CompTIA Security+: key terms

Flashcards for this exam CompTIA Security+ guide Class dates

• /etc/shadowThe root-only Linux file that stores hashed user passwords and password aging information.Foundational
• 3-2-1 Backup RuleA backup guideline: keep three copies of data on two different media types with one copy offsite.Foundational
• Acceptable Use Policy (AUP)Policy defining permitted and prohibited uses of organizational systems, networks, and data by users.Foundational
• Access ControlSecurity mechanisms that determine who or what can view, use, or change resources, and under what conditions.Foundational
• Access Control List (ACL)Ordered list of rules attached to an object or interface that permits or denies access to specific subjects or traffic.Foundational
• Access Control VestibuleSmall space with two interlocking doors where only one opens at a time, preventing tailgating; formerly called a mantrap.Foundational
• Access ReviewPeriodic verification by managers or owners that users' access rights are still appropriate.Intermediate
• Access TokenCredential issued by an authorization server that a client presents to an API to access protected resources.Intermediate
• Account LockoutDisabling an account temporarily or permanently after a set number of failed login attempts.Foundational
• Account Takeover (ATO)Unauthorized control of a legitimate user account, typically through stolen credentials or session tokens.Intermediate
• Active Directory (AD)Microsoft's on-premises directory service for Windows domains, using LDAP, Kerberos, and DNS.Foundational
• Active Directory Certificate Services (AD CS)The Windows Server role that implements a public key infrastructure for issuing and managing digital certificates.Advanced
• Active ReconnaissanceGathering information by directly interacting with target systems, such as scanning or probing services.Foundational
• Address Space Layout Randomization (ASLR)An OS exploit mitigation that randomizes where code, stack, heap and libraries are loaded in memory.Intermediate
• AdmissibilityWhether evidence meets legal standards to be accepted in court, such as relevance, reliability and proper handling.Intermediate
• Advanced Encryption Standard (AES)NIST-standard symmetric block cipher (Rijndael) with a 128-bit block and 128-, 192-, or 256-bit keys.Foundational
• Advanced Persistent Threat (APT)A well-resourced, stealthy adversary that gains long-term access to a target to steal data or prepare for disruption.Intermediate
• Adversary-in-the-Middle Phishing (AiTM)Phishing that proxies a real login session to steal both credentials and session cookies, bypassing traditional MFA.Advanced
• AdwareSoftware that displays unwanted advertisements, often bundled with free applications.Foundational
• After-Action Report (AAR)A formal document summarizing an incident or exercise, its timeline, outcomes and recommendations.Intermediate
• Agent-Based ScanningVulnerability assessment using software agents installed on endpoints that report findings to a central console.Intermediate
• Air GapPhysically isolating a system or network from all other networks, including the internet.Foundational
• Air-Gapped BackupA backup copy that is physically or logically isolated from production networks so attackers cannot reach it.Intermediate
• Allowlist ValidationInput validation that accepts only values matching a known-good pattern or set and rejects everything else.Foundational
• Amplification AttackA DDoS technique that sends small spoofed requests to services that return much larger responses to the victim.Intermediate
• Android Runtime PermissionsAndroid's model requiring apps to request dangerous permissions, such as location or camera, from the user at runtime.Foundational
• Annualized Loss Expectancy (ALE)Expected yearly monetary loss from a risk: ALE = SLE x ARO.Foundational
• Annualized Rate of Occurrence (ARO)Estimated number of times a specific threat event is expected to occur in one year.Foundational
• Anomaly-Based DetectionDetecting threats by identifying deviations from an established baseline of normal behavior.Foundational
• AnonymizationIrreversibly transforming personal data so individuals can no longer be identified by any means reasonably likely to be used.Intermediate
• Anti-CSRF TokenA secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.Foundational
• Anti-Rollback ProtectionA mechanism that prevents installing older, vulnerable firmware or software versions after an update.Advanced
• API Authentication MethodsWays clients prove identity to APIs, including HTTP Basic, API keys, bearer tokens, OAuth 2.0, and mutual TLS.Foundational
• AppArmorA Linux mandatory access control module that confines programs using path-based profiles, default on Ubuntu and SUSE.Intermediate
• Application InventoryA maintained catalog of an organization's applications, APIs and components with owners, data classification and risk ratings.Foundational
• Application-Level Gateway (ALG)Proxy firewall that terminates connections and inspects traffic at the application layer for specific protocols.Intermediate
• Approved Scanning Vendor (ASV)Organization certified by the PCI SSC to perform external vulnerability scans for PCI DSS.Intermediate
• Argon2Memory-hard password hashing function that won the 2015 Password Hashing Competition; Argon2id is recommended.Advanced
• ARP PoisoningSending forged ARP replies to associate the attacker's MAC address with another host's IP, redirecting LAN traffic.Intermediate
• Asset CriticalityA rating of how important an asset is to the business, used to prioritize protection and response.Foundational
• Asset InventoryA complete, current record of hardware, software, cloud resources and data assets an organization owns or uses.Foundational
• Asset ValuationDetermining the worth of an asset, including replacement cost, revenue impact, and intangible value, to support risk analysis.Intermediate
• Asymmetric EncryptionEncryption using a mathematically related key pair: a public key to encrypt or verify and a private key to decrypt or sign.Foundational
• Attack SurfaceThe total set of points where an unauthorized user could try to enter or extract data from a system.Foundational
• Attack Surface AnalysisIdentifying and assessing all the points where an attacker could interact with or send input to an application.Foundational
• Attack Surface Management (ASM)Continuous discovery, inventory and monitoring of an organization's internet-facing assets and exposures.Intermediate
• AttestationProcess by which a device or workload provides cryptographic evidence of its identity and integrity to a verifier.Advanced
• Attestation of Compliance (AOC)Formal declaration of an entity's PCI DSS compliance status, accompanying a ROC or SAQ.Intermediate
• Attribute-Based Access Control (ABAC)Access control model that evaluates attributes of the subject, object, action, and environment against policies.Intermediate
• Audit TrailChronological record of system activities that allows reconstruction of events and accountability.Foundational
• AuthenticationVerifying that a user, device, or process is who or what it claims to be.Foundational
• Authentication BypassGaining access to protected functions without valid credentials due to flaws in authentication logic.Intermediate
• Authentication FactorCategory of evidence used to prove identity: something you know, have, or are, plus contextual attributes.Foundational
• Authentication Header (AH)IPsec protocol (IP protocol 51) that provides integrity, data origin authentication, and anti-replay but no encryption.Intermediate
• Authentication, Authorization, and Accounting (AAA)Framework that verifies identity, determines permitted actions, and records what users do.Foundational
• Authenticator AppMobile application that generates TOTP codes or approves push sign-ins as a possession factor.Foundational
• AuthenticityAssurance that data, a message, or an entity is genuine and comes from its claimed source.Foundational
• AuthorizationDetermining what an authenticated subject is permitted to access or do.Foundational
• Automated Certificate Management Environment (ACME)Protocol (RFC 8555) that automates domain validation, issuance, and renewal of certificates.Intermediate
• AvailabilitySecurity goal ensuring authorized users have timely, reliable access to data and systems when needed.Foundational
• BackdoorA hidden method of bypassing normal authentication or security controls to access a system.Foundational
• Backup TypesThe main backup methods: full, incremental and differential, plus snapshots and synthetic full backups.Foundational
• BACnetBuilding Automation and Control Networks, an ASHRAE/ISO standard protocol for HVAC, lighting, access control and other building systems.Advanced
• BaitingA social engineering attack that leaves an enticing item, such as an infected USB drive, for a victim to use.Foundational
• Banking TrojanA trojan designed to steal online banking credentials and manipulate financial transactions.Intermediate
• BaselineA documented reference of normal system, network or user behavior used to identify anomalies.Foundational
• bcryptAdaptive password-hashing function based on Blowfish with a configurable cost factor.Intermediate
• Behavioral DetectionDetecting threats by analyzing actions and sequences of activity rather than static signatures.Intermediate
• Biometric AuthenticationVerifying identity using unique physiological or behavioral characteristics.Foundational
• Birthday AttackCryptographic attack exploiting the birthday paradox to find hash collisions in about the square root of the output space.Intermediate
• BitLockerMicrosoft Windows full-volume encryption feature that can use a TPM to protect keys.Foundational
• Black-Box TestingTesting with no prior knowledge of the target's internals, simulating an external attacker; CompTIA calls it unknown-environment testing.Foundational
• BloatwareUnnecessary software preinstalled by a manufacturer that consumes resources and expands the attack surface.Foundational
• Block CipherA symmetric cipher that encrypts fixed-size blocks of data, such as 128 bits, using a key.Foundational
• BlockchainDistributed, append-only ledger where blocks are cryptographically chained by hashes to resist tampering.Intermediate
• BlowfishSymmetric block cipher by Bruce Schneier with a 64-bit block and variable key length from 32 to 448 bits.Intermediate
• Blue TeamThe defensive security team responsible for detecting, responding to and preventing attacks.Foundational
• BluesnarfingUnauthorized access to data on a Bluetooth-enabled device, such as contacts, messages or files.Foundational
• BluetoothA short-range 2.4 GHz wireless personal area network technology standardized by the Bluetooth SIG.Foundational
• Bluetooth Low Energy (BLE)A low-power Bluetooth variant using 40 2-MHz channels, widely used for IoT sensors and location beacons.Intermediate
• BollardShort, sturdy post that prevents vehicles from entering or ramming into a protected area while allowing pedestrians through.Foundational
• BootkitA rootkit that infects the boot process, such as the MBR, VBR or UEFI firmware, to load before the operating system.Advanced
• BotnetA network of compromised devices remotely controlled by an attacker to perform coordinated tasks.Foundational
• Brand ImpersonationMimicking a trusted company's name, logo and communications to deceive victims.Foundational
• Breach Notification LawsLaws requiring organizations to notify individuals, regulators, or others after unauthorized access to personal information.Foundational
• Bring Your Own Device (BYOD)A policy allowing employees to use personal devices to access corporate resources.Foundational
• Broken Access ControlOWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.Foundational
• Broken Object Level Authorization (BOLA)API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.Foundational
• Brute Force AttackSystematically trying all possible passwords or keys until the correct one is found.Foundational
• Buffer OverflowWriting more data into a memory buffer than it can hold, overwriting adjacent memory and potentially enabling code execution.Intermediate
• Bug Bounty ProgramA program in which organizations reward independent researchers for responsibly reporting security vulnerabilities.Foundational
• Business Continuity Planning (BCP)Planning to keep essential business functions operating during and after a disruption.Foundational
• Business Email Compromise (BEC)A fraud in which attackers impersonate or take over business email accounts to trick staff into sending money or data.Intermediate
• Business Impact Analysis (BIA)An analysis that identifies critical business functions and the impact of their disruption over time.Foundational
• California Consumer Privacy Act (CCPA)California law, effective 2020 and amended by the CPRA, granting consumers privacy rights over personal information held by businesses.Foundational
• Caller ID SpoofingFalsifying the calling number or name presented on a call to impersonate a trusted party or hide the caller.Foundational
• CAPTCHAA challenge-response test intended to distinguish humans from automated bots.Foundational
• Captive PortalA web page that intercepts a user's HTTP traffic and requires acceptance or login before granting access.Foundational
• Cardholder Data Environment (CDE)People, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus connected systems.Intermediate
• Certificate AuthorityTrusted entity that verifies identities and issues, signs, and revokes digital certificates.Foundational
• Certificate Lifecycle Management (CLM)Processes and tools to discover, issue, deploy, renew, and revoke certificates across an organization.Intermediate
• Certificate LifetimeThe validity period of a certificate, between its notBefore and notAfter dates.Intermediate
• Certificate of DestructionA document from a disposal vendor confirming that media or devices were destroyed or sanitized.Foundational
• Certificate PinningAssociating a host with an expected certificate or public key so other valid-looking certificates are rejected.Advanced
• Certificate Revocation List (CRL)CA-signed list of serial numbers of certificates that have been revoked before their expiration date.Foundational
• Certificate Signing Request (CSR)Message sent to a CA containing a public key and subject information, signed with the requester's private key.Foundational
• Certificate Transparency (CT)Public, append-only logs of issued TLS certificates that let anyone monitor which certificates exist for a domain.Intermediate
• Certificate-Based Authentication (CBA)Authenticating a user or device by proving possession of the private key matching a trusted certificate.Intermediate
• Chain of CustodyDocumentation that records every person who handled evidence, when, why and how, from collection to presentation.Foundational
• Chain of TrustSequence of certificates from an end-entity certificate through intermediates to a trusted root CA.Foundational
• Challenge-Handshake Authentication Protocol (CHAP)PPP authentication protocol using a three-way challenge-response with a hash of a shared secret.Intermediate
• CIA TriadThe three core goals of information security: confidentiality, integrity, and availability.Foundational
• CipherAn algorithm that performs encryption and decryption.Foundational
• Cipher SuiteNamed combination of algorithms used by TLS for key exchange, authentication, bulk encryption, and hashing.Intermediate
• CiphertextThe unreadable, encrypted output of a cipher that requires the correct key to decrypt.Foundational
• CIS BenchmarksConsensus-based secure configuration guides for operating systems, cloud platforms, applications, and devices.Foundational
• CIS Critical Security Controls (CIS Controls)Prioritized set of 18 cybersecurity safeguard groups from the Center for Internet Security.Foundational
• CIS Implementation Groups (IG)Three tiers (IG1, IG2, IG3) prioritizing CIS Controls safeguards by organizational risk and resources.Intermediate
• ClickjackingTricking a user into clicking something different from what they perceive by overlaying a transparent framed page.Foundational
• Client CertificateCertificate issued to a user or device to authenticate it to a server or network.Intermediate
