡意行為，\n因使用合法工具而難以被偵測。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "攻擊技術", "規避偵測", "Windows" ], "related_terms": [ "living_off_the_land", "fileless_attack" ], "aliases": {} }, { "id": "payload", "term_en": "Payload", "term_zh": "惡意酬載", "definitions": { "brief": "惡意程式中執行實際攻擊功能的程式碼", "standard": "惡意酬載是惡意程式中執行實際惡意行為的核心程式碼，\n如竊取資料、加密檔案、建立後門等，\n通常由載入器或漏洞利用程式投放。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "惡意程式", "攻擊", "漏洞利用" ], "related_terms": [ "dropper", "loader", "exploit" ], "aliases": {} }, { "id": "container_security", "term_en": "Container Security", "term_zh": "容器安全", "definitions": { "brief": "保護容器化應用程式和基礎架構的安全措施", "standard": "容器安全涵蓋容器映像掃描、執行期保護、\n網路分隔、存取控制等面向，\n確保 Docker、Kubernetes 等容器環境的安全。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [ "容器", "雲端", "DevSecOps" ], "related_terms": [ "cwpp", "cnapp" ], "aliases": {} }, { "id": "serverless", "term_en": "Serverless", "term_zh": "無伺服器運算", "definitions": { "brief": "由雲端供應商管理基礎架構的運算模式", "standard": "無伺服器運算讓開發者專注於程式碼，\n由雲端供應商管理底層伺服器和擴展，\n如 AWS Lambda、Azure Functions，帶來新的安全挑戰。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [ "雲端", "FaaS", "架構" ], "related_terms": [ "cwpp", "cloud_security" ], "aliases": {} }, { "id": "cloud_security", "term_en": "Cloud Security", "term_zh": "雲端安全", "definitions": { "brief": "保護雲端運算環境的安全措施和實務", "standard": "雲端安全涵蓋保護雲端基礎架構、資料和應用程式的所有措施，\n包括身分管理、資料加密、網路安全、合規等面向，\n採用共同責任模式。\n" }, "category": "technologies", "subcategory": "cloud_security", "tags": [ "雲端", "IaaS", "共同責任" ], "related_terms": [ "cspm", "cwpp", "casb" ], "aliases": {} }, { "id": "ics", "term_en": "ICS", "term_zh": "工業控制系統", "definitions": { "brief": "控制工業流程的電腦系統", "standard": "工業控制系統是用於監控和控制工業流程的電腦系統，\n包括 SCADA、DCS、PLC 等，\n廣泛應用於能源、製造、水處理等關鍵基礎設施。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "OT", "關鍵基礎設施", "工業" ], "related_terms": [ "scada", "ot", "critical_infrastructure" ], "aliases": {} }, { "id": "scada", "term_en": "SCADA", "term_zh": "監控與資料擷取系統", "definitions": { "brief": "監控和控制工業設備的系統架構", "standard": "SCADA 是用於遠端監控和控制工業設備的系統，\n收集現場感測器資料並提供操作介面，\n是電力、石油、水處理等產業的核心系統。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "OT", "關鍵基礎設施", "監控" ], "related_terms": [ "ics", "ot", "critical_infrastructure" ], "aliases": {} }, { "id": "ot", "term_en": "OT", "term_zh": "營運技術", "definitions": { "brief": "用於監控和控制實體設備的硬體和軟體", "standard": "營運技術是指用於監控和控制實體流程和設備的系統，\n與資訊技術（IT）相對，\nOT 安全是關鍵基礎設施保護的重要領域。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "OT", "關鍵基礎設施", "工業" ], "related_terms": [ "ics", "scada" ], "aliases": {} }, { "id": "proxy", "term_en": "Proxy", "term_zh": "代理伺服器", "definitions": { "brief": "作為中介轉發網路請求的伺服器", "standard": "位於用戶端與目標伺服器之間的中介系統，可代為轉發請求、快取內容、過濾流量或隱藏來源 IP。在資安中常用於流量檢測、存取控制、匿名化或作為攻擊者隱藏真實位置的跳板。" }, "category": "technologies", "subcategory": "", "tags": [], "related_terms": [ "reverse_proxy", "vpn", "socks", "web_gateway", "traffic_inspection" ], "aliases": { "en": [ "Proxy Server", "Web Proxy", "Forward Proxy" ], "zh": [ "代理", "網路代理", "中繼伺服器" ] } }, { "id": "cybersecurity", "term_en": "Cybersecurity", "term_zh": "網路安全", "definitions": { "brief": "保護資訊系統免受網路攻擊的實務與技術", "standard": "網路安全是指保護電腦系統、網路和資料免受未授權存取、\n攻擊、損害或竊取的實務、技術和流程。\n涵蓋人員、流程、技術三個面向。\n" }, "category": "technologies", "subcategory": "general", "tags": [ "基礎概念", "總稱" ], "related_terms": [ "information_security", "network_security" ], "aliases": { "en": [ "Cyber Security", "Cyber-security" ], "zh": [ "資訊安全", "資安" ] } }, { "id": "incident_response", "term_en": "Incident Response", "term_zh": "事件回應", "definitions": { "brief": "偵測、分析和處理資安事件的結構化流程", "standard": "事件回應是組織偵測、分析和處理資安事件的系統化方法，\n目標是限制損害、縮短復原時間、降低成本。\n典型流程包括準備、識別、遏制、根除、復原、檢討六階段。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "SOC", "事件處理", "基礎概念" ], "related_terms": [ "soc", "siem" ], "aliases": { "en": [ "IR" ], "zh": [ "資安事件回應", "事件應變" ] } }, { "id": "threat_hunting", "term_en": "Threat Hunting", "term_zh": "威脅獵捕", "definitions": { "brief": "主動搜尋潛伏在網路中未被偵測威脅的活動", "standard": "威脅獵捕是資安分析師主動搜尋網路中潛在威脅的活動，\n不依賴自動化警報，而是基於假設驅動的調查，\n目的是找出繞過現有安全控制的進階威脅。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "SOC", "主動防禦", "APT" ], "related_terms": [ "soc", "threat_intelligence", "edr" ], "aliases": { "zh": [ "威脅狩獵", "主動威脅搜尋" ] } }, { "id": "encryption_at_rest", "term_en": "Encryption at Rest", "term_zh": "靜態加密", "definitions": { "brief": "對儲存中資料進行加密保護", "standard": "靜態加密是指對儲存在硬碟、資料庫、雲端儲存等\n持久化媒體上的資料進行加密，\n保護資料在儲存狀態下不被未授權存取。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "資料保護", "儲存" ], "related_terms": [ "encryption", "encryption_in_transit" ], "aliases": { "zh": [ "儲存加密", "落地加密" ] } }, { "id": "encryption_in_transit", "term_en": "Encryption in Transit", "term_zh": "傳輸加密", "definitions": { "brief": "對網路傳輸中資料進行加密保護", "standard": "傳輸加密是指對在網路上傳輸的資料進行加密，\n防止資料在傳輸過程中被竊聽或篡改。\n常見實作包括 TLS/SSL、VPN 等。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "資料保護", "網路" ], "related_terms": [ "encryption", "encryption_at_rest", "tls" ], "aliases": { "zh": [ "傳輸中加密", "動態加密" ] } }, { "id": "security_awareness", "term_en": "Security Awareness", "term_zh": "資安意識", "definitions": { "brief": "員工對資安風險和最佳實務的認知與警覺", "standard": "資安意識是指組織成員對資訊安全風險、政策和最佳實務的了解程度，\n以及識別和回應潛在威脅的能力。\n資安意識訓練是人員安全的重要環節。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "人員安全", "訓練", "基礎概念" ], "related_terms": [ "social_engineering", "phishing" ], "aliases": { "en": [ "Security Awareness Training" ], "zh": [ "資安意識訓練", "安全意識" ] } }, { "id": "backup", "term_en": "Backup", "term_zh": "備份", "definitions": { "brief": "複製資料以便在原始資料遺失時恢復", "standard": "備份是建立資料副本的過程，用於在原始資料遺失、\n損壞或遭勒索軟體加密時恢復。\n有效的備份策略應包括離線備份和定期測試復原。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "資料保護", "災難復原", "基礎概念" ], "related_terms": [ "disaster_recovery", "ransomware" ], "aliases": { "zh": [ "資料備份" ] } }, { "id": "disaster_recovery", "term_en": "Disaster Recovery", "term_zh": "災難復原", "definitions": { "brief": "在重大事故後恢復關鍵系統運作的計畫與流程", "standard": "災難復原是組織在遭遇重大事故（如勒索軟體、天災、硬體故障）後，\n恢復關鍵 IT 系統和業務運作的計畫與執行流程，\n通常包含 RTO（復原時間目標）和 RPO（復原點目標）。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "業務持續", "備份", "基礎概念" ], "related_terms": [ "backup", "ransomware" ], "aliases": { "en": [ "DR" ], "zh": [ "災害復原", "DR 計畫" ] } }, { "id": "ethical_hacking", "term_en": "Ethical Hacking", "term_zh": "道德駭客", "definitions": { "brief": "經授權模擬惡意攻擊以發現系統弱點的行為", "standard": "道德駭客是指在獲得組織授權的情況下，\n使用與惡意駭客相同的技術和工具來測試系統安全性，\n目的是在攻擊者之前發現並修補漏洞。又稱白帽駭客。\n" }, "category": "technologies", "subcategory": "security_testing", "tags": [ "滲透測試", "白帽", "安全評估" ], "related_terms": [ "pentesting", "red_team", "vulnerability_assessment" ], "aliases": { "en": [ "White Hat Hacking" ], "zh": [ "白帽駭客", "合法入侵測試" ] } }, { "id": "ip_address", "term_en": "IP Address", "term_zh": "IP 位址", "definitions": { "brief": "網路上識別裝置的唯一數字位址", "standard": "IP 位址是網際網路協定中用於識別網路裝置的唯一數字標識，\n分為 IPv4（32 位元）和 IPv6（128 位元）兩種格式。\n在資安中常用於追蹤攻擊來源和實施存取控制。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "識別" ], "related_terms": [ "firewall", "network_monitoring" ], "aliases": { "zh": [ "網路位址", "IP 地址" ] } }, { "id": "cryptography", "term_en": "Cryptography", "term_zh": "密碼學", "definitions": { "brief": "使用數學技術保護資訊安全的科學", "standard": "密碼學是研究如何使用數學演算法保護資訊機密性、\n完整性和真實性的科學。\n涵蓋對稱加密、非對稱加密、雜湊函數、數位簽章等技術。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "基礎概念", "數學" ], "related_terms": [ "encryption", "aes", "rsa", "tls" ], "aliases": { "zh": [ "加密學" ] } }, { "id": "hash", "term_en": "Hash", "term_zh": "雜湊", "definitions": { "brief": "將任意長度資料轉換為固定長度摘要的函數", "standard": "雜湊函數將任意長度的輸入轉換為固定長度的輸出（雜湊值），\n具有單向性（無法從雜湊值還原原始資料）。\n常用於密碼儲存、資料完整性驗證和數位簽章。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "完整性", "密碼" ], "related_terms": [ "cryptography", "encryption" ], "aliases": { "en": [ "Hash Function", "Hashing" ], "zh": [ "雜湊函數", "哈希" ] } }, { "id": "digital_signature", "term_en": "Digital Signature", "term_zh": "數位簽章", "definitions": { "brief": "用於驗證數位文件真實性和完整性的加密機制", "standard": "數位簽章使用非對稱加密技術，讓發送者可以「簽署」文件，\n接收者可以驗證文件確實來自發送者且未被篡改。\n廣泛用於軟體發布、電子合約和安全通訊。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "驗證", "完整性" ], "related_terms": [ "cryptography", "rsa", "pki" ], "aliases": { "zh": [ "電子簽章" ] } }, { "id": "pki", "term_en": "PKI", "term_zh": "公開金鑰基礎架構", "definitions": { "brief": "管理數位憑證和公開金鑰的系統架構", "standard": "公開金鑰基礎架構是一套用於建立、管理、發布、\n撤銷數位憑證的系統，支援安全的電子通訊。\n包含憑證授權中心（CA）、註冊中心（RA）等元件。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "憑證", "加密", "身分驗證" ], "related_terms": [ "digital_signature", "tls", "certificate" ], "aliases": {} }, { "id": "certificate", "term_en": "Digital Certificate", "term_zh": "數位憑證", "definitions": { "brief": "用於證明公開金鑰擁有者身分的電子文件", "standard": "數位憑證是由憑證授權中心（CA）簽發的電子文件，\n將公開金鑰與擁有者身分綁定。\nHTTPS 網站使用 SSL/TLS 憑證來建立安全連線。\n" }, "category": "technologies", "subcategory": "identity", "tags": [ "PKI", "身分驗證", "HTTPS" ], "related_terms": [ "pki", "tls" ], "aliases": { "en": [ "SSL Certificate", "TLS Certificate" ], "zh": [ "憑證", "SSL 憑證" ] } }, { "id": "business_continuity", "term_en": "Business Continuity", "term_zh": "業務持續", "definitions": { "brief": "確保組織在災難後能持續運作的計畫與能力", "standard": "業務持續是組織在遭遇重大事故時維持關鍵業務運作的能力，\n包含業務持續計畫（BCP）的制定、測試和維護。\n與災難復原相輔相成，災難復原著重 IT 系統，業務持續著重整體營運。