What is the difference between , and ? Should they be merged? I'm not sure that difference outlined by @AviD worth having separate tags


2 Answers 2


To my mind, they do seem to be different enough, even if only slightly.

would be regarding a specific attack vector - e.g. how do I prevent an attacker from exploiting XSS. Or how can I ensure I'm safe from SYN attacks.

On the other hand, would be the more general, solid construction types of questions. This is more of a mindset shift, e.g. how to defend against the unknown, etc.

In OWASP nomenclature, this would be Breakers (and specific countermeasures) vs. Builders.

  • 1
    Yes - attack prevention is almost the white hat spin on black hat topics, whereas defence (see the proper spelling :-) ) is as you describe
    – Rory Alsop Mod
    Jul 24, 2012 at 16:14

All three describe ways of addressing risk.

"Mitigation" involves reducing damage from a successful attack, without necessarily making an attack less likely to succeed. For example,

  • I can mitigate the effect of stolen keys by rotating keys frequently,
  • I can mitigate the effect of stolen passwords by using different passwords for different sites,
  • I can mitigate the effect of XSS by not associating cookies with the domain in which the script is run.

The common thread here is that mitigation doesn't necessarily reduce the effort it takes to attack, but does reduce the loss due to an attack.

"Defense" includes both attack prevention and mitigation -- both making an attack more expensive to execute and making the losses less severe count as defense.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .