Glossary

​

2FA (Two-Factor Authentication)

A security measure that requires two forms of identification to authenticate a user, adding an extra layer of security.

 

Access Control

Rules and policies that determine who can access which resources.

 

Access Control List (ACL)

A list that defines which users or systems have access to resources and the permissions that apply.

 

Access Management

The administration and control of access rights and user roles to ensure security.

 

Adversary Emulation

Simulation of real threat actor tactics and techniques to test and improve an organization’s defenses.

 

Adversary-In-The-Middle (AITM)

A variant of a Man-in-the-Middle attack designed to hijack multi-factor authenticated sessions.

 

Anti-Virus Bypass

Techniques specifically developed to evade antivirus detection.

 

APT (Advanced Persistent Threat)

A sophisticated, long-term cyberattack often conducted by organized and well-funded groups.

 

Attack Surface

The entire set of points through which an attacker can try to gain unauthorized access to a system.

 

Attack Surface Reduction

Measures to decrease the attack surface by minimizing exposed services and vulnerabilities.

 

Attack Vector

A path or method used by an attacker to access a system or network.

 

Behavioral Analysis

Analyzing user behavior to identify anomalies and potential threats.

 

Beaconing

A communication method where compromised systems periodically send signals to maintain contact with command and control (C2) servers.

 

Biometric Authentication

An authentication method that relies on biological characteristics like fingerprints or facial recognition.

 

Black Hat

A term for a malicious hacker who compromises systems to cause harm or steal data.

 

Blue Team

The team responsible for protecting and monitoring an organization’s security systems.

 

Botnet

A network of compromised devices controlled by attackers to perform coordinated attacks.

 

Botnet Detection

Techniques and systems to identify and combat botnets in networks.

 

Brute Force Attack

An attempt to gain access to a system by systematically trying every possible password.

 

Brute-Force Protection

Measures to detect and prevent brute-force attacks, such as captchas or IP blocking.

 

Buffer Overflow

An attack where memory is overwritten to gain control over a program.

 

Canary Trap

A technique where information is shared with slight variations to identify a leak.

 

CAPTCHA

A security measure to verify that a user is human, not an automated program.

 

CAPTCHA Breaking

Techniques or tools designed to bypass CAPTCHA security measures.

 

Casing the Joint

The process of gathering information and surveying a target prior to an attack.

 

Certificate Authority (CA)

A trusted organization that issues digital certificates to verify identities and enable secure connections.

 

Certificate Pinning

A technique to ensure an application communicates only with trusted certificates.

 

CIA Triad

Core principles of information security: Confidentiality, Integrity, and Availability.

 

Clickjacking

A technique where a user is tricked into clicking on hidden links or elements.

 

Cloud Access Security Broker (CASB)

A tool that monitors the use of cloud services and enforces data security policies.

 

Cloud Forensics

Investigation and analysis of digital evidence in cloud environments to resolve security incidents.

 

Cloud Security

Measures to protect data and applications hosted in cloud environments.

 

Code Injection

An attack where malicious code is embedded in an application to manipulate its behavior.

 

Cold Boot Attack

An attack targeting the memory of a device to extract sensitive information after a reboot.

 

Command and Control (C2)

A server used by attackers to manage and control compromised systems.

 

Command Injection

Exploiting vulnerabilities in a system to execute unauthorized commands.

 

Confidentiality

An information security principle that ensures data is accessible only to authorized users.

 

Content Security Policy (CSP)

A policy to prevent XSS attacks by allowing only trusted content to load on websites.

 

Continuous Monitoring

Regular monitoring of security data and events to detect and respond to threats.

 

Counter Adversary Operations (CAO)

Proactive measures to identify, track, and disrupt threat actors to prevent future attacks.

 

Cryptanalysis

The study of breaking cryptographic algorithms and codes.

 

Cryptography

The science of encrypting and decrypting information to protect data.

 

Cyber Hygiene

Routine security practices to minimize risks and protect against threats.

 

Cyber Kill Chain

A model describing the phases of a cyberattack, from reconnaissance to exfiltration.

 

Data Breach

An incident where unauthorized access to sensitive information is gained.

 

Data Exfiltration

The unauthorized transfer of data out of a system.

 

Data Loss Prevention (DLP)

Policies and tools that prevent the loss or theft of data.

 

Data Masking

Obscuring sensitive data to ensure that only authorized users have access to the real data.

 

Data Mining

The analysis of large datasets to extract useful information, often for security assessments.

 

Decryption

The process of decrypting data to make it accessible.

 

Defense in Depth

A security strategy that uses multiple layers of security measures to reduce the likelihood of a successful attack.

 

Denial of Service (DoS)

An attack aimed at making a system unavailable by overwhelming it.

 

Digital Forensics

The investigation and analysis of digital evidence to resolve security incidents.

 

Digital Signature

An encrypted signature that confirms the authenticity and integrity of a message or document.

 

Directory Traversal

An attack where an attacker tries to access directories and files outside of the web root folder.

 

DNS Spoofing

An attack where a domain’s DNS entry is faked to redirect users to a different IP address.

 

DNS Tunneling

A technique where DNS requests are used to transmit data, often for exfiltration and C2 communication.

 

Domain Generation Algorithm (DGA)

An algorithm that automatically generates domains to evade detection of C2 servers.

 

Drive-By Download Attack

An attack where malware is downloaded to a user’s system without their active consent.

 

Eavesdropping

Listening in on communication to intercept sensitive information like passwords or data.

 

Endpoint

A device like a computer, smartphone, or printer connected to a network that can be targeted.

 

Endpoint Detection and Response (EDR)

A security solution that monitors and reports suspicious activity on endpoints.

 

Endpoint Protection

Security measures and software to protect endpoint devices like laptops and smartphones.

 

Encryption

The process of encoding data to prevent unauthorized access.

 

Enumeration

The process of collecting specific information about a target to identify points of entry.

 

Ethical Hacker

A security professional authorized to test systems for vulnerabilities and report security flaws.

 

Evil Twin Attack

An attack where a fake Wi-Fi network is set up to intercept user traffic and data.

 

Event Logging

Recording events to analyze and investigate security incidents.

 

Exploit

Code or a technique that leverages a vulnerability in a system to gain control.

 

Exploit Chain

A sequence of exploits combined to gain deep access to a target.

 

Exploit Development

The process of creating and customizing exploits for specific vulnerabilities.

 

False Positive

A security alert that falsely indicates a threat where none exists.

 

Fuzzing

A testing method where random data is inputted to software to find bugs and vulnerabilities.

 

Hardware Root of Trust

A hardware component that enables secure authentication and encryption, serving as a trust anchor.

 

Hardware Security Module (HSM)

A physical device that protects cryptographic keys and enables secure transactions.

 

Hash Collision

A scenario where two different data sets produce the same hash value.

 

Hash Function

A cryptographic function that converts data into a fixed bit length, used for data integrity.

 

Honeypot

A deliberately vulnerable system used to bait attackers and study their behavior.

 

Host Intrusion Detection System (HIDS)

A system that detects and reports attacks on individual hosts.

 

HTTP Header Injection

An attack where malicious code is embedded in HTTP headers to manipulate the web application.

 

Identity Theft

The theft of personal information to commit identity fraud.

 

Indicator of Compromise (IoC)

An observation that signals a possible system compromise, such as unusual network activity.

 

Information Disclosure

A security flaw that leads to sensitive information being accessible to unauthorized users.

 

Insider Threat

A threat from individuals within the organization who have access to systems and data.

 

Input Validation

A technique for checking user input to prevent SQL injection, XSS, and other attacks.

 

Integrity

A principle of information security that ensures data remains complete and unaltered.

 

Intrusion Detection

Systems and processes that detect attacks and suspicious activities within a network.

 

Intrusion Detection System (IDS)

A system that detects attacks and suspicious activity in a network.