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "業務持續", "風險管理", "規劃" ], "related_terms": [ "disaster_recovery", "backup", "risk_management" ], "aliases": { "en": [ "BCP", "Business Continuity Planning" ], "zh": [ "業務連續性", "營運持續" ] } }, { "id": "security_policy", "term_en": "Security Policy", "term_zh": "資安政策", "definitions": { "brief": "定義組織資訊安全要求和規範的正式文件", "standard": "資安政策是組織制定的正式文件，\n定義資訊安全的目標、責任、規範和程序。\n是資訊安全管理系統（ISMS）的基礎。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "政策", "治理", "合規" ], "related_terms": [ "isms", "security_control", "risk_management" ], "aliases": { "zh": [ "安全政策", "資訊安全政策" ] } }, { "id": "access_log", "term_en": "Access Log", "term_zh": "存取日誌", "definitions": { "brief": "記錄系統或資源存取活動的日誌", "standard": "存取日誌記錄使用者或系統對資源的存取活動，\n包含時間、來源、目標、操作類型等資訊。\n是安全監控、事件調查和合規稽核的重要資料來源。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "日誌", "監控", "稽核" ], "related_terms": [ "audit_log", "siem", "soc" ], "aliases": { "zh": [ "存取紀錄" ] } }, { "id": "security_baseline", "term_en": "Security Baseline", "term_zh": "安全基準", "definitions": { "brief": "系統或應用程式應達到的最低安全設定標準", "standard": "安全基準是組織定義的最低安全設定要求，\n確保所有系統符合一致的安全標準。\n常見的基準包括 CIS Benchmarks、DISA STIG 等。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "設定管理", "合規", "標準" ], "related_terms": [ "hardening", "misconfiguration", "security_control" ], "aliases": { "zh": [ "安全基線" ] } }, { "id": "hardening", "term_en": "System Hardening", "term_zh": "系統強化", "definitions": { "brief": "減少系統攻擊面的安全設定過程", "standard": "系統強化是透過移除不必要的服務、關閉未使用的埠、\n套用安全設定等方式，減少系統潛在弱點的過程。\n是縱深防禦的重要環節。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "設定管理", "攻擊面", "防禦" ], "related_terms": [ "security_baseline", "attack_surface", "defense_in_depth" ], "aliases": { "en": [ "Hardening" ], "zh": [ "強化", "安全強化" ] } }, { "id": "segmentation", "term_en": "Network Segmentation", "term_zh": "網路分段", "definitions": { "brief": "將網路劃分為較小區段以限制威脅擴散", "standard": "網路分段是將大型網路劃分為較小、隔離的區段，\n限制攻擊者的橫向移動能力。\n可透過 VLAN、防火牆、微分段等技術實現。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路安全", "隔離", "橫向移動" ], "related_terms": [ "firewall", "lateral_movement", "zero_trust" ], "aliases": { "en": [ "Segmentation", "Microsegmentation" ], "zh": [ "網路隔離", "微分段" ] } }, { "id": "threat_modeling", "term_en": "Threat Modeling", "term_zh": "威脅建模", "definitions": { "brief": "系統性識別和評估系統潛在威脅的方法", "standard": "威脅建模是在設計階段識別應用程式或系統可能面臨的威脅，\n評估風險並規劃對策的系統化方法。\n常用方法包括 STRIDE、PASTA、DREAD 等。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "安全設計", "SDLC", "風險評估" ], "related_terms": [ "stride", "dread", "risk_assessment" ], "aliases": { "zh": [ "威脅模型" ] } }, { "id": "secure_coding", "term_en": "Secure Coding", "term_zh": "安全程式設計", "definitions": { "brief": "在開發過程中遵循安全最佳實務的程式設計方法", "standard": "安全程式設計是在軟體開發過程中考慮安全性，\n遵循最佳實務避免引入漏洞的開發方法。\n包含輸入驗證、輸出編碼、錯誤處理等實務。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "DevSecOps", "SDLC", "開發" ], "related_terms": [ "sast", "owasp_top10", "input_validation" ], "aliases": { "en": [ "Secure Development" ], "zh": [ "安全開發", "安全編碼" ] } }, { "id": "devsecops", "term_en": "DevSecOps", "term_zh": "DevSecOps", "definitions": { "brief": "將安全整合到 DevOps 流程中的方法論", "standard": "DevSecOps 是將安全實務整合到軟體開發和維運流程的方法，\n強調「左移」安全（在開發早期考慮安全）、\n自動化安全測試和持續安全監控。\n" }, "category": "technologies", "subcategory": "application_security", "tags": [ "開發", "自動化", "CI/CD" ], "related_terms": [ "sast", "dast", "sbom", "secure_coding" ], "aliases": { "zh": [ "開發安全維運" ] } }, { "id": "data_masking", "term_en": "Data Masking", "term_zh": "資料遮蔽", "definitions": { "brief": "隱藏敏感資料的部分內容以保護隱私", "standard": "資料遮蔽是將敏感資料替換為虛假但格式相似的資料，\n用於在非生產環境中使用或顯示資料時保護隱私。\n例如將信用卡號顯示為 **** **** **** 1234。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "資料保護", "隱私", "合規" ], "related_terms": [ "dlp", "pii", "encryption" ], "aliases": { "en": [ "Data Obfuscation" ], "zh": [ "資料脫敏" ] } }, { "id": "tokenization", "term_en": "Tokenization", "term_zh": "代碼化", "definitions": { "brief": "以無意義的代碼取代敏感資料的保護技術", "standard": "代碼化是將敏感資料（如信用卡號）替換為無意義的代碼（token），\n原始資料儲存在安全的 token vault 中。\n與加密不同，token 與原始資料沒有數學關係。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "資料保護", "支付安全", "PCI DSS" ], "related_terms": [ "encryption", "data_masking", "pci_dss" ], "aliases": { "zh": [ "權杖化", "Token 化" ] } }, { "id": "log_management", "term_en": "Log Management", "term_zh": "日誌管理", "definitions": { "brief": "收集、儲存、分析和保留系統日誌的流程", "standard": "日誌管理是集中收集、正規化、儲存和分析來自\n各種系統和應用程式日誌的流程。\n是安全監控、事件調查和合規的基礎。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "日誌", "SIEM", "監控" ], "related_terms": [ "siem", "audit_log", "access_log" ], "aliases": { "zh": [ "日誌集中管理" ] } }, { "id": "security_audit", "term_en": "Security Audit", "term_zh": "資安稽核", "definitions": { "brief": "評估組織資安控制措施有效性的系統性檢查", "standard": "資安稽核是對組織的資安政策、程序和控制措施\n進行系統性評估的過程，驗證是否符合安全標準和法規要求。\n可分為內部稽核和外部稽核。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "合規", "稽核", "評估" ], "related_terms": [ "security_control", "isms", "risk_assessment" ], "aliases": { "zh": [ "安全稽核", "資訊安全稽核" ] } }, { "id": "information_security", "term_en": "Information Security", "term_zh": "資訊安全", "definitions": { "brief": "保護資訊資產免受未授權存取、使用、揭露、破壞的實務", "standard": "資訊安全是保護資訊及其基礎設施免受未授權存取、使用、揭露、\n中斷、修改或破壞的實務，以確保機密性、完整性和可用性。\n涵蓋人員、流程和技術三個面向。\n" }, "category": "technologies", "subcategory": "general", "tags": [ "基礎概念", "CIA" ], "related_terms": [ "cybersecurity", "cia_triad" ], "aliases": { "en": [ "InfoSec" ], "zh": [ "資安" ] } }, { "id": "confidentiality", "term_en": "Confidentiality", "term_zh": "機密性", "definitions": { "brief": "確保資訊僅被授權人員存取的特性", "standard": "機密性是 CIA 三要素之一，確保資訊只能被授權人員存取。\n透過存取控制、加密、分類等措施保護，\n防止資訊被未授權的個人、實體或流程取得。\n" }, "category": "technologies", "subcategory": "general", "tags": [ "CIA", "基礎概念", "資料保護" ], "related_terms": [ "cia_triad", "encryption", "access_control" ], "aliases": {} }, { "id": "integrity", "term_en": "Integrity", "term_zh": "完整性", "definitions": { "brief": "確保資訊在儲存和傳輸過程中不被未授權修改", "standard": "完整性是 CIA 三要素之一，確保資訊的正確性和完整性。\n透過雜湊、數位簽章、變更管理等措施保護，\n防止資訊被未授權修改或篡改。\n" }, "category": "technologies", "subcategory": "general", "tags": [ "CIA", "基礎概念", "資料保護" ], "related_terms": [ "cia_triad", "hash", "digital_signature" ], "aliases": {} }, { "id": "availability", "term_en": "Availability", "term_zh": "可用性", "definitions": { "brief": "確保資訊和系統在需要時可被存取使用", "standard": "可用性是 CIA 三要素之一，確保授權使用者能在需要時存取資訊和系統。\n透過備份、高可用架構、DDoS 防護等措施保護，\n防止服務中斷影響業務運作。\n" }, "category": "technologies", "subcategory": "general", "tags": [ "CIA", "基礎概念", "業務持續" ], "related_terms": [ "cia_triad", "backup", "disaster_recovery", "ddos" ], "aliases": {} }, { "id": "decryption", "term_en": "Decryption", "term_zh": "解密", "definitions": { "brief": "將加密後的密文還原為可讀明文的過程", "standard": "解密是將密文轉換回原始明文的過程，\n需要使用正確的解密金鑰和演算法。\n是加密的反向操作。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "資料保護" ], "related_terms": [ "encryption", "cryptography" ], "aliases": {} }, { "id": "symmetric_encryption", "term_en": "Symmetric Encryption", "term_zh": "對稱式加密", "definitions": { "brief": "加解密使用相同金鑰的加密方式", "standard": "對稱式加密使用相同的金鑰進行加密和解密，\n效率高、適合大量資料加密。\n代表演算法包括 AES、DES、3DES 等。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "密碼學" ], "related_terms": [ "aes", "asymmetric_encryption", "cryptography" ], "aliases": { "zh": [ "對稱加密" ] } }, { "id": "asymmetric_encryption", "term_en": "Asymmetric Encryption", "term_zh": "非對稱式加密", "definitions": { "brief": "使用公私金鑰對進行加解密的加密方式", "standard": "非對稱式加密使用一對數學相關的金鑰：公開金鑰加密、私密金鑰解密。\n解決了對稱加密的金鑰分發問題，但效能較低。\n代表演算法包括 RSA、ECC 等。\n" }, "category": "technologies", "subcategory": "data_security", "tags": [ "加密", "密碼學", "公開金鑰" ], "related_terms": [ "rsa", "symmetric_encryption", "pki" ], "aliases": { "zh": [ "非對稱加密", "公開金鑰加密" ] } }, { "id": "port", "term_en": "Port", "term_zh": "通訊埠", "definitions": { "brief": "網路通訊中識別特定服務或程序的數字端點", "standard": "通訊埠是網路協定中用於識別特定服務或程序的 16 位元數字（0-65535）。\n常見埠號如 HTTP(80)、HTTPS(443)、SSH(22)、RDP(3389)。\n防火牆常透過控制通訊埠來限制網路存取。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "服務" ], "related_terms": [ "firewall", "ip_address" ], "aliases": { "en": [ "Network Port" ], "zh": [ "埠", "連接埠" ] } }, { "id": "protocol", "term_en": "Protocol", "term_zh": "通訊協定", "definitions": { "brief": "網路通訊中裝置間交換資料的標準規則", "standard": "通訊協定是定義網路裝置間如何通訊的標準規則集，\n包含資料格式、傳輸順序、錯誤處理等規範。\n常見協定如 TCP/IP、HTTP、DNS、SMTP 等。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "標準" ], "related_terms": [ "tcp_ip", "http", "tls" ], "aliases": { "zh": [ "協定", "網路協定" ] } }, { "id": "domain_name", "term_en": "Domain Name", "term_zh": "網域名稱", "definitions": { "brief": "用於識別網站的人類可讀文字位址", "standard": "網域名稱是網際網路上用於識別網站的文字位址（如 example.com），\n透過 DNS 系統轉換為 IP 位址。\n網域名稱的安全管理是防止釣魚和劫持的重要環節。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "DNS" ], "related_terms": [ "dns", "ip_address", "typosquatting", "domain_hijacking" ], "aliases": { "en": [ "Domain" ], "zh": [ "網域", "域名" ] } }, { "id": "dns", "term_en": "DNS", "term_zh": "網域名稱系統", "definitions": { "brief": "將網域名稱轉換為 IP 位址的分散式系統", "standard": "網域名稱系統是網際網路的「電話簿」，\n將人類可讀的網域名稱轉換為電腦使用的 IP 位址。\nDNS 安全對防止釣魚、劫持攻擊至關重要。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "基礎設施" ], "related_terms": [ "domain_name", "dns_spoofing", "dns_hijacking" ], "aliases": { "zh": [ "域名系統" ] } }, { "id": "ssl", "term_en": "SSL", "term_zh": "安全通訊端層", "definitions": { "brief": "早期用於保護網路通訊的加密協定（已棄用）", "standard": "SSL 是早期用於保護網路通訊的加密協定，\n現已因安全漏洞被 TLS 取代。\n但「SSL」一詞仍常被用於泛指安全連線或憑證。