Glossary and Acronyms · Security+

This glossary defines the acronyms and key terms you are expected to recognize on the SY0-801 exam, drawn from the official exam objectives and the standard Security+ acronym list. Entries are alphabetized by their full term, with the acronym in parentheses. Definitions are deliberately short and in plain language; the chapter that covers each objective explains the concept in depth. Use this glossary in two ways. During study, look up any unfamiliar term the moment you meet it. In the final week before the exam, read straight through it and mark every entry you cannot explain in your own words, then return to the relevant chapter for those terms.

Acceptable use policy (AUP) — A policy that defines how employees may and may not use organizational systems, networks, and data, and the consequences of misuse. Users typically sign or acknowledge it.
Access control list (ACL) — An ordered list of rules attached to a resource, router, or firewall that permits or denies access based on attributes such as user, IP address, port, or protocol.
Access control vestibule — A small space with two interlocking doors where only one door can open at a time, preventing tailgating and piggybacking into secure areas. Formerly called a mantrap.
Access point (AP) — A device that connects wireless clients to a wired network. A rogue access point is one installed without authorization.
Access review — A periodic check, usually by managers or data owners, that confirms each user's permissions are still needed, catching privilege creep and orphaned accounts.
Account lockout — A control that disables an account after a set number of failed logins. Unexpected lockouts across many accounts can indicate a password attack.
Accounting — The third "A" of AAA: recording what authenticated users do, such as logins, commands, and data accessed, to support auditing and investigations.
Active reconnaissance — Information gathering that directly interacts with the target, such as port scanning or banner grabbing, and that the target may detect.
Address Resolution Protocol (ARP) — The protocol that maps IPv4 addresses to MAC addresses on a local network. ARP poisoning sends forged replies to redirect traffic for on-path attacks.
Address Space Layout Randomization (ASLR) — An operating system defense that randomizes memory locations of code and data, making buffer overflow and memory-corruption exploits harder to execute reliably.
Advanced Encryption Standard (AES) — The widely used symmetric block cipher standardized by NIST, operating on 128-bit blocks with 128-, 192-, or 256-bit keys. AES-256 uses a 256-bit key.
Advanced persistent threat (APT) — A well-resourced, usually state-sponsored or organized adversary that gains access and remains undetected for a long period to steal data or maintain influence.
Adware — Software that displays unwanted advertisements, often bundled with free programs. It degrades performance and may track browsing behavior.
Agent-based — A monitoring or security approach that installs software on each endpoint to collect data or enforce policy, providing deep visibility at the cost of deployment effort.
Agentic AI — Artificial intelligence that can plan and take actions autonomously across tools and systems to achieve a goal, rather than only answering prompts. Requires guardrails and oversight.
Agentless — Monitoring or scanning that gathers data remotely using existing protocols or credentials without installing software on the target.
Air-gapped network — A network physically isolated from all other networks, including the internet. Data must cross the gap manually, such as on removable media.
Alert tuning — Adjusting detection rules, thresholds, and exclusions to reduce false positives and alert fatigue while keeping true positives visible.
Allow list — A list of explicitly permitted applications, addresses, or domains; anything not on the list is blocked. Also called an allowlist or whitelist.
Annualized loss expectancy (ALE) — The expected yearly monetary loss from a risk, calculated as SLE multiplied by ARO.
Annualized rate of occurrence (ARO) — The expected number of times a risk event occurs per year. Once every ten years is an ARO of 0.1.
Anomaly detection — Identifying activity that deviates from an established baseline of normal behavior, often used by IDS, UEBA, and AI-assisted tools.
Anti-money laundering (AML) — Laws, regulations, and training intended to prevent criminals from disguising illegally obtained funds as legitimate income. Often paired with counter-terrorist financing (CTF).
Antivirus (AV) — Software that detects and removes malware, traditionally using signatures, with modern versions adding heuristics and behavioral analysis.
Application programming interface (API) — A defined interface through which software components or services communicate. Unprotected or poorly authenticated APIs are a common attack surface.
Application restart — Restarting an application to apply a change, which causes brief unavailability and must be planned in change management.
Artificial intelligence (AI) — Computer systems that perform tasks associated with human intelligence, such as language understanding, prediction, and decision-making. AI introduces risks such as prompt injection and data poisoning.
Assertion — In audits, a claim made by management that a control exists or operates effectively, which the auditor then tests. In SAML, a signed statement about a user's identity or attributes.
Asset management — Tracking hardware, software, and data assets throughout their life cycle, from planning and procurement through assignment, monitoring, and disposal.
Asset value (AV) — The monetary value assigned to an asset in quantitative risk analysis, used to calculate SLE.
Asymmetric encryption — Encryption that uses a mathematically related key pair: a public key that can be shared and a private key kept secret. Examples include RSA and ECC.
Attack surface — The total set of points where an attacker could try to enter or extract data, including open ports, services, applications, accounts, and people.
Attestation — A formal statement or evidence that a system, control, or person meets a requirement, such as a compliance attestation from a vendor or hardware attestation from a TPM.
Attribute-based access control (ABAC) — An access model that grants access based on attributes of the user, resource, action, and environment, evaluated against policy.
Audit charter — A formal document that defines an audit function's authority, scope, responsibilities, and reporting lines.
Audit committee — A board-level committee that oversees internal and external audits, financial reporting, and the organization's control environment.
Audit log — A record of security-relevant events, such as logins, permission changes, and administrative actions, used to establish accountability.
Authentication — Verifying that a user, device, or process is who or what it claims to be, using factors such as passwords, tokens, or biometrics.
Authentication, authorization, and accounting (AAA) — The framework for controlling access: verify identity, decide what the identity may do, and record what it did.
Authentication Header (AH) — An IPsec protocol that provides integrity and origin authentication for packets but not encryption.
Authenticator app — A mobile application that generates time-based one-time passwords or approves push notifications as a second authentication factor; a type of soft token.
Authorization — Determining what an authenticated identity is permitted to do, based on permissions, roles, or policies.
Automated Indicator Sharing (AIS) — A CISA program for exchanging cyber threat indicators between government and private organizations using STIX and TAXII.
Automation — Using scripts or tools to perform repeatable tasks without manual effort, such as provisioning accounts or applying configurations.
Autoscaling — Automatically adding or removing compute resources in response to demand, supporting availability and cost efficiency.
Availability — The CIA property that ensures systems and data are accessible to authorized users when needed.

Backout plan — A documented procedure for reversing a change and returning to the previous state if the change fails.
Backup — A copy of data kept so it can be restored after loss, corruption, or ransomware. Types include full, incremental, differential, and snapshot.
Backup code — A single-use code issued during MFA enrollment that lets a user sign in if their primary second factor is lost.
Baseline — A documented, approved configuration or level of normal activity used for comparison. Security baselines define the required settings for a system type.
Bash — Bourne Again Shell, the common Unix and Linux command-line shell and scripting language. Attackers use it to run commands and scripts after compromise.
Basic Input/Output System (BIOS) — Legacy firmware that initializes hardware and starts the operating system; largely replaced by UEFI.
Behavioral testing — Testing that evaluates how people or systems respond to realistic situations, such as phishing simulations or observing users following procedures.
Benchmark — A published set of recommended secure configuration settings, such as CIS Benchmarks, used to harden and audit systems.
Benchmarking (audit) — Comparing an organization's controls or performance against industry peers, standards, or best practices.
Bias (AI) — Systematic unfairness in AI output caused by unrepresentative training data or flawed design, leading to discriminatory or inaccurate decisions.
Biometrics — Authentication based on physical or behavioral characteristics such as fingerprints, facial geometry, iris, or voice ("something you are").
Bit-level copy — A forensic image that duplicates every bit of a storage device, including deleted and unallocated space. Also called a bit-stream image.
Black hole routing — See Remote triggered black hole (RTBH).
Block cipher — A symmetric cipher that encrypts fixed-size blocks of data, such as AES with 128- bit blocks.
Block list — A list of explicitly prohibited applications, addresses, or domains; everything else is allowed. Also called a deny list or blacklist.
Bluejacking — Sending unsolicited messages to nearby Bluetooth devices.
Bluesnarfing — Unauthorized access to data on a Bluetooth device, such as contacts or messages.
Bluetooth — A short-range wireless technology for personal area networks. Weak pairing and outdated firmware create attack opportunities.
Bollard — A short, sturdy post that prevents vehicles from approaching a building or entrance.
Border Gateway Protocol (BGP) — The routing protocol that exchanges routes between autonomous systems on the internet. BGP hijacking redirects traffic by advertising false routes.
Botnet — A network of compromised devices controlled by an attacker through command and control, often used for DDoS attacks, spam, or credential stuffing.
Brand Indicators for Message Identification (BIMI) — An email standard that displays a verified brand logo next to authenticated messages; it requires DMARC enforcement.
Bridge Protocol Data Unit (BPDU) — A message used by Spanning Tree Protocol. BPDU guard shuts down access ports that receive BPDUs to prevent rogue switches and loops.
Bring your own device (BYOD) — A model in which employees use personally owned devices for work, governed by a BYOD policy and often managed with MDM containerization.
Brute force — An attack that tries many passwords or keys against the same account or ciphertext until one works.
Buffer overflow — A flaw where a program writes more data to a memory buffer than it can hold, overwriting adjacent memory and potentially allowing code execution.
Bug bounty program — A program that pays external researchers for responsibly reporting vulnerabilities in an organization's products or services.
Business continuity plan (BCP) — A plan for keeping essential business functions operating during and after a disruption.
Business email compromise (BEC) — Fraud in which an attacker uses a compromised or spoofed business email account to trick staff into sending money or sensitive data.
Business impact analysis (BIA) — A process that identifies critical business functions and the impact of their disruption, producing recovery objectives such as RTO and RPO.
Business partners agreement (BPA) — An agreement defining the responsibilities, profit sharing, and obligations of partner organizations.