• Client-Side ValidationInput checks performed in the browser or mobile app before data is sent to the server.Foundational
• Cloud Access Security Broker (CASB)Security policy enforcement point between users and cloud services that provides visibility, compliance, data security and threat protection.Intermediate
• Cloud MisconfigurationIncorrect or insecure setting of a cloud resource, such as public storage or overly permissive access, that creates security risk.Foundational
• Cloud Security Posture Management (CSPM)Tools that continuously assess cloud configurations against best practices and compliance frameworks to detect and fix misconfigurations.Intermediate
• Code ObfuscationTransforming code to make it harder to read and reverse engineer while preserving its behavior.Intermediate
• Code SigningDigitally signing software so users and systems can verify its publisher and that it has not been modified.Foundational
• Code Signing CertificateCertificate used to digitally sign software so users can verify its publisher and integrity.Intermediate
• Cold SiteAn alternate facility with basic infrastructure such as power and space but no ready equipment or data.Foundational
• Column-Level EncryptionEncrypting specific database columns so sensitive fields remain protected even from users with table access.Intermediate
• Command and Control (C2)Infrastructure and channels attackers use to communicate with and control compromised systems.Intermediate
• Command InjectionInjecting operating system commands through an application input that is passed to a system shell.Intermediate
• Common Vulnerabilities and Exposures (CVE)A public dictionary of unique identifiers for publicly disclosed cybersecurity vulnerabilities.Foundational
• Common Vulnerability Scoring System (CVSS)An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.Foundational
• Common Weakness Enumeration (CWE)A community-developed catalog of software and hardware weakness types, maintained by MITRE.Intermediate
• Communication PlanThe part of the IR plan defining who is notified, how, when and by whom during an incident.Foundational
• Community StringA shared password-like string used for access control in SNMPv1 and SNMPv2c, sent in clear text.Intermediate
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• ComplianceConforming to laws, regulations, contracts, standards, and internal policies.Foundational
• Concurrent Session UsageAn indicator where the same account has simultaneous active sessions from different devices or locations.Foundational
• ConfidentialitySecurity goal ensuring information is disclosed only to authorized people, processes, or systems.Foundational
• Constrained Application Protocol (CoAP)A lightweight REST-like UDP protocol (RFC 7252) for constrained IoT devices, secured with DTLS or OSCORE.Advanced
• Container EscapeBreaking out of a container's isolation to gain access to the host or other containers.Advanced
• Container Image HardeningBuilding container images with minimal contents, non-root users and no secrets to reduce attack surface.Intermediate
• Container Image ScanningScanning container images for vulnerable OS packages and libraries, misconfigurations, secrets and malware before and after deployment.Intermediate
• ContainmentThe incident response phase that limits the spread and impact of an incident while preserving evidence.Foundational
• Content Security Policy (CSP)An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.Intermediate
• Context-Aware AuthenticationAuthentication that evaluates contextual signals such as location, device, time, and behavior.Intermediate
• Continuity of Operations Planning (COOP)A US federal government term for planning that ensures essential functions continue during a wide range of emergencies.Intermediate
• Continuous MonitoringMaintaining ongoing awareness of security, vulnerabilities, and threats to support risk decisions.Intermediate
• Control BaselinePredefined set of controls serving as a starting point for protecting a system at a given impact level.Intermediate
• Control DiversityCombining different types of controls, such as technical, administrative, and physical, to protect an asset.Intermediate
• Control TailoringModifying a control baseline to align with the organization's mission, environment, and risk.Intermediate
• Coordinated Vulnerability Disclosure (CVD)A disclosure model where a researcher privately reports a flaw and publication is delayed until the vendor can release a fix.Intermediate
• Corporate-Owned, Personally Enabled (COPE)A deployment model where the organization owns the device but allows reasonable personal use.Foundational
• Corrective ControlControl that reduces the impact of an event or restores systems after it occurs.Foundational
• Counter Mode with CBC-MAC Protocol (CCMP)The AES-based 802.11i encryption protocol using CTR mode for confidentiality and CBC-MAC for integrity.Intermediate
• Credential GuardA Windows security feature that uses virtualization-based security to isolate credential secrets from the operating system.Advanced
• Credential HarvestingCollecting usernames and passwords from victims, usually through fake login pages or malware.Foundational
• Credential StuffingAutomated use of username-password pairs leaked from one breach to log in to other services.Intermediate
• Credentialed ScanA vulnerability scan that logs in to targets with valid credentials to assess installed software and configurations accurately.Foundational
• Cross-Origin Resource Sharing (CORS)A browser mechanism using HTTP headers that lets a server allow specific other origins to read its responses.Intermediate
• Cross-Site Request Forgery (CSRF)An attack that tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in.Intermediate
• Cross-Site Scripting (XSS)An attack that injects malicious script into web pages viewed by other users, executing in their browsers.Foundational
• Crossover Error Rate (CER)Point where a biometric system's FAR equals its FRR; lower CER means a more accurate system.Intermediate
• Crowdsourced Security TestingEngaging many independent researchers through a managed platform to find vulnerabilities, via bug bounties or private vulnerability programs.Intermediate
• Crypto-ShreddingRendering encrypted data unrecoverable by securely destroying the encryption keys.Intermediate
• Cryptographic FailuresOWASP Top 10 category for failures to protect data with appropriate cryptography, formerly called Sensitive Data Exposure.Foundational
• Cryptographic KeyA secret or public value used by a cryptographic algorithm to transform data.Foundational
• CryptographyThe science of protecting information by transforming it so only intended parties can read or verify it.Foundational
• CryptojackingUnauthorized use of a victim's computing resources to mine cryptocurrency.Foundational
• CSF Detect FunctionCSF function for finding and analyzing possible cybersecurity attacks and compromises.Foundational
• CSF Govern Function (GV)CSF 2.0 function covering cybersecurity risk management strategy, expectations, policy, roles, oversight, and supply chain risk.Intermediate
• CSF Identify FunctionCSF function for understanding current cybersecurity risks to assets, suppliers, and the organization.Foundational
• CSF Implementation TiersFour levels describing the rigor of an organization's cybersecurity risk governance and management: Partial, Risk Informed, Repeatable, Adaptive.Intermediate
• CSF Protect FunctionCSF function covering safeguards to manage cybersecurity risk, such as identity management, training, and data security.Foundational
• CSF Recover Function (RC)CSF function for restoring assets and operations affected by a cybersecurity incident.Foundational
• CSF Respond Function (RS)CSF function for taking action regarding a detected cybersecurity incident.Foundational
• CVSS Base MetricsCVSS metrics describing a vulnerability's intrinsic exploitability and impact characteristics.Intermediate
• CVSS Environmental MetricsCVSS metrics that adjust a score for a specific organization's environment and security requirements.Advanced
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Cyber Threat Intelligence (CTI)Evidence-based knowledge about threats and threat actors that informs security decisions.Foundational
• Cyber Workforce QualificationDoD 8140 requirement that personnel in cyber work roles demonstrate foundational and residential qualification at a proficiency level.Intermediate
• Cyber-Physical System (CPS)A system that integrates computing, networking and physical processes so that digital actions have physical effects.Intermediate
• CycloneDXAn OWASP SBOM standard (ECMA-424) designed for security use cases, supporting software, hardware, services, cryptographic assets and VEX data.Intermediate
• DAD TriadThe opposite of the CIA triad: disclosure, alteration, and destruction (denial) of information.Foundational
• Dangling DNS RecordA DNS record that points to an IP address or cloud resource no longer owned or controlled by the organization.Intermediate
• Dark Web MonitoringWatching underground forums, marketplaces and leak sites for stolen data, credentials or threats targeting an organization.Intermediate
• Data at RestData stored on persistent media such as disks, databases, backups, or cloud object storage.Foundational
• Data BreachA security incident resulting in confirmed unauthorized access to or disclosure of sensitive data.Foundational
• Data Breach NotificationLegal or contractual obligations to inform regulators, affected individuals or partners after a qualifying data breach.Intermediate
• Data ClassificationCategorizing data by sensitivity and value to determine required protection and handling.Foundational
• Data ControllerEntity that determines the purposes and means of processing personal data.Foundational
• Data CustodianRole responsible for implementing and maintaining the controls that protect data on behalf of the data owner.Foundational
• Data Encryption Standard (DES)Legacy symmetric block cipher with a 64-bit block and 56-bit effective key, now insecure.Foundational
• Data Execution Prevention (DEP)A mitigation that marks memory regions such as the stack and heap as non-executable, using the CPU's NX/XD bit.Intermediate
• Data ExfiltrationThe unauthorized transfer of data out of an organization to an attacker-controlled location.Intermediate
• Data in TransitData moving across a network between systems, also called data in motion.Foundational
• Data in UseData actively being processed in memory or by a CPU, which is typically unencrypted during computation.Intermediate
• Data Loss Prevention (DLP)Technology that detects and blocks unauthorized transmission or storage of sensitive data.Foundational
• Data MaskingObscuring parts of sensitive data so it remains usable for some purposes without revealing the full value.Foundational
• Data MinimizationPrinciple of collecting and retaining only the personal data that is adequate, relevant, and necessary for a stated purpose.Foundational
• Data OwnerSenior individual accountable for a data set, including its classification, access approval, and protection requirements.Foundational
• Data PoisoningAn attack that corrupts training, fine-tuning or retrieval data to manipulate model behavior or implant backdoors.Intermediate
• Data ProcessorEntity that processes personal data on behalf of and under the instructions of a controller.Foundational
• Data Retention PolicyPolicy defining how long categories of data are kept and how they are disposed of when no longer needed.Foundational
• Data SovereigntyPrinciple that data is subject to the laws and governance of the country in which it is collected or stored.Foundational
• Data StewardRole responsible for data quality, metadata, and appropriate use of data according to policy.Intermediate
• Deauthentication AttackA wireless attack that sends forged 802.11 deauthentication frames to disconnect clients from an access point.Intermediate
• Deauthentication FrameA management notification frame that ends authentication and association.Intermediate
• Debug Mode in ProductionLeaving framework debug features, consoles or verbose diagnostics enabled on production systems.Foundational
• Deception TechnologySecurity tools that deploy decoys, lures and fake credentials throughout an environment to detect attackers.Intermediate
• DeepfakeSynthetic audio, video or images generated with AI to convincingly impersonate a real person.Intermediate
• Default CredentialsFactory-set usernames and passwords on applications, devices or services that are publicly documented.Foundational
• Defense in DepthLayering multiple, independent security controls so that the failure of one does not compromise the asset.Foundational
• Demilitarized Zone (DMZ)A network segment between an organization's internal network and the Internet that hosts public-facing services.Foundational
• Denial of Service (DoS)An attack that makes a system or network unavailable to legitimate users by exhausting resources or crashing services.Foundational
• Denylist ValidationInput validation that rejects values matching known-bad patterns and accepts everything else.Foundational
• Dependency ConfusionA supply chain risk in which a package manager installs a malicious public package instead of an internal private package with the same name.Intermediate
• DeprovisioningRemoving or disabling a user's accounts and access when they leave or no longer need it.Foundational
• Detection and AnalysisThe incident response phase focused on identifying potential incidents, validating them and determining scope and impact.Foundational
• Detective ControlControl that identifies and records an undesired event after or while it occurs.Foundational
• Deterrent ControlControl that discourages potential attackers or violators from attempting an action.Foundational
• Device Posture CheckEvaluating a device's security state, such as patch level, encryption, and EDR status, before granting access.Intermediate
• DevSecOpsThe integration of security practices and automated security testing into every stage of the DevOps pipeline.Intermediate
• Dictionary AttackA password attack that tries words from a list of common passwords and dictionary terms.Foundational
• Differential BackupA backup that copies all data changed since the last full backup, growing each day until the next full.Foundational
• Diffie-Hellman (DH)Key agreement protocol that lets two parties derive a shared secret over an insecure channel.Foundational
• Digital CertificateElectronic document signed by a CA that binds a public key to an identity such as a domain, person, or device.Foundational
• Digital ForensicsThe scientific collection, preservation, analysis and presentation of digital evidence in a legally defensible manner.Foundational
• Digital SignatureCryptographic value created with a private key over a message hash that proves origin, integrity, and non-repudiation.Foundational
• Directive ControlControl that specifies required behavior, such as policies, standards, and procedures.Foundational
• Directory ListingA web server setting that displays a list of files in a directory when no index file is present.Foundational
• Directory ServiceCentralized database that stores and organizes information about users, groups, devices, and resources for authentication and lookup.Foundational
• Directory TraversalAn attack that manipulates file paths with sequences like ../ to access files outside the intended directory.Foundational
• Disaster Recovery Plan (DRP)A documented plan for restoring IT systems, data and infrastructure after a disruptive event.Foundational
• Discretionary Access Control (DAC)Access control model where the owner of a resource decides who may access it.Foundational
• DisinformationDeliberately false or misleading information spread to deceive, often as part of an influence campaign.Foundational
• Distinguished Encoding Rules (DER)Binary encoding format for X.509 certificates and keys.Intermediate
• Distributed Control System (DCS)A process control system in which controllers are distributed throughout a single plant or facility under centralized supervision.Intermediate