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "加密", "通訊協定", "已棄用" ], "related_terms": [ "tls", "certificate" ], "aliases": {} }, { "id": "https", "term_en": "HTTPS", "term_zh": "安全超文字傳輸協定", "definitions": { "brief": "使用 TLS 加密的安全網頁傳輸協定", "standard": "HTTPS 是 HTTP 協定的安全版本，使用 TLS 加密傳輸內容。\n確保瀏覽器與網站間的通訊機密性和完整性，\n現代網站應一律使用 HTTPS。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網頁安全", "加密", "傳輸協定" ], "related_terms": [ "tls", "ssl", "certificate" ], "aliases": {} }, { "id": "packet", "term_en": "Packet", "term_zh": "封包", "definitions": { "brief": "網路傳輸中的資料單元", "standard": "封包是網路中傳輸資料的基本單元，\n包含標頭（來源/目的位址等資訊）和內容（實際資料）。\n防火牆和 IDS/IPS 透過檢查封包來過濾和偵測威脅。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "傳輸" ], "related_terms": [ "firewall", "ids", "network_monitoring" ], "aliases": { "zh": [ "資料封包", "網路封包" ] } }, { "id": "bandwidth", "term_en": "Bandwidth", "term_zh": "頻寬", "definitions": { "brief": "網路連線的資料傳輸能力", "standard": "頻寬是網路連線在單位時間內可傳輸的最大資料量，\n通常以 Mbps 或 Gbps 為單位。\nDDoS 攻擊常透過耗盡頻寬來癱瘓目標服務。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "效能", "DDoS" ], "related_terms": [ "ddos", "network_monitoring" ], "aliases": {} }, { "id": "dmz", "term_en": "DMZ", "term_zh": "非軍事區", "definitions": { "brief": "位於內外網路之間的緩衝區域", "standard": "非軍事區是網路架構中介於外部網路和內部網路之間的區域，\n放置對外服務（如網頁伺服器、郵件伺服器），\n提供額外的安全隔離層。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路架構", "隔離", "防火牆" ], "related_terms": [ "firewall", "segmentation" ], "aliases": { "zh": [ "隔離區" ] } }, { "id": "nat", "term_en": "NAT", "term_zh": "網路位址轉換", "definitions": { "brief": "轉換內外網路 IP 位址的技術", "standard": "網路位址轉換是將內部私有 IP 位址轉換為外部公開 IP 位址的技術，\n讓多台內部裝置共用一個公開 IP 上網。\n也提供一定程度的安全隱藏效果。\n" }, "category": "technologies", "subcategory": "network_security", "tags": [ "網路基礎", "路由器", "IP" ], "related_terms": [ "firewall", "ip_address" ], "aliases": {} }, { "id": "virus_definition", "term_en": "Virus Definition", "term_zh": "病毒定義檔", "definitions": { "brief": "防毒軟體用於識別惡意程式的特徵資料庫", "standard": "病毒定義檔是防毒軟體用於識別已知惡意程式的特徵碼資料庫，\n需要定期更新以偵測新型威脅。\n現代防毒也結合行為分析來偵測未知威脅。\n" }, "category": "technologies", "subcategory": "endpoint_security", "tags": [ "防毒", "特徵碼", "更新" ], "related_terms": [ "antivirus", "malware" ], "aliases": { "en": [ "Virus Signature", "Malware Definition" ], "zh": [ "病毒碼", "特徵碼" ] } }, { "id": "sandbox", "term_en": "Sandbox", "term_zh": "沙箱", "definitions": { "brief": "隔離執行可疑程式以進行安全分析的環境", "standard": "沙箱是一個隔離的執行環境，用於安全地執行和分析可疑程式，\n觀察其行為而不影響實際系統。\n常用於惡意程式分析和電子郵件附件檢測。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "惡意程式分析", "隔離", "動態分析" ], "related_terms": [ "malware", "edr", "detonation" ], "aliases": {} }, { "id": "whitelist", "term_en": "Whitelist", "term_zh": "白名單", "definitions": { "brief": "預先核准可允許的項目清單", "standard": "白名單是預先核准的項目清單，只有清單中的項目才被允許。\n應用於應用程式控制、電子郵件過濾、網路存取控制等場景。\n與黑名單相反，採取「預設拒絕」策略。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "存取控制", "策略", "應用程式控制" ], "related_terms": [ "blacklist", "access_control" ], "aliases": { "en": [ "Allowlist" ], "zh": [ "允許清單" ] } }, { "id": "blacklist", "term_en": "Blacklist", "term_zh": "黑名單", "definitions": { "brief": "已知有害或應禁止的項目清單", "standard": "黑名單是已知有害或應禁止的項目清單，符合清單的項目會被阻擋。\n應用於阻擋惡意 IP、網域、程式等。\n與白名單相反，採取「預設允許」策略。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "存取控制", "策略", "威脅情報" ], "related_terms": [ "whitelist", "ioc", "threat_intelligence" ], "aliases": { "en": [ "Blocklist", "Denylist" ], "zh": [ "黑名單", "封鎖清單" ] } }, { "id": "forensics", "term_en": "Digital Forensics", "term_zh": "數位鑑識", "definitions": { "brief": "收集和分析數位證據以調查資安事件的科學", "standard": "數位鑑識是識別、收集、分析和呈現數位證據的科學和程序，\n用於調查資安事件、網路犯罪或訴訟支援。\n需遵循嚴格的證據鏈程序以確保證據效力。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "調查", "事件回應", "證據" ], "related_terms": [ "incident_response", "soc", "malware" ], "aliases": { "en": [ "Computer Forensics", "Cyber Forensics" ], "zh": [ "電腦鑑識", "資安鑑識" ] } }, { "id": "signature", "term_en": "Signature", "term_zh": "特徵碼", "definitions": { "brief": "用於識別特定惡意程式或攻擊的特徵模式", "standard": "特徵碼是惡意程式或攻擊的獨特識別模式，\n安全工具透過比對特徵碼來偵測已知威脅。\n特徵碼偵測有效但無法偵測零日或變種威脅。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "偵測", "惡意程式", "IDS/IPS" ], "related_terms": [ "virus_definition", "ids", "antivirus" ], "aliases": { "zh": [ "簽章", "特徵" ] } }, { "id": "heuristic", "term_en": "Heuristic Analysis", "term_zh": "啟發式分析", "definitions": { "brief": "透過行為模式偵測未知惡意程式的技術", "standard": "啟發式分析是透過分析程式行為和特徵，\n而非依賴特徵碼來偵測可疑程式的技術。\n可偵測變種和部分未知威脅，但可能產生誤報。\n" }, "category": "technologies", "subcategory": "security_operations", "tags": [ "偵測", "行為分析", "防毒" ], "related_terms": [ "antivirus", "signature", "edr" ], "aliases": { "zh": [ "啟發式偵測", "行為啟發" ] } }, { "id": "bug_bounty", "term_en": "Bug Bounty", "term_zh": "漏洞獎勵計畫", "definitions": { "brief": "企業獎勵外部研究人員發現和回報漏洞的計畫", "standard": "漏洞獎勵計畫是企業邀請外部安全研究人員發現和負責任地回報漏洞，\n並提供金錢獎勵的計畫。知名平台包括 HackerOne、Bugcrowd 等。\n是補充內部安全測試的有效方式。\n" }, "category": "technologies", "subcategory": "security_testing", "tags": [ "漏洞揭露", "社群", "獎勵" ], "related_terms": [ "pentesting", "responsible_disclosure", "vulnerability" ], "aliases": { "en": [ "Bug Bounty Program", "VDP" ], "zh": [ "漏洞懸賞" ] } }, { "id": "secrets_management", "term_en": "Secrets Management", "term_zh": "機密資訊管理", "definitions": { "brief": "安全儲存、存取和輪換 API 金鑰與憑證的系統", "standard": "機密資訊管理是安全儲存、存取控制和自動輪換\nAPI 金鑰、密碼、憑證和加密金鑰等敏感資訊的系統，\n常見工具包括 HashiCorp Vault、AWS Secrets Manager 和 Azure Key Vault。\n" }, "category": "technologies", "subcategory": "identity_access", "tags": [ "憑證管理", "金鑰管理", "DevSecOps" ], "related_terms": [ "pki", "privileged_access_management" ], "aliases": {} }, { "id": "csp_header", "term_en": "CSP", "term_zh": "內容安全政策", "definitions": { "brief": "限制瀏覽器可載入資源來源以防範 XSS 的 HTTP 標頭", "standard": "內容安全政策（CSP）是 HTTP 回應標頭，\n允許網站管理員控制瀏覽器可載入的資源來源，\n有效降低跨站腳本（XSS）和資料注入攻擊的風險，\n透過白名單機制限制腳本、樣式和其他資源的來源。\n" }, "category": "technologies", "subcategory": "web_security", "tags": [ "HTTP 標頭", "XSS 防護", "瀏覽器安全" ], "related_terms": [ "xss", "hsts" ], "aliases": { "en": [ "Content Security Policy" ], "zh": [ "內容安全策略" ] } }, { "id": "dmarc", "term_en": "DMARC", "term_zh": "電子郵件驗證機制", "definitions": { "brief": "防止電子郵件偽造的驗證協定（整合 SPF+DKIM）", "standard": "DMARC 是電子郵件驗證協定，\n基於 SPF 和 DKIM 建構，\n讓網域擁有者定義未通過驗證郵件的處理政策（監控/隔離/拒絕），\n有效防止網域冒用和電子郵件詐騙。\n" }, "category": "technologies", "subcategory": "email_security", "tags": [ "電子郵件安全", "網域驗證", "反釣魚" ], "related_terms": [ "spf", "dkim", "email_security" ], "aliases": {} }, { "id": "spf", "term_en": "SPF", "term_zh": "寄件者政策框架", "definitions": { "brief": "驗證郵件伺服器是否有權代表網域發信的機制", "standard": "寄件者政策框架（SPF）是 DNS 電子郵件驗證機制，\n網域管理員在 DNS 中發布授權的郵件伺服器清單，\n收件端伺服器可驗證寄件端 IP 是否在授權清單內，\n防止未授權伺服器偽造網域發送郵件。\n" }, "category": "technologies", "subcategory": "email_security", "tags": [ "電子郵件安全", "DNS", "反垃圾郵件" ], "related_terms": [ "dkim", "dmarc", "email_security" ], "aliases": {} }, { "id": "dkim", "term_en": "DKIM", "term_zh": "網域金鑰識別郵件", "definitions": { "brief": "以數位簽章驗證電子郵件完整性與來源的協定", "standard": "網域金鑰識別郵件（DKIM）使用公開金鑰密碼學\n為電子郵件加入數位簽章，\n收件端可透過 DNS 查詢驗證簽章，\n確認郵件內容未被竄改且確實由宣稱的網域發送。\n" }, "category": "technologies", "subcategory": "email_security", "tags": [ "電子郵件安全", "數位簽章", "密碼學" ], "related_terms": [ "spf", "dmarc", "email_security" ], "aliases": {} }, { "id": "apt", "term_en": "APT", "term_zh": "進階持續性威脅", "definitions": { "brief": "國家級駭客組織發動的長期網路攻擊", "standard": "進階持續性威脅是指由國家政府支持或高度組織化的駭客團體，\n針對特定目標進行長期、隱蔽的網路入侵活動，\n目標通常是竊取情報或破壞關鍵基礎設施。\n", "detailed": "APT 是一種攻擊類型的總稱，具有以下特徵：\n\n1. **進階 (Advanced)**：使用先進技術，包括零日漏洞、客製化惡意程式\n2. **持續性 (Persistent)**：長期潛伏，可達數月甚至數年\n3. **威脅 (Threat)**：有明確目標和充足資源\n\n各國資安機構對 APT 組織有不同命名方式：\n- 美國：APT + 編號（如 APT29）\n- Microsoft：元素名稱（如 Midnight Blizzard）\n- CrowdStrike：動物名稱（如 Cozy Bear）\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "國家級攻擊", "長期潛伏", "針對性" ], "related_terms": [ "nation_state_actor", "cyber_espionage" ], "aliases": { "zh": [ "高級持續性威脅", "APT 攻擊" ] } }, { "id": "apt29", "term_en": "APT29", "term_zh": "APT29", "definitions": { "brief": "俄羅斯國家級駭客組織，又稱 Cozy Bear", "standard": "APT29 是俄羅斯對外情報局 (SVR) 關聯的國家級駭客組織，\n主要針對政府機關、智庫、政黨進行網路間諜活動，\n以 SolarWinds 供應鏈攻擊聞名。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "俄羅斯", "國家級", "網路間諜" ], "related_terms": [ "apt28", "supply_chain_attack" ], "aliases": { "en": [ "Cozy Bear", "The Dukes", "NOBELIUM", "Midnight Blizzard" ] } }, { "id": "apt28", "term_en": "APT28", "term_zh": "APT28", "definitions": { "brief": "俄羅斯國家級駭客組織，又稱 Fancy Bear", "standard": "APT28 是俄羅斯軍事情報局 (GRU) 關聯的國家級駭客組織，\n以針對政治目標的攻擊聞名，包括 2016 年美國大選干預事件。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "俄羅斯", "國家級", "政治干預" ], "related_terms": [ "apt29" ], "aliases": { "en": [ "Fancy Bear", "Sofacy", "Pawn Storm", "Forest Blizzard" ] } }, { "id": "apt41", "term_en": "APT41", "term_zh": "APT41", "definitions": { "brief": "中國國家級駭客組織，兼具間諜與金融犯罪動機", "standard": "APT41 是與中國政府有關聯的駭客組織，獨特之處在於\n同時進行國家支持的網路間諜活動和以金錢為動機的犯罪行為。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "中國", "國家級", "雙重動機" ], "related_terms": [], "aliases": { "en": [ "Double Dragon", "Wicked Panda", "Brass Typhoon" ] } }, { "id": "lazarus_group", "term_en": "Lazarus Group", "term_zh": "拉撒路集團", "definitions": { "brief": "北韓國家級駭客組織，以金融竊盜聞名", "standard": "Lazarus Group 是北韓政府支持的駭客組織，\n主要從事金融竊盜以規避國際制裁，\n曾發動孟加拉央行 SWIFT 系統攻擊，竊取近 10 億美元。