California Consumer Privacy Act (CCPA) — A California law granting residents rights over their personal information, including access, deletion, and opting out of sale.
Canary account — A fake account that no one should ever use; any login attempt signals an intruder. A type of honeytoken.
Capacity planning — Forecasting the people, technology, and infrastructure resources needed to meet demand, including during incidents or growth.
CAPTCHA — Completely Automated Public Turing test to tell Computers and Humans Apart: a challenge that distinguishes humans from bots. Fake CAPTCHA pages are now used to trick users into running malicious commands.
Captive portal — A web page that intercepts new network users and requires them to authenticate or accept terms before receiving access, common on guest Wi-Fi.
Card skimming — See Skimming.
Certificate — A digitally signed electronic document, usually in X.509 format, that binds a public key to an identity such as a domain name, person, or device.
Certificate authority (CA) — A trusted entity that issues and signs digital certificates, binding public keys to identities.
Certificate pinning — Configuring an application to accept only a specific certificate or public key for a service, defeating certificate substitution attacks.
Certificate revocation list (CRL) — A signed list published by a CA of certificates revoked before their expiration date.
Certificate signing request (CSR) — A message sent to a CA containing the applicant's public key and identity information, signed with the matching private key, requesting a certificate.
Chain of custody — Documentation that records who handled evidence, when, and for what purpose, from collection to presentation, proving it was not tampered with.
Chain of trust — The hierarchy of certificates from an end-entity certificate through intermediate CAs to a trusted root CA.
Challenge-Handshake Authentication Protocol (CHAP) — An authentication protocol that uses a challenge and a hashed response rather than sending the password in cleartext.
Change advisory board (CAB) — The group that reviews, approves, or rejects proposed changes based on risk, impact, and readiness.
Change management — The formal process for requesting, assessing, approving, implementing, and documenting changes to systems to minimize risk and disruption.
Chatbot — A conversational AI application. In security operations, chatbots help analysts query data; as attack surfaces, they can be manipulated by prompt injection.
Chief information officer (CIO) — The executive responsible for an organization's information technology strategy and operations.
Chief information security officer (CISO) — The executive responsible for the organization's information security program. Also called chief security officer (CSO).
Chief technology officer (CTO) — The executive responsible for an organization's technology direction and engineering.
Choose your own device (CYOD) — A mobile model in which employees select from a list of approved devices that the organization purchases and manages.
CIA triad — Confidentiality, integrity, and availability: the three core goals of information security.
Cipher Block Chaining (CBC) — A block cipher mode in which each plaintext block is XORed with the previous ciphertext block before encryption, using an IV for the first block.
Cipher Feedback (CFB) — A block cipher mode that turns a block cipher into a self-synchronizing stream cipher.
Ciphertext — Data after encryption, unreadable without the correct key.
Clean desk policy — A policy requiring employees to secure documents, media, and devices when away from their workspace so sensitive information is not exposed.
Closed-circuit television (CCTV) — A video surveillance system that records or displays camera footage within a private network.
Cloud access security broker (CASB) — A security control between users and cloud services that provides visibility, policy enforcement, DLP, and threat protection for SaaS usage.
Cloud computing — On-demand delivery of compute, storage, and services over a network, typically billed by usage. Service models include IaaS, PaaS, and SaaS.
Cloud security posture management (CSPM) — Tools that continuously assess cloud configurations against best practices and compliance standards to find misconfigurations.
Clustering — Grouping multiple servers so they work together as one system, providing high availability through failover or load sharing.
Code signing — Digitally signing software so users can verify the publisher and confirm the code has not been altered since signing.
Cold site — A recovery site with space, power, and connectivity but little or no equipment or data; cheapest and slowest to activate.
Collaboration tools — Platforms such as chat, video conferencing, and shared workspaces. Attackers use them to deliver phishing links and malware that bypass email filters.
Collision — When two different inputs produce the same hash value. Practical collisions make hash algorithms such as MD5 and SHA-1 unsuitable for security.
Command and control (C2) — The infrastructure and communication channel attackers use to send instructions to and receive data from compromised systems.
Command injection — An attack in which untrusted input is passed to an operating system shell, allowing the attacker to execute arbitrary commands.
Common Vulnerabilities and Exposures (CVE) — A public catalog of unique identifiers for known vulnerabilities, such as CVE-2026-12345, maintained by MITRE.
Common Vulnerability Scoring System (CVSS) — A standard for rating vulnerability severity from 0.0 to 10.0 based on exploitability and impact metrics.
Community cloud — A cloud deployment shared by several organizations with common requirements, such as government agencies or healthcare providers.
Compensating control — A control used in place of a primary control that is impractical or unavailable, providing comparable risk reduction.
Competitor — A threat actor that is a rival organization seeking intellectual property, customer lists, or a market advantage.
Compliance — Adherence to laws, regulations, standards, contracts, and internal policies.
Computer incident response team (CIRT) — The team responsible for responding to security incidents. Also called CSIRT or CERT.
Concurrent session — Multiple simultaneous active sessions for one account. Unexpected concurrent sessions, especially from different locations, can indicate stolen credentials.
Confidentiality — The CIA property that ensures information is disclosed only to authorized parties.
Conflict of interest — A situation in which personal or business interests could improperly influence decisions, such as vendor selection; must be disclosed and managed.
Container — A lightweight, isolated package containing an application and its dependencies, sharing the host operating system kernel.
Containerization (mobile) — Separating corporate apps and data from personal apps and data on a mobile device so each can be managed and wiped independently.
Containment — The incident response activity of limiting the spread and impact of an incident, such as isolating hosts or disabling accounts.
Content delivery network (CDN) — A distributed network of servers that caches and serves content close to users, improving performance and absorbing DDoS traffic.
Content filter — A control that blocks or allows web or email content based on categories, keywords, or reputation.
Continuity of operations plan (COOP) — A plan, common in government, for continuing essential functions during emergencies.
Continuous integration and continuous delivery/deployment (CI/CD) — Automated pipelines that build, test, and release code frequently; security checks are integrated as part of DevSecOps.
Cookie — A small piece of data a website stores in the browser, often holding session identifiers. Secure cookies use the Secure, HttpOnly, and SameSite attributes.
Corporate-owned, personally enabled (COPE) — A mobile model in which the organization owns the device but allows some personal use.
Corrective control — A control that fixes or limits damage after an incident, such as restoring from backup.
Counter mode (CTR) — A block cipher mode that encrypts a counter value and XORs it with plaintext, turning a block cipher into a stream cipher.
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) — The AES-based encryption protocol used by WPA2 and WPA3 to provide confidentiality and integrity.
Counter-terrorist financing (CTF) — Laws and controls designed to detect and stop funding of terrorist activity; usually paired with AML training.
Credential stuffing — Using username and password pairs leaked from one breach to log in to other services, exploiting password reuse.
Crime syndicate — An organized criminal group that conducts cyberattacks for financial gain, such as ransomware operations. Also called organized crime.
Critical (data classification) — Data or systems essential to the organization's survival or operations, whose loss or unavailability would cause severe harm.
Cross-site request forgery (CSRF or XSRF) — An attack that tricks an authenticated user's browser into sending an unwanted request to a site where the user is logged in.
Cross-site scripting (XSS) — An injection attack in which malicious script is inserted into a web page and executed in other users' browsers.
Cryptographic hash — See Hashing.
Cryptography — The practice of protecting information through encryption, hashing, and digital signatures to provide confidentiality, integrity, authentication, and non-repudiation.
Cryptominer — Malware that uses a victim's computing resources to mine cryptocurrency, often detected by excessive CPU or GPU usage.
Cyber Kill Chain — Lockheed Martin's model of attack stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
Cybersecurity and Infrastructure Security Agency (CISA) — The US federal agency responsible for protecting critical infrastructure and coordinating cyber defense, and publisher of advisories and the KEV catalog.
Cyclic redundancy check (CRC) — An error-detection code used to detect accidental data corruption; not a security control against intentional tampering.