• Distributed Denial of Service (DDoS)A denial-of-service attack launched from many sources, often a botnet, to overwhelm a target.Foundational
• DLL InjectionForcing a running process to load a malicious dynamic-link library.Advanced
• DNP3Distributed Network Protocol 3, an industrial protocol used mainly in electric and water utilities for communication between SCADA masters, RTUs and IEDs.Intermediate
• DNS AmplificationA reflected DDoS attack that abuses open DNS resolvers to send large responses to a spoofed victim address.Intermediate
• DNS Cache PoisoningInserting false records into a DNS resolver's cache so users are directed to malicious IP addresses.Intermediate
• DNS over HTTPS (DoH)Encrypting DNS queries inside HTTPS on TCP 443 to provide privacy from on-path observers.Intermediate
• DNS over TLS (DoT)Encrypting DNS queries with TLS on dedicated TCP port 853.Intermediate
• DNS SinkholeA DNS server configuration that returns a controlled IP for known malicious domains to block and identify infected hosts.Intermediate
• DNS TunnelingEncoding data or command-and-control traffic inside DNS queries and responses to bypass network controls.Advanced
• DoD 8570.01-MFormer DoD manual that required certifications for information assurance workforce categories, superseded by DoD 8140.Intermediate
• Domain HijackingTaking unauthorized control of a domain registration, often by compromising the registrar account.Intermediate
• Domain Name System Security Extensions (DNSSEC)DNS extensions that digitally sign records so resolvers can verify their authenticity and integrity.Intermediate
• Domain Validation Certificate (DV)Certificate issued after the CA verifies only that the requester controls the domain.Foundational
• Double ExtortionA ransomware tactic that both encrypts data and threatens to leak stolen copies unless a ransom is paid.Intermediate
• Downgrade AttackForcing a system to use an older, weaker protocol or cipher version that the attacker can exploit.Intermediate
• Drive-by DownloadAn unintended download of malicious code that occurs simply by visiting a compromised or malicious website.Foundational
• Due CareActing as a reasonable person would to protect assets, by implementing and maintaining appropriate safeguards.Foundational
• Due DiligenceInvestigation and analysis performed to understand risks before and while making decisions.Foundational
• Dumpster DivingSearching trash for discarded information or media that can aid an attack.Foundational
• Dynamic Application Security Testing (DAST)Testing a running application from the outside by sending crafted requests to find vulnerabilities.Intermediate
• E-DiscoveryThe process of identifying, preserving, collecting, reviewing and producing electronically stored information for legal proceedings.Intermediate
• Egress FilteringRestricting outbound network traffic from systems to only approved destinations and protocols.Intermediate
• Elastic Stack (ELK)A log and search platform made up of Elasticsearch, Logstash, Kibana, and Beats, commonly called the ELK stack.Foundational
• Electromagnetic LockLock that uses an electromagnet to hold a door closed, releasing when power is removed.Intermediate
• Elevation of Privilege (EoP)Gaining capabilities beyond those that were authorized, such as a normal user gaining administrative rights.Foundational
• Elliptic Curve Cryptography (ECC)Public key cryptography based on elliptic curve math, offering strong security with short keys.Intermediate
• Elliptic Curve Diffie-Hellman (ECDH)Diffie-Hellman key agreement performed with elliptic curve groups, providing equal security with smaller keys.Intermediate
• Elliptic Curve Digital Signature Algorithm (ECDSA)Digital signature algorithm using elliptic curve cryptography, standardized in FIPS 186-5.Intermediate
• Embedded System SecurityProtecting purpose-built computing devices with constrained resources, often running real-time operating systems and long-lived firmware.Intermediate
• Encapsulating Security Payload (ESP)IPsec protocol (IP protocol 50) that provides confidentiality, integrity, authentication, and anti-replay.Intermediate
• Encrypting File System (EFS)Windows NTFS feature that encrypts individual files and folders using certificate-protected keys.Intermediate
• EncryptionConverting plaintext into ciphertext using an algorithm and key so only authorized parties can read it.Foundational
• End-of-Life (EOL)The point at which a vendor stops selling, supporting, or patching a product.Foundational
• End-to-End Encryption for Meetings (E2EE)Meeting encryption in which media keys are known only to participants' endpoints, not to the meeting service provider.Advanced
• Endpoint Detection and Response (EDR)Security software that continuously records endpoint activity, detects malicious behavior and enables investigation and response.Foundational
• Endpoint Protection Platform (EPP)An endpoint security solution focused on preventing threats with antimalware, firewall, device control and exploit prevention.Foundational
• EntropyMeasure of randomness or unpredictability, critical for generating strong keys and passwords.Intermediate
• Envelope EncryptionEncrypting data with a data key and then encrypting that data key with a separate master key (key encryption key).Advanced
• Ephemeral KeyA key generated for a single session or transaction and discarded afterward.Intermediate
• EradicationThe incident response phase that removes the threat, including malware, backdoors and compromised accounts, from the environment.Foundational
• ETSI EN 303 645A European standard setting baseline cybersecurity provisions for consumer IoT devices.Advanced
• Evidence IntegrityAssurance that evidence has not been altered since collection, typically demonstrated by cryptographic hashes.Foundational
• Evil TwinA malicious wireless access point that impersonates a legitimate SSID to lure clients into connecting.Foundational
• Executive Order 14028The May 2021 U.S. order 'Improving the Nation's Cybersecurity' that drove federal SBOM and secure development attestation requirements.Intermediate
• ExploitCode or a technique that takes advantage of a vulnerability to cause unintended behavior, such as code execution.Foundational
• Exploit KitA toolkit hosted on malicious or compromised websites that automatically probes visitors' browsers for vulnerabilities and delivers malware.Intermediate
• Exposure Factor (EF)Percentage of an asset's value expected to be lost if a specific threat event occurs.Foundational
• Extended Detection and Response (XDR)A security platform that correlates telemetry across endpoints, network, cloud, identity and email for unified detection and response.Intermediate
• Extended Validation Certificate (EV)Certificate issued after the most rigorous CA vetting of an organization's legal, physical, and operational existence.Intermediate
• Extensible Authentication Protocol (EAP)Authentication framework supporting multiple methods, used with 802.1X, PPP, and wireless networks.Intermediate
• Extensible Authentication Protocol-Transport Layer Security (EAP-TLS)EAP method using mutual certificate authentication between client and server.Intermediate
• Fail-OpenFailure mode where a system allows access or traffic to continue when it fails, favoring availability.Intermediate
• Fail-SafeFailure mode that defaults to a state protecting human life, often unlocking doors when power fails.Foundational
• Fail-Safe DefaultsBase access decisions on explicit permission rather than exclusion, so the default is no access.Intermediate
• Fail-SecureFailure mode where a system defaults to a locked or denied state, protecting assets when it fails.Foundational
• FailoverAutomatic or manual switching to a redundant or standby system when the primary fails.Foundational
• False Acceptance Rate (FAR)Biometric error rate at which unauthorized users are incorrectly accepted; a Type II error.Intermediate
• False Negative (FN)A failure to alert on activity that is actually malicious.Foundational
• False Positive (FP)An alert that flags benign activity as malicious.Foundational
• False Rejection Rate (FRR)Biometric error rate at which legitimate users are incorrectly rejected; a Type I error.Intermediate
• Faraday CageEnclosure of conductive material that blocks electromagnetic fields and radio signals.Intermediate
• Fault ToleranceAbility of a system to continue operating without interruption when one or more components fail.Intermediate
• Federal Information Processing Standard 140-3 (FIPS 140-3)US/Canadian standard for validating cryptographic modules at four increasing security levels.Advanced
• Federal Information Security Modernization Act (FISMA)US law requiring federal agencies to develop, document, and implement agency-wide information security programs.Foundational
• FederationTrust relationship letting identities from one domain access resources in another without separate accounts.Intermediate
• FedRAMPFederal Risk and Authorization Management Program, the US government-wide approach to security assessment and authorization of cloud services.Intermediate
• FIDO2FIDO Alliance and W3C standard for phishing-resistant, public key-based passwordless authentication.Intermediate
• File HashA fixed-length value computed from file content by a hash function, used to identify files and verify integrity.Foundational
• File Transfer Protocol Secure (FTPS)FTP secured with TLS, either explicitly via AUTH TLS on port 21 or implicitly on ports 990 (control) and 989 (data).Intermediate
• File-Level EncryptionEncrypting individual files rather than entire volumes, so protection can travel with the file.Foundational
• Fileless MalwareMalware that runs in memory and abuses legitimate system tools instead of writing malicious executables to disk.Intermediate
• FileVaultApple macOS full disk encryption feature using XTS-AES-128 with a 256-bit key.Foundational
• FIPS 199Federal standard for categorizing information and systems by potential impact (low, moderate, high) on confidentiality, integrity, and availability.Intermediate
• Fire Suppression SystemSystem that detects and extinguishes fires, chosen to match fire classes and protect people and equipment.Intermediate
• FirewallA device or software that permits or denies traffic between networks or hosts according to a security policy.Foundational
• firewalldThe dynamic host firewall manager on RHEL and Fedora that uses zones and services on top of nftables.Intermediate
• Forensic ImageA bit-for-bit copy of a storage device, including unallocated space and slack, used for analysis instead of the original.Foundational
• Forward SecrecyA property ensuring that compromise of a long-term secret does not expose past session keys.Intermediate
• Four-Way HandshakeThe EAPOL-Key exchange that confirms the PMK and derives the PTK and delivers the GTK.Intermediate
• Full BackupA backup that copies all selected data regardless of when it last changed.Foundational
• Full Disk Encryption (FDE)Encrypting an entire storage device, including the OS and free space, so data is unreadable without authentication.Foundational
• Full Interruption TestA disaster recovery test that shuts down the primary site and moves operations completely to the recovery site.Intermediate
• Fuzz TestingAn automated testing technique that feeds large volumes of malformed, unexpected or random input to a program to find crashes and bugs.Foundational
• Galois/Counter Mode (GCM)Authenticated block cipher mode combining counter mode encryption with Galois field authentication (GHASH).Intermediate
• Gap AnalysisComparison of current state with a desired state or requirement to identify deficiencies and actions.Foundational
• GDPR Administrative FinesTwo-tier GDPR penalty structure: up to 10 million euros or 2 percent, or up to 20 million euros or 4 percent of global annual turnover.Intermediate
• General Data Protection Regulation (GDPR)EU regulation (2016/679), applicable since 25 May 2018, governing processing of personal data of individuals in the EU/EEA.Foundational
• GeofencingUsing a device's geographic location to create virtual boundaries that trigger security policies.Foundational
• GNU Privacy Guard (GPG)Free, open-source implementation of the OpenPGP standard.Foundational
• Google DorkingUsing advanced search engine operators to find sensitive information or vulnerable systems indexed by search engines.Foundational
• Governance, Risk, and Compliance (GRC)Integrated approach to aligning IT and security with business objectives, managing risk, and meeting legal and regulatory requirements.Foundational
• Gramm-Leach-Bliley Act (GLBA)1999 US law requiring financial institutions to protect customers' nonpublic personal information and disclose privacy practices.Intermediate
• Gratuitous ARP (GARP)An unsolicited ARP message in which a host announces its own IP-to-MAC mapping.Intermediate
• Gray-Box TestingTesting with partial knowledge of the target, such as user-level credentials or limited documentation; CompTIA's partially known environment.Foundational
• Group PolicyWindows Active Directory feature for centrally applying security and configuration settings to users and computers.Intermediate
• Guest NetworkA WLAN that provides visitors with internet-only access isolated from internal resources.Foundational
• GuidelineRecommended, non-mandatory advice for implementing policies and standards when no specific standard applies.Foundational
• HacktivistA threat actor who attacks to promote a political, social or ideological cause rather than for profit.Foundational
• Hard-Coded CredentialsPasswords, API keys or cryptographic keys embedded directly in source code, scripts or binaries.Foundational
• HardeningReducing a system's attack surface by removing unnecessary functions and applying secure configurations.Foundational
• Hardware Debug InterfacePhysical interfaces such as JTAG, SWD and UART used during development that can expose device memory, firmware and consoles.Advanced
• Hardware Security KeyPhysical token, such as a USB or NFC key, that performs FIDO2 or U2F authentication.Foundational
• Hardware Security Module (HSM)Tamper-resistant hardware device that generates, stores, and uses cryptographic keys without exposing them.Foundational
• Hash CollisionWhen two different inputs produce the same hash digest.Intermediate
• Hash FunctionOne-way function that maps input of any size to a fixed-size digest, used to verify integrity.Foundational
• Hash-Based Message Authentication Code (HMAC)MAC construction that combines a cryptographic hash function with a secret key (RFC 2104).Intermediate
• Health Insurance Portability and Accountability Act (HIPAA)1996 US law whose administrative simplification rules protect the privacy and security of protected health information.Foundational
• Heap-Based Buffer OverflowWriting beyond the bounds of memory allocated on the heap, corrupting adjacent data or allocator metadata.Advanced
• HeartbleedA 2014 OpenSSL vulnerability (CVE-2014-0160) in the TLS heartbeat extension that let attackers read up to 64 KB of server memory per request.Foundational
• Hidden SSIDConfiguring an AP not to include its SSID in beacons, also called SSID cloaking.Foundational
• High Availability (HA)Design goal of keeping a system operational and accessible for a high percentage of time by eliminating single points of failure.Foundational
• High-Water MarkPrinciple that a system's overall impact level equals the highest impact level of any security objective or information type it handles.Intermediate
• HIPAA Security RuleHIPAA rule requiring administrative, physical, and technical safeguards for electronic PHI.Intermediate
• HMAC-Based One-Time Password (HOTP)OTP algorithm (RFC 4226) that generates codes from a shared secret and an incrementing counter.Intermediate
• Homomorphic EncryptionEncryption that allows computation on ciphertext, producing encrypted results that decrypt to the correct answer.Advanced
• HoneyfileA decoy file, often with an enticing name, that triggers an alert when accessed.Foundational
• HoneynetA network of honeypots that simulates a realistic environment to observe attacker behavior.Foundational
• HoneypotA decoy system designed to attract attackers, detect intrusion attempts and study their techniques.Foundational