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "北韓", "國家級", "金融犯罪" ], "related_terms": [], "aliases": { "en": [ "Hidden Cobra", "Zinc", "Diamond Sleet" ], "zh": [ "拉撒路組織" ] } }, { "id": "nation_state_actor", "term_en": "Nation-State Actor", "term_zh": "國家級駭客", "definitions": { "brief": "由國家政府支持或直接指揮的駭客組織", "standard": "國家級駭客是由國家政府資助、訓練或直接指揮的網路攻擊組織，\n擁有充足資源和先進技術，執行網路間諜、破壞或影響力行動。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "國家級", "地緣政治" ], "related_terms": [ "apt", "cyber_espionage" ], "aliases": {} }, { "id": "ransomware_group", "term_en": "Ransomware Group", "term_zh": "勒索軟體集團", "definitions": { "brief": "專門開發和散播勒索軟體的犯罪組織", "standard": "勒索軟體集團是專門從事勒索軟體攻擊的網路犯罪組織，\n可能自行開發惡意程式或透過 RaaS 模式運作，\n通常具有組織化結構和分工。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "犯罪組織", "勒索軟體", "金錢動機" ], "related_terms": [ "ransomware", "raas" ], "aliases": {} }, { "id": "hacktivist", "term_en": "Hacktivist", "term_zh": "駭客行動主義者", "definitions": { "brief": "基於政治或社會理念進行網路攻擊的駭客", "standard": "駭客行動主義者出於政治、社會或意識形態動機進行網路攻擊，\n常見手法包括網站置換、DDoS 攻擊、資料外洩等，\n目的是宣傳理念或抗議特定組織或政府。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "政治動機", "社會運動" ], "related_terms": [ "ddos", "defacement" ], "aliases": {} }, { "id": "insider_threat", "term_en": "Insider Threat", "term_zh": "內部威脅", "definitions": { "brief": "來自組織內部人員的安全威脅", "standard": "內部威脅是指來自組織內部人員（員工、承包商、合作夥伴）的安全風險，\n可能是惡意行為（故意竊取或破壞）或疏忽（意外洩露）。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "內部", "人員安全" ], "related_terms": [ "data_exfiltration", "privileged_access" ], "aliases": {} }, { "id": "iab", "term_en": "IAB", "term_zh": "初始存取掮客", "definitions": { "brief": "專門販售企業網路存取權限的犯罪角色", "standard": "初始存取掮客專門入侵企業網路並販售存取權限給其他犯罪者，\n是勒索軟體攻擊供應鏈中的重要角色。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "犯罪服務", "供應鏈" ], "related_terms": [ "ransomware_group", "raas" ], "aliases": {} }, { "id": "ttp", "term_en": "TTP", "term_zh": "戰術、技術與程序", "definitions": { "brief": "描述威脅行為者攻擊方式的標準化框架", "standard": "TTP 是描述威脅行為者如何進行攻擊的標準化方式：\n戰術是攻擊目標、技術是達成目標的方法、程序是具體實作細節。\n" }, "category": "threat_actors", "subcategory": "methodology", "tags": [ "威脅情報", "MITRE ATT&CK" ], "related_terms": [ "mitre_attack", "ioc" ], "aliases": {} }, { "id": "ioc", "term_en": "IoC", "term_zh": "入侵指標", "definitions": { "brief": "用於識別系統是否遭入侵的技術證據", "standard": "入侵指標是可用於偵測系統是否遭入侵的技術證據，\n包括惡意 IP、網域、檔案雜湊值、異常行為模式等。\n" }, "category": "threat_actors", "subcategory": "methodology", "tags": [ "威脅情報", "偵測", "鑑識" ], "related_terms": [ "ttp", "threat_intelligence" ], "aliases": { "en": [ "Indicators of Compromise" ] } }, { "id": "c2", "term_en": "C2", "term_zh": "命令與控制", "definitions": { "brief": "攻擊者用來遠端控制受感染系統的基礎設施", "standard": "命令與控制是攻擊者建立的通訊管道，用於向受感染系統下達指令、\n接收竊取的資料，並管理殭屍網路。\n" }, "category": "threat_actors", "subcategory": "infrastructure", "tags": [ "惡意程式", "網路通訊" ], "related_terms": [ "botnet", "backdoor" ], "aliases": { "en": [ "C&C", "CnC" ] } }, { "id": "botnet", "term_en": "Botnet", "term_zh": "殭屍網路", "definitions": { "brief": "由攻擊者控制的大量受感染電腦組成的網路", "standard": "殭屍網路是由大量被惡意程式感染的電腦（殭屍電腦）組成，\n受攻擊者遠端控制，常用於發動 DDoS 攻擊、散播垃圾郵件或挖礦。\n" }, "category": "threat_actors", "subcategory": "infrastructure", "tags": [ "惡意程式", "DDoS" ], "related_terms": [ "c2", "ddos" ], "aliases": {} }, { "id": "scattered_spider", "term_en": "Scattered Spider", "term_zh": "Scattered Spider", "definitions": { "brief": "以社交工程手法著稱的年輕駭客組織", "standard": "Scattered Spider 是一個以年輕成員為主的駭客組織，\n擅長使用社交工程手法繞過 MFA 和 IT 服務台，\n曾攻擊 MGM、Caesars 等大型企業。\n" }, "category": "threat_actors", "subcategory": "cybercrime_group", "tags": [ "社交工程", "勒索軟體", "身分冒充" ], "related_terms": [ "social_engineering", "blackcat" ], "aliases": { "en": [ "UNC3944", "0ktapus", "Muddled Libra" ] } }, { "id": "fin7", "term_en": "FIN7", "term_zh": "FIN7", "definitions": { "brief": "專門攻擊零售和餐飲業的金融犯罪組織", "standard": "FIN7 是一個以金融利益為動機的網路犯罪組織，\n主要針對零售和餐飲業竊取信用卡資料，\n後來轉向勒索軟體攻擊。\n" }, "category": "threat_actors", "subcategory": "cybercrime_group", "tags": [ "金融犯罪", "POS 惡意程式", "勒索軟體" ], "related_terms": [], "aliases": { "en": [ "Carbanak", "Carbon Spider" ] } }, { "id": "turla", "term_en": "Turla", "term_zh": "Turla", "definitions": { "brief": "俄羅斯最精密的國家級駭客組織之一", "standard": "Turla 是與俄羅斯 FSB 有關聯的國家級駭客組織，\n以高度精密的惡意程式和隱蔽技術著稱，\n主要針對政府機關和外交單位進行間諜活動。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "俄羅斯", "國家級", "網路間諜" ], "related_terms": [], "aliases": { "en": [ "Snake", "Venomous Bear", "Secret Blizzard" ] } }, { "id": "sandworm", "term_en": "Sandworm", "term_zh": "Sandworm", "definitions": { "brief": "俄羅斯軍事情報局的破壞性攻擊組織", "standard": "Sandworm 是俄羅斯 GRU 單位 74455 的駭客組織，\n以破壞性攻擊聞名，曾發動 NotPetya、對烏克蘭電網的攻擊。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "俄羅斯", "國家級", "破壞性攻擊" ], "related_terms": [ "wiper", "notpetya" ], "aliases": { "en": [ "Voodoo Bear", "IRIDIUM", "Seashell Blizzard" ] } }, { "id": "kimsuky", "term_en": "Kimsuky", "term_zh": "Kimsuky", "definitions": { "brief": "北韓針對南韓的網路間諜組織", "standard": "Kimsuky 是北韓的國家級駭客組織，\n主要針對南韓政府、智庫、學術機構進行網路間諜活動，\n擅長使用魚叉式釣魚攻擊。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "北韓", "國家級", "網路間諜" ], "related_terms": [], "aliases": { "en": [ "Velvet Chollima", "Thallium", "Emerald Sleet" ] } }, { "id": "volt_typhoon", "term_en": "Volt Typhoon", "term_zh": "Volt Typhoon", "definitions": { "brief": "中國針對美國關鍵基礎設施的駭客組織", "standard": "Volt Typhoon 是中國國家級駭客組織，\n專門針對美國關鍵基礎設施（通訊、能源、水務）進行滲透，\n以「就地取材」手法著稱，潛伏時間長。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "中國", "國家級", "關鍵基礎設施" ], "related_terms": [ "living_off_the_land", "critical_infrastructure" ], "aliases": { "en": [ "Vanguard Panda", "Bronze Silhouette" ] } }, { "id": "blacktech", "term_en": "BlackTech", "term_zh": "BlackTech", "definitions": { "brief": "中國針對台灣和日本的駭客組織", "standard": "BlackTech 是與中國政府有關聯的駭客組織，\n主要針對台灣、日本和美國的政府機關和科技公司，\n進行網路間諜活動。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "中國", "國家級", "台灣" ], "related_terms": [], "aliases": { "en": [ "Palmerworm", "Circuit Panda" ] } }, { "id": "threat_intelligence", "term_en": "Threat Intelligence", "term_zh": "威脅情報", "definitions": { "brief": "關於現有或潛在網路威脅的可行動資訊", "standard": "威脅情報是經過收集、分析的資訊，\n可幫助組織了解威脅行為者的動機、能力和手法，\n以做出更好的安全決策。\n" }, "category": "threat_actors", "subcategory": "methodology", "tags": [ "情報", "防禦", "決策支援" ], "related_terms": [ "ioc", "ttp" ], "aliases": { "zh": [ "威脅情資" ] } }, { "id": "dark_web", "term_en": "Dark Web", "term_zh": "暗網", "definitions": { "brief": "需要特殊軟體才能存取的隱藏網路", "standard": "暗網是網際網路中需要使用 Tor 等特殊軟體才能存取的部分，\n因其匿名特性，常被用於非法交易、販售被盜資料和駭客服務。\n" }, "category": "threat_actors", "subcategory": "infrastructure", "tags": [ "匿名", "犯罪", "Tor" ], "related_terms": [ "underground_forum" ], "aliases": {} }, { "id": "underground_forum", "term_en": "Underground Forum", "term_zh": "地下論壇", "definitions": { "brief": "網路犯罪者交流和交易的秘密社群", "standard": "地下論壇是網路犯罪者聚集的秘密網站，\n用於分享駭客技術、販售被盜資料、招募合作夥伴，\n是網路犯罪生態系統的重要組成部分。\n" }, "category": "threat_actors", "subcategory": "infrastructure", "tags": [ "犯罪", "交易", "社群" ], "related_terms": [ "dark_web", "iab" ], "aliases": {} }, { "id": "cyber_espionage", "term_en": "Cyber Espionage", "term_zh": "網路間諜活動", "definitions": { "brief": "透過網路入侵竊取機密資訊的活動", "standard": "網路間諜活動是利用網路入侵手段竊取政府、企業機密資訊的行為，\n通常由國家級駭客組織執行，目標包括政治、軍事、經濟情報。\n" }, "category": "threat_actors", "subcategory": "activity_type", "tags": [ "國家級", "情報", "機密" ], "related_terms": [ "apt", "nation_state_actor" ], "aliases": {} }, { "id": "supply_chain_compromise", "term_en": "Supply Chain Compromise", "term_zh": "供應鏈入侵", "definitions": { "brief": "透過攻擊軟體供應鏈來滲透目標的手法", "standard": "供應鏈入侵是針對軟體開發、分發過程中的弱點，\n在合法軟體中植入惡意程式，藉由軟體更新散播給所有使用者。\n" }, "category": "threat_actors", "subcategory": "activity_type", "tags": [ "供應鏈", "第三方風險", "進階攻擊" ], "related_terms": [ "supply_chain_attack", "apt" ], "aliases": {} }, { "id": "lapsus", "term_en": "LAPSUS$", "term_zh": "LAPSUS$ 駭客組織", "definitions": { "brief": "以社交工程和內部威脅手法著稱的駭客組織", "standard": "LAPSUS$ 是一個以年輕成員為主的駭客組織，\n擅長透過社交工程、賄賂內部員工取得存取權限，\n曾攻擊 Microsoft、Nvidia、Uber 等大型科技公司。\n" }, "category": "threat_actors", "subcategory": "cybercrime_group", "tags": [ "社交工程", "資料竊取", "內部威脅" ], "related_terms": [ "social_engineering", "scattered_spider" ], "aliases": {} }, { "id": "lockbit_group", "term_en": "LockBit Group", "term_zh": "LockBit 勒索軟體集團", "definitions": { "brief": "全球最活躍的 RaaS 勒索軟體營運組織", "standard": "LockBit 是最多產的勒索軟體即服務營運組織之一，\n透過加盟者網路進行攻擊，2024 年遭執法機構 Operation Cronos 打擊，\n但仍持續活躍。\n" }, "category": "threat_actors", "subcategory": "ransomware_operator", "tags": [ "勒索軟體", "RaaS", "犯罪集團" ], "related_terms": [ "lockbit", "raas", "ransomware_group" ], "aliases": {} }, { "id": "alphv_group", "term_en": "ALPHV/BlackCat Group", "term_zh": "ALPHV 勒索軟體集團", "definitions": { "brief": "營運 BlackCat 勒索軟體的犯罪組織", "standard": "ALPHV 是營運 BlackCat 勒索軟體的組織，\n採用 RaaS 模式，以進階的 Rust 開發技術著稱，\n曾攻擊 MGM Resorts 等大型企業。\n" }, "category": "threat_actors", "subcategory": "ransomware_operator", "tags": [ "勒索軟體", "RaaS", "BlackCat" ], "related_terms": [ "blackcat", "raas" ], "aliases": {} }, { "id": "mustang_panda", "term_en": "Mustang Panda", "term_zh": "Mustang Panda", "definitions": { "brief": "針對東南亞和歐洲的中國國家級駭客組織", "standard": "Mustang Panda 是與中國政府有關聯的駭客組織，\n主要針對東南亞政府和歐洲外交單位進行間諜活動，\n擅長使用 PlugX 惡意程式。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "中國", "國家級", "網路間諜" ], "related_terms": [ "plugx" ], "aliases": { "en": [ "Bronze President", "RedDelta", "Earth Preta" ] } }, { "id": "flax_typhoon", "term_en": "Flax Typhoon", "term_zh": "Flax Typhoon", "definitions": { "brief": "針對台灣的中國國家級駭客組織", "standard": "Flax Typhoon 是中國國家級駭客組織，\n主要針對台灣政府機關、教育機構和關鍵基礎設施，\n以「就地取材」手法維持長期存取。