Dashboard — A visual display that summarizes key metrics, alerts, and status information for quick situational awareness.
Data at rest — Data stored on media such as disks, databases, or backups. Protected primarily by encryption and access controls.
Data classification — Assigning sensitivity labels to data, such as public, confidential, restricted, secret, or top secret, to determine handling requirements.
Data controller — Under privacy law, the organization that determines the purposes and means of processing personal data and bears primary responsibility for compliance.
Data custodian — The person or team that implements and maintains technical controls for data, such as backups, encryption, and access permissions, as directed by the owner.
Data execution prevention (DEP) — A memory protection that marks areas of memory as non-executable, preventing code from running in data regions.
Data exfiltration — Unauthorized transfer of data out of an organization.
Data in transit — Data moving across a network. Protected by encryption protocols such as TLS, IPsec, and SSH. Also called data in motion.
Data in use — Data being actively processed in memory or by the CPU. Protected by techniques such as secure enclaves and confidential computing.
Data loss prevention (DLP) — Tools and policies that detect and block unauthorized transmission or storage of sensitive data on endpoints, networks, email, and cloud services.
Data masking — Hiding part or all of a data value, such as showing only the last four digits of a card number, while preserving its format.
Data operator — A person or system that processes or works with data day to day under the direction of the owner and controller.
Data owner — The senior person accountable for a data set, who determines its classification and approves who may access it.
Data poisoning — Corrupting the training data of an AI or machine learning model so it learns incorrect or malicious behavior.
Data processor — Under privacy law, an organization that processes personal data on behalf of the data controller.
Data protection officer (DPO) — A role, required by GDPR for some organizations, responsible for overseeing data protection strategy and compliance.
Data retention — Keeping data for a defined period to meet legal, regulatory, or business requirements, then disposing of it securely.
Data sovereignty — The principle that data is subject to the laws of the country in which it is stored or processed.
Data steward — The role responsible for data quality, metadata, and ensuring data is used according to policy.
Data subject — The individual whom personal data describes.
Data transpose — An obfuscation technique that rearranges or swaps data values or their positions so the original cannot be read directly.
Database administrator (DBA) — The person responsible for managing, securing, and maintaining databases.
Decommissioning — Retiring an asset from service, including removing it from inventories, revoking access, and securely disposing of its data.
Deepfake — Realistic synthetic audio, video, or images created with AI to impersonate real people, used in fraud and disinformation.
Defense in depth — Using multiple, overlapping layers of security controls so that the failure of one does not lead to compromise.
Deidentification — Removing or altering personal identifiers from data so it can no longer be linked to an individual.
Demilitarized zone (DMZ) — See Screened subnet.
Denial of service (DoS) — An attack that makes a system or service unavailable to legitimate users by exhausting resources or exploiting flaws.
Deny list — See Block list.
Dependency — A component, service, or system that another relies on. Changes to dependencies can break or weaken dependent systems.
Deprovisioning — Removing user accounts, access rights, and resources when they are no longer needed, such as when an employee leaves.
Desired state management — Automatically enforcing and restoring a defined configuration so systems do not drift from their approved baseline.
Detective control — A control that identifies and records incidents after they occur, such as logs, IDS, or cameras.
Deterring control — A control that discourages an attacker from attempting an attack, such as warning signs or login banners.
Diamond Model of Intrusion Analysis — A threat analysis model that describes every intrusion event using four connected elements: adversary, capability, infrastructure, and victim.
Dictionary attack — A password attack that tries words from a list of common passwords and words rather than every possible combination.
Diffie-Hellman (DH) — A key exchange algorithm that lets two parties establish a shared secret over an insecure channel. DHE and ECDHE are ephemeral versions providing perfect forward secrecy.
Digital forensics — The collection, preservation, analysis, and presentation of digital evidence in a legally defensible manner.
Digital signature — A hash of a message encrypted with the sender's private key, proving origin, integrity, and non-repudiation.
Digital Signature Algorithm (DSA) — A US federal standard algorithm for creating digital signatures.
Directive control — A control that instructs people what to do or not do, such as policies, procedures, and "Authorized personnel only" signs.
Directory traversal — An attack that uses sequences such as ../ to access files and directories outside the intended web root. Also called path traversal.
Disaster recovery plan (DRP) — A plan for restoring IT systems and data after a disaster, supporting the broader business continuity plan.
Discretionary access control (DAC) — An access model in which the resource owner decides who may access it, as with standard NTFS and Unix file permissions.
Disinformation — Deliberately false information spread to deceive, often used in influence campaigns.
Distributed denial of service (DDoS) — A denial-of-service attack launched from many sources at once, often a botnet, overwhelming the target's bandwidth or resources.
DNS sinkhole — A DNS server configured to return a controlled address for known malicious domains, blocking malware communication and identifying infected hosts.
Domain Name System (DNS) — The system that translates domain names into IP addresses. Attacks include cache poisoning, hijacking, and tunneling.
Domain Name System Security Extensions (DNSSEC) — Extensions that digitally sign DNS records so resolvers can verify their authenticity and integrity.
Domain-based Message Authentication, Reporting, and Conformance (DMARC) — An email policy published in DNS that tells receivers how to handle messages failing SPF and DKIM alignment, and where to send reports.
DomainKeys Identified Mail (DKIM) — An email authentication method in which the sending domain signs messages with a private key and publishes the public key in DNS.
Downgrade attack — An attack that forces a connection to use an older, weaker protocol or cipher, such as forcing TLS down to a vulnerable version. Also called a protocol downgrade.
Due care — Acting as a reasonable person would to protect assets, by implementing and maintaining appropriate controls.
Due diligence — Investigating and assessing risks before making a decision, such as evaluating a vendor's security before signing a contract.
Dumpster diving — Searching through trash for discarded information useful to an attack.
Dynamic analysis — Testing software while it is running to find vulnerabilities, including fuzzing and runtime monitoring.
Dynamic Host Configuration Protocol (DHCP) — The protocol that automatically assigns IP addresses and network settings. Rogue DHCP servers can redirect traffic; DHCP snooping prevents them.

E-discovery — The process of identifying, collecting, and producing electronically stored information in response to legal proceedings.
Elasticity — The ability of a system, usually in the cloud, to automatically adjust resources to match demand.
Electronic Code Book (ECB) — The simplest block cipher mode, encrypting each block independently. Identical plaintext blocks produce identical ciphertext, so it leaks patterns and is insecure.
Elliptic curve cryptography (ECC) — Asymmetric cryptography based on elliptic curves, offering strong security with shorter keys, ideal for mobile and IoT devices.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) — A key exchange using elliptic curves and temporary keys, providing perfect forward secrecy in TLS.
Elliptic Curve Digital Signature Algorithm (ECDSA) — A digital signature algorithm based on elliptic curve cryptography.
Embedded system — A dedicated computing system built into a larger device, such as a printer, medical device, or vehicle controller, often hard to patch.
Emergency access account — A highly privileged "break glass" account used only when normal administrative access is unavailable, tightly controlled and monitored.
Encapsulating Security Payload (ESP) — The IPsec protocol that provides confidentiality through encryption, plus integrity and authentication.
Encrypting File System (EFS) — A Windows feature that encrypts individual files and folders on NTFS volumes.
Encryption — Converting plaintext into ciphertext using an algorithm and a key so that only authorized parties can read it.
End-of-life (EOL) — The point at which a vendor stops selling or supporting a product. EOL systems no longer receive security patches.
Endpoint detection and response (EDR) — Endpoint software that continuously records activity, detects suspicious behavior, and supports investigation and response actions such as isolation.
End-to-end encryption (E2EE) — Encryption in which only the communicating endpoints hold the keys, so intermediaries, including the service provider, cannot read messages.
Enterprise resource planning (ERP) — Integrated software that manages core business processes such as finance, supply chain, and HR.
Ephemeral key — A temporary key used for a single session and then discarded, supporting perfect forward secrecy.
Eradication — The incident response activity of removing the cause of an incident, such as malware, attacker accounts, and exploited vulnerabilities.
Espionage — Spying to obtain secret information, a common motivation of state-sponsored actors and competitors.
Evasion attack (AI) — Crafting inputs that cause an AI model to misclassify them, such as malware modified to slip past an ML-based detector.
Evil twin — A rogue wireless access point that imitates a legitimate SSID to trick users into connecting so traffic can be intercepted.
Exclusive OR (XOR) — A bitwise operation that outputs 1 when inputs differ; a building block of many ciphers and simple obfuscation.
Explainability — The degree to which humans can understand why an AI model produced a particular output, important for trust, auditing, and compliance.
Exploit — Code or a technique that takes advantage of a vulnerability.
Exposure factor (EF) — The percentage of an asset's value expected to be lost in a single incident.
Expression of interest (EOI) — A preliminary request asking vendors to indicate interest in a project, used before issuing a formal RFP.
Extended detection and response (XDR) — A platform that correlates detection and response data across endpoints, network, cloud, email, and identity.
Extensible Authentication Protocol (EAP) — An authentication framework used with 802.1X, supporting methods such as EAP-TLS, PEAP, EAP-TTLS, and EAP-FAST.
Extensible Markup Language (XML) — A text-based format for structured data, used by SAML and many APIs. Vulnerable to XML injection and external entity attacks.
External media — Removable storage such as USB drives and external disks, a common vector for malware and data loss.
Extortion — Demanding payment or action under threat, such as publishing stolen data; a common ransomware motivation.