• HoneytokenA fake credential, record or data item planted to detect unauthorized access or use.Intermediate
• Host-Based FirewallSoftware firewall running on an individual endpoint that filters traffic to and from that host.Foundational
• Hot SiteA fully equipped alternate facility with current systems and data that can take over operations almost immediately.Foundational
• HTTP Security HeadersResponse headers that enable browser security features such as HSTS, CSP, frame restrictions and MIME sniffing protection.Intermediate
• HTTP Strict Transport Security (HSTS)HTTP response header instructing browsers to connect to a site only over HTTPS for a set time.Intermediate
• HttpOnly Cookie AttributeA cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.Foundational
• Human-Machine Interface (HMI)The software and screens operators use to view process status and issue commands to an industrial control system.Foundational
• Hybrid CryptosystemSystem that uses asymmetric cryptography to exchange a symmetric key, then symmetric encryption for bulk data.Foundational
• Hypertext Transfer Protocol Secure (HTTPS)HTTP carried inside TLS encryption, using TCP port 443 by default (and UDP 443 for HTTP/3).Foundational
• IdentificationThe act of a subject claiming an identity, such as entering a username, before it is authenticated.Foundational
• Identification and Authentication FailuresOWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.Foundational
• Identity and Access Management (IAM)Policies, processes, and technologies for managing digital identities and controlling their access to resources.Foundational
• Identity Lifecycle ManagementManaging identities from creation through role changes to removal, often called joiner-mover-leaver.Intermediate
• Identity ProofingVerifying that a person is who they claim to be before issuing credentials.Intermediate
• Identity Provider (IdP)System that authenticates users and issues identity assertions or tokens to relying applications.Foundational
• IEEE 802.11i2004 security amendment defining Robust Security Networks with CCMP/AES, TKIP, and 802.1X/PSK key management.Intermediate
• IEEE 802.11wAmendment that protects selected management frames such as deauthentication and disassociation.Intermediate
• IEEE 802.1XPort-based network access control standard that authenticates devices before allowing traffic on wired or wireless networks.Foundational
• Immutable BackupA backup that cannot be modified or deleted for a defined retention period, even by administrators.Intermediate
• ImpactThe magnitude of harm or consequence if a risk event occurs.Foundational
• ImpersonationPretending to be another person or role, such as an executive, technician or vendor, to gain trust or access.Foundational
• Implicit DenyDefault rule that blocks any traffic or access not explicitly permitted.Foundational
• Implicit Trust ZoneArea behind a policy enforcement point where entities are trusted to the last enforcement check.Advanced
• Impossible TravelDetection that flags sign-ins from geographically distant locations within a time too short for real travel.Intermediate
• Improper Credential UsageMobile Top 10 2024 risk (M1) covering hard-coded credentials, insecure credential transmission and storage, and weak authentication of the app to backends.Foundational
• Incident Response (IR)The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.Foundational
• Incident Response Plan (IRP)A documented set of policies, roles and procedures guiding how an organization responds to security incidents.Foundational
• Incident Response Team (CSIRT)The group responsible for handling security incidents, also called a computer security incident response team.Foundational
• Incident SeverityA classification of an incident's urgency and impact used to prioritize response and escalation.Foundational
• Incremental BackupA backup that copies only data changed since the last backup of any type, minimizing backup time and storage.Foundational
• Indicator of Compromise (IoC)Forensic evidence that a system or network has likely been breached, such as malicious hashes, IPs, domains or registry keys.Foundational
• Industrial Control System (ICS)A general term for control systems (SCADA, DCS, PLC-based systems) used to operate industrial processes.Foundational
• Information DisclosureExposure of information to someone not authorized to see it.Foundational
• Information Rights Management (IRM)Technology that applies persistent usage restrictions to documents and emails wherever they travel.Intermediate
• Information Sharing and Analysis Center (ISAC)A sector-based organization that facilitates sharing of threat information among member companies.Foundational
• InfostealerMalware designed to harvest credentials, browser cookies, crypto wallets and other sensitive data from infected systems.Intermediate
• Infrastructure as Code ScanningStatic analysis of Terraform, CloudFormation, Kubernetes manifests, Helm charts and similar templates for security misconfigurations before deployment.Intermediate
• Inherence FactorAuthentication factor based on something the user is, such as a fingerprint, face, iris, or voice.Foundational
• Inherent RiskLevel of risk before any controls or treatments are applied.Intermediate
• Initialization Vector (IV)A random or unique value combined with a key to ensure the same plaintext encrypts to different ciphertext.Intermediate
• InjectionOWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.Foundational
• Input ValidationChecking that all untrusted input conforms to expected type, length, format and range before it is processed.Foundational
• Insecure Communication (Mobile)Mobile Top 10 risk (M5) where an app transmits data without strong transport security or validates certificates improperly.Foundational
• Insecure Data Storage (Mobile)Storing sensitive data on a mobile device in a way that other apps, backups or someone with physical access can read.Foundational
• Insecure DeserializationDeserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.Intermediate
• Insecure DesignOWASP Top 10 category for flaws rooted in missing or ineffective security controls at the design level rather than implementation bugs.Intermediate
• Insecure Direct Object Reference (IDOR)An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.Foundational
• Insecure Password RecoveryWeak account recovery flows that let attackers reset other users' passwords.Intermediate
• Insecure RandomnessUsing a predictable random number generator for security-sensitive values such as tokens, keys or nonces.Intermediate
• Insider ThreatA risk posed by a current or former employee, contractor or partner who misuses authorized access, maliciously or by accident.Foundational
• IntegritySecurity goal ensuring data and systems are accurate, complete, and not altered by unauthorized parties.Foundational
• Interactive Application Security Testing (IAST)Security testing that uses agents instrumented inside a running application to observe code execution and data flow during functional tests.Intermediate
• Intermediate Certificate AuthorityA subordinate CA whose certificate is signed by a root or another intermediate and that issues end-entity certificates.Foundational
• Internet Key Exchange (IKE)Protocol that negotiates IPsec security associations and keys, using UDP 500 and UDP 4500 for NAT traversal.Advanced
• Internet of Things (IoT)Networked sensors, actuators, and devices that collect data and interact with the physical world.Foundational
• Internet of Things SecurityPractices for protecting connected devices with limited resources, long lifespans, and often weak default security.Intermediate
• Internet Protocol Security (IPsec)Suite of protocols that authenticates and encrypts IP packets, used mainly for site-to-site and remote-access VPNs.Intermediate
• Intrusion Detection System (IDS)System that monitors network or host activity and alerts on suspicious or malicious behavior without blocking it.Foundational
• Intrusion Prevention System (IPS)Inline security system that detects and actively blocks malicious traffic in real time.Foundational
• IP Phone HardeningDisabling unnecessary features on IP phones, such as PC port access, web access and gratuitous ARP, to reduce attack surface.Intermediate
• IP SpoofingForging the source IP address of packets to hide the sender's identity or impersonate another system.Intermediate
• iptablesThe legacy Linux packet-filtering command that manages netfilter tables and chains such as INPUT, OUTPUT and FORWARD.Intermediate
• IsolationSeparating processes, systems, or networks so that compromise of one does not affect others.Foundational
• JailbreakingRemoving iOS restrictions to gain root access and install unauthorized software.Foundational
• Job RotationPeriodically moving staff between roles to reduce fraud risk, detect misuse, and cross-train employees.Foundational
• JSON Web Token (JWT)A compact, URL-safe token format consisting of a base64url-encoded header, payload of claims, and signature.Intermediate
• Jump ServerHardened intermediary host used to access and manage devices in a secure zone.Intermediate
• Just-in-Time Access (JIT Access)Granting elevated privileges only when needed and only for a limited time, removing standing privileges.Intermediate
• KerberosTicket-based network authentication protocol using a trusted KDC and symmetric cryptography.Intermediate
• Key EscrowStoring a copy of cryptographic keys with a trusted third party so they can be recovered if needed.Intermediate
• Key ExchangeProcess by which parties establish a shared cryptographic key, by key transport or key agreement.Foundational
• Key LengthThe size of a cryptographic key in bits, which determines the size of the key space and resistance to brute force.Foundational
• Key ManagementPractices and systems for securely generating, distributing, storing, rotating, and destroying cryptographic keys.Foundational
• Key Management Service (KMS)Managed cloud service for creating, storing, controlling, and auditing cryptographic keys.Intermediate
• Key Recovery AgentDesignated person or account authorized to recover encrypted data or archived private keys.Intermediate
• Key Reinstallation Attack (KRACK)2017 attack that tricks clients into reinstalling an in-use key, resetting nonces and enabling decryption.Advanced
• Key RotationReplacing cryptographic keys with new ones on a schedule or after suspected compromise.Intermediate
• Key StretchingTechnique that makes a weak key or password more resistant to brute force by applying many computational rounds.Foundational
• KeyloggerSoftware or hardware that records keystrokes to capture passwords and other sensitive input.Foundational
• Knowledge FactorAuthentication factor based on something the user knows, such as a password, PIN, or passphrase.Foundational
• Known Exploited Vulnerabilities Catalog (KEV)CISA's authoritative list of vulnerabilities confirmed to be actively exploited in the wild.Intermediate
• Lateral MovementTechniques attackers use to move from one compromised system to others within a network.Intermediate
• Layered SecuritySynonym for defense in depth: multiple overlapping security measures protecting the same asset.Foundational
• Least PrivilegePrinciple of granting users and processes only the minimum access rights needed to perform their tasks.Foundational
• Legal HoldA directive to preserve all potentially relevant information when litigation or investigation is reasonably anticipated.Foundational
• Lessons LearnedA review conducted after an incident to identify what happened, what worked, what failed and how to improve.Foundational
• Lightweight CryptographyCryptographic algorithms designed for constrained devices with limited power, memory, and processing.Advanced
• Lightweight Directory Access Protocol (LDAP)A protocol for querying and modifying directory services such as Active Directory, using TCP/UDP port 389.Foundational
• Lightweight Directory Access Protocol over SSL (LDAPS)LDAP secured with TLS on TCP port 636 to protect directory queries and credentials.Foundational
• LikelihoodThe chance or probability that a risk event will occur within a time frame.Foundational
• Linux Unified Key Setup (LUKS)Standard Linux disk encryption format built on dm-crypt that supports multiple passphrase key slots.Intermediate
• Living off the Land (LotL)An attacker technique of using tools already present on the target system to blend in and avoid detection.Intermediate
• Load BalancerA device or service that distributes client requests across multiple servers to improve performance and availability.Foundational
• Log AggregationCollecting logs from many systems into a central store for search, correlation, retention, and alerting.Foundational
• Log RetentionPolicy defining how long logs are stored, balancing investigation needs, compliance requirements and cost.Intermediate
• Log TamperingModifying, deleting or disabling logs to hide malicious activity.Intermediate
• Log4ShellA critical 2021 remote code execution vulnerability (CVE-2021-44228) in Apache Log4j 2 caused by JNDI lookups in logged strings.Foundational
• Logic BombMalicious code that lies dormant until a specific condition, such as a date or event, triggers its payload.Foundational
• Login BannerWarning message displayed before or at sign-in stating that use is monitored and unauthorized access is prohibited.Foundational
• MAC Address RandomizationClient privacy feature that uses random MAC addresses for scanning or per network.Intermediate
• MAC Authentication Bypass (MAB)Authenticating a device by sending its MAC address to RADIUS when it cannot perform 802.1X.Intermediate
• MAC FloodingOverwhelming a switch's MAC address table with fake entries so it floods frames to all ports like a hub.Intermediate
• Macro VirusA virus written in a macro language, such as VBA, embedded in documents and executed when the document is opened.Foundational
• Malicious PackageAn open-source package intentionally published or modified to perform harmful actions such as stealing credentials or installing backdoors.Intermediate
• MalvertisingThe use of online advertising to deliver malware or redirect users to malicious sites.Intermediate
• MalwareMalicious software designed to damage, disrupt, spy on or gain unauthorized access to systems or data.Foundational
• Malware SandboxAn isolated, instrumented environment where suspicious files or URLs are executed safely to observe behavior.Intermediate
• Man-in-the-Browser (MitB)An attack in which malware inside the browser intercepts and modifies web content and transactions.Intermediate
• Managed Security Service Provider (MSSP)A third party that delivers outsourced security monitoring and management services.Foundational
• Managerial ControlControl category focused on governance and risk management activities such as policies, assessments, and planning.Foundational
• Mandatory Access Control (MAC)Access control model where a central authority enforces access based on security labels and clearances.Foundational
• Mandatory VacationPolicy requiring employees to take consecutive days off so others can perform their duties and uncover fraud.Foundational
• Maximum Tolerable Downtime (MTD)The longest period a business function can be unavailable before causing unacceptable or irrecoverable harm.Intermediate
• Mean Time Between Failures (MTBF)The average operating time between failures of a repairable system, a measure of reliability.Foundational
• Mean Time to Detect (MTTD)The average time between when an incident begins and when it is detected.Foundational
• Mean Time to Repair (MTTR)The average time required to repair a failed component or system and return it to service.Foundational
• Measured BootBoot process that records hashes of each component into the TPM so the boot state can be verified later.Advanced
• Media SanitizationRemoving data from storage so it cannot be recovered, using clear, purge, or destroy methods.Intermediate
• Meeting HijackingUnauthorized entry into an online meeting to disrupt, eavesdrop or share offensive content, also called meeting bombing.Foundational
• Memory InjectionInserting malicious code into the memory space of a running process to execute it under that process's context.Advanced
• Memory-Safe LanguageA programming language that prevents memory errors such as buffer overflows and use-after-free by design.Intermediate
• Message Authentication Code (MAC)Short tag computed with a shared secret key that verifies a message's integrity and origin.Intermediate
• Message Digest 5 (MD5)Legacy 128-bit hash function that is broken for collision resistance.Foundational
• MFA Fatigue AttackRepeatedly sending MFA push requests to a user with stolen credentials until they approve one.Intermediate
• Micro-SegmentationA security approach that applies fine-grained firewall policies between individual workloads, even within the same subnet.Intermediate
• MicrosegmentationDividing networks into very small, workload-level zones with granular policies controlling east-west traffic.Intermediate
• Microsoft Challenge Handshake Authentication Protocol version 2 (MSCHAPv2)A password-based challenge-response protocol commonly used as the inner method of PEAP.Intermediate
• MiraiAn IoT botnet malware family that spreads by logging in to devices with default credentials and launches massive DDoS attacks.Intermediate
• Mishandling of Exceptional ConditionsOWASP Top 10 2025 category (A10) for improper error handling, failing open and logic errors under abnormal conditions.Intermediate
• Missing LogsAn indicator of compromise where expected log data is absent, suggesting tampering or deliberate clearing.Intermediate
• Mission-Essential Function (MEF)A business function that must continue or be quickly restored for the organization to fulfill its mission.Foundational
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• Mobile App SandboxOperating system isolation that restricts each mobile app to its own data and resources unless granted permissions.Foundational
• Mobile Device Management (MDM)Centralized management of phones, tablets, and computers to enforce policies, deploy apps, and secure data.Foundational
• ModbusA simple master/slave (client/server) industrial communication protocol created by Modicon in 1979, widely used to read and write PLC registers.Foundational
• Mode of OperationA method that defines how a block cipher repeatedly applies its transformation to encrypt data longer than one block.Intermediate
• MQTT SecurityProtecting the MQTT publish/subscribe messaging protocol widely used by IoT devices.Intermediate
• Multifactor Authentication (MFA)Authentication requiring two or more factors from different categories.Foundational
• MultitenancyArchitecture where multiple customers (tenants) share the same physical infrastructure or application instance with logical isolation.Foundational
• Mutual TLS (mTLS)TLS in which both client and server present and verify certificates, providing two-way authentication and encryption.Intermediate
• NAT Traversal (NAT-T)Techniques that let protocols which embed addresses or lack ports, such as IPsec and VoIP, work through NAT devices.Intermediate
• Nation-State ActorA threat actor sponsored or directed by a government, with high sophistication, funding and strategic goals.Foundational
• National Vulnerability Database (NVD)The US government repository, maintained by NIST, that enriches CVE records with CVSS scores, CWE and CPE data.Foundational
• Near Field Communication (NFC)Very short-range (about 4 cm) 13.56 MHz wireless communication used for payments, access badges, and pairing.Foundational
• Negative TestingTesting how software behaves with invalid, unexpected or malicious input and conditions.Foundational
• NessusA widely used commercial vulnerability scanner from Tenable that uses plugins to detect vulnerabilities and misconfigurations.Foundational
• Network Access Control (NAC)Technology that authenticates and checks devices before granting network access, enforcing policy at the edge.Foundational
• Network SegmentationDividing a network into separate zones, such as VLANs or subnets, with controlled traffic between them.Foundational
• Network Time Protocol (NTP)A protocol that synchronizes clocks across network devices and hosts, using UDP port 123.Foundational
• Next-Generation Antivirus (NGAV)Endpoint antimalware that uses machine learning, behavioral analysis and exploit prevention instead of relying solely on signatures.Foundational
• Next-Generation Firewall (NGFW)Firewall that adds application awareness, user identity, intrusion prevention, and threat intelligence to stateful inspection.Intermediate
• NIST Cybersecurity Framework (CSF)A NIST framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Foundational
• NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)Voluntary NIST framework (Feb 2024) organizing cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.Foundational
• NIST Definition of Cloud Computing (NIST SP 800-145)The NIST special publication that defines cloud computing via 5 essential characteristics, 3 service models and 4 deployment models.Foundational
• NIST SP 800-53NIST catalog of security and privacy controls for information systems and organizations.Intermediate
• NIST SP 800-61The NIST publication providing guidance on computer security incident handling and response.Intermediate
• NISTIR 8259NIST's foundational guidance on cybersecurity activities and capabilities that IoT device manufacturers should provide.Advanced
• NmapA widely used open-source network scanner for host discovery, port scanning, service detection and OS fingerprinting.Intermediate
• Non-Credentialed ScanA vulnerability scan performed without logging in, seeing only what is exposed over the network.Foundational
• Non-Disclosure Agreement (NDA)A legally binding contract that obligates parties to keep shared confidential information secret.Foundational
• Non-repudiationAssurance that a party cannot credibly deny having performed an action, such as sending a message or signing a document.Foundational
• NonceA 'number used once' that ensures uniqueness in a cryptographic operation to prevent replay and keystream reuse.Intermediate
• NotPetyaA 2017 destructive wiper disguised as ransomware that spread from a compromised Ukrainian accounting software update.Intermediate
• NT LAN Manager (NTLM)Legacy Microsoft challenge-response authentication protocol, now deprecated in favor of Kerberos.Intermediate
• Number MatchingPush MFA enhancement requiring the user to enter a number shown on the sign-in screen into the authenticator app.Intermediate
• OAuth 2.0An authorization framework that lets applications obtain limited, delegated access tokens to APIs without handling user passwords.Intermediate
• ObfuscationMaking data or code difficult to understand without changing its function, to hinder analysis.Foundational
• OCSP StaplingTLS feature where the server fetches and attaches a signed OCSP response to its handshake.Intermediate
• Offline Root CAA root certificate authority kept powered off or disconnected from networks to protect its private key.Intermediate
• On-Path AttackAn attack in which the adversary positions themselves between two communicating parties to intercept or alter traffic.Foundational
• One-Time Password (OTP)Password valid for only one login session or transaction, generated by a token, app, or service.Foundational
• Online Certificate Status Protocol (OCSP)Protocol (RFC 6960) for querying the real-time revocation status of a single certificate.Intermediate
• Open RedirectA flaw where an application redirects users to a URL supplied in a parameter without validation.Foundational
• Open-Source Intelligence (OSINT)Intelligence collected from publicly available sources such as websites, social media, public records and search engines.Foundational
• OpenID Connect (OIDC)Identity layer on top of OAuth 2.0 that authenticates users and returns an ID token.Intermediate
• Operational ControlControl category primarily implemented and executed by people rather than systems.Foundational
• Operational Technology (OT)Hardware and software that monitor and control physical devices, processes and infrastructure, such as in manufacturing, utilities and transportation.Foundational
• Opportunistic Wireless Encryption (OWE)Standard (RFC 8110) providing encryption without authentication on open networks; certified as Wi-Fi Enhanced Open.Intermediate
• Order of VolatilityThe sequence for collecting evidence from most to least volatile so short-lived data is not lost.Foundational
• Organization Validation Certificate (OV)Certificate issued after the CA verifies domain control and the legal existence of the requesting organization.Intermediate
• Organized Crime GroupA structured criminal enterprise that conducts cyberattacks primarily for financial gain.Foundational
• OS Command Injection PreventionDefenses that prevent user input from being executed as operating system commands.Intermediate
• Out-of-Band CommunicationCommunication through channels separate from potentially compromised production systems during an incident.Intermediate
• Out-of-Band Key ExchangeDelivering keys through a separate channel from the one the keys will protect.Intermediate
• Out-of-Band Management (OOB)Managing network devices through a dedicated path separate from production data traffic.Intermediate
• Out-of-Cycle LoggingLog entries generated at unusual times or outside expected patterns, indicating possible malicious activity.Foundational
• Output EncodingConverting untrusted data into a safe representation for the specific context where it is output, such as HTML, JavaScript, URL or SQL.Foundational
• OWASP API Security Top 10OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.Foundational
• OWASP Application Security Verification Standard (ASVS)An OWASP standard listing testable security requirements for web applications and services at three verification levels.Intermediate
• OWASP IoT Top 10OWASP's 2018 list of the top security issues for Internet of Things devices and ecosystems.Foundational
• OWASP Mobile Application Security Verification Standard (MASVS)OWASP's standard of security requirements for mobile apps, organized into control groups and verified with the MASTG.Intermediate
• OWASP Mobile Top 10OWASP's list of the ten most critical security risks for mobile applications, last updated in 2024.Foundational
• OWASP Top 10OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.Foundational
• OWASP Top 10 for LLM ApplicationsOWASP's list of the most critical security risks for applications built on large language models.Intermediate
• Packet Capture (pcap)The recording of network packets for analysis, and the file format (pcap/pcapng) that stores them.Foundational
• Packet-Filtering FirewallStateless firewall that allows or denies individual packets based on header information such as IP, port, and protocol.Foundational
• Parallel TestA disaster recovery test in which recovery systems are brought up at the alternate site and run alongside production without interrupting it.Intermediate
• Parameterized QueryA query that uses placeholders for input values that are bound separately, so the input is never treated as SQL code.Intermediate
• Pass-the-Hash (PtH)Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.Advanced
• Passive ReconnaissanceGathering information about a target without directly interacting with its systems.Foundational
• PasskeyFIDO2 discoverable credential that replaces passwords, either synced across devices or bound to one device.Intermediate
• Password Authentication Protocol (PAP)Legacy PPP authentication protocol that sends usernames and passwords in cleartext.Foundational
• Password HashingStoring passwords as salted, slow, one-way hashes rather than plaintext or reversible encryption.Intermediate
• Password ManagerApplication that generates, stores, and autofills strong unique passwords in an encrypted vault.Foundational
• Password PolicyRules governing password creation, storage, and use, now guided by NIST SP 800-63B.Foundational
• Password SprayingTrying a few common passwords against many accounts to avoid lockout thresholds.Intermediate
• Password-Based Key Derivation Function 2 (PBKDF2)Key derivation function that applies an HMAC many times with a salt to stretch a password.Intermediate
• Passwordless AuthenticationAuthentication methods that remove passwords, using cryptographic keys, biometrics, or possession factors instead.Intermediate
• Patch ManagementThe process of acquiring, testing, deploying and verifying software updates to fix vulnerabilities and defects.Foundational
• Path Traversal PreventionDefenses that stop user input from accessing files outside an intended directory.Intermediate
• Payment Card Industry Data Security Standard (PCI DSS)Industry standard with 12 requirements for protecting payment account data, maintained by the PCI Security Standards Council.Foundational
• PCI DSS Customized ApproachPCI DSS v4 option allowing entities to meet a requirement's stated objective with controls they design, validated by an assessor.Advanced
• PCI Security Standards Council (PCI SSC)Global forum founded by major card brands that develops and maintains PCI security standards.Intermediate
• Peer-to-Peer BlockingAn AP or controller setting that prevents wireless clients from communicating directly with each other.Intermediate
• Penetration TestingAn authorized, simulated attack on systems to find and safely exploit vulnerabilities before real attackers do.Foundational
• Penetration Testing PhasesThe typical sequence of a penetration test: planning and scoping, reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting.Foundational
• PepperA secret value added to passwords before hashing and stored separately from the password database.Intermediate
• Perfect Forward Secrecy (PFS)Property ensuring that compromise of long-term keys does not compromise past session keys.Intermediate
• PersistenceTechniques attackers use to maintain access to a system across reboots, credential changes and other interruptions.Intermediate
• Personal DataAny information relating to an identified or identifiable natural person under GDPR.Foundational
• Personal Data Breach NotificationGDPR requirement to notify the supervisory authority within 72 hours and affected individuals when risk is high.Foundational
• Personal Identity Verification (PIV)US federal smart card standard (FIPS 201) for employee and contractor identity credentials.Intermediate
• Personally Identifiable Information (PII)Information that can be used to distinguish or trace an individual's identity, alone or combined with other information.Foundational
• PharmingRedirecting users from a legitimate website to a fraudulent one by manipulating DNS or host files.Intermediate
• PhishingA social engineering attack using fraudulent messages, typically email, to steal credentials, deliver malware or induce payments.Foundational
• Phishing SimulationAn authorized fake phishing campaign used to measure and improve user resistance to email-based attacks.Foundational
• Phishing-Resistant MFAMFA methods that cannot be relayed or tricked into authenticating to a fake site, such as FIDO2 or PKI.Intermediate
• Physical ControlControl that restricts or monitors physical access to facilities and assets.Foundational
• Physical SecurityProtecting facilities, hardware, and people from physical threats such as unauthorized entry, theft, and environmental hazards.Foundational
• PiggybackingEntering a secure area with the consent of an authorized person who lets the intruder in.Foundational
• PlaintextReadable, unencrypted data that is input to an encryption algorithm or output from decryption.Foundational
• PlaybookA documented or automated set of steps for responding to a specific type of security incident or alert.Foundational
• Pluggable Authentication Modules (PAM)A modular Linux framework that lets applications authenticate users through configurable stacks of modules.Advanced
• Policy Decision Point (PDP)Zero trust component that evaluates access requests against policy and decides whether to grant them.Advanced
• Policy Enforcement Point (PEP)Zero trust component that enables, monitors, and terminates connections between subjects and resources as directed by the PDP.Advanced
• Polymorphic MalwareMalware that changes its code appearance with each infection, often through encryption, to evade signature detection.Intermediate