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "中國", "國家級", "台灣" ], "related_terms": [ "living_off_the_land", "volt_typhoon" ], "aliases": { "en": [ "Ethereal Panda" ] } }, { "id": "salt_typhoon", "term_en": "Salt Typhoon", "term_zh": "Salt Typhoon", "definitions": { "brief": "針對美國電信業的中國國家級駭客組織", "standard": "Salt Typhoon 是中國國家級駭客組織，\n於 2024 年被揭露入侵美國多家主要電信公司，\n可能存取合法監聽系統和通訊資料。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "中國", "國家級", "電信" ], "related_terms": [], "aliases": { "en": [ "GhostEmperor", "FamousSparrow" ] } }, { "id": "earth_lusca", "term_en": "Earth Lusca", "term_zh": "Earth Lusca", "definitions": { "brief": "針對政府和教育機構的中國駭客組織", "standard": "Earth Lusca 是與中國有關聯的駭客組織，\n針對全球政府機關、媒體和教育機構進行間諜活動，\n同時也從事加密貨幣竊盜等金融犯罪。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "中國", "國家級", "雙重動機" ], "related_terms": [], "aliases": { "en": [ "TAG-22" ] } }, { "id": "sidewinder", "term_en": "SideWinder", "term_zh": "SideWinder", "definitions": { "brief": "針對南亞鄰國的印度國家級駭客組織", "standard": "SideWinder 是與印度政府有關聯的駭客組織，\n主要針對巴基斯坦、中國、尼泊爾等鄰國的政府和軍事單位，\n進行網路間諜活動。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "印度", "國家級", "南亞" ], "related_terms": [], "aliases": { "en": [ "Rattlesnake", "T-APT-04" ] } }, { "id": "bitter_apt", "term_en": "Bitter APT", "term_zh": "Bitter APT", "definitions": { "brief": "針對南亞的國家級駭客組織", "standard": "Bitter APT 是針對南亞國家進行網路間諜活動的組織，\n主要攻擊巴基斯坦、孟加拉和中國的政府機關，\n被認為與印度有關聯。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "國家級", "南亞", "網路間諜" ], "related_terms": [], "aliases": { "en": [ "T-APT-17" ] } }, { "id": "transparent_tribe", "term_en": "Transparent Tribe", "term_zh": "Transparent Tribe", "definitions": { "brief": "針對印度的巴基斯坦國家級駭客組織", "standard": "Transparent Tribe 是與巴基斯坦政府有關聯的駭客組織，\n主要針對印度政府和軍事單位進行網路間諜活動，\n使用自製的 CrimsonRAT 惡意程式。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "巴基斯坦", "國家級", "印度" ], "related_terms": [], "aliases": { "en": [ "APT36", "Mythic Leopard", "ProjectM" ] } }, { "id": "lancefly", "term_en": "Lancefly", "term_zh": "Lancefly", "definitions": { "brief": "針對南亞和東南亞的間諜活動組織", "standard": "Lancefly 是一個針對南亞和東南亞國家的駭客組織，\n主要攻擊政府、航空和電信產業，\n使用名為 Merdoor 的自製後門程式。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "國家級", "東南亞", "網路間諜" ], "related_terms": [], "aliases": {} }, { "id": "apt33", "term_en": "APT33", "term_zh": "APT33", "definitions": { "brief": "針對航空和能源產業的伊朗國家級駭客組織", "standard": "APT33 是伊朗政府支持的駭客組織，\n主要針對美國、沙烏地阿拉伯的航空和能源產業，\n進行破壞性攻擊和網路間諜活動。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "伊朗", "國家級", "能源" ], "related_terms": [], "aliases": { "en": [ "Elfin", "Magnallium", "Refined Kitten", "Peach Sandstorm" ] } }, { "id": "apt34", "term_en": "APT34", "term_zh": "APT34", "definitions": { "brief": "針對中東地區的伊朗國家級駭客組織", "standard": "APT34 是與伊朗情報機構有關聯的駭客組織，\n主要針對中東地區的政府、金融和能源產業，\n進行網路間諜活動和社交工程攻擊。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "伊朗", "國家級", "中東" ], "related_terms": [], "aliases": { "en": [ "OilRig", "Helix Kitten", "Hazel Sandstorm" ] } }, { "id": "charming_kitten", "term_en": "Charming Kitten", "term_zh": "Charming Kitten", "definitions": { "brief": "針對學術和媒體人士的伊朗駭客組織", "standard": "Charming Kitten 是伊朗國家級駭客組織，\n主要針對學者、記者、人權活動家和政策研究人員，\n使用精細的社交工程和釣魚攻擊。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "伊朗", "國家級", "社交工程" ], "related_terms": [], "aliases": { "en": [ "APT42", "Phosphorus", "TA453", "Mint Sandstorm" ] } }, { "id": "chinese_apt", "term_en": "Chinese APT", "term_zh": "中國 APT 組織", "definitions": { "brief": "與中國政府有關聯的國家級駭客組織統稱", "standard": "中國 APT 組織是與中國政府有關聯的國家級駭客組織，\n主要從事網路間諜活動，目標包括政府機關、關鍵基礎設施和智慧財產，\nMicrosoft 採用「Typhoon」命名，CrowdStrike 採用「Panda」命名。\n" }, "category": "threat_actors", "subcategory": "apt_category", "tags": [ "中國", "國家級", "分類" ], "related_terms": [ "apt41", "volt_typhoon", "blacktech", "mustang_panda", "salt_typhoon" ], "aliases": {} }, { "id": "russian_apt", "term_en": "Russian APT", "term_zh": "俄羅斯 APT 組織", "definitions": { "brief": "與俄羅斯政府有關聯的國家級駭客組織統稱", "standard": "俄羅斯 APT 組織主要隸屬於情報機構（SVR、FSB）或軍方（GRU），\n從事網路間諜和破壞性攻擊，Microsoft 採用「Blizzard」命名，\nCrowdStrike 採用「Bear」命名。\n" }, "category": "threat_actors", "subcategory": "apt_category", "tags": [ "俄羅斯", "國家級", "分類" ], "related_terms": [ "apt28", "apt29", "turla", "sandworm" ], "aliases": {} }, { "id": "north_korean_apt", "term_en": "North Korean APT", "term_zh": "北韓 APT 組織", "definitions": { "brief": "與北韓政府有關聯的國家級駭客組織統稱", "standard": "北韓 APT 組織主要從事金融竊盜以規避國際制裁，\n同時也進行間諜活動，Microsoft 採用「Sleet」命名，\nCrowdStrike 採用「Chollima」命名。\n" }, "category": "threat_actors", "subcategory": "apt_category", "tags": [ "北韓", "國家級", "分類" ], "related_terms": [ "lazarus_group", "kimsuky" ], "aliases": {} }, { "id": "iranian_apt", "term_en": "Iranian APT", "term_zh": "伊朗 APT 組織", "definitions": { "brief": "與伊朗政府有關聯的國家級駭客組織統稱", "standard": "伊朗 APT 組織主要針對中東地區和西方國家，\n從事間諜活動和破壞性攻擊，Microsoft 採用「Sandstorm」命名，\nCrowdStrike 採用「Kitten」命名。\n" }, "category": "threat_actors", "subcategory": "apt_category", "tags": [ "伊朗", "國家級", "分類" ], "related_terms": [ "apt33", "apt34", "charming_kitten" ], "aliases": {} }, { "id": "moonstone_sleet", "term_en": "Moonstone Sleet", "term_zh": "Moonstone Sleet", "definitions": { "brief": "北韓國家級駭客組織，針對科技與國防產業", "standard": "Moonstone Sleet 是北韓國家級駭客組織，\n主要針對軟體開發者、科技公司和國防產業，\n使用假公司和社交工程手法散播惡意程式。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "北韓", "國家級", "軟體開發者" ], "related_terms": [ "lazarus_group", "social_engineering" ], "aliases": { "en": [ "Storm-1789" ] } }, { "id": "qilin", "term_en": "Qilin", "term_zh": "Qilin 勒索軟體組織", "definitions": { "brief": "採用 RaaS 模式的勒索軟體犯罪組織", "standard": "Qilin（又名 Agenda）是 2022 年出現的勒索軟體組織，\n以 RaaS 模式運作，使用 Rust 和 Go 語言開發惡意程式，\n主要攻擊醫療、教育和關鍵基礎設施。\n" }, "category": "threat_actors", "subcategory": "ransomware_operator", "tags": [ "勒索軟體", "RaaS", "醫療" ], "related_terms": [ "ransomware_group", "raas" ], "aliases": { "en": [ "Agenda Ransomware" ] } }, { "id": "lazarus", "term_en": "Lazarus Group", "term_zh": "Lazarus 駭客集團", "definitions": { "brief": "北韓政府支持的多功能駭客組織", "standard": "Lazarus Group 是北韓最知名的國家級駭客組織，\n進行網路間諜、金融犯罪和破壞性攻擊，\n包括 2014 年 Sony Pictures 攻擊和 WannaCry 勒索軟體。\n" }, "category": "threat_actors", "subcategory": "apt_group", "tags": [ "北韓", "國家級", "金融犯罪" ], "related_terms": [ "apt", "wannacry" ], "aliases": { "en": [ "Hidden Cobra", "Zinc", "Diamond Sleet" ] } }, { "id": "script_kiddie", "term_en": "Script Kiddie", "term_zh": "腳本小子", "definitions": { "brief": "使用現成工具進行攻擊的低技術駭客", "standard": "腳本小子是指沒有深厚技術能力，\n依賴他人開發的現成攻擊工具或腳本進行攻擊的人，\n通常出於好奇或炫耀目的。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "低技術", "工具使用者", "業餘" ], "related_terms": [ "hacker" ], "aliases": {} }, { "id": "hacker", "term_en": "Hacker", "term_zh": "駭客", "definitions": { "brief": "具有電腦技術專長，可進行系統入侵的人", "standard": "駭客原指對電腦技術有深入研究的專家，\n現今常用於描述進行網路攻擊的人，\n依動機可分為白帽、黑帽和灰帽駭客。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "基礎概念", "技術專家" ], "related_terms": [ "white_hat", "black_hat", "gray_hat" ], "aliases": {} }, { "id": "white_hat", "term_en": "White Hat", "term_zh": "白帽駭客", "definitions": { "brief": "以合法方式進行安全測試的道德駭客", "standard": "白帽駭客是經過授權進行安全測試的專業人員，\n協助組織發現和修復安全漏洞，\n通常是滲透測試人員或安全研究人員。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "道德駭客", "授權測試", "防禦" ], "related_terms": [ "pentesting", "hacker" ], "aliases": { "zh": [ "道德駭客" ] } }, { "id": "black_hat", "term_en": "Black Hat", "term_zh": "黑帽駭客", "definitions": { "brief": "出於惡意目的進行非法入侵的駭客", "standard": "黑帽駭客是出於金錢、政治或惡意目的，\n未經授權入侵系統、竊取資料或造成破壞的駭客，\n其行為通常違反法律。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "惡意", "犯罪", "非法" ], "related_terms": [ "hacker", "cybercriminal" ], "aliases": {} }, { "id": "gray_hat", "term_en": "Gray Hat", "term_zh": "灰帽駭客", "definitions": { "brief": "介於白帽和黑帽之間的駭客", "standard": "灰帽駭客可能未經授權入侵系統，\n但目的不是造成傷害而是發現漏洞，\n有時會在公開漏洞前通知組織，行為處於法律灰色地帶。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "非授權", "漏洞揭露" ], "related_terms": [ "white_hat", "black_hat", "bug_bounty" ], "aliases": {} }, { "id": "cybercriminal", "term_en": "Cybercriminal", "term_zh": "網路犯罪者", "definitions": { "brief": "從事網路犯罪活動以牟利的個人或組織", "standard": "網路犯罪者是利用網路技術從事違法活動的人或團體，\n動機通常是金錢利益，活動包括詐騙、勒索、盜竊等。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "犯罪", "金錢動機" ], "related_terms": [ "black_hat", "ransomware_group" ], "aliases": {} }, { "id": "organized_crime", "term_en": "Organized Cybercrime", "term_zh": "組織化網路犯罪", "definitions": { "brief": "有組織結構和分工的網路犯罪集團", "standard": "組織化網路犯罪是具有類似企業結構的犯罪組織，\n有明確的分工、管理層級和專業化角色，\n從事大規模的勒索軟體、詐騙或盜竊活動。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "犯罪組織", "企業化", "分工" ], "related_terms": [ "ransomware_group", "cybercriminal" ], "aliases": {} }, { "id": "state_sponsored", "term_en": "State-Sponsored", "term_zh": "國家支持的", "definitions": { "brief": "由國家政府資助或指揮的網路行動", "standard": "國家支持的是指由政府直接或間接資助、訓練或指揮的網路攻擊，\n通常具有充足資源和先進技術，目標是政治、軍事或經濟利益。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "國家級", "政府", "資源充足" ], "related_terms": [ "apt", "nation_state_actor" ], "aliases": {} }, { "id": "bug_bounty_hunter", "term_en": "Bug Bounty Hunter", "term_zh": "漏洞獎金獵人", "definitions": { "brief": "參與漏洞獎勵計畫的安全研究人員", "standard": "漏洞獎金獵人是參與企業漏洞獎勵計畫的獨立研究人員，\n合法發現和回報軟體漏洞以獲取獎金，\n是白帽駭客的一種。