Fail closed — A failure mode in which a device blocks all traffic when it fails, favoring security over availability. Also called fail secure.
Fail forward — Responding to a failed change by fixing the problem and moving ahead rather than rolling back, used when backout is impractical.
Fail open — A failure mode in which a device allows traffic to pass when it fails, favoring availability over security.
Failover — Automatic switching to a redundant or standby system when the primary system fails.
False acceptance rate (FAR) — The rate at which a biometric system incorrectly accepts an unauthorized user.
False negative — A failure to detect a real attack or vulnerability.
False positive — An alert or finding that incorrectly identifies benign activity as malicious.
False rejection rate (FRR) — The rate at which a biometric system incorrectly rejects an authorized user.
Federation — A trust relationship that lets users authenticate with one identity provider and access services in other organizations or domains.
Field-programmable gate array (FPGA) — An integrated circuit that can be reprogrammed after manufacturing, used in embedded and specialized systems.
File integrity monitoring (FIM) — Tools that detect unauthorized changes to critical files by comparing current hashes against a known-good baseline.
File Transfer Protocol (FTP) — A legacy protocol for transferring files that sends credentials and data in cleartext on TCP 20 and 21.
File Transfer Protocol Secure (FTPS) — FTP with TLS encryption.
Fileless malware — Malware that runs in memory or uses built-in system tools such as PowerShell and WMI, leaving few artifacts on disk.
Filtering (data) — Removing or excluding sensitive data elements from a data set or output before it is shared or displayed.
Firewall — A device or software that filters traffic between networks or hosts based on rules. Types include packet-filtering, stateful, NGFW, and WAF.
Firmware — Low-level software embedded in hardware that controls device functions. Firmware vulnerabilities are hard to detect and patch.
Forgery — Creating a fraudulent request, token, or document that appears legitimate, such as cross-site or server-side request forgery.
Full disk encryption (FDE) — Encrypting an entire storage device so all data is protected when the device is powered off or stolen.
Functional testing — Testing that verifies a control or system works as designed and meets its requirements.
Fuzzing — Sending large volumes of random or malformed input to software to find crashes and vulnerabilities.

Galois/Counter Mode (GCM) — An authenticated encryption mode for block ciphers that provides confidentiality and integrity; widely used with AES in TLS.
Gap analysis — Comparing the current state of security controls against a desired state or framework to identify missing or weak areas.
General Data Protection Regulation (GDPR) — The European Union regulation governing the processing of personal data of individuals in the EU, including rights such as erasure and data portability.
Generator — A fuel-powered device that supplies electricity during extended outages, typically started after a UPS bridges the gap.
Generic Routing Encapsulation (GRE) — A tunneling protocol that encapsulates many types of traffic, usually combined with IPsec for encryption.
Geofencing — Using location data to define a virtual boundary and enforce policy, such as restricting data access to a specific region or triggering MDM actions.
Geolocation — Determining the physical location of a device or user, used for access policies and impossible-travel detection.
Global Positioning System (GPS) — A satellite navigation system used for location services, geofencing, and time synchronization.
GNU Privacy Guard (GPG) — An open-source implementation of the OpenPGP standard for encrypting and signing files and email.
Governance, risk, and compliance (GRC) — The coordinated approach to directing the security program, managing risk, and meeting legal and regulatory obligations.
Graphics processing unit (GPU) — A processor optimized for parallel computation, used by attackers to accelerate password cracking and by AI workloads.
Gray hat — An attacker or researcher who may break laws or rules without malicious intent, such as testing systems without permission.
Group managed service account (gMSA) — An Active Directory service account whose password is automatically managed and rotated, usable by multiple servers without exposing the password to administrators.
Group Policy — A Windows Active Directory feature for centrally configuring and enforcing settings on users and computers through Group Policy Objects (GPOs).
Group Policy Object (GPO) — A collection of Group Policy settings linked to sites, domains, or organizational units.
Guardrails — Technical and procedural limits that constrain automation or AI so it cannot take unsafe or unauthorized actions.

Hacktivist — A threat actor motivated by ideological, political, or social causes, often using defacement, leaks, or DDoS.
Hallucination — An AI output that is confident but factually incorrect or fabricated.
Hard disk drive (HDD) — Magnetic spinning-platter storage. Can be sanitized by overwriting, degaussing, or physical destruction.
Hard token — A physical device that generates one-time codes or stores cryptographic keys for authentication, such as a key fob or FIDO2 security key.
Hardcoded secret — A password, API key, or other credential embedded directly in source code or configuration, easily exposed through repositories or reverse engineering.
Hardening — Reducing a system's attack surface by removing unnecessary services, applying secure configurations, patching, and restricting access.
Hardware security module (HSM) — A tamper-resistant hardware device that securely generates, stores, and uses cryptographic keys.
Hash-based message authentication code (HMAC) — A message authentication code that combines a hash function with a secret key to verify integrity and authenticity.
Hashing — A one-way function that produces a fixed-length digest from input data. Any change to the input changes the digest, so hashes verify integrity.
Heat map — A visualization showing signal strength or activity intensity, used in wireless surveys and risk reporting.
Heating, ventilation, and air conditioning (HVAC) — Environmental systems that control temperature and humidity; critical for data centers and a target for OT attacks.
Heuristic analysis — Detecting malware by examining behavior or code characteristics rather than relying only on known signatures.
High availability (HA) — Designing systems to remain operational with minimal downtime through redundancy, clustering, and failover.
HMAC-based one-time password (HOTP) — A one-time password algorithm based on a counter and a shared secret; each code is valid until used.
Honeyfile — A decoy file with an enticing name that triggers an alert when accessed.
Honeynet — A network of honeypots designed to observe attacker behavior across multiple systems.
Honeypot — A decoy system designed to attract attackers, detect intrusions, and study techniques without exposing production assets.
Honeytoken — Fake data, such as a credential, API key, or database record, that has no legitimate use; any use signals compromise.
Host-based firewall — Firewall software running on an individual host that filters traffic to and from that host.
Host-based intrusion detection system (HIDS) — Software on a host that monitors logs, files, and activity for signs of intrusion.
Host-based intrusion prevention system (HIPS) — Software on a host that detects and actively blocks malicious activity.
Hot site — A fully equipped recovery site with current data that can take over operations almost immediately; most expensive.
Hybrid cloud — A deployment combining public cloud and private cloud or on-premises resources.
Hypertext Markup Language (HTML) — The markup language for web pages.
Hypertext Transfer Protocol (HTTP) — The protocol for web traffic, sent in cleartext on TCP 80.
Hypertext Transfer Protocol Secure (HTTPS) — HTTP protected by TLS, typically on TCP 443.
Hypervisor — Software that creates and runs virtual machines. Type 1 runs directly on hardware; type 2 runs on a host operating system.

Identity and access management (IAM) — The policies and technologies for managing digital identities and controlling their access to resources.
Identity proofing — Verifying a person's real-world identity, such as checking government ID, before issuing credentials.
Identity provider (IdP) — A service that authenticates users and issues identity assertions or tokens to relying applications in SSO and federation.
IEEE 802.1X — A port-based network access control standard that requires devices to authenticate, usually through RADIUS, before gaining access to wired or wireless networks.
Impact — The magnitude of harm that results if a threat exploits a vulnerability.
Impact analysis — Evaluating how a proposed change could affect systems, users, and security before approval.
Impersonation — Pretending to be someone else, such as an executive, vendor, or IT staff member, to gain trust or access.
Implicit deny — The default rule that blocks any traffic or access not explicitly allowed.
Impossible travel — An indicator in which the same account authenticates from locations too far apart to reach in the elapsed time.
Incident response (IR) — The organized approach to preparing for, detecting, containing, eradicating, recovering from, and learning from security incidents.
Incident response plan (IRP) — The documented plan defining roles, procedures, and communication for handling security incidents.
Indicator of compromise (IoC) — Evidence that a system may have been breached, such as malicious hashes, IP addresses, domains, or unusual processes.
Industrial control system (ICS) — Systems that monitor and control industrial processes, including SCADA and PLCs. Part of operational technology.
Information sharing and analysis center (ISAC) — A sector-specific organization that shares threat intelligence among members, such as FS-ISAC for financial services.
Information systems security officer (ISSO) — A role responsible for the security of a specific information system, common in government.
Infrastructure as a service (IaaS) — A cloud model providing virtual machines, storage, and networking; the customer manages the operating system and above.
Infrastructure as code (IaC) — Defining and provisioning infrastructure through machine-readable configuration files, enabling version control and consistent deployments.
Initialization vector (IV) — A random or unique value combined with a key to ensure identical plaintexts encrypt to different ciphertexts.
Injection — A class of attack in which untrusted input is interpreted as code or commands, including SQL, LDAP, XML, and command injection.
Input validation — Checking that input matches expected type, length, format, and range before processing, the primary defense against injection.
Insider threat — A threat posed by current or former employees, contractors, or partners who misuse authorized access, intentionally or accidentally.
Instant messaging (IM) — Real-time text messaging platforms, a vector for phishing links and malware.
Integrity — The CIA property that ensures data is accurate and unaltered except by authorized changes.
Intellectual property (IP) — Creations of the mind such as trade secrets, patents, copyrights, and source code; a common target of espionage.
Intermediate CA — A certificate authority that is signed by the root CA and issues certificates to end entities, protecting the root from exposure.
International Organization for Standardization (ISO) — A body that publishes international standards, including ISO/IEC 27001 for information security management and 27002 for controls.
Internet Control Message Protocol (ICMP) — A network protocol for diagnostics and error messages, used by ping and traceroute; can be abused for floods and tunneling.
Internet Key Exchange (IKE) — The protocol that negotiates security associations and keys for IPsec.
Internet Message Access Protocol (IMAP) — A protocol for retrieving email from a server (TCP 143, or 993 with TLS).
Internet of Things (IoT) — Network-connected everyday devices such as cameras, sensors, and smart appliances, often with weak default security.
Internet Protocol Flow Information Export (IPFIX) — An IETF standard, based on NetFlow version 9, for exporting network flow metadata.
Internet Protocol (IP) — The network-layer protocol that addresses and routes packets.
Internet Protocol Security (IPsec) — A suite of protocols that authenticates and encrypts IP packets, used for site-to-site and remote-access VPNs.
Internet service provider (ISP) — A company that provides internet connectivity.
Intrusion detection system (IDS) — A system that monitors network or host activity and alerts on suspicious behavior without blocking it.
Intrusion prevention system (IPS) — An inline system that detects and actively blocks malicious traffic.
IP address management (IPAM) — Tools for planning, tracking, and managing IP address space, DHCP, and DNS, which also help identify unknown devices.

Jailbreaking — Removing manufacturer restrictions on a mobile device; in AI, crafting prompts that bypass a model's safety controls.
Journaling — Recording changes before they are committed, so a file system or database can recover to a consistent state after a failure.
Jump server — A hardened host that administrators connect to first, and from which they access servers in a protected zone. Also called a jump box or bastion host.
Just-in-time (JIT) access — Granting elevated permissions only when needed, for a limited time, usually after approval, eliminating standing privileges.

Kerberos — A ticket-based authentication protocol used by Active Directory, relying on a key distribution center and time-limited tickets.
Key distribution center (KDC) — The Kerberos component that authenticates users and issues ticket-granting tickets and service tickets.
Key encryption key (KEK) — A key used to encrypt other keys for storage or transport.
Key escrow — Storing a copy of cryptographic keys with a trusted third party so they can be recovered if lost or legally required.
Key exchange — The method two parties use to securely establish a shared encryption key, such as Diffie-Hellman or RSA key transport.
Key length — The size of a cryptographic key in bits. Longer keys increase resistance to brute-force attacks.
Key stretching — Repeatedly hashing a password, often with a salt, to make brute-force attacks slower. Examples include PBKDF2 and bcrypt.
Keylogger — Malware or hardware that records keystrokes to capture passwords and other sensitive input.
Known environment test — A penetration test in which testers receive full information about the target. Formerly called white box.
Known Exploited Vulnerabilities (KEV) catalog — A CISA list of vulnerabilities confirmed to be actively exploited, used to prioritize patching.

Large language model (LLM) — An AI model trained on vast text data to generate and understand language. Risks include prompt injection, data leakage, and hallucinations.
Layer 2 Tunneling Protocol (L2TP) — A VPN tunneling protocol that provides no encryption itself and is usually paired with IPsec.
Layer 4 firewall — A firewall that filters traffic by IP addresses, ports, and protocols at the transport layer.
Layer 7 firewall — A firewall that inspects application-layer content, understanding protocols and applications. Also called an application-aware or next-generation firewall.
Learning management system (LMS) — A platform for delivering, tracking, and reporting on training, including security awareness courses.
Least privilege — Granting users and processes only the minimum access needed to perform their tasks.
Legacy application — An older application that may depend on outdated platforms or protocols and may not support modern security controls.
Legal hold — An instruction to preserve all data relevant to anticipated or ongoing litigation, overriding normal retention and deletion schedules.
Lessons learned — The post-incident review of what happened, what worked, and what should improve.
Lightweight Directory Access Protocol (LDAP) — A protocol for querying and managing directory services such as Active Directory (TCP 389; LDAPS on TCP 636).
Likelihood — The probability that a threat will exploit a vulnerability within a given period.
Living off the land (LOTL) — Attacker techniques that use legitimate, built-in tools such as PowerShell, WMI, and certutil to avoid detection.
Load balancer — A device or service that distributes traffic across multiple servers to improve availability and performance.
Local area network (LAN) — A network covering a limited area such as an office or building.
Log aggregation — Collecting logs from many sources into a central location for correlation, search, and retention.
Logic bomb — Malicious code that executes when specific conditions are met, such as a date or an employee's account being deleted.

Machine learning (ML) — A branch of AI in which systems learn patterns from data rather than being explicitly programmed.
Macro — A script embedded in a document, such as a VBA macro in Office files, which attackers use to execute malware when a document is opened.
Malware — Malicious software, including viruses, worms, Trojans, ransomware, spyware, rootkits, and keyloggers.
Managed security service provider (MSSP) — A third party that provides outsourced security monitoring and management.
Managed service provider (MSP) — A third party that manages IT services for clients. A compromised MSP can provide attackers access to many customers.
Managerial control — A control focused on governance and risk management, such as policies, risk assessments, and security planning. Also called administrative.
Mandatory access control (MAC) — An access model in which the system enforces access based on security labels and clearances; users cannot change permissions.
Master service agreement (MSA) — A contract that sets general terms for an ongoing relationship, with individual projects defined in statements of work.
Mean time between failures (MTBF) — The average time a repairable system operates between failures; a measure of reliability.
Mean time to failure (MTTF) — The average expected lifetime of a non-repairable component.
Mean time to repair (MTTR) — The average time required to repair a failed component and restore service.
Media access control (MAC) address — A hardware address assigned to a network interface, used for local network delivery.
Memorandum of agreement (MOA) — A document that formalizes a cooperative relationship with more specific responsibilities than an MOU, sometimes binding.
Memorandum of understanding (MOU) — A non-binding agreement expressing a mutual intent to cooperate.
Memory dump — A capture of the contents of RAM, used in forensics to recover running processes, network connections, keys, and fileless malware.
Message authentication code (MAC) — A short value derived from a message and secret key that verifies integrity and authenticity.
Message Digest 5 (MD5) — A legacy 128-bit hash algorithm with known collisions; unsuitable for security but still used for non-security checksums.
Metadata — Data about data, such as email headers, file timestamps, or authorship, valuable in investigations.
Metropolitan area network (MAN) — A network spanning a city or campus.
Microservices — An architecture that builds applications as small, independently deployed services communicating through APIs.
Misconfiguration — An insecure setting, such as default credentials, public storage, or open ports, that creates a vulnerability.
MITRE ATT&CK — A public knowledge base of adversary tactics, techniques, and procedures based on real-world observations.
Mobile device management (MDM) — Software that enforces policies, configures, monitors, and remotely wipes mobile devices.
Model manipulation — Altering an AI model's behavior or outputs through attacks on its training data, parameters, or inputs.
Monitoring — Continuously observing systems, applications, and infrastructure for performance and security events.
Multicloud — Using services from more than one cloud provider to avoid lock-in or improve resilience.
Multifactor authentication (MFA) — Authentication requiring two or more factors from different categories: something you know, have, or are.
Multifunction device (MFD) — A device that combines printing, scanning, copying, and faxing; often has stored data and network services. Also called multifunction printer (MFP).
Multiprotocol Label Switching (MPLS) — A carrier technology that routes traffic using labels, used for private WAN links.