• Port Mirroring (SPAN)A switch feature that copies traffic from one or more ports or VLANs to a monitoring port for analysis.Intermediate
• Port ScannerA tool that probes a host for open TCP and UDP ports to identify running services.Intermediate
• Port SecuritySwitch feature that limits which or how many MAC addresses can use a port.Foundational
• Possession FactorAuthentication factor based on something the user has, such as a security key, smartphone, or smart card.Foundational
• Post-Incident ActivityThe final incident response phase covering lessons learned, reporting, evidence retention and process improvement.Foundational
• Post-Quantum Cryptography (PQC)Classical cryptographic algorithms designed to resist attacks by both classical and quantum computers.Intermediate
• Potentially Unwanted Program (PUP)Software that is not clearly malicious but is unwanted, often installed through bundling, such as toolbars or adware.Foundational
• Pre-Shared Key (PSK)Secret shared in advance between parties and used for authentication or key derivation.Foundational
• PreparationThe incident response phase in which an organization establishes capabilities, tools, plans and training before incidents occur.Foundational
• PretextingCreating a fabricated scenario or identity to persuade a target to disclose information or take an action.Foundational
• Pretty Good Privacy (PGP)Encryption program and standard (OpenPGP) for signing and encrypting email and files using a hybrid cryptosystem.Foundational
• Preventive ControlControl designed to stop an undesired event from occurring.Foundational
• Primary Account Number (PAN)The unique payment card number identifying the issuer and cardholder account.Foundational
• Principle of Least FunctionalityConfiguring systems to provide only essential capabilities and disabling unneeded ports, protocols, and services.Intermediate
• Privacy-Enhanced Mail Format (PEM)Base64-encoded certificate or key format wrapped in -----BEGIN----- and -----END----- lines.Foundational
• Private KeyThe secret half of an asymmetric key pair, used to decrypt data or create digital signatures.Foundational
• Privilege CreepGradual accumulation of access rights beyond what a user's current role requires.Foundational
• Privilege EscalationGaining higher-level permissions than originally granted, such as moving from a standard user to administrator or root.Intermediate
• Privileged Access Management (PAM)Controls and tools that secure, monitor, and limit use of administrative and other privileged accounts.Intermediate
• Privileged ContainerA container run with all host capabilities and device access, effectively removing isolation from the host.Intermediate
• ProcedureDetailed, step-by-step mandatory instructions for performing a specific task in compliance with policy and standards.Foundational
• Programmable Logic Controller (PLC)A ruggedized industrial computer that reads inputs from sensors and controls outputs to machinery according to a stored program.Foundational
• Prompt InjectionAn attack in which crafted input causes an LLM to ignore its instructions or perform unintended actions.Foundational
• Proof of Concept (PoC)A demonstration that a vulnerability is real and exploitable, used to validate findings and prioritize remediation.Foundational
• Protected Extensible Authentication Protocol (PEAP)EAP method that creates a TLS tunnel using only a server certificate, then authenticates the user inside it.Intermediate
• Protected Health Information (PHI)Individually identifiable health information held or transmitted by a covered entity or business associate.Foundational
• Protected Management Frames (PMF)IEEE 802.11w feature that authenticates and protects Wi-Fi management frames such as deauthentication.Advanced
• Protocol AnalyzerA tool that captures and decodes network traffic so it can be examined protocol by protocol.Foundational
• Proximity CardContactless access card read by radio frequency when held near a reader, commonly used for badge entry.Foundational
• Proxy ServerA server that acts as an intermediary for requests between clients and other servers.Foundational
• PseudonymizationProcessing personal data so it cannot be attributed to an individual without separately kept additional information.Intermediate
• Public KeyThe shareable half of an asymmetric key pair, used to encrypt data for the owner or verify the owner's signatures.Foundational
• Public Key Cryptography Standards (PKCS)Set of standards originally published by RSA Laboratories for public key cryptography formats and operations.Advanced
• Public Key Cryptography Standards #12 (PKCS #12)Password-protected archive format (.pfx/.p12) that bundles a certificate, its chain, and the private key.Intermediate
• Public Key Cryptography Standards #7 (PKCS #7)Format (.p7b/.p7c) for signed or enveloped data, often used to bundle certificate chains without private keys.Intermediate
• Public Key Infrastructure (PKI)Framework of CAs, policies, and technology for issuing, managing, and revoking digital certificates.Foundational
• Purdue ModelThe Purdue Enterprise Reference Architecture, a layered model that segments industrial networks from physical processes up to enterprise IT.Foundational
• Purple TeamA collaborative approach in which red and blue teams work together to improve detections in real time.Intermediate
• Push Notification AuthenticationMFA method where a sign-in prompt is sent to a registered mobile app for the user to approve.Foundational
• Qualified Security Assessor (QSA)Assessor company or employee certified by the PCI SSC to perform PCI DSS assessments.Intermediate
• Qualitative Risk AnalysisRisk analysis that ranks risks using descriptive scales such as low, medium, and high rather than monetary values.Intermediate
• Quantitative Risk AnalysisRisk analysis that assigns numeric, usually monetary, values to assets, impacts, and probabilities.Intermediate
• Quid Pro QuoA social engineering attack that offers a service or benefit in exchange for information or access.Foundational
• QuishingPhishing that uses QR codes to direct victims to malicious websites.Intermediate
• Race ConditionA flaw where the outcome depends on the timing of events, allowing attackers to exploit the gap between operations.Advanced
• Radio Frequency Identification (RFID)Technology that uses radio to identify and track tags, in LF, HF, and UHF bands, passive or active.Foundational
• Rainbow TableA precomputed table of hash values used to rapidly reverse unsalted password hashes.Intermediate
• RansomwareMalware that encrypts or locks a victim's data or systems and demands payment for restoration.Foundational
• Ransomware-as-a-Service (RaaS)A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates for a share of ransoms.Intermediate
• ReconnaissanceThe information-gathering phase of an attack or test, identifying targets, technologies and people before exploitation.Foundational
• RecoveryThe incident response phase that restores systems and operations to normal and verifies they are functioning securely.Foundational
• Recovery Point Objective (RPO)Maximum acceptable amount of data loss measured in time before a disruption.Foundational
• Recovery Time Objective (RTO)Maximum acceptable time to restore a service after a disruption.Foundational
• Red TeamA group that emulates real adversaries to test an organization's detection and response capabilities.Foundational
• RedundancyDuplicating critical components so a backup takes over if one fails.Foundational
• Reflected Cross-Site ScriptingXSS in which a malicious script in a request is immediately echoed in the response without proper encoding.Foundational
• Registration AuthorityPKI component that verifies the identity of certificate requesters before the CA issues certificates.Intermediate
• ReimagingRestoring a system from a known-good image to remove compromise rather than attempting to clean it.Foundational
• Remote Access Trojan (RAT)A trojan that gives an attacker covert remote administrative control over an infected system.Foundational
• Remote Authentication Dial-In User Service (RADIUS)AAA protocol commonly used for network access, using UDP 1812 (authentication) and 1813 (accounting).Foundational
• Remote Code Execution (RCE)The ability of an attacker to execute arbitrary code on a target system over a network.Foundational
• Replay AttackCapturing valid data transmissions, such as authentication tokens, and retransmitting them to gain unauthorized access.Intermediate
• ReplicationCopying data continuously or frequently to another system or location to support availability and low RPO.Intermediate
• Report on Compliance (ROC)Detailed PCI DSS assessment report documenting how each requirement is met, completed by a QSA or ISA.Intermediate
• RepudiationA user or system denying that it performed an action because there is insufficient evidence to prove otherwise.Foundational
• Residual RiskRisk that remains after controls and treatments have been applied.Foundational
• Resource ConsumptionAn indicator of malicious activity shown by unusual CPU, memory, disk, or bandwidth usage.Foundational
• Restore TestingRegularly verifying that backups can actually be restored and meet recovery objectives.Foundational
• Reverse ProxyA proxy that sits in front of servers and accepts client requests on their behalf, often providing TLS termination, caching and load balancing.Intermediate
• Right to Audit ClauseContract provision allowing a customer or regulator to audit a vendor's controls, records, and facilities.Intermediate
• RiskThe combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.Foundational
• Risk AcceptanceFormal decision by an authorized risk owner to tolerate a risk without further treatment.Foundational
• Risk AppetiteBroad amount and type of risk an organization is willing to pursue or retain to achieve its objectives.Foundational
• Risk AssessmentOverall process of risk identification, risk analysis, and risk evaluation.Foundational
• Risk AvoidanceEliminating a risk by not starting or by discontinuing the activity that creates it.Foundational
• Risk ExceptionFormally approved, time-limited deviation from a policy or standard with documented risk acceptance.Intermediate
• Risk Heat MapVisual matrix plotting risks by likelihood and impact, using color to show severity.Foundational
• Risk Management Framework (RMF)NIST SP 800-37 process for managing security and privacy risk of federal information systems in seven steps.Intermediate
• Risk MitigationRisk treatment that reduces likelihood or impact by implementing controls.Foundational
• Risk RegisterCentral record of identified risks with their analysis, owners, treatment, and status.Foundational
• Risk RejectionIgnoring or denying the existence of a risk; an unacceptable response distinct from acceptance.Intermediate
• Risk ToleranceAcceptable variation around objectives or risk appetite for a specific risk or category.Foundational
• Risk TransferenceShifting the financial impact of a risk to a third party, such as through insurance or contracts.Foundational
• Risk TreatmentSelecting and implementing options to modify risk: mitigate, transfer, avoid, or accept.Foundational
• Risk-Based AuthenticationAdjusting authentication requirements dynamically based on the calculated risk of each sign-in.Intermediate
• Rivest Cipher 4 (RC4)Legacy stream cipher once used in WEP, WPA-TKIP, and SSL/TLS, now prohibited due to biases.Intermediate
• Rivest-Shamir-Adleman (RSA)Asymmetric algorithm based on the difficulty of factoring large integers, used for encryption and digital signatures.Foundational
• Rogue Access PointAn unauthorized wireless access point connected to a network, bypassing perimeter security.Foundational
• Rogue DHCP ServerAn unauthorized DHCP server that hands out incorrect addressing, causing outages or enabling on-path attacks.Intermediate
• Role-Based Access Control (RBAC)The Kubernetes authorization mode that grants permissions through Roles/ClusterRoles bound to users, groups, or service accounts.Intermediate
• Root AccountThe Linux superuser account with UID 0 that bypasses normal permission checks.Foundational
• Root and Jailbreak DetectionMobile app checks that determine whether a device has been rooted (Android) or jailbroken (iOS), indicating weakened platform security.Intermediate
• Root Cause Analysis (RCA)A structured investigation to identify the underlying causes of an incident so they can be eliminated.Foundational
• Root Certificate Authority (Root CA)The top-level CA in a hierarchy whose self-signed certificate is the trust anchor for all subordinate certificates.Foundational
• Root of Trust (RoT)Inherently trusted hardware or firmware component from which a chain of trust is built.Intermediate
• RootingGaining superuser (root) access on an Android device, bypassing built-in restrictions.Foundational
• RootkitMalware that hides its presence and other malicious activity by subverting the operating system at a deep level.Intermediate
• Rule-Based Access Control (RuBAC)Access control model that applies global rules to all subjects, such as time-of-day or firewall rules.Foundational
• Rules of Engagement (RoE)The document defining how a security test will be conducted: timing, targets, allowed techniques, contacts and limits.Foundational
• RunbookA documented procedure describing how to perform a routine operational task or respond to a specific alert.Foundational
• Runtime Application Self-Protection (RASP)Security technology embedded in an application's runtime that detects and blocks attacks in real time using application context.Intermediate
• Safe HarborA commitment in a disclosure policy not to pursue legal action against researchers acting in good faith within the stated rules.Intermediate
• SaltA Python-based configuration management and remote execution tool (SaltStack, now owned by Broadcom) using a master/minion architecture over a ZeroMQ event bus.Intermediate
• Same-Origin Policy (SOP)A browser security model that restricts scripts on one origin from reading data from another origin.Foundational
• SameSite Cookie AttributeA cookie attribute (Strict, Lax or None) controlling whether a cookie is sent with cross-site requests, mitigating CSRF.Intermediate
• SandboxingRunning code in a restricted, isolated environment that limits its access to the system.Foundational
• SANS PICERLThe SANS six-step incident response model: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.Intermediate
• Sarbanes-Oxley Act (SOX)2002 US law requiring public companies to maintain and attest to internal control over financial reporting.Foundational
• ScarewareSoftware or pop-ups that use fear of infection to trick users into buying fake security products or installing malware.Foundational
• Scheduled TaskA Windows mechanism for running programs at specified times or events, frequently abused for persistence and execution.Intermediate
• ScopeThe defined boundaries of an engagement: which assets, locations, techniques and time frames are included or excluded.Foundational
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Screened SubnetNetwork segment, formerly called a DMZ, that hosts public-facing services between the internet and the internal network.Foundational
• Secret ScanningAutomatically detecting credentials such as API keys, tokens, and passwords committed to source repositories.Intermediate
• Secrets ManagementSecurely storing, distributing, rotating, and auditing credentials such as passwords, API keys, and certificates.Foundational
• Secure Access Service Edge (SASE)Cloud-delivered architecture converging SD-WAN networking with security services such as SWG, CASB, ZTNA and FWaaS.Intermediate
• Secure BootUEFI feature that allows only cryptographically signed bootloaders and OS components to run at startup.Intermediate
• Secure by DefaultPrinciple that systems ship with the most secure settings enabled out of the box.Foundational
• Secure Code ReviewManual examination of source code to find security flaws, often focused on high-risk components and guided by checklists and tool output.Foundational
• Secure Cookie AttributeA cookie flag that instructs browsers to send the cookie only over HTTPS connections.Foundational