 

Intrusion Prevention System (IPS)

A system that actively blocks threats by preventing suspicious activities.

 

IP Spoofing

A technique where an attacker falsifies their IP address to impersonate another user or device.

 

ISO 27001

An internationally recognized standard for information security management systems.

 

Keystroke Injection

An attack where keystrokes are simulated via a USB device to execute commands.

 

Key Distribution Center (KDC)

A component in an authentication protocol (e.g., Kerberos) that distributes keys for encrypted communication.

 

Key Escrow

A security system where cryptographic keys are stored with a trusted third party for emergency access.

 

Keylogger

Malware that records keystrokes to steal sensitive information like passwords.

 

Least Privilege

A security principle where users are granted only the minimal access necessary to perform their duties.

 

Load Balancer

A device or software that evenly distributes network traffic across multiple servers to improve availability and performance.

 

Log Injection

An attack where manipulated data is entered into logs to create false alerts or hidden actions.

 

Log Management

Managing and analyzing log files to monitor and detect anomalies.

 

Malvertising

The use of online advertising to spread malware or redirect users to malicious websites.

 

Malware

Malicious software designed to damage systems, steal data, or gain unauthorized access.

 

Man-in-the-Middle Attack

An attack where an attacker intercepts and manipulates communication between two parties.

 

Managed Security Service Provider (MSSP)

A company that provides security services, such as threat monitoring and incident response.

 

MITM (Man-in-the-Middle)

Abbreviation for Man-in-the-Middle attacks.

 

MITRE ATT&CK Framework

A knowledge base of cyberattacks that describes tactics and techniques used by attackers.

 

Mobile Device Management (MDM)

Software to manage mobile devices, enforce security policies, and protect data.

 

Multi-Factor Authentication (MFA)

An authentication method that requires more than one form of identity verification.

 

Multi-Tenancy

An architecture principle where multiple customers (tenants) share the same resources, often in cloud environments.

 

Nmap (Network Mapper)

An open-source tool for network and security scanning.

 

OAuth

An open protocol for authorization, allowing users to grant third-party access to their resources without sharing passwords.

 

OS Fingerprinting

Identifying a target’s operating system based on analysis of its network activity.

 

Pass-the-Hash

An attack method where hash values are used instead of plaintext passwords to bypass authentication.

 

Password Policy

Guidelines for secure password creation and management to protect against unauthorized access.

 

Patch Management

The process of managing and installing updates and patches to protect systems from vulnerabilities.

 

Payload

The part of an exploit that contains malicious code and is executed on the target system.

 

Penetration Test

A simulated attack on a system to identify vulnerabilities and close security gaps.

 

Phishing

A deception technique where users are tricked into revealing sensitive data.

 

Pivoting

A technique where an attacker gains access to other systems in a network via a compromised system.

 

Port Knocking

A technique to secure network services by requiring a specific sequence of port requests to gain access.

 

Port Scanning

A technique where a network is scanned for open ports and services to identify vulnerabilities.

 

Post-Exploitation

The phase after intrusion where attackers solidify their position and exfiltrate data.

 

Privilege Escalation

Methods to obtain higher privileges in a system to gain greater access.

 

Protocol Tunneling

Method for transferring protocols through other networks or applications.

 

Quantum Cryptography

A cryptographic technique that uses quantum mechanics to enable secure communication.

 

Ransomware

Malware that encrypts data and demands a ransom to release it.

 

Recovery Point Objective (RPO)

The maximum tolerable data loss, measured in time, that is acceptable in a failure scenario.

 

Reconnaissance

The phase of gathering information about the target before an attack.

 

Red Team

A team of security professionals that conducts simulated attacks to test an organization’s defense strategies.

 

Remote Authentication Dial-In User Service (RADIUS)

An authentication protocol for securely verifying users on a network.

 

Remote Code Execution (RCE)

A vulnerability that allows attackers to execute arbitrary code on a remote system.

 

Remote Wipe

A technique where data on a lost or stolen device is remotely erased.