National Institute of Standards and Technology (NIST) — The US agency that publishes security standards and frameworks, including the Cybersecurity Framework and SP 800 series.
Near-field communication (NFC) — A very short-range wireless technology used for contactless payments and access badges.
Negotiation — In incident response, communication with attackers, such as ransomware operators, usually handled by specialists with legal guidance.
NetFlow — A Cisco protocol that exports metadata about network flows (source, destination, ports, bytes) for traffic analysis.
Network access control (NAC) — Technology that checks devices for identity and posture compliance before granting network access.
Network address translation (NAT) — Translating private internal IP addresses to public addresses at the network edge.
Network-based intrusion detection system (NIDS) — A sensor that monitors network traffic and alerts on suspicious activity.
Network-based intrusion prevention system (NIPS) — An inline network device that detects and blocks malicious traffic.
New Technology File System (NTFS) — The Windows file system that supports permissions, encryption, and journaling.
New Technology LAN Manager (NTLM) — A legacy Windows challenge-response authentication protocol vulnerable to pass-the-hash and relay attacks.
Next-generation firewall (NGFW) — A firewall combining stateful inspection with application awareness, intrusion prevention, and threat intelligence.
Non-disclosure agreement (NDA) — A contract that prohibits parties from disclosing confidential information.
Non-repudiation — Assurance that a party cannot deny an action, such as sending a message, typically provided by digital signatures.
Notoriety — A motivation in which attackers seek fame or recognition.

Obfuscation — Making code or data difficult to understand, used both defensively (protecting code) and offensively (hiding malware).
Object identifier (OID) — A unique numeric identifier for objects, such as certificate extensions and SNMP variables.
Offboarding — The process of removing a departing employee's access and recovering assets.
One-time password (OTP) — A password valid for one login or a short time, generated by a token or app or sent by message.
Online Certificate Status Protocol (OCSP) — A protocol for checking the revocation status of a single certificate in real time.
On-path attack — An attack in which the attacker intercepts and possibly alters communication between two parties. Formerly man-in-the-middle.
Open Authorization (OAuth) — An authorization framework that lets applications access resources on a user's behalf using tokens, without receiving the user's password.
Open Vulnerability and Assessment Language (OVAL) — An XML-based standard, part of SCAP, for describing system configuration checks and vulnerabilities.
OpenID Connect (OIDC) — An authentication layer built on OAuth 2.0 that provides identity tokens for single sign-on.
Open-source intelligence (OSINT) — Information gathered from publicly available sources such as websites, social media, and public records.
Operating system (OS) — The software that manages hardware and provides services to applications.
Operational control — A control implemented primarily by people performing tasks, such as awareness training delivery, guard patrols, and log review.
Operational security (OPSEC) — Practices that protect sensitive information from being pieced together by adversaries, such as limiting what is shared publicly.
Operational technology (OT) — Hardware and software that monitor and control physical processes, such as industrial control systems.
Opt-in and opt-out — Consent models in which individuals must actively agree to data processing (opt-in) or are included unless they decline (opt-out).
Order of volatility — The sequence for collecting evidence from most volatile (CPU cache, RAM) to least volatile (archives).
Out-of-band management — Managing devices through a separate, dedicated network or connection rather than the production network.
Over-the-air (OTA) update — Wireless delivery of firmware or software updates to devices.

Packet analyzer — A tool such as Wireshark or tcpdump that captures and decodes network packets. Also called a protocol analyzer or sniffer.
Packet capture (PCAP) — A recording of network packets, also the common file format for saving captures.
Partially known environment test — A penetration test in which testers receive limited information about the target. Formerly gray box.
Passive reconnaissance — Gathering information about a target without directly interacting with it, such as OSINT research.
Passkey — A FIDO2-based passwordless credential that uses a device-bound or synced key pair, unlocked by biometrics or PIN, and resists phishing.
Password manager — Software that generates, stores, and fills strong unique passwords, protected by a master credential.
Password spraying — An attack that tries a few common passwords against many accounts to avoid lockouts.
Password-Based Key Derivation Function 2 (PBKDF2) — A key stretching function that applies a hash many times with a salt to derive keys or store passwords.
Passwordless — Authentication that does not use a password, relying instead on passkeys, biometrics, or hardware tokens.
Patch management — The process of identifying, testing, deploying, and verifying software updates.
Payment Card Industry Data Security Standard (PCI DSS) — The industry standard for protecting payment card data, required for organizations that store, process, or transmit it.
Penetration testing — Authorized simulated attacks to identify exploitable vulnerabilities and test defenses.
Perfect forward secrecy (PFS) — A property of key exchange in which compromise of a long-term key does not expose past session keys.
Personal health information (PHI) — Health information that identifies an individual, protected under laws such as HIPAA. Also called protected health information.
Personal identity verification (PIV) — A US federal smart card standard for employee identification and authentication.
Personally identifiable information (PII) — Information that can identify an individual, such as name, government ID number, or biometric data.
Personnel behavior risk scoring — Rating individuals' security risk based on behavior such as phishing-simulation results and policy violations, used to target training.
Phishing — Fraudulent messages, usually email, designed to trick recipients into revealing information or running malware.
Physical control — A tangible control that protects facilities and equipment, such as locks, fences, bollards, and cameras.
Platform as a service (PaaS) — A cloud model providing a managed platform for developing and running applications; the customer manages code and data.
Playbook — A documented, step-by-step response procedure for a specific incident type, which can be automated in SOAR.
Point-to-Point Protocol (PPP) — A protocol for direct connections between two nodes.
Point-to-Point Tunneling Protocol (PPTP) — An obsolete VPN protocol with weak security.
Policy enforcement point (PEP) — In Zero Trust, the component that enforces the access decision, allowing or blocking the connection.
Policy engine — In Zero Trust, the component that decides whether to grant access based on policy and signals.
Port mirroring — Copying traffic from one or more switch ports to another port for monitoring. Also called SPAN.
Post Office Protocol (POP3) — A protocol for downloading email from a server (TCP 110, or 995 with TLS).
Post-incident report (PIR) — The formal report documenting an incident's timeline, impact, root cause, and improvements.
Power distribution unit (PDU) — A device that distributes power to equipment in a rack, often with remote monitoring.
Predictive analysis — Using data and AI models to forecast likely future events, such as attacks or failures.
Pre-shared key (PSK) — A shared secret configured on both sides of a connection, as in WPA2- Personal.
Pretexting — Creating a fabricated scenario to manipulate a target into providing information or access.
Preventive control — A control that stops an incident from occurring, such as firewalls, locks, and

Mfa.

Private cloud — A cloud environment dedicated to a single organization.
Private key — The secret half of an asymmetric key pair, used to decrypt data and create digital signatures.
Privilege creep — The gradual accumulation of unnecessary permissions as users change roles.
Privilege escalation — Gaining higher privileges than authorized, either vertically (to admin) or horizontally (to another user's privileges).
Privileged access management (PAM) — Tools and processes that secure, control, and monitor privileged accounts, including vaulting and just-in-time access.
Processing restriction — A privacy right allowing individuals to limit how an organization uses their personal data without requiring deletion.
Programmable logic controller (PLC) — An industrial computer that controls machinery in OT environments.
Prompt injection — An attack that embeds malicious instructions in input to an AI model, causing it to ignore its instructions or leak data.
Protected Extensible Authentication Protocol (PEAP) — An EAP method that wraps authentication inside a TLS tunnel established with a server certificate.
Provisioning — Creating accounts, granting access, and allocating resources for users or systems.
Proxy server — An intermediary that forwards requests. Forward proxies serve clients; reverse proxies front servers.
Public cloud — A cloud environment operated by a provider and shared among many customers.
Public key — The shareable half of an asymmetric key pair, used to encrypt data and verify signatures.
Public key infrastructure (PKI) — The framework of CAs, certificates, policies, and procedures that manages public key cryptography.
Public-Key Cryptography Standards (PKCS) — A set of standards for public key cryptography, such as PKCS #12 for storing keys and certificates.

Qualitative risk analysis — Assessing risk using descriptive ratings such as low, medium, and high.
Quantitative risk analysis — Assessing risk using numerical values such as SLE, ARO, and ALE.
Quarantine — Isolating a file, device, or system to prevent harm while it is analyzed.
Quick Response (QR) code — A two-dimensional barcode. Malicious QR codes direct victims to phishing sites (quishing).
Quishing — Phishing using QR codes to bypass email link scanning and move victims to mobile devices.