• Secure EnclaveIsolated, hardware-protected processor or memory region that handles sensitive data and keys apart from the main OS.Intermediate
• Secure Error HandlingHandling errors and exceptions so the application fails securely, reveals minimal information and logs useful detail internally.Foundational
• Secure Firmware UpdateA device update mechanism that delivers firmware authenticated by digital signature, protected in transit and resistant to rollback.Intermediate
• Secure Hash Algorithm 1 (SHA-1)Legacy 160-bit hash function with practical collision attacks; deprecated for security use.Foundational
• Secure Hash Algorithm 2 (SHA-2)NIST family of hash functions including SHA-224, SHA-256, SHA-384, and SHA-512.Foundational
• Secure Hash Algorithm 3 (SHA-3)NIST hash standard based on the Keccak sponge construction, standardized in FIPS 202.Intermediate
• Secure Real-time Transport Protocol (SRTP)Profile of RTP that provides encryption, authentication, and replay protection for voice and video streams.Intermediate
• Secure Shell (SSH)An encrypted protocol for remote command-line access, tunneling and file transfer, using TCP port 22.Foundational
• Secure Software Development Framework (SSDF)NIST SP 800-218, a set of high-level secure software development practices grouped into Prepare, Protect, Produce and Respond categories.Intermediate
• Secure Software Development Life Cycle (SSDLC)A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.Foundational
• Secure Web Gateway (SWG)Security service that filters user web traffic for malware, URL categories, and policy violations.Intermediate
• Secure/Multipurpose Internet Mail Extensions (S/MIME)Standard for signing and encrypting email using X.509 certificates.Intermediate
• Security as a Service (SECaaS)Delivery of security capabilities, such as email filtering, web gateways or SIEM, as cloud-hosted subscription services.Intermediate
• Security Assertion Markup Language (SAML)XML-based standard for exchanging authentication and authorization data between an IdP and SP.Intermediate
• Security Awareness Training (SAT)Education that teaches staff to recognize and report security threats such as phishing and social engineering.Foundational
• Security BaselineA documented minimum set of security configurations and controls that a system type must meet.Foundational
• Security BenchmarkA consensus-based configuration standard specifying secure settings for systems and applications.Intermediate
• Security Content Automation Protocol (SCAP)A NIST suite of specifications for automating vulnerability management, measurement and compliance checking.Advanced
• Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
• Security EventAny observable occurrence in a system or network that may have security relevance.Foundational
• Security IncidentAn occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of information or systems, or violates security policy.Foundational
• Security Information and Event Management (SIEM)A platform that collects, normalizes, correlates and analyzes log data from across an environment to detect and investigate threats.Foundational
• Security Logging and Monitoring FailuresOWASP Top 10 category for insufficient logging, detection, alerting and response that allows breaches to go unnoticed.Foundational
• Security MisconfigurationOWASP Top 10 category for insecure default, incomplete or ad hoc configurations across the application stack.Foundational
• Security Operations Center (SOC)A centralized team and facility that monitors, detects, analyzes and responds to cybersecurity incidents around the clock.Foundational
• Security Orchestration, Automation and Response (SOAR)A platform that integrates security tools and automates investigation and response workflows using playbooks.Intermediate
• Security PolicyHigh-level management statement of intent, direction, and requirements for protecting information assets.Foundational
• Security PostureAn organization's overall security status and its ability to prevent, detect, and respond to threats.Foundational
• Security QuestionnaireStandardized set of questions used to assess a third party's security and privacy controls.Intermediate
• Security Service Edge (SSE)Cloud-delivered security stack combining secure web gateway, CASB and zero trust network access, often with firewall as a service.Intermediate
• Security StandardMandatory requirement specifying uniform use of technologies, configurations, or methods to support policy.Foundational
• Security Technical Implementation Guide (STIG)DISA configuration standards for securing DoD information systems and software.Intermediate
• Security Through ObscurityRelying on secrecy of design or implementation, rather than sound controls, as the main form of protection.Foundational
• Security ZoneLogical grouping of networks or interfaces with the same trust level, with policy applied between zones.Foundational
• Security-Enhanced Linux (SELinux)A Linux kernel mandatory access control system that confines processes using security labels and policy.Intermediate
• security.txtA standard file (RFC 9116) placed at /.well-known/security.txt that tells researchers how to report security vulnerabilities to an organization.Intermediate
• SegmentationUsing network separation as a containment measure to restrict an attacker's ability to move or communicate.Foundational
• Segregation of Duties (SoD)Dividing critical tasks among different people so no single person can both commit and conceal errors or fraud.Foundational
• Self-Assessment Questionnaire (SAQ)PCI DSS validation tool for eligible merchants and service providers to self-assess compliance.Intermediate
• Self-Encrypting Drive (SED)Storage drive with built-in hardware encryption that encrypts all data automatically.Intermediate
• Self-Signed CertificateCertificate signed with its own private key rather than by a trusted CA.Foundational
• Sensitive Authentication Data (SAD)Card security data such as full track data, card verification codes, and PINs that must not be stored after authorization.Intermediate
• Separation of Duties (SoD)Dividing a critical task among multiple people so no single individual can complete it alone.Foundational
• Server-Side Request Forgery (SSRF)An attack that makes a server issue requests to unintended internal or external destinations on the attacker's behalf.Advanced
• Service AccountA Kubernetes identity for processes running in pods to authenticate to the API server and, via federation, to cloud services.Intermediate
• Service Provider (SP)Application that relies on an identity provider's assertion to grant users access; called a relying party in OIDC.Intermediate
• Session FixationAn attack in which the attacker sets a victim's session ID before login and then uses it after the victim authenticates.Intermediate
• Session HijackingTaking over a valid user session by stealing or predicting its session identifier or token.Intermediate
• Session ID in URLPassing session tokens in URL query strings or paths, which exposes them in logs, history and Referer headers.Foundational
• Session InvalidationDestroying a session on the server so its identifier can no longer be used, such as at logout or password change.Foundational
• Session KeyA temporary symmetric key used to encrypt a single communication session.Foundational
• Session ManagementThe secure creation, maintenance and termination of user sessions after authentication.Foundational
• Session TimeoutAutomatic expiration of a session after inactivity (idle timeout) or after a maximum lifetime (absolute timeout).Foundational
• Set User ID (SUID)A special permission that makes an executable run with the privileges of the file's owner rather than the user running it.Intermediate
• Shadow ITHardware, software or cloud services used inside an organization without the approval or knowledge of IT and security.Foundational
• Shared Responsibility ModelFramework dividing security and operational duties between the cloud provider (of the cloud) and customer (in the cloud).Foundational
• Shift LeftThe practice of moving testing, security, and quality activities earlier in the software delivery lifecycle.Foundational
• ShodanA search engine that indexes internet-connected devices and their service banners.Foundational
• Shoulder SurfingObserving someone's screen or keyboard to obtain sensitive information such as passwords or PINs.Foundational
• Side-Channel AttackAttack that extracts secrets from physical or implementation leaks such as timing, power, or electromagnetic emissions.Advanced
• Signature-Based DetectionDetecting threats by matching known patterns, such as file hashes or byte sequences, against a database of signatures.Foundational
• Signed CommitA Git commit cryptographically signed with GPG, SSH, or S/MIME keys to verify the author's identity.Advanced
• SIM SwappingFraudulently transferring a victim's phone number to an attacker-controlled SIM to intercept calls and SMS codes.Intermediate
• Simple Network Management Protocol version 3 (SNMPv3)Version of SNMP adding user-based authentication and encryption for device monitoring and management.Foundational
• Simulation ExerciseAn exercise that simulates an incident with hands-on activity in a controlled environment to test response capabilities.Intermediate
• Simultaneous Authentication of Equals (SAE)Password-authenticated key exchange (Dragonfly) used by WPA3-Personal.Intermediate
• Single Loss Expectancy (SLE)Expected monetary loss from one occurrence of a threat event: SLE = Asset Value x Exposure Factor.Foundational
• Single Point of Failure (SPOF)Component whose failure stops the entire system because no redundant alternative exists.Foundational
• Single Sign-On (SSO)Allowing a user to authenticate once and access multiple applications without signing in again.Foundational
• SIP Digest AuthenticationSIP's challenge-response authentication in which a server responds 401 or 407 with a nonce and the client returns a hashed credential.Intermediate
• SIP over TLS (SIPS)Securing SIP signaling with TLS, normally on TCP port 5061, to provide confidentiality, integrity and authentication.Intermediate
• SIP Registration HijackingAn attack in which an adversary sends a forged REGISTER to bind a victim's SIP address to the attacker's device.Advanced
• SIP ScanningAutomated probing of the internet or a network for SIP devices and extensions, often as reconnaissance for toll fraud.Intermediate
• Smart CardCredit-card-sized card with an embedded chip that securely stores certificates and private keys for authentication.Foundational
• SmishingPhishing conducted through SMS or other text messaging.Foundational
• SMS-Based AuthenticationSending one-time codes by text message as a second factor; convenient but weak.Foundational
• SnapshotA point-in-time capture of the state of a volume, virtual machine or storage system.Foundational
• SNMPv3The secure version of SNMP, providing user-based authentication, message integrity and encryption.Intermediate
• SOC 2Report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy.Foundational
• SOC 3General-use summary report of a SOC 2 examination suitable for public distribution.Intermediate
• SOC Type 1 ReportSOC report on the fairness of the description and suitability of control design as of a specific date.Foundational
• SOC Type 2 ReportSOC report covering both design and operating effectiveness of controls over a specified period.Foundational
• Social EngineeringManipulating people into revealing information, granting access or performing actions that compromise security.Foundational
• Social Engineering Penetration TestingAssessing human susceptibility to manipulation through phishing, vishing, pretexting and physical impersonation.Foundational
• Social Engineering PrinciplesThe psychological levers attackers use to persuade victims, such as authority, urgency, scarcity, trust and consensus.Foundational
• Software and Data Integrity FailuresOWASP Top 10 category for code and infrastructure that do not protect against integrity violations, such as untrusted updates and insecure deserialization.Intermediate
• Software Bill of Materials (SBOM)A formal, machine-readable inventory of all components and dependencies in a piece of software.Intermediate
• Software Composition Analysis (SCA)Identifying open-source and third-party dependencies in software and checking them for known vulnerabilities and license issues.Intermediate
• Software Package Data Exchange (SPDX)An open standard (ISO/IEC 5962:2021) from the Linux Foundation for communicating SBOM information, including components, licenses and relationships.Intermediate
• Software Supply Chain FailuresOWASP Top 10 2025 category (A03) for compromises or weaknesses in dependencies, build systems and distribution infrastructure.Intermediate
• Software Supply Chain SecurityProtecting the integrity, provenance and security of all code, dependencies, tools and processes used to build and deliver software.Intermediate
• SolarWinds Supply Chain AttackThe 2020 compromise in which attackers inserted the SUNBURST backdoor into SolarWinds Orion builds, which were signed and distributed to about 18,000 customers.Foundational
• Spam over Internet Telephony (SPIT)Unsolicited bulk VoIP calls or messages, the telephony equivalent of email spam.Intermediate
• Spear PhishingA targeted phishing attack crafted for a specific individual or group using personal or organizational details.Foundational
• Split TunnelingVPN configuration that sends only corporate traffic through the tunnel while other traffic goes directly to the internet.Foundational
• SpoofingPretending to be another user, system or component in order to gain its access or trust.Foundational
• SpywareMalware that secretly monitors user activity and collects information without consent.Foundational
• SQL Injection (SQLi)Injecting malicious SQL into application inputs to read, modify or delete database data or bypass authentication.Foundational
• SQL Injection PreventionThe set of defenses that stop SQL injection, led by parameterized queries and supported by validation and least privilege.Foundational
• SSH File Transfer Protocol (SFTP)A secure file transfer protocol that runs as a subsystem of SSH over TCP port 22.Foundational
• SSH Key-Based AuthenticationLogging in to SSH servers with a public/private key pair instead of a password.Intermediate
• SSL StrippingAn on-path attack that downgrades a user's HTTPS connection to HTTP so traffic can be read in clear text.Intermediate
• SSRF PreventionDefenses that stop an application from being used to send requests to unintended internal or external destinations.Intermediate
• Stack-Based Buffer OverflowWriting past the end of a buffer allocated on the call stack, which can overwrite the saved return address and hijack execution.Intermediate
• Stateful FirewallA firewall that tracks the state of connections and automatically allows return traffic for sessions initiated from trusted networks.Foundational
• Static Application Security Testing (SAST)Analyzing source code, bytecode, or binaries for security vulnerabilities without executing the application.Intermediate
• SteganographyHiding the existence of data inside other data, such as an image, audio, or network traffic.Foundational
• STIR/SHAKENStandards that let carriers cryptographically sign and verify caller ID on SIP calls to combat spoofed robocalls.Intermediate
• Stored Cross-Site ScriptingXSS in which a malicious script is saved by the application and later served to other users.Foundational
• Stream CipherA symmetric cipher that encrypts data one bit or byte at a time by combining it with a pseudorandom keystream.Foundational
• STRIDEMicrosoft's threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.Foundational
• Structured Threat Information Expression (STIX)A standardized JSON language for representing cyber threat intelligence objects and relationships.Intermediate
• StuxnetA sophisticated worm discovered in 2010 that sabotaged Iranian uranium enrichment centrifuges by manipulating PLCs.Intermediate
• Subdomain TakeoverGaining control of a subdomain whose DNS record points to a deprovisioned external resource, such as a deleted cloud bucket or app.Intermediate