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "漏洞研究", "獎勵計畫", "白帽" ], "related_terms": [ "bug_bounty", "white_hat" ], "aliases": {} }, { "id": "penetration_tester", "term_en": "Penetration Tester", "term_zh": "滲透測試人員", "definitions": { "brief": "受雇進行授權安全測試的專業人員", "standard": "滲透測試人員是經過組織授權，\n模擬攻擊者手法測試系統安全性的專業人員，\n目的是找出漏洞並提供修補建議。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "授權測試", "專業服務", "白帽" ], "related_terms": [ "pentesting", "white_hat", "red_team" ], "aliases": { "zh": [ "滲透測試員" ] } }, { "id": "red_team", "term_en": "Red Team", "term_zh": "紅隊", "definitions": { "brief": "模擬真實攻擊者的內部安全測試團隊", "standard": "紅隊是組織內部或外聘的安全團隊，\n模擬真實威脅行為者的戰術、技術和程序，\n對組織進行全面的攻擊模擬，測試防禦能力。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "攻擊模擬", "安全測試", "內部" ], "related_terms": [ "blue_team", "purple_team", "penetration_tester" ], "aliases": {} }, { "id": "blue_team", "term_en": "Blue Team", "term_zh": "藍隊", "definitions": { "brief": "負責防禦和事件回應的安全團隊", "standard": "藍隊是組織內部負責安全防禦的團隊，\n包括安全監控、事件回應、威脅狩獵等工作，\n在紅藍對抗中扮演防守角色。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "防禦", "監控", "事件回應" ], "related_terms": [ "red_team", "purple_team", "soc" ], "aliases": {} }, { "id": "purple_team", "term_en": "Purple Team", "term_zh": "紫隊", "definitions": { "brief": "協調紅藍兩隊合作的安全團隊", "standard": "紫隊是協調紅隊和藍隊合作的團隊，\n確保攻擊模擬的成果能有效轉化為防禦改善，\n促進攻防雙方的知識分享和持續改進。\n" }, "category": "threat_actors", "subcategory": "actor_type", "tags": [ "協調", "改善", "整合" ], "related_terms": [ "red_team", "blue_team" ], "aliases": {} }, { "id": "soc", "term_en": "SOC", "term_zh": "資安監控中心", "definitions": { "brief": "全天候監控組織資安狀態的中央單位", "standard": "資安監控中心是組織內負責 24/7 安全監控的單位，\n負責偵測、分析和回應資安事件，\n是藍隊運作的核心。\n" }, "category": "threat_actors", "subcategory": "infrastructure", "tags": [ "監控", "事件回應", "全天候" ], "related_terms": [ "blue_team", "siem" ], "aliases": {} }, { "id": "mssp", "term_en": "MSSP", "term_zh": "託管式安全服務供應商", "definitions": { "brief": "提供外包資安監控和管理服務的廠商", "standard": "託管式安全服務供應商是提供外包資安服務的廠商，\n服務包括安全監控、事件回應、漏洞管理等，\n讓組織無需自建完整的安全團隊。\n" }, "category": "threat_actors", "subcategory": "infrastructure", "tags": [ "外包", "服務", "託管" ], "related_terms": [ "soc", "mdr" ], "aliases": {} }, { "id": "mdr", "term_en": "MDR", "term_zh": "託管式偵測與回應", "definitions": { "brief": "結合自動化和人工分析的安全監控服務", "standard": "託管式偵測與回應是進階的安全監控服務，\n結合自動化工具和專業分析師的人工判斷，\n提供威脅偵測、調查和回應服務。\n" }, "category": "threat_actors", "subcategory": "infrastructure", "tags": [ "偵測", "回應", "託管服務" ], "related_terms": [ "mssp", "edr" ], "aliases": {} }, { "id": "attribution", "term_en": "Attribution", "term_zh": "攻擊歸因", "definitions": { "brief": "確定網路攻擊背後實際行為者的過程", "standard": "攻擊歸因是分析和確定網路攻擊背後真正行為者的過程，\n通常需要結合技術證據、情報資訊和政治脈絡，\n是一項複雜且具爭議性的工作。\n" }, "category": "threat_actors", "subcategory": "methodology", "tags": [ "調查", "分析", "溯源" ], "related_terms": [ "threat_intelligence", "ioc" ], "aliases": {} }, { "id": "false_flag", "term_en": "False Flag", "term_zh": "假旗行動", "definitions": { "brief": "攻擊者偽裝成其他組織的欺騙手法", "standard": "假旗行動是攻擊者故意在攻擊中留下指向其他組織的痕跡，\n目的是混淆歸因、嫁禍他人或引發地緣政治衝突，\n使調查人員誤判攻擊來源。\n" }, "category": "threat_actors", "subcategory": "methodology", "tags": [ "欺騙", "歸因", "偽裝" ], "related_terms": [ "attribution" ], "aliases": {} }, { "id": "diamond_model", "term_en": "Diamond Model", "term_zh": "鑽石模型", "definitions": { "brief": "以四個核心元素分析入侵事件的框架", "standard": "鑽石模型是分析網路入侵的框架，\n包含對手、能力、基礎設施和受害者四個頂點，\n用於理解攻擊事件的關係和脈絡。\n" }, "category": "threat_actors", "subcategory": "methodology", "tags": [ "框架", "分析", "威脅情報" ], "related_terms": [ "threat_intelligence", "kill_chain" ], "aliases": {} }, { "id": "apt43", "term_en": "APT43", "term_zh": "APT43", "definitions": { "brief": "北韓國家級 APT 組織，專注竊密與加密貨幣竊取", "standard": "APT43 是北韓國家支持的 APT 組織，\n又稱 Kimsuky 或 Velvet Chollima，\n以魚叉式網路釣魚為主要手法，\n針對政府機關、智庫和外交單位進行情報竊取，\n並從事加密貨幣竊取以資助政府行動。\n" }, "category": "threat_actors", "subcategory": "nation_state", "tags": [ "北韓", "APT", "加密貨幣", "間諜活動" ], "related_terms": [ "apt38", "lazarus_group" ], "aliases": {} }, { "id": "apt40", "term_en": "APT40", "term_zh": "APT40", "definitions": { "brief": "中國國家級 APT 組織，針對海事與國防產業", "standard": "APT40 是中國國家安全部（MSS）關聯的 APT 組織，\n又稱 BRONZE MOHAWK 或 Leviathan，\n主要針對海事、造船、航太和國防產業，\n以及與南海主權爭議相關的政府機關。\n" }, "category": "threat_actors", "subcategory": "nation_state", "tags": [ "中國", "APT", "海事", "國防" ], "related_terms": [ "apt41" ], "aliases": {} }, { "id": "apt38", "term_en": "APT38", "term_zh": "APT38", "definitions": { "brief": "北韓國家級組織，與 Lazarus 相關，專注金融機構攻擊", "standard": "APT38 是北韓國家支持的 APT 組織，\n與 Lazarus Group 存在重疊但運作獨立，\n專門針對全球金融機構，\n透過 SWIFT 銀行系統攻擊竊取數億美元，\n是目前已知最具破壞力的金融網路犯罪組織之一。\n" }, "category": "threat_actors", "subcategory": "nation_state", "tags": [ "北韓", "APT", "金融", "SWIFT" ], "related_terms": [ "lazarus_group", "apt43" ], "aliases": {} }, { "id": "midnight_blizzard", "term_en": "Midnight Blizzard", "term_zh": "Midnight Blizzard", "definitions": { "brief": "俄羅斯 SVR 關聯 APT 組織，前稱 Nobelium", "standard": "Midnight Blizzard 是俄羅斯對外情報局（SVR）關聯的 APT 組織，\n微軟將其前稱 Nobelium，另稱 APT29 或 Cozy Bear，\n負責 2020 年 SolarWinds 供應鏈攻擊，\n持續針對政府機關、外交單位和科技公司進行間諜行動。\n" }, "category": "threat_actors", "subcategory": "nation_state", "tags": [ "俄羅斯", "SVR", "APT29", "供應鏈攻擊" ], "related_terms": [ "cozy_bear", "apt29" ], "aliases": { "en": [ "Nobelium", "APT29", "IRON HEMLOCK", "Dark Halo" ] } }, { "id": "fancy_bear", "term_en": "Fancy Bear", "term_zh": "Fancy Bear", "definitions": { "brief": "俄羅斯 GRU 關聯 APT28 組織的別稱", "standard": "Fancy Bear 是 CrowdStrike 對俄羅斯軍事情報局（GRU）\n關聯的 APT28 組織的命名，\n以針對政府機關、選舉基礎設施和軍事目標的攻擊聞名，\n曾干預 2016 年美國總統大選和 2016 年法國大選。\n" }, "category": "threat_actors", "subcategory": "nation_state", "tags": [ "俄羅斯", "GRU", "APT28", "選舉干預" ], "related_terms": [ "cozy_bear", "midnight_blizzard" ], "aliases": { "en": [ "APT28", "Sofacy", "STRONTIUM", "Pawn Storm" ] } }, { "id": "cozy_bear", "term_en": "Cozy Bear", "term_zh": "Cozy Bear", "definitions": { "brief": "俄羅斯 SVR 關聯 APT29 組織的別稱", "standard": "Cozy Bear 是 CrowdStrike 對俄羅斯對外情報局（SVR）\n關聯的 APT29 組織的命名，\n即微軟所稱的 Midnight Blizzard，\n以高度隱蔽的長期間諜行動和複雜的惡意程式工具鏈著稱。\n" }, "category": "threat_actors", "subcategory": "nation_state", "tags": [ "俄羅斯", "SVR", "APT29", "間諜活動" ], "related_terms": [ "fancy_bear", "midnight_blizzard" ], "aliases": { "en": [ "APT29", "Midnight Blizzard", "Nobelium", "The Dukes" ] } }, { "id": "cl0p_group", "term_en": "Cl0p", "term_zh": "Cl0p 勒索組織", "definitions": { "brief": "以大規模 MOVEit 漏洞攻擊聞名的勒索軟體組織", "standard": "Cl0p 是以勒索軟體即服務（RaaS）模式運作的網路犯罪組織，\n以大規模利用零日漏洞（如 MOVEit、GoAnywhere、Accellion）\n進行資料勒索攻擊著稱，\n2023 年 MOVEit 漏洞攻擊影響全球逾 2,500 個組織。\n" }, "category": "threat_actors", "subcategory": "cybercrime_group", "tags": [ "勒索軟體", "RaaS", "MOVEit", "資料勒索" ], "related_terms": [ "ransomware", "lockbit" ], "aliases": {} }, { "id": "medusa_group", "term_en": "Medusa Ransomware Group", "term_zh": "Medusa 勒索組織", "definitions": { "brief": "採用雙重勒索策略並維護資料洩漏網站的勒索組織", "standard": "Medusa 是自 2022 年活躍的勒索軟體組織，\n採用雙重勒索策略（加密資料同時威脅公開洩漏），\n維護「Medusa Blog」資料洩漏網站，\n攻擊目標涵蓋教育、醫療、政府及製造業等多個產業。\n" }, "category": "threat_actors", "subcategory": "cybercrime_group", "tags": [ "勒索軟體", "雙重勒索", "資料洩漏" ], "related_terms": [ "ransomware", "cl0p_group" ], "aliases": {} }, { "id": "rce", "term_en": "RCE", "term_zh": "遠端程式碼執行", "definitions": { "brief": "攻擊者可遠端在目標系統執行任意程式碼的漏洞", "standard": "遠端程式碼執行漏洞允許攻擊者透過網路在目標系統上執行任意程式碼，\n通常被評為「危急」等級，是最嚴重的漏洞類型之一。\n" }, "category": "vulnerabilities", "subcategory": "code_execution", "tags": [ "危急", "程式碼執行", "遠端" ], "related_terms": [ "ace", "command_injection" ], "aliases": {} }, { "id": "ace", "term_en": "ACE", "term_zh": "任意程式碼執行", "definitions": { "brief": "攻擊者可執行任意程式碼的漏洞", "standard": "任意程式碼執行漏洞允許攻擊者在目標系統上執行其選擇的程式碼，\n與 RCE 類似但更廣泛，可能是本地或遠端利用。\n" }, "category": "vulnerabilities", "subcategory": "code_execution", "tags": [], "related_terms": [ "rce", "lce" ], "aliases": {} }, { "id": "sql_injection", "term_en": "SQL Injection", "term_zh": "SQL 注入", "definitions": { "brief": "透過惡意 SQL 語句操縱資料庫的攻擊", "standard": "SQL 注入是將惡意 SQL 程式碼插入應用程式查詢中，\n可能導致資料外洩、資料篡改、驗證繞過，甚至系統入侵。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "網頁安全", "資料庫", "OWASP Top 10" ], "related_terms": [ "xss", "command_injection" ], "aliases": {} }, { "id": "xss", "term_en": "XSS", "term_zh": "跨站腳本", "definitions": { "brief": "在網頁中注入惡意腳本的攻擊", "standard": "跨站腳本攻擊將惡意 JavaScript 注入網頁，\n當其他使用者瀏覽時執行，可竊取 Cookie、劫持工作階段或進行釣魚攻擊。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "網頁安全", "JavaScript", "OWASP Top 10" ], "related_terms": [ "csrf", "sql_injection" ], "aliases": {} }, { "id": "xxe", "term_en": "XXE", "term_zh": "XML 外部實體注入", "definitions": { "brief": "利用 XML 解析器處理外部實體的漏洞", "standard": "XXE 漏洞發生在應用程式解析含有外部實體參照的 XML 時，\n攻擊者可利用此漏洞讀取伺服器檔案、發起 SSRF 攻擊，\n甚至在某些情況下執行遠端程式碼。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [], "related_terms": [ "ssrf", "lfi" ], "aliases": {} }, { "id": "command_injection", "term_en": "Command Injection", "term_zh": "命令注入", "definitions": { "brief": "透過應用程式執行系統命令的漏洞", "standard": "命令注入發生在應用程式將使用者輸入傳遞給系統命令時，\n攻擊者可注入額外的命令在伺服器上執行，\n通常可導致完全控制系統。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [], "related_terms": [ "rce", "sql_injection" ], "aliases": {} }, { "id": "buffer_overflow", "term_en": "Buffer Overflow", "term_zh": "緩衝區溢位", "definitions": { "brief": "程式寫入資料超過緩衝區大小的漏洞", "standard": "緩衝區溢位發生在程式寫入資料超過分配的記憶體空間，\n可能覆蓋相鄰記憶體導致程式崩潰或執行任意程式碼。