NEWS BLOGS EVENTS & WEBINARS SUPPORT CONTACT Search PRODUCTS SOLUTIONS PARTNERS RESOURCES COMPANY REQUEST DEMO Glossary of Terms REQUEST A DEMO CONTACT SALES APT BOT Botnet C&C Honeypot BYOD Sandbox Whitelist APT Advanced Persistent Threat (APT) is a set of stealthy and continuous computer hacking processes, often orchestrated by human(s) targeting a specific entity. APT usually targets organizations and or nations for business or political motives. APT processes require high degree of covertness over a long period of time. As the name implies, APT consists of three major components/processes: advanced, persistent, and threat. The advanced process signifies sophisticated techniques using malware to exploit vulnerabilities in systems. The persistent process suggests that an external command and control is continuously monitoring and extracting data off a specific target. The threat process indicates human involvement in orchestrating the attack. BOT Malicious use of BOTs is the coordination and operation of an automated attack on networked computers, such as a denial-of-service attack by a botnet. Internet bots can also be used to commit click fraud and more recently have seen usage around MMORPG games as computer game BOTs. A spambot is an internet bot that attempts to spam large amounts of content on the Internet, usually adding advertising links.There are malicious BOTs (and botnets) of the following types: Spambots that harvest email addresses from contact or guestbook pages Downloader programs that suck bandwidth by downloading entire web sites Web site scrapers that grab the content of web sites and re-use it without permission on automatically generated doorway pages Viruses and worms Botnets / zombie computers; etc. Botnet A botnet is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks. The word botnet is a combination of the words robot and network. The term is usually used with a negative or malicious connotation. Botnets sometimes compromise computers whose security defenses have been breached and control conceded to a third party. Each such compromised device, known as a “BOT,” is created when a computer is penetrated by software from a malware (malicious software) distribution. The controller of a botnet is able to direct the activities of these compromised computers through communication channels formed by standards-based network protocols such as IRC and Hypertext Transfer Protocol (HTTP). C&C A botnet’s originator (known as a “BOT herder” or “BOT master”) can control the group remotely, usually through an IRC, and often for criminal purposes. This server is known as the command-and-control (C&C) server. Though rare, more experienced botnet operators program command protocols from scratch. These protocols include a server program, a client program for operation, and the program that embeds the client on the victim’s machine. These communicate over a network, using a unique encryption scheme for stealth and protection against detection or intrusion into the botnet. Honeypot A honeypot is a trap set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. This is similar to the police baiting a criminal and then conducting undercover surveillance. BYOD Bring your own device (BYOD)—also called bring your own technology (BYOT), bring your own phone (BYOP), and bring your own PC (BYOPC)—refers to the policy of permitting employees to bring personally owned mobile devices (laptops, tablets, and smart phones) to their workplace, and to use those devices to access privileged company information and applications. Sandbox In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third-parties, suppliers, untrusted users and untrusted websites.The sandbox typically provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to inspect the host system or read from input devices are usually disallowed or heavily restricted. In this sense, sandboxes are a specific example of virtualization. Sandboxing technology is frequently used to test unverified programs which may contain a virus or other malignant code, without allowing the software to harm the host device. Whitelist An IP address in the Whitelist instructs the System to ignore any and all traffic from that IP address. Ready to find out what’s lurking in your network? SCHEDULE DEMO CONTACT US Products ADAssessor ADSecure IDEntitleX ThreatStrike ThreatPath DATACLOAK Deflect EDN Manager BOTsink ThreatDirect ThreatOps Attivo Central Manager Solutions Identity Security Active Directory Cloud Endpoint Network Threat Detection Insider Threat Detection Ransomware Mitigation Risk Reduction Programs Remote Worker Risk Mitigation Lateral Movement Incident Response Credential Protection Cloaking Company Management Investors Board Awards Careers Events Resource Center Help Contact Us Support 46601 Fremont Boulevard Fremont, CA 94538 510.623.1000 @attivonetworks LinkedIn Facebook Copyright © 2021 Attivo Networks | All rights reserved. Use and access to this site are subject to the terms and conditions as set out in the privacy policy. Sitemap | Attivo Networks Privacy Policy and Trademark Information This website uses cookies to give you the best online experience and provide functionality essential to our services. By clicking 'Accept' or by continuing to use our website, you are consenting to our use of cookies in accordance with our Privacy Policy. Read More Accept