• Subject Alternative Name (SAN)X.509 extension listing additional identities, such as DNS names or IPs, that a certificate is valid for.Foundational
• Subresource Integrity (SRI)A browser feature that verifies scripts or stylesheets loaded from third parties against a cryptographic hash in the HTML tag.Intermediate
• sudoA Linux command that lets permitted users run commands as root or another user, with logging and fine-grained policy.Foundational
• Supervisory Control and Data Acquisition (SCADA)An ICS architecture for monitoring and controlling geographically dispersed assets from a central location.Foundational
• SupplicantThe client software or device requesting network access in an 802.1X exchange.Foundational
• Supply Chain AttackAn attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.Intermediate
• Symmetric EncryptionEncryption in which the same secret key is used to both encrypt and decrypt data.Foundational
• SYN FloodA DoS attack that sends many TCP SYN packets without completing the handshake, exhausting the server's connection table.Foundational
• SyslogA standard for sending event log messages to a central collector, traditionally over UDP port 514.Foundational
• Syslog Severity LevelsThe eight syslog message levels from 0 (Emergency) to 7 (Debugging).Intermediate
• System and Organization Controls Report (SOC report)AICPA attestation report by a CPA on controls at a service organization.Foundational
• System for Cross-domain Identity Management (SCIM)REST/JSON standard (RFC 7643/7644) for automating user and group provisioning between identity systems.Intermediate
• Tabletop Exercise (TTX)A discussion-based exercise in which participants walk through a simulated incident scenario to test plans and roles.Foundational
• Tactics, Techniques and Procedures (TTP)The patterns of adversary behavior: tactics are goals, techniques are methods and procedures are specific implementations.Intermediate
• TailgatingGaining physical access by following an authorized person through a secured entrance without their knowledge.Foundational
• TamperingUnauthorized modification of data, code or configuration in transit, at rest or in memory.Foundational
• Targeted Risk Analysis (TRA)PCI DSS v4 risk analysis used to justify the frequency of certain controls or to support customized approach controls.Advanced
• tcpdumpA command-line packet capture tool for Unix-like systems.Intermediate
• Technical ControlControl implemented through hardware, software, or firmware that enforces security automatically.Foundational
• Telephony Denial of Service (TDoS)An attack that floods a phone system or number with calls to make it unavailable to legitimate callers.Intermediate
• Temporal Key Integrity Protocol (TKIP)Interim WPA encryption protocol that wrapped RC4 with per-packet keys and a MIC; now deprecated.Intermediate
• Terminal Access Controller Access-Control System Plus (TACACS+)Cisco-developed AAA protocol over TCP 49 that encrypts the full payload and separates authentication, authorization, and accounting.Foundational
• Text Record (TXT)A DNS record that holds arbitrary text, widely used for domain verification and email authentication (SPF, DKIM, DMARC).Foundational
• Third-Party Risk Management (TPRM)Discipline of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, and other external parties.Foundational
• ThreatAny potential cause of an unwanted incident that may harm an asset, such as an actor, event, or circumstance.Foundational
• Threat ActorAn individual or group that carries out or intends to carry out malicious activity against an organization's systems or data.Foundational
• Threat Actor MotivationThe underlying reason a threat actor attacks, such as financial gain, espionage, ideology, revenge, disruption or war.Foundational
• Threat FeedA continuous stream of threat data, typically indicators of compromise, delivered for integration into security tools.Foundational
• Threat ModelingStructured process of identifying threats, attack paths, and mitigations for a system during design.Intermediate
• Threat VectorThe path or means by which a threat actor gains access to a target, such as email, removable media or vulnerable software.Foundational
• Time-Based One-Time Password (TOTP)OTP algorithm (RFC 6238) that generates codes from a shared secret and the current time, typically every 30 seconds.Foundational
• Time-of-Check to Time-of-Use (TOCTOU)A race condition in which a resource changes between the time it is checked and the time it is used.Intermediate
• Time-of-Day RestrictionsAccess controls that limit when accounts can log in or resources can be used.Foundational
• TLS InspectionDecrypting, inspecting, and re-encrypting TLS traffic at a security device to detect hidden threats and data loss.Intermediate
• TokenizationReplacing sensitive data with a non-sensitive surrogate value (token) that maps back to the original via a secure vault.Intermediate
• Toll FraudUnauthorized use of a telephony system to place calls, usually expensive international or premium-rate calls, at the owner's expense.Intermediate
• Topology HidingConcealing internal IP addresses, hostnames and network structure from external parties by rewriting signaling and relaying media.Intermediate
• Total RiskThe amount of risk an organization faces before safeguards: threats x vulnerabilities x asset value.Intermediate
• Transparent Data Encryption (TDE)Database feature that encrypts data and log files at rest without requiring application changes.Intermediate
• Transport Layer Security (TLS)The cryptographic protocol that secures application traffic with encryption, integrity and certificate-based authentication; successor to SSL.Foundational
• Transport Layer Security 1.3 (TLS 1.3)Current TLS version (RFC 8446) with a faster handshake, mandatory forward secrecy, and only AEAD ciphers.Intermediate
• TriageRapidly assessing alerts or incidents to determine validity, severity and priority for response.Foundational
• Triple DES (3DES)Symmetric cipher applying DES three times (encrypt-decrypt-encrypt) to increase effective key strength.Foundational
• Trojan HorseMalware disguised as legitimate software that performs hidden malicious actions once the user runs it.Foundational
• True Positive (TP)An alert that correctly identifies real malicious activity.Foundational
• Trust StoreCollection of trusted root CA certificates maintained by an operating system, browser, or application.Intermediate
• Trusted Automated Exchange of Intelligence Information (TAXII)A protocol for exchanging cyber threat intelligence over HTTPS, designed to carry STIX data.Intermediate
• Trusted Execution Environment (TEE)Hardware-isolated area of a processor that protects code and data from the rest of the system, including the OS.Advanced
• Trusted Platform Module (TPM)Secure cryptoprocessor chip on a device that stores keys, measures boot integrity, and supports attestation.Foundational
• TyposquattingRegistering domain names that are common misspellings or variants of legitimate domains to deceive users.Foundational
• U.S. Cyber Trust MarkA voluntary U.S. FCC labeling program indicating that a consumer wireless IoT product meets baseline cybersecurity criteria.Advanced
• Unidirectional GatewayA hardware-enforced network device that allows data to flow in only one direction, typically from OT out to IT.Intermediate
• Unified Threat Management (UTM)All-in-one security appliance combining firewall, IPS, antivirus, web filtering, VPN, and other functions.Foundational
• Universal Plug and Play (UPnP)A set of protocols that let devices discover each other and automatically request port forwards on a home router.Intermediate
• Unrestricted File UploadAllowing users to upload files without adequately validating type, content, name and size, which can lead to code execution or stored XSS.Foundational
• Unskilled AttackerA low-sophistication threat actor who relies on pre-built tools and exploits written by others.Foundational
• User Account Control (UAC)A Windows feature that prompts for consent or credentials before actions requiring administrative privileges.Foundational
• User and Entity Behavior Analytics (UEBA)Analytics that baseline normal behavior of users and entities and flag anomalies that may indicate threats.Intermediate
• Username EnumerationDetermining which usernames or emails are valid from differences in an application's responses.Foundational
• Vendor DiversityUsing products from different vendors in layered defenses so a single flaw cannot defeat all layers.Intermediate
• Vendor Due DiligencePre-contract evaluation of a vendor's security, privacy, financial, operational, and compliance posture.Intermediate
• Verbose Error MessageAn error message that reveals internal details such as stack traces, queries, file paths or software versions.Foundational
• Video SurveillanceUse of cameras (CCTV or IP cameras) to deter, detect, and record physical security events.Foundational
• Virtual PatchingBlocking exploitation of a known vulnerability with an external control such as a WAF or IPS rule while the code fix is pending.Intermediate
• Virtual Private Network (VPN)Encrypted tunnel that securely connects remote users or sites across an untrusted network.Foundational
• VirusMalware that attaches to a host file or program and replicates when that host is executed, requiring user action to spread.Foundational
• VishingVoice phishing that uses phone calls or voicemail to manipulate victims into revealing information or taking action.Foundational
• VLAN HoppingAn attack that sends traffic from one VLAN to another without passing through a router, via switch spoofing or double tagging.Intermediate
• Voicemail PIN SecurityPolicies that enforce strong voicemail PINs and lockouts to prevent unauthorized mailbox access and toll fraud.Intermediate
• VoIP EavesdroppingIntercepting voice or video traffic, for example by capturing unencrypted RTP and reconstructing the audio.Intermediate
• VulnerabilityA weakness in an asset, control, or process that a threat could exploit.Foundational
• Vulnerability AssessmentA systematic process of identifying, quantifying and prioritizing vulnerabilities without attempting to exploit them.Foundational
• Vulnerability Disclosure Policy (VDP)A public policy explaining how external parties can report vulnerabilities and what they can expect in return.Foundational
• Vulnerability ManagementThe continuous process of identifying, assessing, prioritizing, remediating and verifying security weaknesses.Foundational
• Vulnerability PrioritizationRanking vulnerabilities for remediation based on severity, exploitability, exposure and asset criticality.Intermediate
• Vulnerability Remediation SLAA defined maximum time to fix a vulnerability based on its severity or risk rating.Foundational
• Vulnerability ScanningAutomated testing of systems and applications to identify known vulnerabilities, missing patches and misconfigurations.Foundational
• Vulnerability ValidationConfirming that a reported vulnerability truly exists and that remediation actually fixed it.Intermediate
• Vulnerable and Outdated ComponentsOWASP Top 10 2021 category for using libraries, frameworks or platforms with known vulnerabilities or that are unsupported.Foundational
• WannaCryA 2017 ransomware worm that spread globally through the EternalBlue SMBv1 exploit.Foundational
• Warm SiteAn alternate facility with some equipment and connectivity in place but requiring data restoration and configuration before use.Foundational
• Watering Hole AttackAn attack that compromises a website frequently visited by a target group in order to infect those visitors.Intermediate
• WeaponizationThe kill-chain stage where an attacker couples an exploit with a deliverable payload, such as a malicious document.Foundational
• Web Application Firewall (WAF)Layer 7 firewall that inspects HTTP/HTTPS traffic to protect web applications from attacks such as SQL injection and XSS.Foundational
• Web of TrustDecentralized trust model where users vouch for one another's public keys instead of relying on a central CA.Intermediate
• Web ShellA malicious script uploaded to a web server that gives an attacker remote command execution through HTTP.Intermediate
• WhalingSpear phishing aimed at senior executives or other high-value individuals.Foundational
• White TeamThe group that oversees a red team or cyber exercise, setting rules, refereeing, scoring and ensuring safety.Foundational
• White-Box TestingTesting with full knowledge of the target, including source code, architecture and credentials; called known-environment testing by CompTIA.Foundational
• WHOISA query protocol and database that returns registration details for domain names and IP address blocks.Foundational
• Wi-Fi Protected Access (WPA)The 2003 Wi-Fi Alliance interim security certification based on a draft of 802.11i, using TKIP.Foundational
• Wi-Fi Protected Access 2 (WPA2)Wi-Fi Alliance security certification implementing 802.11i with AES-CCMP, in Personal (PSK) and Enterprise (802.1X) modes.Foundational
• Wi-Fi Protected Access 3 (WPA3)Current Wi-Fi security standard that uses SAE for personal networks and mandates protected management frames.Foundational
• Wi-Fi Protected Setup (WPS)A simplified setup method using a PIN or push button, vulnerable to brute-force and Pixie Dust attacks.Foundational
• Wildcard CertificateCertificate that secures all first-level subdomains of a domain using an asterisk, such as *.example.com.Foundational
• Windows Event LogThe structured logging system in Windows that records security, system and application events.Foundational
• Windows Hello for Business (WHfB)Microsoft passwordless authentication using a TPM-protected key pair unlocked by a PIN or biometric.Intermediate
• Windows Local Administrator Password Solution (LAPS)A Microsoft feature that randomizes and rotates each computer's local administrator password and stores it securely in AD or Entra ID.Intermediate
• Wiper MalwareDestructive malware designed to permanently erase or corrupt data and systems rather than extort payment.Intermediate
• Wired Equivalent Privacy (WEP)Original, broken 802.11 encryption protocol using RC4 with a 24-bit IV.Foundational
• Wireless Intrusion Prevention System (WIPS)A system that monitors RF for rogue devices and attacks and can take containment actions.Intermediate
• WiresharkA free, open-source graphical protocol analyzer that captures and decodes network packets.Foundational
• WormSelf-replicating malware that spreads across networks without user interaction by exploiting vulnerabilities.Foundational
• Write BlockerA hardware or software tool that allows reading from a storage device while preventing any writes to it.Foundational
• X-Content-Type-OptionsAn HTTP response header whose nosniff value stops browsers from MIME-sniffing a response away from its declared Content-Type.Intermediate
• X-Frame-Options (XFO)A legacy HTTP response header that controls whether a page may be displayed in a frame, used to prevent clickjacking.Foundational
• X.509ITU-T standard defining the format of public key certificates and certificate revocation lists.Intermediate
• XML External Entity (XXE)A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.Intermediate
• XZ Utils BackdoorA 2024 supply chain compromise (CVE-2024-3094) in which a long-term contributor inserted a backdoor into the xz/liblzma compression library.Intermediate
• Zero Trust Architecture (ZTA)Security model that assumes no implicit trust and continuously verifies every user, device, and request before granting access.Intermediate
• Zero Trust Control PlaneThe zero trust layer where policy decisions are made, separate from the data plane where traffic flows.Advanced
• Zero Trust Network Access (ZTNA)Remote access approach that grants users per-application access based on identity and context, not network access.Intermediate
• Zero-Day VulnerabilityA vulnerability unknown to the vendor or without an available patch, which attackers may exploit before defenders can fix it.Foundational
• ZigbeeA low-power mesh networking standard built on IEEE 802.15.4, mostly in 2.4 GHz at up to 250 kbps.Intermediate
• Zone TransferReplication of DNS zone data from a primary to secondary servers, as a full transfer (AXFR) or incremental transfer (IXFR), over TCP 53.Intermediate