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "C/C++", "二進位" ], "related_terms": [ "use_after_free", "heap_overflow" ], "aliases": {} }, { "id": "use_after_free", "term_en": "Use-After-Free", "term_zh": "釋放後使用", "definitions": { "brief": "程式使用已釋放記憶體區域的漏洞", "standard": "釋放後使用發生在程式釋放記憶體後仍繼續使用該位址，\n攻擊者可透過控制該記憶體區域的內容來劫持程式執行流程，\n是瀏覽器和作業系統中常見的嚴重漏洞類型。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [], "related_terms": [], "aliases": { "en": [ "UAF" ] } }, { "id": "authentication_bypass", "term_en": "Authentication Bypass", "term_zh": "驗證繞過", "definitions": { "brief": "繞過身分驗證機制取得未授權存取的漏洞", "standard": "驗證繞過漏洞允許攻擊者在不提供有效憑證的情況下存取受保護資源，\n常見原因包括邏輯錯誤、預設帳號、會話管理問題等。\n" }, "category": "vulnerabilities", "subcategory": "authentication", "tags": [], "related_terms": [], "aliases": {} }, { "id": "idor", "term_en": "IDOR", "term_zh": "不安全直接物件參考", "definitions": { "brief": "透過修改參數存取未授權資源的漏洞", "standard": "IDOR 漏洞發生在應用程式使用使用者提供的輸入直接存取物件，\n攻擊者可透過修改 ID 或參數值存取其他使用者的資料，\n是水平權限提升的常見形式。\n" }, "category": "vulnerabilities", "subcategory": "authentication", "tags": [], "related_terms": [], "aliases": {} }, { "id": "csrf", "term_en": "CSRF", "term_zh": "跨站請求偽造", "definitions": { "brief": "誘騙使用者在已登入網站執行非預期操作的攻擊", "standard": "跨站請求偽造誘使已登入的使用者在不知情的情況下執行操作，\n攻擊者建立惡意網頁，使使用者的瀏覽器向目標網站發送請求，\n可能導致轉帳、修改密碼等危害。\n" }, "category": "vulnerabilities", "subcategory": "authentication", "tags": [], "related_terms": [], "aliases": { "en": [ "XSRF" ] } }, { "id": "ssrf", "term_en": "SSRF", "term_zh": "伺服器端請求偽造", "definitions": { "brief": "利用伺服器發送請求存取內部資源的攻擊", "standard": "SSRF 漏洞允許攻擊者誘使伺服器向內部或外部資源發送請求，\n可用於存取內部服務、讀取雲端元資料或掃描內網。\n" }, "category": "vulnerabilities", "subcategory": "authentication", "tags": [ "網頁安全", "雲端安全", "OWASP Top 10" ], "related_terms": [], "aliases": {} }, { "id": "path_traversal", "term_en": "Path Traversal", "term_zh": "路徑遍歷", "definitions": { "brief": "透過操縱路徑存取未授權檔案的漏洞", "standard": "路徑遍歷漏洞允許攻擊者使用 ../ 等特殊字元跳出預期目錄，\n存取伺服器上的其他檔案，如設定檔、密碼檔等敏感資料。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [], "related_terms": [], "aliases": { "en": [ "Directory Traversal" ], "zh": [ "目錄遍歷" ] } }, { "id": "deserialization", "term_en": "Insecure Deserialization", "term_zh": "不安全反序列化", "definitions": { "brief": "反序列化不受信任資料導致的安全漏洞", "standard": "不安全反序列化發生在應用程式將不受信任的資料還原為物件時，\n攻擊者可透過精心構造的序列化資料執行任意程式碼，\n是 Java、PHP 等語言中的常見嚴重漏洞。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [], "related_terms": [], "aliases": {} }, { "id": "misconfiguration", "term_en": "Security Misconfiguration", "term_zh": "安全設定錯誤", "definitions": { "brief": "因不當設定導致的安全弱點", "standard": "安全設定錯誤是因系統、應用程式或雲端服務設定不當所導致的漏洞，\n例如預設密碼、過於寬鬆的權限、未關閉除錯功能等。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "設定", "雲端安全", "OWASP Top 10" ], "related_terms": [], "aliases": {} }, { "id": "race_condition", "term_en": "Race Condition", "term_zh": "競爭條件", "definitions": { "brief": "多執行緒競爭存取共享資源導致的漏洞", "standard": "競爭條件發生在多個程序或執行緒同時存取共享資源時，\n因時序差異導致非預期行為，可能被利用於權限提升或繞過檢查。\n" }, "category": "vulnerabilities", "subcategory": "logic", "tags": [ "邏輯漏洞", "並行", "TOCTOU" ], "related_terms": [], "aliases": { "zh": [ "競態條件" ] } }, { "id": "heap_overflow", "term_en": "Heap Overflow", "term_zh": "堆積溢位", "definitions": { "brief": "堆積記憶體區域的緩衝區溢位漏洞", "standard": "堆積溢位發生在程式對堆積記憶體區域寫入超過分配大小的資料，\n攻擊者可利用來覆蓋函式指標或控制程式執行流程。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "二進位", "漏洞利用" ], "related_terms": [ "buffer_overflow", "use_after_free" ], "aliases": {} }, { "id": "integer_overflow", "term_en": "Integer Overflow", "term_zh": "整數溢位", "definitions": { "brief": "整數運算超出型別範圍導致的漏洞", "standard": "整數溢位發生在運算結果超過變數可儲存的最大值，\n導致數值回繞，可能被利用來繞過長度檢查或觸發緩衝區溢位。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "二進位", "數值" ], "related_terms": [], "aliases": {} }, { "id": "format_string", "term_en": "Format String Vulnerability", "term_zh": "格式化字串漏洞", "definitions": { "brief": "因不當使用格式化函式導致的漏洞", "standard": "格式化字串漏洞發生在程式將使用者輸入直接作為格式字串參數，\n攻擊者可利用 %x、%n 等格式符來讀取或寫入記憶體。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "C/C++", "printf" ], "related_terms": [], "aliases": {} }, { "id": "lfi", "term_en": "LFI", "term_zh": "本地檔案包含", "definitions": { "brief": "透過操縱參數讀取伺服器本地檔案的漏洞", "standard": "本地檔案包含漏洞允許攻擊者透過操縱路徑參數，\n讀取伺服器上的敏感檔案如設定檔、密碼檔等。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "網頁安全", "檔案存取" ], "related_terms": [ "rfi", "path_traversal" ], "aliases": {} }, { "id": "rfi", "term_en": "RFI", "term_zh": "遠端檔案包含", "definitions": { "brief": "透過操縱參數載入外部惡意檔案的漏洞", "standard": "遠端檔案包含漏洞允許攻擊者讓伺服器載入並執行外部惡意程式碼，\n常導致遠端程式碼執行。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "網頁安全", "RCE" ], "related_terms": [ "lfi", "rce" ], "aliases": {} }, { "id": "ssti", "term_en": "SSTI", "term_zh": "伺服器端模板注入", "definitions": { "brief": "在伺服器端模板引擎中注入惡意程式碼", "standard": "伺服器端模板注入發生在使用者輸入被直接嵌入模板中，\n攻擊者可利用模板語法執行任意程式碼，常導致 RCE。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "網頁安全", "模板", "RCE" ], "related_terms": [ "rce", "xss" ], "aliases": {} }, { "id": "ldap_injection", "term_en": "LDAP Injection", "term_zh": "LDAP 注入", "definitions": { "brief": "透過惡意 LDAP 查詢存取或修改目錄資料", "standard": "LDAP 注入發生在應用程式使用使用者輸入建構 LDAP 查詢時，\n攻擊者可操控查詢邏輯以繞過驗證、存取未授權資料，\n或修改 Active Directory 等目錄服務中的資訊。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "目錄服務", "Active Directory" ], "related_terms": [ "sql_injection" ], "aliases": {} }, { "id": "prototype_pollution", "term_en": "Prototype Pollution", "term_zh": "原型污染", "definitions": { "brief": "污染 JavaScript 物件原型導致的安全漏洞", "standard": "原型污染是 JavaScript 特有的漏洞，攻擊者透過操縱物件屬性，\n污染 Object.prototype，影響所有繼承該原型的物件。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "JavaScript", "Node.js", "網頁安全" ], "related_terms": [], "aliases": {} }, { "id": "open_redirect", "term_en": "Open Redirect", "term_zh": "開放重導向", "definitions": { "brief": "將使用者重導向至任意外部網站的漏洞", "standard": "開放重導向漏洞允許攻擊者利用受信任網站將使用者重導向至惡意網站，\n常用於釣魚攻擊或 OAuth 劫持。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "網頁安全", "釣魚" ], "related_terms": [ "phishing" ], "aliases": {} }, { "id": "hardcoded_credentials", "term_en": "Hardcoded Credentials", "term_zh": "硬編碼憑證", "definitions": { "brief": "將密碼或金鑰直接寫入程式碼的弱點", "standard": "硬編碼憑證是將密碼、API 金鑰等敏感資訊直接寫入原始碼，\n一旦程式碼洩露，這些憑證即被暴露。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "設定", "密碼管理", "DevSecOps" ], "related_terms": [], "aliases": {} }, { "id": "information_disclosure", "term_en": "Information Disclosure", "term_zh": "資訊洩露", "definitions": { "brief": "非預期暴露敏感資訊的漏洞", "standard": "資訊洩露漏洞導致系統暴露敏感資訊，\n如錯誤訊息顯示技術細節、目錄列表、原始碼外洩等。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "資訊安全", "偵察" ], "related_terms": [], "aliases": {} }, { "id": "broken_access_control", "term_en": "Broken Access Control", "term_zh": "存取控制失效", "definitions": { "brief": "存取控制機制實作不當導致的漏洞", "standard": "存取控制失效是 OWASP Top 10 第一名的漏洞類型，\n包含水平/垂直權限提升、繞過授權檢查等問題。\n" }, "category": "vulnerabilities", "subcategory": "authentication", "tags": [ "OWASP Top 10", "授權", "權限" ], "related_terms": [ "idor", "privilege_escalation" ], "aliases": {} }, { "id": "null_pointer_dereference", "term_en": "Null Pointer Dereference", "term_zh": "空指標解參考", "definitions": { "brief": "程式嘗試存取空指標所指向的記憶體位置", "standard": "空指標解參考發生在程式嘗試讀取或寫入空指標（NULL）指向的記憶體，\n通常導致程式崩潰，某些情況下可能被利用執行任意程式碼。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "崩潰", "C/C++" ], "related_terms": [], "aliases": {} }, { "id": "double_free", "term_en": "Double Free", "term_zh": "重複釋放", "definitions": { "brief": "程式對同一記憶體區塊執行兩次釋放操作", "standard": "重複釋放發生在程式對已釋放的記憶體再次呼叫 free()，\n可能導致記憶體損壞，攻擊者可利用來執行任意程式碼。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "堆積", "漏洞利用" ], "related_terms": [ "use_after_free", "heap_overflow" ], "aliases": {} }, { "id": "type_confusion", "term_en": "Type Confusion", "term_zh": "型別混淆", "definitions": { "brief": "程式將資料當作錯誤的型別處理", "standard": "型別混淆發生在程式將某種型別的資料誤認為另一種型別處理，\n在瀏覽器引擎等複雜軟體中常見，可能導致任意程式碼執行。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "瀏覽器", "漏洞利用" ], "related_terms": [], "aliases": {} }, { "id": "out_of_bounds_read", "term_en": "Out-of-Bounds Read", "term_zh": "越界讀取", "definitions": { "brief": "程式讀取超出緩衝區邊界的記憶體資料", "standard": "越界讀取發生在程式讀取超出分配記憶體範圍的資料，\n可能洩露敏感資訊，如 Heartbleed 漏洞。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "資訊洩露" ], "related_terms": [], "aliases": { "en": [ "OOB Read" ] } }, { "id": "out_of_bounds_write", "term_en": "Out-of-Bounds Write", "term_zh": "越界寫入", "definitions": { "brief": "程式寫入資料到緩衝區邊界之外", "standard": "越界寫入發生在程式將資料寫入超出分配記憶體範圍的位置，\n可能覆蓋重要資料或控制流程，導致任意程式碼執行。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "程式碼執行", "二進位" ], "related_terms": [], "aliases": { "en": [ "OOB Write" ] } }, { "id": "crlf_injection", "term_en": "CRLF Injection", "term_zh": "CRLF 注入", "definitions": { "brief": "透過注入換行符號操控 HTTP 標頭的漏洞", "standard": "CRLF 注入透過在使用者輸入中插入 CR（%0D）和 LF（%0A）字元，\n可以在 HTTP 回應中注入新的標頭或分割回應，用於 XSS 或快取污染。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "HTTP", "網頁安全", "標頭注入" ], "related_terms": [ "http_response_splitting", "xss" ], "aliases": {} }, { "id": "xpath_injection", "term_en": "XPath Injection", "term_zh": "XPath 注入", "definitions": { "brief": "透過惡意 XPath 查詢存取 XML 資料的漏洞", "standard": "XPath 注入發生在應用程式使用使用者輸入建構 XPath 查詢，\n攻擊者可以操控查詢邏輯，存取或修改 XML 文件中的資料。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "XML", "注入", "資料存取" ], "related_terms": [ "sql_injection", "xxe" ], "aliases": {} }, { "id": "nosql_injection", "term_en": "NoSQL Injection", "term_zh": "NoSQL 注入", "definitions": { "brief": "針對 NoSQL 資料庫的注入攻擊", "standard": "NoSQL 注入是針對 MongoDB、Redis 等 NoSQL 資料庫的攻擊，\n攻擊者透過操控查詢物件或運算子，繞過驗證或存取未授權資料。