 

Replay Attack

An attack where legitimate data transmissions are intercepted and reused to gain access.

 

Reverse Engineering

The process of analyzing software or hardware to understand its workings and identify vulnerabilities.

 

Rootkit

Malware that deeply embeds itself into a system, making it difficult to detect.

 

Sandboxing

A security approach where applications are run in an isolated environment to limit the impact of an attack.

 

Script Kiddie

A derogatory term for an inexperienced hacker who uses pre-made tools without understanding the underlying technology.

 

Secure Sockets Layer (SSL)

A security protocol for encrypted data transmission over the internet.

 

Security Awareness Training

Programs to raise employees' awareness of security threats and minimize human error.

 

Security Information and Event Management (SIEM)

A system that collects and analyzes security information to detect and respond to threats.

 

Security Operations Center (SOC)

A facility for centrally monitoring and responding to security events in real-time.

 

Security Orchestration, Automation, and Response (SOAR)

Technologies for automating responses to security threats.

 

Session Hijacking

An attack where an attacker takes control of an active user session.

 

Side-Channel Attack

An attack that uses indirect information like timing or electromagnetic emissions to bypass security barriers.

 

SIEM (Security Information and Event Management)

A system that collects and analyzes security information to detect and respond to threats.

 

Social Engineering

The art of manipulating people to disclose confidential information.

 

Social Engineering Toolkit (SET)

A tool specifically designed for social engineering attacks, e.g., phishing campaigns.

 

Software Exploitation

Exploiting vulnerabilities in software to gain control over systems.

 

Spear Phishing

A targeted phishing technique aimed at specific individuals or organizations, often using personalized messages.

 

Spoofing

Faking information to appear as a trusted source, e.g., IP spoofing or email spoofing.

 

SQL Injection

An attack where SQL commands are manipulated to access or alter database information.

 

Stateful Inspection

A firewall technique that monitors the state of active connections and allows only permitted connections.

 

Steganography

Hiding information within other media, such as images or audio files.

 

Supply Chain Attack

An attack on the supply chain where vulnerabilities in third parties are exploited to compromise a target system.

 

Threat Actor

An individual or group that conducts malicious activities, such as hacker groups or APT groups.

 

Threat Intelligence

The gathering and analysis of information on current and potential threats to prevent future attacks.

 

Threat Modeling

A method to analyze threats and better understand potential attacks.

 

Tokenization

A security method where sensitive data is replaced by tokens to restrict access.

 

Trojan Horse (Trojan)

Malware disguised as legitimate software to gain unauthorized access.

 

Trusted Execution Environment (TEE)

A secure hardware area designed to protect sensitive data.

 

TTP (Tactics, Techniques, and Procedures)

The tactics, techniques, and procedures used by threat actors in an attack.

 

Two-Person Integrity (TPI)

A security principle where two people are required for specific tasks to ensure integrity.

 

Typo-Squatting

An attack where domains are registered that look similar to legitimate domains to trick users.

 

URL Manipulation

A technique where URLs are manipulated to gain unauthorized access or alter data.

 

User Enumeration

A technique for identifying usernames on a system, often in preparation for attacks like brute force.

 

Vulnerability

A weakness in software or hardware that can be exploited by attackers.

 

Vulnerability Assessment

A systematic review of a system for vulnerabilities and potential security gaps.

 

VPN (Virtual Private Network)

A network providing a secure connection over the internet, encrypting data to protect privacy.

 

Watering Hole Attack

An attack where a trusted website is compromised to infect specific visitors.

 

Weakness

A potential flaw or security gap in a system that can become a vulnerability.

 

Web Application Firewall (WAF)

A firewall specifically designed to protect web applications from common attacks like SQL injection and XSS.

 

Whaling

A form of spear phishing specifically targeting high-profile individuals like executives.

 

White Hat

An ethical hacker who tests systems for vulnerabilities and reports security gaps to fix them.

 

Wi-Fi Pineapple

A hardware device used to set up fake Wi-Fi networks to intercept traffic.