Race condition — A flaw in which the outcome depends on the timing of events, such as time-of-check to time-of-use (TOCTOU).
Radio frequency (RF) — Electromagnetic signals used for wireless communications; vulnerable to jamming and interception.
Radio-frequency identification (RFID) — Technology that uses radio waves to read tags, used for badges and asset tracking; can be cloned.
Rainbow table — A precomputed table of hashes used to crack passwords; defeated by salting.
Ransomware — Malware that encrypts or steals data and demands payment for decryption or to prevent publication.
Real-time operating system (RTOS) — An operating system designed for predictable timing in embedded systems.
Recovery — The incident response activity of restoring systems to normal operation and verifying they are clean.
Recovery point objective (RPO) — The maximum acceptable amount of data loss, measured in time since the last backup.
Recovery time objective (RTO) — The maximum acceptable time to restore a system after a disruption.
Redundant array of independent disks (RAID) — Combining disks for redundancy or performance. RAID 1 mirrors; RAID 5 stripes with parity.
Redundant power supply (RPS) — A second power supply in a device so it keeps running if one fails.
Reference architecture — A documented template design that shows recommended components and practices for a type of system.
Remote access Trojan (RAT) — Malware that gives an attacker remote control of a system, often disguised as legitimate software.
Remote Authentication Dial-In User Service (RADIUS) — A protocol for centralized AAA, commonly used with 802.1X and VPNs (UDP 1812 and 1813).
Remote Desktop Protocol (RDP) — Microsoft's protocol for remote graphical access (TCP 3389); a frequent attack target when exposed.
Remote triggered black hole (RTBH) — A technique for dropping traffic to or from specified addresses at the network edge, used during DDoS attacks.
Replay attack — Capturing valid data such as credentials or tokens and retransmitting it to gain unauthorized access.
Request for information (RFI) — A document asking vendors for general information about their capabilities.
Request for proposal (RFP) — A formal document asking vendors to propose solutions and pricing for defined requirements.
Request for quote (RFQ) — A request asking vendors to provide pricing for clearly specified goods or services.
Residual risk — The risk that remains after controls are applied.
Resilience — The ability to withstand and recover quickly from disruption.
Responsible disclosure — A policy and process for researchers to report vulnerabilities privately so they can be fixed before public release.
Restricted (data classification) — A high sensitivity level for data whose disclosure could cause severe harm or regulatory penalties.
Return on investment (ROI) — The benefit of an investment relative to its cost.
Reverse proxy — A server that sits in front of web servers, handling client requests for load balancing, TLS termination, and protection.
Rich Communication Services (RCS) — A messaging protocol that enhances SMS with media and read receipts; a vector for smishing-style attacks.
Rich Text Format (RTF) — A document format that can carry embedded objects and exploits.
Right to audit — A contract clause permitting the customer to audit a vendor's controls.
Right to be forgotten — A privacy right allowing individuals to request deletion of their personal data. Also called the right to erasure.
Risk appetite — The amount and type of risk an organization is willing to pursue or accept to meet its objectives.
Risk register — A document listing identified risks with owners, ratings, mitigations, and treatment status.
Risk tolerance — The acceptable deviation from the risk appetite for a specific risk.
Rivest Cipher 4 (RC4) — A legacy stream cipher with known weaknesses, used in WEP and old TLS.
Rivest-Shamir-Adleman (RSA) — A widely used asymmetric algorithm based on factoring large primes, used for encryption, signatures, and key exchange.
Rogue device — An unauthorized device connected to the network, such as a rogue access point.
Role-based access control (RBAC) — An access model that grants permissions based on job roles.
Root cause analysis (RCA) — Determining the underlying cause of an incident so it can be prevented from recurring.
Root of trust — An inherently trusted component, such as a TPM or root CA, from which other trust is derived.
Rootkit — Malware that hides its presence and grants privileged access, sometimes operating at the kernel or firmware level.
Rule-based access control — An access model in which administrator-defined rules, such as firewall ACLs, determine access for all subjects.
Rules of engagement (RoE) — The agreed boundaries and conditions for a penetration test, including scope, timing, and permitted techniques.
Runbook — Detailed operational steps for performing a specific task, often automated.

Salting — Adding a unique random value to each password before hashing so identical passwords produce different hashes, defeating rainbow tables.
Sanctions — Penalties imposed by governments or regulators, or restrictions on dealing with specified countries or entities.
Sandboxing — Running code in an isolated environment to observe behavior or limit damage.
Sanitization — Removing data from media so it cannot be recovered, through overwriting, degaussing, cryptographic erase, or destruction.
Scalability — The ability of a system to handle growth by adding resources.
Screened subnet — A network segment between the internet and the internal network that hosts public-facing services. Formerly called a DMZ.
Secret (data classification) — A government classification for information whose disclosure could cause serious damage to national security.
Secrets scanning — Automatically searching code repositories for exposed credentials, keys, and tokens.
Secure Access Service Edge (SASE) — A cloud architecture combining networking (SD-WAN) and security services such as SWG, CASB, ZTNA, and FWaaS.
Secure cookie — A cookie set with the Secure attribute so it is sent only over HTTPS, often combined with HttpOnly and SameSite.
Secure File Transfer Protocol (SFTP) — File transfer over an SSH connection (TCP 22).
Secure hash algorithm (SHA) — A family of hash functions; SHA-256 and SHA-3 are current, while SHA-1 is deprecated.
Secure Real-time Transport Protocol (SRTP) — A protocol that encrypts and authenticates voice and video streams.
Secure Shell (SSH) — A protocol for encrypted remote command-line access and file transfer (TCP 22).
Secure Sockets Layer (SSL) — The deprecated predecessor of TLS; all versions are insecure.
Secure/Multipurpose Internet Mail Extensions (S/MIME) — A standard for encrypting and digitally signing email using certificates.
Security Assertion Markup Language (SAML) — An XML-based standard for exchanging authentication and authorization assertions between an identity provider and service providers for SSO.
Security Content Automation Protocol (SCAP) — A NIST suite of standards for automating vulnerability management and configuration compliance checks.
Security Enhanced Linux (SELinux) — A Linux kernel module that enforces mandatory access control policies.
Security information and event management (SIEM) — A system that aggregates, correlates, and analyzes logs from many sources to detect and alert on security events.
Security operations center (SOC) — The team and facility that monitors, detects, and responds to security events.
Security orchestration, automation, and response (SOAR) — Tools that automate and coordinate security workflows and playbooks across multiple systems.
Security Service Edge (SSE) — The security portion of SASE, delivering SWG, CASB, and ZTNA from the cloud.
Security zone — A network segment grouping assets with similar trust levels and security requirements.
Segmentation — Dividing a network into smaller segments to limit traffic and contain breaches.
Self-encrypting drive (SED) — A drive that encrypts data automatically in hardware.
Self-signed certificate — A certificate signed by its own private key rather than a CA, not trusted by default.
Sensitive (data classification) — Data that requires protection because disclosure could harm individuals or the organization.
Separation of duties — Dividing critical tasks among multiple people so no one person can complete a sensitive process alone.
Server-side request forgery (SSRF) — An attack that tricks a server into making requests to internal or external resources on the attacker's behalf.
Service account — A non-human account used by applications or services to access resources.
Service level agreement (SLA) — A contract defining measurable service levels, such as uptime, and remedies if they are not met.
Service level objective (SLO) — A specific target within an SLA, such as 99.9 percent monthly availability.
Session hijacking — Taking over a user's authenticated session, typically by stealing a session token or cookie.
Session token — A value that identifies an authenticated session; if stolen, it can let an attacker bypass authentication and MFA.
Shadow IT — Technology used within an organization without IT approval or oversight.
Shoulder surfing — Observing someone's screen or keyboard to steal information.
Simple Mail Transfer Protocol (SMTP) — The protocol for sending email between servers (TCP 25; 587 for submission).
Simple Network Management Protocol (SNMP) — A protocol for monitoring and managing network devices (UDP 161 and 162). SNMPv3 adds authentication and encryption.
Simple Object Access Protocol (SOAP) — An XML-based messaging protocol for web services.
Simulation — A realistic exercise that tests response capabilities in a controlled environment, more hands-on than a tabletop.
Single loss expectancy (SLE) — The expected monetary loss from a single occurrence of a risk, calculated as asset value multiplied by exposure factor.
Single point of failure (SPOF) — A component whose failure stops the entire system.
Single sign-on (SSO) — Authentication that lets users sign in once to access multiple systems.
Skimming — Capturing payment card data with a hidden device attached to a card reader.
Smishing — Phishing through SMS text messages.
Snapshot — A point-in-time copy of a virtual machine or storage volume.
Social engineering — Manipulating people into revealing information or performing actions that compromise security.
Soft token — A software-based authenticator, such as an authenticator app, that generates one-time codes.
Software as a service (SaaS) — A cloud model delivering complete applications managed by the provider.
Software bill of materials (SBOM) — An inventory of the components and dependencies in a software product, used to track supply chain vulnerabilities.
Software development kit (SDK) — A set of tools and libraries for building applications on a platform.
Software development life cycle (SDLC) — The structured process of planning, building, testing, deploying, and maintaining software.
Software-defined networking (SDN) — Separating network control from forwarding hardware so networks can be centrally programmed.
Software-defined wide area network (SD-WAN) — Software-controlled WAN connectivity across multiple link types.
Solid-state drive (SSD) — Flash-based storage. Overwriting is unreliable for sanitization; use cryptographic erase or physical destruction.
Source code review — Manually or automatically examining application code to find vulnerabilities.
Spam over instant messaging (SPIM) — Unsolicited messages sent through instant messaging platforms.
Spear phishing — Targeted phishing aimed at a specific person or group using personalized details.
Spoofing — Falsifying identity information, such as an IP address, MAC address, email sender, or caller ID.
Spyware — Malware that secretly monitors user activity and collects information.
SQL injection (SQLi) — An injection attack that inserts malicious SQL into a query to read, modify, or delete database data.
Stakeholder — A person or group with an interest in, or affected by, a decision, change, or incident.
Standard operating procedure (SOP) — A documented, step-by-step method for performing a routine task consistently.
Stateful firewall — A firewall that tracks connection state and allows return traffic for established sessions.
Statement of work (SOW) — A document defining the specific tasks, deliverables, and timelines for a project.
State-sponsored actor — A threat actor funded or directed by a government, typically with significant resources and advanced capabilities.
Static code analysis — Examining source code without executing it to find vulnerabilities. Also called SAST.
Steganography — Hiding data within other data, such as an image or audio file.
Storage area network (SAN) — A dedicated high-speed network providing block-level storage.
Stream cipher — A symmetric cipher that encrypts data one bit or byte at a time.
Structured data — Data organized in a defined format, such as database tables.
Structured Query Language (SQL) — The language used to query and manage relational databases.
Structured Threat Information eXpression (STIX) — A standard format for describing cyber threat intelligence.
Subject Alternative Name (SAN) — A certificate extension listing additional hostnames or identities the certificate covers.
Subprocessor — A third party engaged by a data processor to process personal data on the controller's behalf.
Supervisory control and data acquisition (SCADA) — A system for monitoring and controlling geographically distributed industrial processes.
Supply chain attack — Compromising an organization by targeting its suppliers, software vendors, or service providers.
Surge protector — A device that protects equipment from voltage spikes.
Symmetric encryption — Encryption using a single shared key for both encryption and decryption, such as AES.
Syslog — A standard protocol and format for sending log messages across a network (UDP 514; TLS on TCP 6514).
System on a chip (SoC) — An integrated circuit that contains all the components of a computer, common in mobile and IoT devices.