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "資料庫", "MongoDB", "注入" ], "related_terms": [ "sql_injection" ], "aliases": {} }, { "id": "http_request_smuggling", "term_en": "HTTP Request Smuggling", "term_zh": "HTTP 請求走私", "definitions": { "brief": "利用前後端伺服器解析差異的攻擊", "standard": "HTTP 請求走私利用前端和後端伺服器對 HTTP 請求解析方式的不一致，\n將惡意請求「走私」到後端，可能導致快取污染、存取控制繞過等問題。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "HTTP", "代理", "Web 伺服器" ], "related_terms": [], "aliases": {} }, { "id": "subdomain_takeover", "term_en": "Subdomain Takeover", "term_zh": "子網域接管", "definitions": { "brief": "接管指向已失效服務的子網域", "standard": "子網域接管發生在子網域的 DNS 記錄指向已不再使用的外部服務，\n攻擊者可以在該服務平台註冊並控制該子網域，用於釣魚或竊取 Cookie。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "DNS", "雲端", "設定錯誤" ], "related_terms": [ "dns_spoofing", "misconfiguration" ], "aliases": {} }, { "id": "cors_misconfiguration", "term_en": "CORS Misconfiguration", "term_zh": "CORS 設定錯誤", "definitions": { "brief": "跨來源資源共用設定不當導致的安全問題", "standard": "CORS 設定錯誤發生在網站設定過於寬鬆的存取控制標頭，\n允許惡意網站跨網域讀取敏感資料或執行操作。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "網頁安全", "跨網域", "API" ], "related_terms": [ "csrf", "api_security" ], "aliases": {} }, { "id": "jwt_vulnerability", "term_en": "JWT Vulnerability", "term_zh": "JWT 漏洞", "definitions": { "brief": "JSON Web Token 實作或設定不當導致的漏洞", "standard": "JWT 漏洞包括使用弱簽章演算法（如 none）、\n未驗證簽章、金鑰洩露等問題，可能導致身分偽造或權限繞過。\n" }, "category": "vulnerabilities", "subcategory": "authentication", "tags": [ "身分驗證", "Token", "API" ], "related_terms": [ "authentication_bypass" ], "aliases": {} }, { "id": "mass_assignment", "term_en": "Mass Assignment", "term_zh": "批量賦值漏洞", "definitions": { "brief": "允許攻擊者修改不應被修改的物件屬性", "standard": "批量賦值漏洞發生在應用程式自動將 HTTP 請求參數綁定到物件屬性，\n攻擊者可以注入額外參數修改敏感屬性，如 isAdmin、role 等。\n" }, "category": "vulnerabilities", "subcategory": "logic", "tags": [ "API", "框架", "物件綁定" ], "related_terms": [], "aliases": { "en": [ "Auto-binding Vulnerability" ] } }, { "id": "insecure_file_upload", "term_en": "Insecure File Upload", "term_zh": "不安全的檔案上傳", "definitions": { "brief": "未充分驗證上傳檔案導致的安全漏洞", "standard": "不安全的檔案上傳漏洞發生在應用程式未正確驗證上傳檔案的類型和內容，\n攻擊者可上傳惡意腳本（如 PHP Webshell）取得系統控制權。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "網頁安全", "檔案上傳", "RCE" ], "related_terms": [ "webshell", "rce" ], "aliases": {} }, { "id": "vulnerability", "term_en": "Vulnerability", "term_zh": "漏洞", "definitions": { "brief": "系統或軟體中可被利用的安全弱點", "standard": "漏洞是系統、軟體或設定中的弱點，\n可被攻擊者利用來取得未授權存取、執行惡意程式碼或造成其他危害，\n漏洞嚴重程度通常以 CVSS 評分表示。\n" }, "category": "vulnerabilities", "subcategory": "general", "tags": [ "基礎概念", "安全弱點" ], "related_terms": [ "cve", "cvss", "exploit" ], "aliases": {} }, { "id": "exploit", "term_en": "Exploit", "term_zh": "漏洞利用程式", "definitions": { "brief": "用於利用特定漏洞的程式碼或技術", "standard": "漏洞利用程式是專門設計來利用特定漏洞的程式碼或技術，\n可能用於取得系統存取權、提升權限或執行其他惡意操作。\n" }, "category": "vulnerabilities", "subcategory": "general", "tags": [ "攻擊", "漏洞利用" ], "related_terms": [ "vulnerability", "zero_day", "poc" ], "aliases": {} }, { "id": "input_validation", "term_en": "Input Validation", "term_zh": "輸入驗證", "definitions": { "brief": "檢查和清理使用者輸入的安全措施", "standard": "輸入驗證是在處理使用者輸入前進行檢查和清理的過程，\n缺乏適當的輸入驗證是注入攻擊（SQL、XSS、命令注入）的根本原因。\n" }, "category": "vulnerabilities", "subcategory": "defense", "tags": [ "安全開發", "防禦", "最佳實務" ], "related_terms": [ "sql_injection", "xss", "command_injection" ], "aliases": {} }, { "id": "memory_corruption", "term_en": "Memory Corruption", "term_zh": "記憶體損壞", "definitions": { "brief": "程式不當操作記憶體導致的安全問題", "standard": "記憶體損壞是指程式不當讀寫記憶體導致的安全漏洞類別，\n包括緩衝區溢位、堆積溢位、使用後釋放、雙重釋放等，\n是嚴重的漏洞類型，可能導致任意程式碼執行。\n" }, "category": "vulnerabilities", "subcategory": "memory_safety", "tags": [ "記憶體", "二進位", "漏洞類別" ], "related_terms": [ "buffer_overflow", "use_after_free", "heap_overflow" ], "aliases": {} }, { "id": "poc", "term_en": "PoC", "term_zh": "概念驗證", "definitions": { "brief": "證明漏洞可被利用的示範程式碼", "standard": "概念驗證是用於證明某個漏洞確實存在且可被利用的程式碼或方法，\n安全研究人員通常在負責任揭露時提供 PoC 供廠商確認漏洞。\n" }, "category": "vulnerabilities", "subcategory": "general", "tags": [ "漏洞研究", "揭露" ], "related_terms": [ "exploit", "vulnerability", "responsible_disclosure" ], "aliases": {} }, { "id": "lce", "term_en": "LCE", "term_zh": "本地程式碼執行", "definitions": { "brief": "在本地系統執行任意程式碼的漏洞", "standard": "本地程式碼執行是指攻擊者能夠在已有存取權限的系統上\n執行任意程式碼的漏洞，\n通常需要結合權限提升漏洞才能造成更大危害。\n" }, "category": "vulnerabilities", "subcategory": "code_execution", "tags": [ "程式碼執行", "本地", "漏洞" ], "related_terms": [ "rce", "ace", "lpe" ], "aliases": {} }, { "id": "lpe", "term_en": "LPE", "term_zh": "本地權限提升", "definitions": { "brief": "從低權限提升至高權限的漏洞", "standard": "本地權限提升是指攻擊者利用漏洞\n從一般使用者權限提升至管理員或系統權限，\n是後滲透階段常見的攻擊步驟。\n" }, "category": "vulnerabilities", "subcategory": "authentication", "tags": [ "權限提升", "本地", "後滲透" ], "related_terms": [ "privilege_escalation", "lce" ], "aliases": {} }, { "id": "stealth", "term_en": "Stealth Techniques", "term_zh": "隱匿技術", "definitions": { "brief": "惡意程式用於規避偵測的技術", "standard": "隱匿技術是惡意程式或攻擊者用於規避安全軟體偵測的方法，\n包括程式碼混淆、反偵錯、rootkit 隱藏等技術，\n增加分析和偵測的困難度。\n" }, "category": "vulnerabilities", "subcategory": "configuration", "tags": [ "規避偵測", "隱藏", "惡意程式" ], "related_terms": [ "rootkit", "obfuscation" ], "aliases": {} }, { "id": "vulnerability_assessment", "term_en": "Vulnerability Assessment", "term_zh": "弱點評估", "definitions": { "brief": "系統性識別和評估安全弱點的過程", "standard": "弱點評估是識別、量化和優先排序系統安全弱點的系統性過程，\n包括自動化掃描和人工審查，\n是弱點管理和風險評估的基礎。\n" }, "category": "vulnerabilities", "subcategory": "general", "tags": [ "弱點", "風險評估", "安全評估" ], "related_terms": [ "pentesting", "vulnerability_management" ], "aliases": {} }, { "id": "toctou", "term_en": "TOCTOU", "term_zh": "競態條件時序攻擊", "definitions": { "brief": "在檢查與使用間的時間差中插入惡意操作的漏洞", "standard": "TOCTOU 是競態條件（Race Condition）的一種，\n在程式對資源進行安全檢查後、實際使用前的時間差中，\n攻擊者可替換資源以繞過安全檢查，\n常見於檔案系統操作和並行程式設計中。\n" }, "category": "vulnerabilities", "subcategory": "race_condition", "tags": [ "競態條件", "時序", "並發" ], "related_terms": [ "race_condition", "privilege_escalation" ], "aliases": {} }, { "id": "heap_spray", "term_en": "Heap Spray", "term_zh": "堆積噴射", "definitions": { "brief": "向記憶體堆積區大量寫入程式碼提高漏洞利用率", "standard": "堆積噴射是一種記憶體漏洞利用輔助技術，\n攻擊者向記憶體堆積區域大量填充含有 shellcode 的資料，\n提高控制流程劫持後執行惡意程式碼的機率，\n常與緩衝區溢位或 use-after-free 漏洞搭配使用。\n" }, "category": "vulnerabilities", "subcategory": "memory_corruption", "tags": [ "記憶體", "漏洞利用", "Shellcode" ], "related_terms": [ "buffer_overflow", "use_after_free" ], "aliases": {} }, { "id": "weak_cryptography", "term_en": "Weak Cryptography", "term_zh": "弱加密演算法", "definitions": { "brief": "使用已知存在弱點的加密演算法或金鑰長度不足", "standard": "弱加密是指使用 MD5、SHA-1、DES、RC4 等已知存在安全弱點的演算法，\n或使用不足以抵抗暴力破解的短金鑰長度，\n導致加密資料可被有效率地破解或偽造。\n" }, "category": "vulnerabilities", "subcategory": "cryptographic", "tags": [ "加密", "密碼學", "金鑰" ], "related_terms": [ "cryptography", "hash_function" ], "aliases": {} }, { "id": "graphql_injection", "term_en": "GraphQL Injection", "term_zh": "GraphQL 注入", "definitions": { "brief": "透過惡意 GraphQL 查詢存取未授權資料的漏洞", "standard": "GraphQL 注入是利用 GraphQL API 的設計缺陷，\n透過惡意查詢或變更操作存取未授權的資料，\n常見問題包括過度深層查詢（DoS）、\n批次查詢濫用和欄位級別的存取控制不當。\n" }, "category": "vulnerabilities", "subcategory": "injection", "tags": [ "GraphQL", "API", "注入" ], "related_terms": [ "sql_injection", "api_security" ], "aliases": {} }, { "id": "log4shell", "term_en": "Log4Shell", "term_zh": "Log4Shell 漏洞", "definitions": { "brief": "Log4j JNDI 注入 RCE 漏洞（CVE-2021-44228）", "standard": "Log4Shell 是 Apache Log4j 2 日誌庫中的嚴重 RCE 漏洞，\n攻擊者可透過日誌記錄觸發 JNDI 查找，\n載入遠端惡意程式碼，CVSS 評分 10.0，\n影響全球數百萬個使用 Log4j 的 Java 應用程式。\n" }, "category": "vulnerabilities", "subcategory": "known_vulnerability", "tags": [ "Log4j", "Java", "RCE", "JNDI" ], "related_terms": [ "rce", "jndi_injection" ], "aliases": {} }, { "id": "printnightmare", "term_en": "PrintNightmare", "term_zh": "列印多工緩衝處理器漏洞", "definitions": { "brief": "Windows 列印多工緩衝處理器 RCE 漏洞", "standard": "PrintNightmare 是 Windows 列印多工緩衝處理器（Print Spooler）服務中的嚴重漏洞，\n允許攻擊者遠端執行任意程式碼並取得 SYSTEM 權限，\n涵蓋 CVE-2021-34527 和 CVE-2021-1675。\n" }, "category": "vulnerabilities", "subcategory": "known_vulnerability", "tags": [ "Windows", "Print Spooler", "RCE", "權限提升" ], "related_terms": [ "rce", "privilege_escalation" ], "aliases": {} }, { "id": "proxylogon", "term_en": "ProxyLogon", "term_zh": "ProxyLogon 漏洞", "definitions": { "brief": "Microsoft Exchange SSRF 漏洞（CVE-2021-26855）", "standard": "ProxyLogon 是 Microsoft Exchange Server 中的嚴重漏洞鏈，\n以 CVE-2021-26855 SSRF 漏洞為入口，\n結合後續 CVE 可實現未驗證 RCE，\n被 HAFNIUM 等多個 APT 組織大規模利用。\n" }, "category": "vulnerabilities", "subcategory": "known_vulnerability", "tags": [ "Microsoft Exchange", "SSRF", "RCE" ], "related_terms": [ "ssrf", "rce" ], "aliases": {} }, { "id": "spring4shell", "term_en": "Spring4Shell", "term_zh": "Spring4Shell 漏洞", "definitions": { "brief": "Spring Framework 遠端程式碼執行漏洞", "standard": "Spring4Shell（CVE-2022-22965）是 Spring Framework 中的嚴重 RCE 漏洞，\n攻擊者可透過資料繫結功能濫用，\n在特定部署條件下實現任意程式碼執行，\n影響 Spring MVC 和 Spring WebFlux 應用程式。\n" }, "category": "vulnerabilities", "subcategory": "known_vulnerability", "tags": [ "Spring", "Java", "RCE" ], "related_terms": [ "rce", "log4shell" ], "aliases": {} } ], "count": 471 }