Tabletop exercise — A discussion-based exercise in which participants walk through a scenario to test plans and roles.
Tailgating — Following an authorized person through a secure door without authenticating. Piggybacking is the same act with the person's consent.
Terminal Access Controller Access-Control System Plus (TACACS+) — A Cisco AAA protocol that separates authentication, authorization, and accounting and encrypts the full payload (TCP 49).
Third-party risk — Risk introduced through vendors, suppliers, partners, and service providers.
Threat actor — An individual or group that carries out or intends to carry out attacks.
Threat feed — A stream of threat intelligence data, such as malicious IPs and domains.
Threat hunting — Proactively searching for threats that evaded existing detections.
Threat intelligence — Evidence-based information about threats and threat actors used to inform defenses.
Threat vector — The path or means by which an attacker reaches a target, such as email, removable media, or a supply chain. Also called attack vector.
Ticket-granting ticket (TGT) — A Kerberos ticket that proves a user's identity and is used to request service tickets.
Time of check to time of use (TOCTOU) — A race condition in which a resource changes between the time it is checked and the time it is used. TOC and TOU are its two moments.
Time-based access control — Restricting access to defined times or days.
Time-based one-time password (TOTP) — A one-time password algorithm based on the current time and a shared secret, typically valid for 30 seconds.
Tokenization — Replacing sensitive data with a non-sensitive token that maps to the original only through a secure vault.
Top secret — The highest government classification, for information whose disclosure could cause exceptionally grave damage.
Transmission Control Protocol/Internet Protocol (TCP/IP) — The protocol suite underlying the internet.
Transport Layer Security (TLS) — The protocol that encrypts and authenticates network communications; TLS 1.2 and 1.3 are current.
Trojan — Malware disguised as legitimate software.
Trusted Automated Exchange of Intelligence Information (TAXII) — A protocol for sharing STIX threat intelligence over HTTPS.
Trusted Platform Module (TPM) — A hardware chip that securely stores keys and measurements, supporting secure boot, attestation, and disk encryption.
Tunneling — Encapsulating one protocol inside another to transport it, as in VPNs, or to evade controls, as in DNS tunneling.
Typosquatting — Registering domain names similar to legitimate ones to catch users who mistype URLs or to impersonate brands.

Unified endpoint management (UEM) — A platform for managing all endpoint types, including mobile, desktop, and IoT, from one console.
Unified Extensible Firmware Interface (UEFI) — Modern firmware that replaces BIOS and supports Secure Boot.
Unified threat management (UTM) — An all-in-one security appliance combining firewall, IPS, antivirus, content filtering, and VPN.
Uniform Resource Identifier (URI) — A string that identifies a resource.
Uniform Resource Locator (URL) — A web address that specifies a resource's location.
Uninterruptible power supply (UPS) — A battery-based device that provides short-term power during outages.
Universal Serial Bus (USB) — A standard interface for peripherals; malicious USB devices can deliver malware or act as keyboards.
Unknown environment test — A penetration test with no prior information about the target. Formerly black box.
Unshielded twisted pair (UTP) — Common network cabling without shielding, susceptible to interference.
Unskilled attacker — A threat actor with limited skills who uses existing tools and exploits. Formerly called script kiddie.
Unstructured data — Data without a predefined format, such as documents, email, and images.
Unsupported product — Hardware or software that no longer receives vendor support or security updates.
User acceptance testing (UAT) — Testing by end users to confirm a system meets requirements before deployment.
User and entity behavior analytics (UEBA) — Analytics that establish baselines for users and devices and flag anomalies.
User Datagram Protocol (UDP) — A connectionless transport protocol.
User enumeration — Discovering valid usernames, often through different error messages or responses.

Vendor lock-in — Dependence on a single vendor that makes switching difficult or costly.
Version control — Tracking changes to code, configurations, and documents over time so changes can be reviewed and rolled back.
Virtual desktop infrastructure (VDI) — Hosting desktop environments on central servers and delivering them to users remotely.
Virtual local area network (VLAN) — A logical network segment created on switches to separate traffic.
Virtual machine escape — An attack in which code in a virtual machine breaks out to the hypervisor or other VMs.
Virtual machine (VM) — A software-based computer running on a hypervisor.
Virtual Network Computing (VNC) — A remote desktop protocol (TCP 5900); often poorly secured.
Virtual private cloud (VPC) — An isolated network within a public cloud.
Virtual private network (VPN) — An encrypted tunnel connecting remote users or sites over an untrusted network.
Virtualization — Running multiple virtual systems on shared physical hardware through a hypervisor.
Virus — Malware that attaches to files and spreads when they are executed, requiring user action.
Vishing — Voice phishing conducted over phone calls, increasingly with deepfake audio.
Visual Basic for Applications (VBA) — The scripting language used in Microsoft Office macros.
Voice over IP (VoIP) — Delivering voice calls over IP networks.
Vulnerability — A weakness that a threat could exploit.
Vulnerability scanner — A tool that identifies known vulnerabilities and misconfigurations on systems.

Warm site — A recovery site with some equipment and connectivity, requiring time to load data and configure.
Watering hole attack — Compromising a website frequently visited by a target group.
Web application firewall (WAF) — A firewall that inspects HTTP traffic to block web attacks such as SQL injection and XSS.
Whaling — Spear phishing aimed at senior executives.
Wide area network (WAN) — A network spanning large geographic areas.
Wi-Fi Protected Access (WPA) — Wireless security protocols. WPA2 uses AES-CCMP; WPA3 adds SAE and stronger protections.
Wi-Fi Protected Setup (WPS) — A simplified wireless setup method whose PIN mode is vulnerable to brute force.
Wildcard certificate — A certificate that covers all subdomains at one level, such as *.example.com.
Wired Equivalent Privacy (WEP) — An obsolete, broken wireless encryption protocol.
Wireless intrusion detection system (WIDS) — A system that monitors wireless spectrum for rogue access points and attacks.
Wireless intrusion prevention system (WIPS) — A system that detects and blocks wireless threats.
Worm — Self-replicating malware that spreads across networks without user action.

Zero Trust — A security model that assumes no implicit trust and continuously verifies every user, device, and request.
Zero-day — A vulnerability unknown to the vendor or without an available patch.